{"id":"CVE-2021-47558","aliases":["DEBIAN-CVE-2021-47558","EUVD-2021-34560","OESA-2024-1706","OESA-2024-1707","ROOT-OS-DEBIAN-11-CVE-2021-47558","SUSE-SU-2024:2008-1","SUSE-SU-2024:2011-1","SUSE-SU-2024:2019-1","SUSE-SU-2024:2189-1","SUSE-SU-2024:2190-1","UBUNTU-CVE-2021-47558"],"status":"published","title":"net: stmmac: Disable Tx queues when reconfiguring the interface","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Disable Tx queues when reconfiguring the interface\n\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\n\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\n\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\n\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00183,"percentile":0.07899,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-05-24T15:09:59Z","modified":"2026-10-23T18:03:51Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["5.15.15-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["5.15.15-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["5.15.15-1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"linux","fixed_in":["5.10.262-1.aikido.113","5.10.262-1.aikido.114"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-linux","fixed_in":["5.10.262-1.aikido.113","5.10.262-1.aikido.114"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.15-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-136.79.0.159.oe2203sp1"}]}],"bundled":61},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-207.0.0.116.oe2203sp3"}]}],"bundled":55},{"source":"osv","ecosystem":"Root:Debian:11","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.262-1.aikido.113"},{"fixed":"5.10.262-1.aikido.114"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.262-1.aikido.113"},{"fixed":"5.10.262-1.aikido.114"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5-RT_Update_16","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.3.1"}]}],"bundled":561},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.58.1"}]}],"bundled":561},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.57.1"}]}],"bundled":541},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.57.1"}]}],"bundled":541},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.57.1"}]}],"bundled":541},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.57.1"}]}],"bundled":541},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.57.1"}]}],"bundled":541},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.57.1"}]}],"bundled":541},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-livepatch-SLE15-SP4_Update_27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150400.9.3.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1.150500.6.31.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1.150500.6.31.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5_Update_15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.3.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1.150500.6.31.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.68.1"}]}],"bundled":557},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/a92f0eebb8dc008b9e8c51c6f7b8c93b27a29a43","tags":["x_transferred","Patch","fix","report"]},{"url":"https://git.kernel.org/stable/c/b270bfe697367776eca2e6759a71d700fb8d82a2","tags":["x_transferred","Patch","fix","report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-47558","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48652","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52646","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52799","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27393","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27415","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36008","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36883","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36964","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47484","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52732","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36954","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242008-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065729","tags":["report"]},{"url":"https://bugzilla.suse.com/1141539","tags":["report"]},{"url":"https://bugzilla.suse.com/1174585","tags":["report"]},{"url":"https://bugzilla.suse.com/1181674","tags":["report"]},{"url":"https://bugzilla.suse.com/1187716","tags":["report"]},{"url":"https://bugzilla.suse.com/1190569","tags":["report"]},{"url":"https://bugzilla.suse.com/1191949","tags":["report"]},{"url":"https://bugzilla.suse.com/1192107","tags":["report"]},{"url":"https://bugzilla.suse.com/1193983","tags":["report"]},{"url":"https://bugzilla.suse.com/1194288","tags":["report"]},{"url":"https://bugzilla.suse.com/1194869","tags":["report"]},{"url":"https://bugzilla.suse.com/1196956","tags":["report"]},{"url":"https://bugzilla.suse.com/1197915","tags":["report"]},{"url":"https://bugzilla.suse.com/1200465","tags":["report"]},{"url":"https://bugzilla.suse.com/1205205","tags":["report"]},{"url":"https://bugzilla.suse.com/1207284","tags":["report"]},{"url":"https://bugzilla.suse.com/1207361","tags":["report"]},{"url":"https://bugzilla.suse.com/1207948","tags":["report"]},{"url":"https://bugzilla.suse.com/1208149","tags":["report"]},{"url":"https://bugzilla.suse.com/1209657","tags":["report"]},{"url":"https://bugzilla.suse.com/1209799","tags":["report"]},{"url":"https://bugzilla.suse.com/1209834","tags":["report"]},{"url":"https://bugzilla.suse.com/1209980","tags":["report"]},{"url":"https://bugzilla.suse.com/1210335","tags":["report"]},{"url":"https://bugzilla.suse.com/1213863","tags":["report"]},{"url":"https://bugzilla.suse.com/1214852","tags":["report"]},{"url":"https://bugzilla.suse.com/1215322","tags":["report"]},{"url":"https://bugzilla.suse.com/1215702","tags":["report"]},{"url":"https://bugzilla.suse.com/1216358","tags":["report"]},{"url":"https://bugzilla.suse.com/1216702","tags":["report"]},{"url":"https://bugzilla.suse.com/1217169","tags":["report"]},{"url":"https://bugzilla.suse.com/1217339","tags":["report"]},{"url":"https://bugzilla.suse.com/1217515","tags":["report"]},{"url":"https://bugzilla.suse.com/1218447","tags":["report"]},{"url":"https://bugzilla.suse.com/1220021","tags":["report"]},{"url":"https://bugzilla.suse.com/1220267","tags":["report"]},{"url":"https://bugzilla.suse.com/1220363","tags":["report"]},{"url":"https://bugzilla.suse.com/1220783","tags":["report"]},{"url":"https://bugzilla.suse.com/1221044","tags":["report"]},{"url":"https://bugzilla.suse.com/1221081","tags":["report"]},{"url":"https://bugzilla.suse.com/1221615","tags":["report"]},{"url":"https://bugzilla.suse.com/1221777","tags":["report"]},{"url":"https://bugzilla.suse.com/1221816","tags":["report"]},{"url":"https://bugzilla.suse.com/1221829","tags":["report"]},{"url":"https://bugzilla.suse.com/1222011","tags":["report"]},{"url":"https://bugzilla.suse.com/1222374","tags":["report"]},{"url":"https://bugzilla.suse.com/1222385","tags":["report"]},{"url":"https://bugzilla.suse.com/1222413","tags":["report"]},{"url":"https://bugzilla.suse.com/1222464","tags":["report"]},{"url":"https://bugzilla.suse.com/1222513","tags":["report"]},{"url":"https://bugzilla.suse.com/1222559","tags":["report"]},{"url":"https://bugzilla.suse.com/1222561","tags":["report"]},{"url":"https://bugzilla.suse.com/1222608","tags":["report"]},{"url":"https://bugzilla.suse.com/1222619","tags":["report"]},{"url":"https://bugzilla.suse.com/1222627","tags":["report"]},{"url":"https://bugzilla.suse.com/1222721","tags":["report"]},{"url":"https://bugzilla.suse.com/1222765","tags":["report"]},{"url":"https://bugzilla.suse.com/1222770","tags":["report"]},{"url":"https://bugzilla.suse.com/1222783","tags":["report"]},{"url":"https://bugzilla.suse.com/1222793","tags":["report"]},{"url":"https://bugzilla.suse.com/1222838","tags":["report"]},{"url":"https://bugzilla.suse.com/1222870","tags":["report"]},{"url":"https://bugzilla.suse.com/1222893","tags":["report"]},{"url":"https://bugzilla.suse.com/1222960","tags":["report"]},{"url":"https://bugzilla.suse.com/1222961","tags":["report"]},{"url":"https://bugzilla.suse.com/1222974","tags":["report"]},{"url":"https://bugzilla.suse.com/1222975","tags":["report"]},{"url":"https://bugzilla.suse.com/1222976","tags":["report"]},{"url":"https://bugzilla.suse.com/1223011","tags":["report"]},{"url":"https://bugzilla.suse.com/1223023","tags":["report"]},{"url":"https://bugzilla.suse.com/1223027","tags":["report"]},{"url":"https://bugzilla.suse.com/1223031","tags":["report"]},{"url":"https://bugzilla.suse.com/1223043","tags":["report"]},{"url":"https://bugzilla.suse.com/1223046","tags":["report"]},{"url":"https://bugzilla.suse.com/1223048","tags":["report"]},{"url":"https://bugzilla.suse.com/1223049","tags":["report"]},{"url":"https://bugzilla.suse.com/1223084","tags":["report"]},{"url":"https://bugzilla.suse.com/1223113","tags":["report"]},{"url":"https://bugzilla.suse.com/1223119","tags":["report"]},{"url":"https://bugzilla.suse.com/1223137","tags":["report"]},{"url":"https://bugzilla.suse.com/1223138","tags":["report"]},{"url":"https://bugzilla.suse.com/1223140","tags":["report"]},{"url":"https://bugzilla.suse.com/1223188","tags":["report"]},{"url":"https://bugzilla.suse.com/1223203","tags":["report"]},{"url":"https://bugzilla.suse.com/1223207","tags":["report"]},{"url":"https://bugzilla.suse.com/1223315","tags":["report"]},{"url":"https://bugzilla.suse.com/1223360","tags":["report"]},{"url":"https://bugzilla.suse.com/1223384","tags":["report"]},{"url":"https://bugzilla.suse.com/1223390","tags":["report"]},{"url":"https://bugzilla.suse.com/1223432","tags":["report"]},{"url":"https://bugzilla.suse.com/1223489","tags":["report"]},{"url":"https://bugzilla.suse.com/1223505","tags":["report"]},{"url":"https://bugzilla.suse.com/1223532","tags":["report"]},{"url":"https://bugzilla.suse.com/1223575","tags":["report"]},{"url":"https://bugzilla.suse.com/1223595","tags":["report"]},{"url":"https://bugzilla.suse.com/1223626","tags":["report"]},{"url":"https://bugzilla.suse.com/1223627","tags":["report"]},{"url":"https://bugzilla.suse.com/1223628","tags":["report"]},{"url":"https://bugzilla.suse.com/1223631","tags":["report"]},{"url":"https://bugzilla.suse.com/1223633","tags":["report"]},{"url":"https://bugzilla.suse.com/1223638","tags":["report"]},{"url":"https://bugzilla.suse.com/1223650","tags":["report"]},{"url":"https://bugzilla.suse.com/1223653","tags":["report"]},{"url":"https://bugzilla.suse.com/1223666","tags":["report"]},{"url":"https://bugzilla.suse.com/1223670","tags":["report"]},{"url":"https://bugzilla.suse.com/1223671","tags":["report"]},{"url":"https://bugzilla.suse.com/1223675","tags":["report"]},{"url":"https://bugzilla.suse.com/1223677","tags":["report"]},{"url":"https://bugzilla.suse.com/1223678","tags":["report"]},{"url":"https://bugzilla.suse.com/1223679","tags":["report"]},{"url":"https://bugzilla.suse.com/1223698","tags":["report"]},{"url":"https://bugzilla.suse.com/1223712","tags":["report"]},{"url":"https://bugzilla.suse.com/1223715","tags":["report"]},{"url":"https://bugzilla.suse.com/1223717","tags":["report"]},{"url":"https://bugzilla.suse.com/1223718","tags":["report"]},{"url":"https://bugzilla.suse.com/1223737","tags":["report"]},{"url":"https://bugzilla.suse.com/1223738","tags":["report"]},{"url":"https://bugzilla.suse.com/1223741","tags":["report"]},{"url":"https://bugzilla.suse.com/1223744","tags":["report"]},{"url":"https://bugzilla.suse.com/1223747","tags":["report"]},{"url":"https://bugzilla.suse.com/1223748","tags":["report"]},{"url":"https://bugzilla.suse.com/1223750","tags":["report"]},{"url":"https://bugzilla.suse.com/1223752","tags":["report"]},{"url":"https://bugzilla.suse.com/1223754","tags":["report"]},{"url":"https://bugzilla.suse.com/1223756","tags":["report"]},{"url":"https://bugzilla.suse.com/1223757","tags":["report"]},{"url":"https://bugzilla.suse.com/1223762","tags":["report"]},{"url":"https://bugzilla.suse.com/1223769","tags":["report"]},{"url":"https://bugzilla.suse.com/1223770","tags":["report"]},{"url":"https://bugzilla.suse.com/1223779","tags":["report"]},{"url":"https://bugzilla.suse.com/1223780","tags":["report"]},{"url":"https://bugzilla.suse.com/1223781","tags":["report"]},{"url":"https://bugzilla.suse.com/1223788","tags":["report"]},{"url":"https://bugzilla.suse.com/1223802","tags":["report"]},{"url":"https://bugzilla.suse.com/1223819","tags":["report"]},{"url":"https://bugzilla.suse.com/1223823","tags":["report"]},{"url":"https://bugzilla.suse.com/1223826","tags":["report"]},{"url":"https://bugzilla.suse.com/1223828","tags":["report"]},{"url":"https://bugzilla.suse.com/1223829","tags":["report"]},{"url":"https://bugzilla.suse.com/1223837","tags":["report"]},{"url":"https://bugzilla.suse.com/1223842","tags":["report"]},{"url":"https://bugzilla.suse.com/1223843","tags":["report"]},{"url":"https://bugzilla.suse.com/1223844","tags":["report"]},{"url":"https://bugzilla.suse.com/1223847","tags":["report"]},{"url":"https://bugzilla.suse.com/1223858","tags":["report"]},{"url":"https://bugzilla.suse.com/1223875","tags":["report"]},{"url":"https://bugzilla.suse.com/1223879","tags":["report"]},{"url":"https://bugzilla.suse.com/1223895","tags":["report"]},{"url":"https://bugzilla.suse.com/1223959","tags":["report"]},{"url":"https://bugzilla.suse.com/1223961","tags":["report"]},{"url":"https://bugzilla.suse.com/1223991","tags":["report"]},{"url":"https://bugzilla.suse.com/1223996","tags":["report"]},{"url":"https://bugzilla.suse.com/1224020","tags":["report"]},{"url":"https://bugzilla.suse.com/1224076","tags":["report"]},{"url":"https://bugzilla.suse.com/1224096","tags":["report"]},{"url":"https://bugzilla.suse.com/1224098","tags":["report"]},{"url":"https://bugzilla.suse.com/1224099","tags":["report"]},{"url":"https://bugzilla.suse.com/1224137","tags":["report"]},{"url":"https://bugzilla.suse.com/1224166","tags":["report"]},{"url":"https://bugzilla.suse.com/1224174","tags":["report"]},{"url":"https://bugzilla.suse.com/1224177","tags":["report"]},{"url":"https://bugzilla.suse.com/1224180","tags":["report"]},{"url":"https://bugzilla.suse.com/1224181","tags":["report"]},{"url":"https://bugzilla.suse.com/1224187","tags":["report"]},{"url":"https://bugzilla.suse.com/1224331","tags":["report"]},{"url":"https://bugzilla.suse.com/1224346","tags":["report"]},{"url":"https://bugzilla.suse.com/1224423","tags":["report"]},{"url":"https://bugzilla.suse.com/1224432","tags":["report"]},{"url":"https://bugzilla.suse.com/1224437","tags":["report"]},{"url":"https://bugzilla.suse.com/1224438","tags":["report"]},{"url":"https://bugzilla.suse.com/1224442","tags":["report"]},{"url":"https://bugzilla.suse.com/1224443","tags":["report"]},{"url":"https://bugzilla.suse.com/1224445","tags":["report"]},{"url":"https://bugzilla.suse.com/1224449","tags":["report"]},{"url":"https://bugzilla.suse.com/1224479","tags":["report"]},{"url":"https://bugzilla.suse.com/1224482","tags":["report"]},{"url":"https://bugzilla.suse.com/1224487","tags":["report"]},{"url":"https://bugzilla.suse.com/1224488","tags":["report"]},{"url":"https://bugzilla.suse.com/1224492","tags":["report"]},{"url":"https://bugzilla.suse.com/1224494","tags":["report"]},{"url":"https://bugzilla.suse.com/1224495","tags":["report"]},{"url":"https://bugzilla.suse.com/1224502","tags":["report"]},{"url":"https://bugzilla.suse.com/1224508","tags":["report"]},{"url":"https://bugzilla.suse.com/1224509","tags":["report"]},{"url":"https://bugzilla.suse.com/1224511","tags":["report"]},{"url":"https://bugzilla.suse.com/1224519","tags":["report"]},{"url":"https://bugzilla.suse.com/1224524","tags":["report"]},{"url":"https://bugzilla.suse.com/1224525","tags":["report"]},{"url":"https://bugzilla.suse.com/1224530","tags":["report"]},{"url":"https://bugzilla.suse.com/1224531","tags":["report"]},{"url":"https://bugzilla.suse.com/1224534","tags":["report"]},{"url":"https://bugzilla.suse.com/1224535","tags":["report"]},{"url":"https://bugzilla.suse.com/1224537","tags":["report"]},{"url":"https://bugzilla.suse.com/1224541","tags":["report"]},{"url":"https://bugzilla.suse.com/1224543","tags":["report"]},{"url":"https://bugzilla.suse.com/1224549","tags":["report"]},{"url":"https://bugzilla.suse.com/1224550","tags":["report"]},{"url":"https://bugzilla.suse.com/1224558","tags":["report"]},{"url":"https://bugzilla.suse.com/1224559","tags":["report"]},{"url":"https://bugzilla.suse.com/1224566","tags":["report"]},{"url":"https://bugzilla.suse.com/1224567","tags":["report"]},{"url":"https://bugzilla.suse.com/1224571","tags":["report"]},{"url":"https://bugzilla.suse.com/1224575","tags":["report"]},{"url":"https://bugzilla.suse.com/1224576","tags":["report"]},{"url":"https://bugzilla.suse.com/1224579","tags":["report"]},{"url":"https://bugzilla.suse.com/1224580","tags":["report"]},{"url":"https://bugzilla.suse.com/1224581","tags":["report"]},{"url":"https://bugzilla.suse.com/1224582","tags":["report"]},{"url":"https://bugzilla.suse.com/1224586","tags":["report"]},{"url":"https://bugzilla.suse.com/1224587","tags":["report"]},{"url":"https://bugzilla.suse.com/1224592","tags":["report"]},{"url":"https://bugzilla.suse.com/1224598","tags":["report"]},{"url":"https://bugzilla.suse.com/1224601","tags":["report"]},{"url":"https://bugzilla.suse.com/1224607","tags":["report"]},{"url":"https://bugzilla.suse.com/1224608","tags":["report"]},{"url":"https://bugzilla.suse.com/1224611","tags":["report"]},{"url":"https://bugzilla.suse.com/1224615","tags":["report"]},{"url":"https://bugzilla.suse.com/1224617","tags":["report"]},{"url":"https://bugzilla.suse.com/1224618","tags":["report"]},{"url":"https://bugzilla.suse.com/1224621","tags":["report"]},{"url":"https://bugzilla.suse.com/1224622","tags":["report"]},{"url":"https://bugzilla.suse.com/1224624","tags":["report"]},{"url":"https://bugzilla.suse.com/1224627","tags":["report"]},{"url":"https://bugzilla.suse.com/1224628","tags":["report"]},{"url":"https://bugzilla.suse.com/1224629","tags":["report"]},{"url":"https://bugzilla.suse.com/1224632","tags":["report"]},{"url":"https://bugzilla.suse.com/1224636","tags":["report"]},{"url":"https://bugzilla.suse.com/1224637","tags":["report"]},{"url":"https://bugzilla.suse.com/1224638","tags":["report"]},{"url":"https://bugzilla.suse.com/1224640","tags":["report"]},{"url":"https://bugzilla.suse.com/1224643","tags":["report"]},{"url":"https://bugzilla.suse.com/1224644","tags":["report"]},{"url":"https://bugzilla.suse.com/1224645","tags":["report"]},{"url":"https://bugzilla.suse.com/1224647","tags":["report"]},{"url":"https://bugzilla.suse.com/1224648","tags":["report"]},{"url":"https://bugzilla.suse.com/1224649","tags":["report"]},{"url":"https://bugzilla.suse.com/1224650","tags":["report"]},{"url":"https://bugzilla.suse.com/1224651","tags":["report"]},{"url":"https://bugzilla.suse.com/1224657","tags":["report"]},{"url":"https://bugzilla.suse.com/1224659","tags":["report"]},{"url":"https://bugzilla.suse.com/1224660","tags":["report"]},{"url":"https://bugzilla.suse.com/1224663","tags":["report"]},{"url":"https://bugzilla.suse.com/1224664","tags":["report"]},{"url":"https://bugzilla.suse.com/1224665","tags":["report"]},{"url":"https://bugzilla.suse.com/1224666","tags":["report"]},{"url":"https://bugzilla.suse.com/1224667","tags":["report"]},{"url":"https://bugzilla.suse.com/1224668","tags":["report"]},{"url":"https://bugzilla.suse.com/1224671","tags":["report"]},{"url":"https://bugzilla.suse.com/1224672","tags":["report"]},{"url":"https://bugzilla.suse.com/1224676","tags":["report"]},{"url":"https://bugzilla.suse.com/1224678","tags":["report"]},{"url":"https://bugzilla.suse.com/1224679","tags":["report"]},{"url":"https://bugzilla.suse.com/1224680","tags":["report"]},{"url":"https://bugzilla.suse.com/1224681","tags":["report"]},{"url":"https://bugzilla.suse.com/1224682","tags":["report"]},{"url":"https://bugzilla.suse.com/1224685","tags":["report"]},{"url":"https://bugzilla.suse.com/1224686","tags":["report"]},{"url":"https://bugzilla.suse.com/1224692","tags":["report"]},{"url":"https://bugzilla.suse.com/1224697","tags":["report"]},{"url":"https://bugzilla.suse.com/1224699","tags":["report"]},{"url":"https://bugzilla.suse.com/1224701","tags":["report"]},{"url":"https://bugzilla.suse.com/1224703","tags":["report"]},{"url":"https://bugzilla.suse.com/1224705","tags":["report"]},{"url":"https://bugzilla.suse.com/1224707","tags":["report"]},{"url":"https://bugzilla.suse.com/1224717","tags":["report"]},{"url":"https://bugzilla.suse.com/1224718","tags":["report"]},{"url":"https://bugzilla.suse.com/1224721","tags":["report"]},{"url":"https://bugzilla.suse.com/1224722","tags":["report"]},{"url":"https://bugzilla.suse.com/1224723","tags":["report"]},{"url":"https://bugzilla.suse.com/1224725","tags":["report"]},{"url":"https://bugzilla.suse.com/1224727","tags":["report"]},{"url":"https://bugzilla.suse.com/1224728","tags":["report"]},{"url":"https://bugzilla.suse.com/1224729","tags":["report"]},{"url":"https://bugzilla.suse.com/1224730","tags":["report"]},{"url":"https://bugzilla.suse.com/1224731","tags":["report"]},{"url":"https://bugzilla.suse.com/1224732","tags":["report"]},{"url":"https://bugzilla.suse.com/1224733","tags":["report"]},{"url":"https://bugzilla.suse.com/1224736","tags":["report"]},{"url":"https://bugzilla.suse.com/1224738","tags":["report"]},{"url":"https://bugzilla.suse.com/1224739","tags":["report"]},{"url":"https://bugzilla.suse.com/1224740","tags":["report"]},{"url":"https://bugzilla.suse.com/1224747","tags":["report"]},{"url":"https://bugzilla.suse.com/1224749","tags":["report"]},{"url":"https://bugzilla.suse.com/1224759","tags":["report"]},{"url":"https://bugzilla.suse.com/1224763","tags":["report"]},{"url":"https://bugzilla.suse.com/1224764","tags":["report"]},{"url":"https://bugzilla.suse.com/1224765","tags":["report"]},{"url":"https://bugzilla.suse.com/1224766","tags":["report"]},{"url":"https://bugzilla.suse.com/1224794","tags":["report"]},{"url":"https://bugzilla.suse.com/1224795","tags":["report"]},{"url":"https://bugzilla.suse.com/1224796","tags":["report"]},{"url":"https://bugzilla.suse.com/1224803","tags":["report"]},{"url":"https://bugzilla.suse.com/1224816","tags":["report"]},{"url":"https://bugzilla.suse.com/1224895","tags":["report"]},{"url":"https://bugzilla.suse.com/1224898","tags":["report"]},{"url":"https://bugzilla.suse.com/1224900","tags":["report"]},{"url":"https://bugzilla.suse.com/1224901","tags":["report"]},{"url":"https://bugzilla.suse.com/1224902","tags":["report"]},{"url":"https://bugzilla.suse.com/1224903","tags":["report"]},{"url":"https://bugzilla.suse.com/1224904","tags":["report"]},{"url":"https://bugzilla.suse.com/1224905","tags":["report"]},{"url":"https://bugzilla.suse.com/1224907","tags":["report"]},{"url":"https://bugzilla.suse.com/1224909","tags":["report"]},{"url":"https://bugzilla.suse.com/1224910","tags":["report"]},{"url":"https://bugzilla.suse.com/1224911","tags":["report"]},{"url":"https://bugzilla.suse.com/1224912","tags":["report"]},{"url":"https://bugzilla.suse.com/1224913","tags":["report"]},{"url":"https://bugzilla.suse.com/1224914","tags":["report"]},{"url":"https://bugzilla.suse.com/1224915","tags":["report"]},{"url":"https://bugzilla.suse.com/1224920","tags":["report"]},{"url":"https://bugzilla.suse.com/1224928","tags":["report"]},{"url":"https://bugzilla.suse.com/1224929","tags":["report"]},{"url":"https://bugzilla.suse.com/1224930","tags":["report"]},{"url":"https://bugzilla.suse.com/1224931","tags":["report"]},{"url":"https://bugzilla.suse.com/1224932","tags":["report"]},{"url":"https://bugzilla.suse.com/1224936","tags":["report"]},{"url":"https://bugzilla.suse.com/1224937","tags":["report"]},{"url":"https://bugzilla.suse.com/1224941","tags":["report"]},{"url":"https://bugzilla.suse.com/1224942","tags":["report"]},{"url":"https://bugzilla.suse.com/1224944","tags":["report"]},{"url":"https://bugzilla.suse.com/1224945","tags":["report"]},{"url":"https://bugzilla.suse.com/1224947","tags":["report"]},{"url":"https://bugzilla.suse.com/1224956","tags":["report"]},{"url":"https://bugzilla.suse.com/1224988","tags":["report"]},{"url":"https://bugzilla.suse.com/1224992","tags":["report"]},{"url":"https://bugzilla.suse.com/1225000","tags":["report"]},{"url":"https://bugzilla.suse.com/1225003","tags":["report"]},{"url":"https://bugzilla.suse.com/1225005","tags":["report"]},{"url":"https://bugzilla.suse.com/1225008","tags":["report"]},{"url":"https://bugzilla.suse.com/1225009","tags":["report"]},{"url":"https://bugzilla.suse.com/1225022","tags":["report"]},{"url":"https://bugzilla.suse.com/1225031","tags":["report"]},{"url":"https://bugzilla.suse.com/1225032","tags":["report"]},{"url":"https://bugzilla.suse.com/1225036","tags":["report"]},{"url":"https://bugzilla.suse.com/1225041","tags":["report"]},{"url":"https://bugzilla.suse.com/1225044","tags":["report"]},{"url":"https://bugzilla.suse.com/1225053","tags":["report"]},{"url":"https://bugzilla.suse.com/1225076","tags":["report"]},{"url":"https://bugzilla.suse.com/1225077","tags":["report"]},{"url":"https://bugzilla.suse.com/1225082","tags":["report"]},{"url":"https://bugzilla.suse.com/1225085","tags":["report"]},{"url":"https://bugzilla.suse.com/1225086","tags":["report"]},{"url":"https://bugzilla.suse.com/1225092","tags":["report"]},{"url":"https://bugzilla.suse.com/1225095","tags":["report"]},{"url":"https://bugzilla.suse.com/1225096","tags":["report"]},{"url":"https://bugzilla.suse.com/1225097","tags":["report"]},{"url":"https://bugzilla.suse.com/1225106","tags":["report"]},{"url":"https://bugzilla.suse.com/1225108","tags":["report"]},{"url":"https://bugzilla.suse.com/1225109","tags":["report"]},{"url":"https://bugzilla.suse.com/1225114","tags":["report"]},{"url":"https://bugzilla.suse.com/1225118","tags":["report"]},{"url":"https://bugzilla.suse.com/1225121","tags":["report"]},{"url":"https://bugzilla.suse.com/1225122","tags":["report"]},{"url":"https://bugzilla.suse.com/1225123","tags":["report"]},{"url":"https://bugzilla.suse.com/1225125","tags":["report"]},{"url":"https://bugzilla.suse.com/1225126","tags":["report"]},{"url":"https://bugzilla.suse.com/1225127","tags":["report"]},{"url":"https://bugzilla.suse.com/1225129","tags":["report"]},{"url":"https://bugzilla.suse.com/1225131","tags":["report"]},{"url":"https://bugzilla.suse.com/1225132","tags":["report"]},{"url":"https://bugzilla.suse.com/1225138","tags":["report"]},{"url":"https://bugzilla.suse.com/1225139","tags":["report"]},{"url":"https://bugzilla.suse.com/1225145","tags":["report"]},{"url":"https://bugzilla.suse.com/1225151","tags":["report"]},{"url":"https://bugzilla.suse.com/1225153","tags":["report"]},{"url":"https://bugzilla.suse.com/1225156","tags":["report"]},{"url":"https://bugzilla.suse.com/1225158","tags":["report"]},{"url":"https://bugzilla.suse.com/1225160","tags":["report"]},{"url":"https://bugzilla.suse.com/1225161","tags":["report"]},{"url":"https://bugzilla.suse.com/1225164","tags":["report"]},{"url":"https://bugzilla.suse.com/1225167","tags":["report"]},{"url":"https://bugzilla.suse.com/1225180","tags":["report"]},{"url":"https://bugzilla.suse.com/1225183","tags":["report"]},{"url":"https://bugzilla.suse.com/1225184","tags":["report"]},{"url":"https://bugzilla.suse.com/1225186","tags":["report"]},{"url":"https://bugzilla.suse.com/1225187","tags":["report"]},{"url":"https://bugzilla.suse.com/1225189","tags":["report"]},{"url":"https://bugzilla.suse.com/1225190","tags":["report"]},{"url":"https://bugzilla.suse.com/1225191","tags":["report"]},{"url":"https://bugzilla.suse.com/1225192","tags":["report"]},{"url":"https://bugzilla.suse.com/1225193","tags":["report"]},{"url":"https://bugzilla.suse.com/1225195","tags":["report"]},{"url":"https://bugzilla.suse.com/1225198","tags":["report"]},{"url":"https://bugzilla.suse.com/1225201","tags":["report"]},{"url":"https://bugzilla.suse.com/1225203","tags":["report"]},{"url":"https://bugzilla.suse.com/1225205","tags":["report"]},{"url":"https://bugzilla.suse.com/1225206","tags":["report"]},{"url":"https://bugzilla.suse.com/1225207","tags":["report"]},{"url":"https://bugzilla.suse.com/1225208","tags":["report"]},{"url":"https://bugzilla.suse.com/1225209","tags":["report"]},{"url":"https://bugzilla.suse.com/1225210","tags":["report"]},{"url":"https://bugzilla.suse.com/1225214","tags":["report"]},{"url":"https://bugzilla.suse.com/1225222","tags":["report"]},{"url":"https://bugzilla.suse.com/1225223","tags":["report"]},{"url":"https://bugzilla.suse.com/1225224","tags":["report"]},{"url":"https://bugzilla.suse.com/1225225","tags":["report"]},{"url":"https://bugzilla.suse.com/1225227","tags":["report"]},{"url":"https://bugzilla.suse.com/1225228","tags":["report"]},{"url":"https://bugzilla.suse.com/1225229","tags":["report"]},{"url":"https://bugzilla.suse.com/1225230","tags":["report"]},{"url":"https://bugzilla.suse.com/1225232","tags":["report"]},{"url":"https://bugzilla.suse.com/1225233","tags":["report"]},{"url":"https://bugzilla.suse.com/1225235","tags":["report"]},{"url":"https://bugzilla.suse.com/1225236","tags":["report"]},{"url":"https://bugzilla.suse.com/1225237","tags":["report"]},{"url":"https://bugzilla.suse.com/1225238","tags":["report"]},{"url":"https://bugzilla.suse.com/1225239","tags":["report"]},{"url":"https://bugzilla.suse.com/1225240","tags":["report"]},{"url":"https://bugzilla.suse.com/1225241","tags":["report"]},{"url":"https://bugzilla.suse.com/1225242","tags":["report"]},{"url":"https://bugzilla.suse.com/1225243","tags":["report"]},{"url":"https://bugzilla.suse.com/1225244","tags":["report"]},{"url":"https://bugzilla.suse.com/1225245","tags":["report"]},{"url":"https://bugzilla.suse.com/1225246","tags":["report"]},{"url":"https://bugzilla.suse.com/1225247","tags":["report"]},{"url":"https://bugzilla.suse.com/1225248","tags":["report"]},{"url":"https://bugzilla.suse.com/1225249","tags":["report"]},{"url":"https://bugzilla.suse.com/1225250","tags":["report"]},{"url":"https://bugzilla.suse.com/1225251","tags":["report"]},{"url":"https://bugzilla.suse.com/1225252","tags":["report"]},{"url":"https://bugzilla.suse.com/1225253","tags":["report"]},{"url":"https://bugzilla.suse.com/1225254","tags":["report"]},{"url":"https://bugzilla.suse.com/1225255","tags":["report"]},{"url":"https://bugzilla.suse.com/1225256","tags":["report"]},{"url":"https://bugzilla.suse.com/1225257","tags":["report"]},{"url":"https://bugzilla.suse.com/1225258","tags":["report"]},{"url":"https://bugzilla.suse.com/1225259","tags":["report"]},{"url":"https://bugzilla.suse.com/1225260","tags":["report"]},{"url":"https://bugzilla.suse.com/1225261","tags":["report"]},{"url":"https://bugzilla.suse.com/1225262","tags":["report"]},{"url":"https://bugzilla.suse.com/1225263","tags":["report"]},{"url":"https://bugzilla.suse.com/1225268","tags":["report"]},{"url":"https://bugzilla.suse.com/1225301","tags":["report"]},{"url":"https://bugzilla.suse.com/1225303","tags":["report"]},{"url":"https://bugzilla.suse.com/1225304","tags":["report"]},{"url":"https://bugzilla.suse.com/1225306","tags":["report"]},{"url":"https://bugzilla.suse.com/1225316","tags":["report"]},{"url":"https://bugzilla.suse.com/1225318","tags":["report"]},{"url":"https://bugzilla.suse.com/1225320","tags":["report"]},{"url":"https://bugzilla.suse.com/1225321","tags":["report"]},{"url":"https://bugzilla.suse.com/1225322","tags":["report"]},{"url":"https://bugzilla.suse.com/1225323","tags":["report"]},{"url":"https://bugzilla.suse.com/1225326","tags":["report"]},{"url":"https://bugzilla.suse.com/1225327","tags":["report"]},{"url":"https://bugzilla.suse.com/1225328","tags":["report"]},{"url":"https://bugzilla.suse.com/1225329","tags":["report"]},{"url":"https://bugzilla.suse.com/1225330","tags":["report"]},{"url":"https://bugzilla.suse.com/1225331","tags":["report"]},{"url":"https://bugzilla.suse.com/1225332","tags":["report"]},{"url":"https://bugzilla.suse.com/1225333","tags":["report"]},{"url":"https://bugzilla.suse.com/1225334","tags":["report"]},{"url":"https://bugzilla.suse.com/1225335","tags":["report"]},{"url":"https://bugzilla.suse.com/1225336","tags":["report"]},{"url":"https://bugzilla.suse.com/1225337","tags":["report"]},{"url":"https://bugzilla.suse.com/1225338","tags":["report"]},{"url":"https://bugzilla.suse.com/1225339","tags":["report"]},{"url":"https://bugzilla.suse.com/1225341","tags":["report"]},{"url":"https://bugzilla.suse.com/1225342","tags":["report"]},{"url":"https://bugzilla.suse.com/1225344","tags":["report"]},{"url":"https://bugzilla.suse.com/1225346","tags":["report"]},{"url":"https://bugzilla.suse.com/1225347","tags":["report"]},{"url":"https://bugzilla.suse.com/1225351","tags":["report"]},{"url":"https://bugzilla.suse.com/1225353","tags":["report"]},{"url":"https://bugzilla.suse.com/1225354","tags":["report"]},{"url":"https://bugzilla.suse.com/1225355","tags":["report"]},{"url":"https://bugzilla.suse.com/1225357","tags":["report"]},{"url":"https://bugzilla.suse.com/1225358","tags":["report"]},{"url":"https://bugzilla.suse.com/1225360","tags":["report"]},{"url":"https://bugzilla.suse.com/1225361","tags":["report"]},{"url":"https://bugzilla.suse.com/1225366","tags":["report"]},{"url":"https://bugzilla.suse.com/1225367","tags":["report"]},{"url":"https://bugzilla.suse.com/1225368","tags":["report"]},{"url":"https://bugzilla.suse.com/1225369","tags":["report"]},{"url":"https://bugzilla.suse.com/1225370","tags":["report"]},{"url":"https://bugzilla.suse.com/1225372","tags":["report"]},{"url":"https://bugzilla.suse.com/1225373","tags":["report"]},{"url":"https://bugzilla.suse.com/1225374","tags":["report"]},{"url":"https://bugzilla.suse.com/1225375","tags":["report"]},{"url":"https://bugzilla.suse.com/1225376","tags":["report"]},{"url":"https://bugzilla.suse.com/1225377","tags":["report"]},{"url":"https://bugzilla.suse.com/1225379","tags":["report"]},{"url":"https://bugzilla.suse.com/1225380","tags":["report"]},{"url":"https://bugzilla.suse.com/1225382","tags":["report"]},{"url":"https://bugzilla.suse.com/1225383","tags":["report"]},{"url":"https://bugzilla.suse.com/1225384","tags":["report"]},{"url":"https://bugzilla.suse.com/1225386","tags":["report"]},{"url":"https://bugzilla.suse.com/1225387","tags":["report"]},{"url":"https://bugzilla.suse.com/1225388","tags":["report"]},{"url":"https://bugzilla.suse.com/1225390","tags":["report"]},{"url":"https://bugzilla.suse.com/1225392","tags":["report"]},{"url":"https://bugzilla.suse.com/1225393","tags":["report"]},{"url":"https://bugzilla.suse.com/1225396","tags":["report"]},{"url":"https://bugzilla.suse.com/1225400","tags":["report"]},{"url":"https://bugzilla.suse.com/1225404","tags":["report"]},{"url":"https://bugzilla.suse.com/1225405","tags":["report"]},{"url":"https://bugzilla.suse.com/1225408","tags":["report"]},{"url":"https://bugzilla.suse.com/1225409","tags":["report"]},{"url":"https://bugzilla.suse.com/1225410","tags":["report"]},{"url":"https://bugzilla.suse.com/1225411","tags":["report"]},{"url":"https://bugzilla.suse.com/1225424","tags":["report"]},{"url":"https://bugzilla.suse.com/1225425","tags":["report"]},{"url":"https://bugzilla.suse.com/1225427","tags":["report"]},{"url":"https://bugzilla.suse.com/1225431","tags":["report"]},{"url":"https://bugzilla.suse.com/1225435","tags":["report"]},{"url":"https://bugzilla.suse.com/1225436","tags":["report"]},{"url":"https://bugzilla.suse.com/1225437","tags":["report"]},{"url":"https://bugzilla.suse.com/1225438","tags":["report"]},{"url":"https://bugzilla.suse.com/1225439","tags":["report"]},{"url":"https://bugzilla.suse.com/1225441","tags":["report"]},{"url":"https://bugzilla.suse.com/1225442","tags":["report"]},{"url":"https://bugzilla.suse.com/1225443","tags":["report"]},{"url":"https://bugzilla.suse.com/1225444","tags":["report"]},{"url":"https://bugzilla.suse.com/1225445","tags":["report"]},{"url":"https://bugzilla.suse.com/1225446","tags":["report"]},{"url":"https://bugzilla.suse.com/1225447","tags":["report"]},{"url":"https://bugzilla.suse.com/1225450","tags":["report"]},{"url":"https://bugzilla.suse.com/1225453","tags":["report"]},{"url":"https://bugzilla.suse.com/1225455","tags":["report"]},{"url":"https://bugzilla.suse.com/1225461","tags":["report"]},{"url":"https://bugzilla.suse.com/1225463","tags":["report"]},{"url":"https://bugzilla.suse.com/1225464","tags":["report"]},{"url":"https://bugzilla.suse.com/1225466","tags":["report"]},{"url":"https://bugzilla.suse.com/1225467","tags":["report"]},{"url":"https://bugzilla.suse.com/1225468","tags":["report"]},{"url":"https://bugzilla.suse.com/1225471","tags":["report"]},{"url":"https://bugzilla.suse.com/1225472","tags":["report"]},{"url":"https://bugzilla.suse.com/1225478","tags":["report"]},{"url":"https://bugzilla.suse.com/1225479","tags":["report"]},{"url":"https://bugzilla.suse.com/1225480","tags":["report"]},{"url":"https://bugzilla.suse.com/1225482","tags":["report"]},{"url":"https://bugzilla.suse.com/1225483","tags":["report"]},{"url":"https://bugzilla.suse.com/1225486","tags":["report"]},{"url":"https://bugzilla.suse.com/1225488","tags":["report"]},{"url":"https://bugzilla.suse.com/1225490","tags":["report"]},{"url":"https://bugzilla.suse.com/1225492","tags":["report"]},{"url":"https://bugzilla.suse.com/1225495","tags":["report"]},{"url":"https://bugzilla.suse.com/1225499","tags":["report"]},{"url":"https://bugzilla.suse.com/1225500","tags":["report"]},{"url":"https://bugzilla.suse.com/1225501","tags":["report"]},{"url":"https://bugzilla.suse.com/1225502","tags":["report"]},{"url":"https://bugzilla.suse.com/1225506","tags":["report"]},{"url":"https://bugzilla.suse.com/1225508","tags":["report"]},{"url":"https://bugzilla.suse.com/1225510","tags":["report"]},{"url":"https://bugzilla.suse.com/1225513","tags":["report"]},{"url":"https://bugzilla.suse.com/1225515","tags":["report"]},{"url":"https://bugzilla.suse.com/1225529","tags":["report"]},{"url":"https://bugzilla.suse.com/1225530","tags":["report"]},{"url":"https://bugzilla.suse.com/1225532","tags":["report"]},{"url":"https://bugzilla.suse.com/1225534","tags":["report"]},{"url":"https://bugzilla.suse.com/1225535","tags":["report"]},{"url":"https://bugzilla.suse.com/1225548","tags":["report"]},{"url":"https://bugzilla.suse.com/1225549","tags":["report"]},{"url":"https://bugzilla.suse.com/1225550","tags":["report"]},{"url":"https://bugzilla.suse.com/1225553","tags":["report"]},{"url":"https://bugzilla.suse.com/1225554","tags":["report"]},{"url":"https://bugzilla.suse.com/1225555","tags":["report"]},{"url":"https://bugzilla.suse.com/1225556","tags":["report"]},{"url":"https://bugzilla.suse.com/1225557","tags":["report"]},{"url":"https://bugzilla.suse.com/1225559","tags":["report"]},{"url":"https://bugzilla.suse.com/1225560","tags":["report"]},{"url":"https://bugzilla.suse.com/1225565","tags":["report"]},{"url":"https://bugzilla.suse.com/1225566","tags":["report"]},{"url":"https://bugzilla.suse.com/1225568","tags":["report"]},{"url":"https://bugzilla.suse.com/1225569","tags":["report"]},{"url":"https://bugzilla.suse.com/1225570","tags":["report"]},{"url":"https://bugzilla.suse.com/1225571","tags":["report"]},{"url":"https://bugzilla.suse.com/1225572","tags":["report"]},{"url":"https://bugzilla.suse.com/1225577","tags":["report"]},{"url":"https://bugzilla.suse.com/1225583","tags":["report"]},{"url":"https://bugzilla.suse.com/1225584","tags":["report"]},{"url":"https://bugzilla.suse.com/1225587","tags":["report"]},{"url":"https://bugzilla.suse.com/1225588","tags":["report"]},{"url":"https://bugzilla.suse.com/1225589","tags":["report"]},{"url":"https://bugzilla.suse.com/1225590","tags":["report"]},{"url":"https://bugzilla.suse.com/1225591","tags":["report"]},{"url":"https://bugzilla.suse.com/1225592","tags":["report"]},{"url":"https://bugzilla.suse.com/1225593","tags":["report"]},{"url":"https://bugzilla.suse.com/1225595","tags":["report"]},{"url":"https://bugzilla.suse.com/1225599","tags":["report"]},{"url":"https://bugzilla.suse.com/1225616","tags":["report"]},{"url":"https://bugzilla.suse.com/1225640","tags":["report"]},{"url":"https://bugzilla.suse.com/1225642","tags":["report"]},{"url":"https://bugzilla.suse.com/1225705","tags":["report"]},{"url":"https://bugzilla.suse.com/1225708","tags":["report"]},{"url":"https://bugzilla.suse.com/1225715","tags":["report"]},{"url":"https://bugzilla.suse.com/1225720","tags":["report"]},{"url":"https://bugzilla.suse.com/1225722","tags":["report"]},{"url":"https://bugzilla.suse.com/1225734","tags":["report"]},{"url":"https://bugzilla.suse.com/1225735","tags":["report"]},{"url":"https://bugzilla.suse.com/1225747","tags":["report"]},{"url":"https://bugzilla.suse.com/1225748","tags":["report"]},{"url":"https://bugzilla.suse.com/1225756","tags":["report"]},{"url":"https://bugzilla.suse.com/1225761","tags":["report"]},{"url":"https://bugzilla.suse.com/1225766","tags":["report"]},{"url":"https://bugzilla.suse.com/1225775","tags":["report"]},{"url":"https://bugzilla.suse.com/1225810","tags":["report"]},{"url":"https://bugzilla.suse.com/1225820","tags":["report"]},{"url":"https://bugzilla.suse.com/1225829","tags":["report"]},{"url":"https://bugzilla.suse.com/1225835","tags":["report"]},{"url":"https://bugzilla.suse.com/1225842","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47504","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47552","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52586","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52618","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52664","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52669","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52705","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52803","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52808","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26597","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26643","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26748","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26777","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26839","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26920","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26957","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26958","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26974","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26994","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27004","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27045","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27051","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27052","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27053","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27072","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27073","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27074","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27075","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27076","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27078","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35801","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35809","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35812","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35813","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35823","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35936","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35959","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35963","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35964","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35976","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35978","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35984","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36012","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36016","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36940","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36947","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36959","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242011-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196869","tags":["report"]},{"url":"https://bugzilla.suse.com/1200313","tags":["report"]},{"url":"https://bugzilla.suse.com/1201308","tags":["report"]},{"url":"https://bugzilla.suse.com/1201489","tags":["report"]},{"url":"https://bugzilla.suse.com/1211592","tags":["report"]},{"url":"https://bugzilla.suse.com/1218917","tags":["report"]},{"url":"https://bugzilla.suse.com/1220492","tags":["report"]},{"url":"https://bugzilla.suse.com/1221645","tags":["report"]},{"url":"https://bugzilla.suse.com/1221958","tags":["report"]},{"url":"https://bugzilla.suse.com/1223057","tags":["report"]},{"url":"https://bugzilla.suse.com/1223111","tags":["report"]},{"url":"https://bugzilla.suse.com/1223191","tags":["report"]},{"url":"https://bugzilla.suse.com/1223481","tags":["report"]},{"url":"https://bugzilla.suse.com/1223501","tags":["report"]},{"url":"https://bugzilla.suse.com/1223512","tags":["report"]},{"url":"https://bugzilla.suse.com/1223520","tags":["report"]},{"url":"https://bugzilla.suse.com/1223894","tags":["report"]},{"url":"https://bugzilla.suse.com/1223921","tags":["report"]},{"url":"https://bugzilla.suse.com/1223922","tags":["report"]},{"url":"https://bugzilla.suse.com/1223923","tags":["report"]},{"url":"https://bugzilla.suse.com/1223924","tags":["report"]},{"url":"https://bugzilla.suse.com/1223929","tags":["report"]},{"url":"https://bugzilla.suse.com/1223931","tags":["report"]},{"url":"https://bugzilla.suse.com/1223932","tags":["report"]},{"url":"https://bugzilla.suse.com/1223934","tags":["report"]},{"url":"https://bugzilla.suse.com/1223941","tags":["report"]},{"url":"https://bugzilla.suse.com/1223948","tags":["report"]},{"url":"https://bugzilla.suse.com/1223952","tags":["report"]},{"url":"https://bugzilla.suse.com/1223953","tags":["report"]},{"url":"https://bugzilla.suse.com/1223957","tags":["report"]},{"url":"https://bugzilla.suse.com/1223962","tags":["report"]},{"url":"https://bugzilla.suse.com/1223963","tags":["report"]},{"url":"https://bugzilla.suse.com/1223964","tags":["report"]},{"url":"https://bugzilla.suse.com/1224085","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26862","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242019-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242189-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2860","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242190-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-47558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-47558","tags":["report"]},{"url":"https://git.kernel.org/linus/b270bfe697367776eca2e6759a71d700fb8d82a2","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-47558","title":"net: stmmac: Disable Tx queues when reconfiguring the interface","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Disable Tx queues when reconfiguring the interface\n\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\n\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\n\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\n\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---","status":"published","published":"2024-05-24T15:09:59.315Z","modified":"2026-05-11T13:56:57.041Z","updated_at":"2026-11-02T14:32:56.308189Z"}],"euvd":[{"id":"EUVD-2021-34560","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Disable Tx queues when reconfiguring the interface\n\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\n\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\n\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\n\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---","status":"published","published":"2024-05-24T15:09:59Z","modified":"2026-05-11T13:56:57Z","updated_at":"2026-11-02T19:05:11.861543Z"}],"nvd":[{"id":"CVE-2021-47558","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Disable Tx queues when reconfiguring the interface\n\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\n\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\n\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\n\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---","status":"published","published":"2024-05-24T15:15:20.467Z","modified":"2026-06-17T04:17:45.943Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:07:08.629518Z"}],"osv":[{"id":"CVE-2021-47558","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: Disable Tx queues when reconfiguring the interface\n\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\n\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\n\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\n\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---","status":"published","published":"2024-05-24T15:15:20.467Z","modified":"2026-03-14T14:51:57.378524Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:22.470367Z"},{"id":"DEBIAN-CVE-2021-47558","description":"In the Linux kernel, the following vulnerability has been resolved:  net: stmmac: Disable Tx queues when reconfiguring the interface  The Tx queues were not disabled in situations where the driver needed to stop the interface to apply a new configuration. This could result in a kernel panic when doing any of the 3 following actions: * reconfiguring the number of queues (ethtool -L) * reconfiguring the size of the ring buffers (ethtool -G) * installing/removing an XDP program (ip l set dev ethX xdp)  Prevent the panic by making sure netif_tx_disable is called when stopping an interface.  Without this patch, the following kernel panic can be observed when doing any of the actions above:  Unable to handle kernel paging request at virtual address ffff80001238d040 [....]  Call trace:   dwmac4_set_addr+0x8/0x10   dev_hard_start_xmit+0xe4/0x1ac   sch_direct_xmit+0xe8/0x39c   __dev_queue_xmit+0x3ec/0xaf0   dev_queue_xmit+0x14/0x20 [...] [ end trace 0000000000000002 ]---","status":"published","published":"2024-05-24T15:15:20.467Z","modified":"2026-10-23T18:03:51.935337696Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:36.373808Z"},{"id":"OESA-2024-1706","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/mlx5e: Fix use-after-free of encap entry in neigh update handler\r\n\r\nFunction mlx5e_rep_neigh_update() wasn\u0026apos;t updated to accommodate rtnl lock\nremoval from TC filter update path and properly handle concurrent encap\nentry insertion/deletion which can lead to following use-after-free:\r\n\r\n [23827.464923] ==================================================================\n [23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635\n [23827.472251]\n [23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5\n [23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n [23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]\n [23827.476731] Call Trace:\n [23827.477260]  dump_stack+0xbb/0x107\n [23827.477906]  print_address_description.constprop.0+0x18/0x140\n [23827.478896]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.479879]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.480905]  kasan_report.cold+0x7c/0xd8\n [23827.481701]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.482744]  kasan_check_range+0x145/0x1a0\n [23827.493112]  mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.494054]  ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core]\n [23827.495296]  mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core]\n [23827.496338]  ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core]\n [23827.497486]  ? read_word_at_a_time+0xe/0x20\n [23827.498250]  ? strscpy+0xa0/0x2a0\n [23827.498889]  process_one_work+0x8ac/0x14e0\n [23827.499638]  ? lockdep_hardirqs_on_prepare+0x400/0x400\n [23827.500537]  ? pwq_dec_nr_in_flight+0x2c0/0x2c0\n [23827.501359]  ? rwlock_bug.part.0+0x90/0x90\n [23827.502116]  worker_thread+0x53b/0x1220\n [23827.502831]  ? process_one_work+0x14e0/0x14e0\n [23827.503627]  kthread+0x328/0x3f0\n [23827.504254]  ? _raw_spin_unlock_irq+0x24/0x40\n [23827.505065]  ? __kthread_bind_mask+0x90/0x90\n [23827.505912]  ret_from_fork+0x1f/0x30\n [23827.506621]\n [23827.506987] Allocated by task 28248:\n [23827.507694]  kasan_save_stack+0x1b/0x40\n [23827.508476]  __kasan_kmalloc+0x7c/0x90\n [23827.509197]  mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core]\n [23827.510194]  mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core]\n [23827.511218]  __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core]\n [23827.512234]  mlx5e_configure_flower+0x191c/0x4870 [mlx5_core]\n [23827.513298]  tc_setup_cb_add+0x1d5/0x420\n [23827.514023]  fl_hw_replace_filter+0x382/0x6a0 [cls_flower]\n [23827.514975]  fl_change+0x2ceb/0x4a51 [cls_flower]\n [23827.515821]  tc_new_tfilter+0x89a/0x2070\n [23827.516548]  rtnetlink_rcv_msg+0x644/0x8c0\n [23827.517300]  netlink_rcv_skb+0x11d/0x340\n [23827.518021]  netlink_unicast+0x42b/0x700\n [23827.518742]  netlink_sendmsg+0x743/0xc20\n [23827.519467]  sock_sendmsg+0xb2/0xe0\n [23827.520131]  ____sys_sendmsg+0x590/0x770\n [23827.520851]  ___sys_sendmsg+0xd8/0x160\n [23827.521552]  __sys_sendmsg+0xb7/0x140\n [23827.522238]  do_syscall_64+0x3a/0x70\n [23827.522907]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n [23827.523797]\n [23827.524163] Freed by task 25948:\n [23827.524780]  kasan_save_stack+0x1b/0x40\n [23827.525488]  kasan_set_track+0x1c/0x30\n [23827.526187]  kasan_set_free_info+0x20/0x30\n [23827.526968]  __kasan_slab_free+0xed/0x130\n [23827.527709]  slab_free_freelist_hook+0xcf/0x1d0\n [23827.528528]  kmem_cache_free_bulk+0x33a/0x6e0\n [23827.529317]  kfree_rcu_work+0x55f/0xb70\n [23827.530024]  process_one_work+0x8ac/0x14e0\n [23827.530770]  worker_thread+0x53b/0x1220\n [23827.531480]  kthread+0x328/0x3f0\n [23827.532114]  ret_from_fork+0x1f/0x30\n [23827.532785]\n [23827.533147] Last potentially related work creation:\n [23827.534007]  kasan_save_stack+0x1b/0x40\n [23827.534710]  kasan_record_aux_stack+0xab/0xc0\n [23827.535492]  kvfree_call_rcu+0x31/0x7b0\n [23827.536206]  mlx5e_tc_del\n---truncated---(CVE-2021-47247)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA: Verify port when creating flow rule\r\n\r\nValidate port value provided by the user and with that remove no longer\nneeded validation by the driver.  The missing check in the mlx5_ib driver\ncould cause to the below oops.\r\n\r\nCall trace:\n  _create_flow_rule+0x2d4/0xf28 [mlx5_ib]\n  mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib]\n  ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs]\n  ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs]\n  ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs]\n  ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs]\n  do_vfs_ioctl+0xd0/0xaf0\n  ksys_ioctl+0x84/0xb4\n  __arm64_sys_ioctl+0x28/0xc4\n  el0_svc_common.constprop.3+0xa4/0x254\n  el0_svc_handler+0x84/0xa0\n  el0_svc+0x10/0x26c\n Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)(CVE-2021-47265)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmISDN: fix possible use-after-free in HFC_cleanup()\r\n\r\nThis module\u0026apos;s remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver\u0026apos;s remove function\nhas finished, which would result in a use-after-free.\r\n\r\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.(CVE-2021-47356)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: stmmac: Disable Tx queues when reconfiguring the interface\r\n\r\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\r\n\r\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\r\n\r\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\r\n\r\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---(CVE-2021-47558)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Fix crash by keep old cfg when update TCs more than queues\r\n\r\nThere are problems if allocated queues less than Traffic Classes.\r\n\r\nCommit a632b2a4c920 (\u0026quot;ice: ethtool: Prohibit improper channel config\nfor DCB\u0026quot;) already disallow setting less queues than TCs.\r\n\r\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\r\n\r\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u0026lt;8b\u0026gt; 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\r\n\r\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.(CVE-2022-48652)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\naio: fix mremap after fork null-deref\r\n\r\nCommit e4a0d3e720e7 (\u0026quot;aio: Make it possible to remap aio ring\u0026quot;) introduced\na null-deref if mremap is called on an old aio mapping after fork as\nmm-\u0026gt;ioctx_table will be set to NULL.\r\n\r\n[jmoyer@redhat.com: fix 80 column issue](CVE-2023-52646)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nriscv: Check if the code to patch lies in the exit section\r\n\r\nOtherwise we fall through to vmalloc_to_page() which panics since the\naddress does not lie in the vmalloc region.(CVE-2023-52677)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nALSA: scarlett2: Add missing error checks to *_ctl_get()\r\n\r\nThe *_ctl_get() functions which call scarlett2_update_*() were not\nchecking the return value. Fix to check the return value and pass to\nthe caller.(CVE-2023-52680)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/powernv: Add a null pointer check in opal_event_init()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.(CVE-2023-52686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: openvswitch: fix possible memory leak in ovs_meter_cmd_set()\r\n\r\nold_meter needs to be free after it is detached regardless of whether\nthe new meter is successfully attached.(CVE-2023-52702)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix underflow in second superblock position calculations\r\n\r\nMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the second\nsuperblock, underflows when the argument device size is less than 4096\nbytes.  Therefore, when using this macro, it is necessary to check in\nadvance that the device size is not less than a lower limit, or at least\nthat underflow does not occur.\r\n\r\nThe current nilfs2 implementation lacks this check, causing out-of-bound\nblock access when mounting devices smaller than 4096 bytes:\r\n\r\n I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0\n phys_seg 1 prio class 2\n NILFS (loop0): unable to read secondary superblock (blocksize = 1024)\r\n\r\nIn addition, when trying to resize the filesystem to a size below 4096\nbytes, this underflow occurs in nilfs_resize_fs(), passing a huge number\nof segments to nilfs_sufile_resize(), corrupting parameters such as the\nnumber of segments in superblocks.  This causes excessive loop iterations\nin nilfs_sufile_resize() during a subsequent resize ioctl, causing\nsemaphore ns_segctor_sem to block for a long time and hang the writer\nthread:\r\n\r\n INFO: task segctord:5067 blocked for more than 143 seconds.\n      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0\n \u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\n task:segctord        state:D stack:23456 pid:5067  ppid:2\n flags:0x00004000\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  context_switch kernel/sched/core.c:5293 [inline]\n  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606\n  schedule+0xc3/0x190 kernel/sched/core.c:6682\n  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190\n  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]\n  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570\n  kthread+0x270/0x300 kernel/kthread.c:376\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\n  \u0026lt;/TASK\u0026gt;\n ...\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515\n  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]\n  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61\n  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121\n  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176\n  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251\n  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]\n  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]\n  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777\n  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422\n  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]\n  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301\n  ...\r\n\r\nThis fixes these issues by inserting appropriate minimum device size\nchecks or anti-underflow checks, depending on where the macro is used.(CVE-2023-52705)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nIB/IPoIB: Fix legacy IPoIB due to wrong number of queues\r\n\r\nThe cited commit creates child PKEY interfaces over netlink will\nmultiple tx and rx queues, but some devices doesn\u0026apos;t support more than 1\ntx and 1 rx queues. This causes to a crash when traffic is sent over the\nPKEY interface due to the parent having a single queue but the child\nhaving multiple queues.\r\n\r\nThis patch fixes the number of queues to 1 for legacy IPoIB at the\nearliest possible point in time.\r\n\r\nBUG: kernel NULL pointer dereference, address: 000000000000036b\nPGD 0 P4D 0\nOops: 0000 [#1] SMP\nCPU: 4 PID: 209665 Comm: python3 Not tainted 6.1.0_for_upstream_min_debug_2022_12_12_17_02 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:kmem_cache_alloc+0xcb/0x450\nCode: ce 7e 49 8b 50 08 49 83 78 10 00 4d 8b 28 0f 84 cb 02 00 00 4d 85 ed 0f 84 c2 02 00 00 41 8b 44 24 28 48 8d 4a\n01 49 8b 3c 24 \u0026lt;49\u0026gt; 8b 5c 05 00 4c 89 e8 65 48 0f c7 0f 0f 94 c0 84 c0 74 b8 41 8b\nRSP: 0018:ffff88822acbbab8 EFLAGS: 00010202\nRAX: 0000000000000070 RBX: ffff8881c28e3e00 RCX: 00000000064f8dae\nRDX: 00000000064f8dad RSI: 0000000000000a20 RDI: 0000000000030d00\nRBP: 0000000000000a20 R08: ffff8882f5d30d00 R09: ffff888104032f40\nR10: ffff88810fade828 R11: 736f6d6570736575 R12: ffff88810081c000\nR13: 00000000000002fb R14: ffffffff817fc865 R15: 0000000000000000\nFS:  00007f9324ff9700(0000) GS:ffff8882f5d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000000000036b CR3: 00000001125af004 CR4: 0000000000370ea0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n skb_clone+0x55/0xd0\n ip6_finish_output2+0x3fe/0x690\n ip6_finish_output+0xfa/0x310\n ip6_send_skb+0x1e/0x60\n udp_v6_send_skb+0x1e5/0x420\n udpv6_sendmsg+0xb3c/0xe60\n ? ip_mc_finish_output+0x180/0x180\n ? __switch_to_asm+0x3a/0x60\n ? __switch_to_asm+0x34/0x60\n sock_sendmsg+0x33/0x40\n __sys_sendto+0x103/0x160\n ? _copy_to_user+0x21/0x30\n ? kvm_clock_get_cycles+0xd/0x10\n ? ktime_get_ts64+0x49/0xe0\n __x64_sys_sendto+0x25/0x30\n do_syscall_64+0x3d/0x90\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f9374f1ed14\nCode: 42 41 f8 ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b\n7c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 68 41 f8 ff 48 8b\nRSP: 002b:00007f9324ff7bd0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f9324ff7cc8 RCX: 00007f9374f1ed14\nRDX: 00000000000002fb RSI: 00007f93000052f0 RDI: 0000000000000030\nRBP: 0000000000000000 R08: 00007f9324ff7d40 R09: 000000000000001c\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\nR13: 000000012a05f200 R14: 0000000000000001 R15: 00007f9374d57bdc\n \u0026lt;/TASK\u0026gt;(CVE-2023-52745)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()\r\n\r\n  int type = nla_type(nla);\r\n\r\n  if (type \u0026gt; XFRMA_MAX) {\n            return -EOPNOTSUPP;\n  }\r\n\r\n@type is then used as an array index and can be used\nas a Spectre v1 gadget.\r\n\r\n  if (nla_len(nla) \u0026lt; compat_policy[type].len) {\r\n\r\narray_index_nospec() can be used to prevent leaking\ncontent of kernel memory to malicious users.(CVE-2023-52746)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Avoid NULL dereference of timing generator\r\n\r\n[Why \u0026amp; How]\nCheck whether assigned timing generator is NULL or not before\naccessing its funcs to prevent NULL dereference.(CVE-2023-52753)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/smc: avoid data corruption caused by decline\r\n\r\nWe found a data corruption issue during testing of SMC-R on Redis\napplications.\r\n\r\nThe benchmark has a low probability of reporting a strange error as\nshown below.\r\n\r\n\u0026quot;Error: Protocol error, got \u0026quot;\\xe2\u0026quot; as reply type byte\u0026quot;\r\n\r\nFinally, we found that the retrieved error data was as follows:\r\n\r\n0xE2 0xD4 0xC3 0xD9 0x04 0x00 0x2C 0x20 0xA6 0x56 0x00 0x16 0x3E 0x0C\n0xCB 0x04 0x02 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xE2\r\n\r\nIt is quite obvious that this is a SMC DECLINE message, which means that\nthe applications received SMC protocol message.\nWe found that this was caused by the following situations:\r\n\r\nclient                  server\n        ¦  clc proposal\n        -------------\u0026gt;\n        ¦  clc accept\n        \u0026lt;-------------\n        ¦  clc confirm\n        -------------\u0026gt;\nwait llc confirm\n\t\t\tsend llc confirm\n        ¦failed llc confirm\n        ¦   x------\n(after 2s)timeout\n                        wait llc confirm rsp\r\n\r\nwait decline\r\n\r\n(after 1s) timeout\n                        (after 2s) timeout\n        ¦   decline\n        --------------\u0026gt;\n        ¦   decline\n        \u0026lt;--------------\r\n\r\nAs a result, a decline message was sent in the implementation, and this\nmessage was read from TCP by the already-fallback connection.\r\n\r\nThis patch double the client timeout as 2x of the server value,\nWith this simple change, the Decline messages should never cross or\ncollide (during Confirm link timeout).\r\n\r\nThis issue requires an immediate solution, since the protocol updates\ninvolve a more long-term solution.(CVE-2023-52775)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipvlan: add ipvlan_route_v6_outbound() helper\r\n\r\nInspired by syzbot reports using a stack of multiple ipvlan devices.\r\n\r\nReduce stack size needed in ipvlan_process_v6_outbound() by moving\nthe flowi6 struct used for the route lookup in an non inlined\nhelper. ipvlan_route_v6_outbound() needs 120 bytes on the stack,\nimmediately reclaimed.\r\n\r\nAlso make sure ipvlan_process_v4_outbound() is not inlined.\r\n\r\nWe might also have to lower MAX_NEST_DEV, because only syzbot uses\nsetups with more than four stacked devices.\r\n\r\nBUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000)\nstack guard page: 0000 [#1] SMP KASAN\nCPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023\nRIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188\nCode: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 \u0026lt;41\u0026gt; 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89\nRSP: 0018:ffffc9000e804000 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2\nRDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568\nRBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c\nR13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000\nFS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u0026lt;#DF\u0026gt;\n\u0026lt;/#DF\u0026gt;\n\u0026lt;TASK\u0026gt;\n[\u0026lt;ffffffff81f281d1\u0026gt;] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\n[\u0026lt;ffffffff817e5bf2\u0026gt;] instrument_atomic_read include/linux/instrumented.h:72 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] cpumask_test_cpu include/linux/cpumask.h:506 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] cpu_online include/linux/cpumask.h:1092 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] trace_lock_acquire include/trace/events/lock.h:24 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632\n[\u0026lt;ffffffff8563221e\u0026gt;] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306\n[\u0026lt;ffffffff8561464d\u0026gt;] rcu_read_lock include/linux/rcupdate.h:747 [inline]\n[\u0026lt;ffffffff8561464d\u0026gt;] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221\n[\u0026lt;ffffffff85618120\u0026gt;] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606\n[\u0026lt;ffffffff856f65b5\u0026gt;] pol_lookup_func include/net/ip6_fib.h:584 [inline]\n[\u0026lt;ffffffff856f65b5\u0026gt;] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116\n[\u0026lt;ffffffff85618009\u0026gt;] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638\n[\u0026lt;ffffffff8561821a\u0026gt;] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ip6_route_output include/net/ip6_route.h:100 [inline]\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline]\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677\n[\u0026lt;ffffffff838c2909\u0026gt;] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229\n[\u0026lt;ffffffff84d03900\u0026gt;] netdev_start_xmit include/linux/netdevice.h:4966 [inline]\n[\u0026lt;ffffffff84d03900\u0026gt;] xmit_one net/core/dev.c:3644 [inline]\n[\u0026lt;ffffffff84d03900\u0026gt;] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660\n[\u0026lt;ffffffff84d080e2\u0026gt;] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324\n[\u0026lt;ffffffff855ce4cd\u0026gt;] dev_queue_xmit include/linux/netdevice.h:3067 [inline]\n[\u0026lt;ffffffff855ce4cd\u0026gt;] neigh_hh_output include/net/neighbour.h:529 [inline]\n[\u0026lt;f\n---truncated---(CVE-2023-52796)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath11k: fix dfs radar event locking\r\n\r\nThe ath11k active pdevs are protected by RCU but the DFS radar event\nhandling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a\nread-side critical section.\r\n\r\nMark the code in question as an RCU read-side critical section to avoid\nany potential use-after-free issues.\r\n\r\nCompile tested only.(CVE-2023-52798)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\njfs: fix array-index-out-of-bounds in dbFindLeaf\r\n\r\nCurrently while searching for dmtree_t for sufficient free blocks there\nis an array out of bounds while getting element in tp-\u0026gt;dm_stree. To add\nthe required check for out of bound we first need to determine the type\nof dmtree. Thus added an extra parameter to dbFindLeaf so that the type\nof tree can be determined and the required check can be applied.(CVE-2023-52799)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath11k: fix htt pktlog locking\r\n\r\nThe ath11k active pdevs are protected by RCU but the htt pktlog handling\ncode calling ath11k_mac_get_ar_by_pdev_id() was not marked as a\nread-side critical section.\r\n\r\nMark the code in question as an RCU read-side critical section to avoid\nany potential use-after-free issues.\r\n\r\nCompile tested only.(CVE-2023-52800)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\r\n\r\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\nworkqueue,which takes care about pipefs superblock locking.\nIn some special scenarios, when kernel frees the pipefs sb of the\ncurrent client and immediately alloctes a new pipefs sb,\nrpc_remove_pipedir function would misjudge the existence of pipefs\nsb which is not the one it used to hold. As a result,\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\r\n\r\nTo fix this issue, rpc_remove_pipedir should check whether the\ncurrent pipefs sb is consistent with the original pipefs sb.\r\n\r\nThis error can be catched by KASAN:\n=========================================================\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\n[  250.500549] Workqueue: events rpc_free_client_work\n[  250.501001] Call Trace:\n[  250.502880]  kasan_report+0xb6/0xf0\n[  250.503209]  ? dget_parent+0x195/0x200\n[  250.503561]  dget_parent+0x195/0x200\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\n[  250.505195]  rpc_free_client_work+0xe4/0x230\n[  250.505598]  process_one_work+0x8ee/0x13b0\n...\n[   22.039056] Allocated by task 244:\n[   22.039390]  kasan_save_stack+0x22/0x50\n[   22.039758]  kasan_set_track+0x25/0x30\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\n[   22.040889]  __d_alloc+0x31/0x8e0\n[   22.041207]  d_alloc+0x44/0x1f0\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\n[   22.042459]  rpc_create_client_dir+0x34/0x150\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\n[   22.043284]  rpc_client_register+0x136/0x4e0\n[   22.043689]  rpc_new_client+0x911/0x1020\n[   22.044057]  rpc_create_xprt+0xcb/0x370\n[   22.044417]  rpc_create+0x36b/0x6c0\n...\n[   22.049524] Freed by task 0:\n[   22.049803]  kasan_save_stack+0x22/0x50\n[   22.050165]  kasan_set_track+0x25/0x30\n[   22.050520]  kasan_save_free_info+0x2b/0x50\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\n[   22.051306]  kmem_cache_free+0xa5/0x390\n[   22.051667]  rcu_core+0x62c/0x1930\n[   22.051995]  __do_softirq+0x165/0x52a\n[   22.052347]\n[   22.052503] Last potentially related work creation:\n[   22.052952]  kasan_save_stack+0x22/0x50\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\n[   22.054209]  dentry_free+0xb2/0x140\n[   22.054540]  __dentry_kill+0x3be/0x540\n[   22.054900]  shrink_dentry_list+0x199/0x510\n[   22.055293]  shrink_dcache_parent+0x190/0x240\n[   22.055703]  do_one_tree+0x11/0x40\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\n[   22.056461]  generic_shutdown_super+0x70/0x590\n[   22.056879]  kill_anon_super+0x3a/0x60\n[   22.057234]  rpc_kill_sb+0x121/0x200(CVE-2023-52803)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs\r\n\r\nThe hns3 driver define an array of string to show the coalesce\ninfo, but if the kernel adds a new mode or a new state,\nout-of-bounds access may occur when coalesce info is read via\ndebugfs, this patch fix the problem.(CVE-2023-52807)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nclk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data\r\n\r\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.(CVE-2023-52865)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nclk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data\r\n\r\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.(CVE-2023-52875)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxen-netfront: Add missing skb_mark_for_recycle\r\n\r\nNotice that skb_mark_for_recycle() is introduced later than fixes tag in\ncommit 6a5bcd84e886 (\u0026quot;page_pool: Allow drivers to hint on SKB recycling\u0026quot;).\r\n\r\nIt is believed that fixes tag were missing a call to page_pool_release_page()\nbetween v5.9 to v5.14, after which is should have used skb_mark_for_recycle().\nSince v6.6 the call page_pool_release_page() were removed (in\ncommit 535b9c61bdef (\u0026quot;net: page_pool: hide page_pool_release_page()\u0026quot;)\nand remaining callers converted (in commit 6bfef2ec0172 (\u0026quot;Merge branch\n\u0026apos;net-page_pool-remove-page_pool_release_page\u0026apos;\u0026quot;)).\r\n\r\nThis leak became visible in v6.8 via commit dba1b8a7ab68 (\u0026quot;mm/page_pool: catch\npage_pool memory leaks\u0026quot;).(CVE-2024-27393)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout\r\n\r\nThere is a race condition between l2cap_chan_timeout() and\nl2cap_chan_del(). When we use l2cap_chan_del() to delete the\nchannel, the chan-\u0026gt;conn will be set to null. But the conn could\nbe dereferenced again in the mutex_lock() of l2cap_chan_timeout().\nAs a result the null pointer dereference bug will happen. The\nKASAN report triggered by POC is shown below:\r\n\r\n[  472.074580] ==================================================================\n[  472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0\n[  472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7\n[  472.075308]\n[  472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36\n[  472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4\n[  472.075308] Workqueue: events l2cap_chan_timeout\n[  472.075308] Call Trace:\n[  472.075308]  \u0026lt;TASK\u0026gt;\n[  472.075308]  dump_stack_lvl+0x137/0x1a0\n[  472.075308]  print_report+0x101/0x250\n[  472.075308]  ? __virt_addr_valid+0x77/0x160\n[  472.075308]  ? mutex_lock+0x68/0xc0\n[  472.075308]  kasan_report+0x139/0x170\n[  472.075308]  ? mutex_lock+0x68/0xc0\n[  472.075308]  kasan_check_range+0x2c3/0x2e0\n[  472.075308]  mutex_lock+0x68/0xc0\n[  472.075308]  l2cap_chan_timeout+0x181/0x300\n[  472.075308]  process_one_work+0x5d2/0xe00\n[  472.075308]  worker_thread+0xe1d/0x1660\n[  472.075308]  ? pr_cont_work+0x5e0/0x5e0\n[  472.075308]  kthread+0x2b7/0x350\n[  472.075308]  ? pr_cont_work+0x5e0/0x5e0\n[  472.075308]  ? kthread_blkcg+0xd0/0xd0\n[  472.075308]  ret_from_fork+0x4d/0x80\n[  472.075308]  ? kthread_blkcg+0xd0/0xd0\n[  472.075308]  ret_from_fork_asm+0x11/0x20\n[  472.075308]  \u0026lt;/TASK\u0026gt;\n[  472.075308] ==================================================================\n[  472.094860] Disabling lock debugging due to kernel taint\n[  472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158\n[  472.096136] #PF: supervisor write access in kernel mode\n[  472.096136] #PF: error_code(0x0002) - not-present page\n[  472.096136] PGD 0 P4D 0\n[  472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI\n[  472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G    B              6.9.0-rc5-00356-g78c0094a146b #36\n[  472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4\n[  472.096136] Workqueue: events l2cap_chan_timeout\n[  472.096136] RIP: 0010:mutex_lock+0x88/0xc0\n[  472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88\n[  472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246\n[  472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865\n[  472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78\n[  472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f\n[  472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000\n[  472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00\n[  472.096136] FS:  0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000\n[  472.096136] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0\n[  472.096136] Call Trace:\n[  472.096136]  \u0026lt;TASK\u0026gt;\n[  472.096136]  ? __die_body+0x8d/0xe0\n[  472.096136]  ? page_fault_oops+0x6b8/0x9a0\n[  472.096136]  ? kernelmode_fixup_or_oops+0x20c/0x2a0\n[  472.096136]  ? do_user_addr_fault+0x1027/0x1340\n[  472.096136]  ? _printk+0x7a/0xa0\n[  472.096136]  ? mutex_lock+0x68/0xc0\n[  472.096136]  ? add_taint+0x42/0xd0\n[  472.096136]  ? exc_page_fault+0x6a/0x1b0\n[  472.096136]  ? asm_exc_page_fault+0x26/0x30\n[  472.096136]  ? mutex_lock+0x75/0xc0\n[  472.096136]  ? mutex_lock+0x88/0xc0\n[  472.096136]  ? mutex_lock+0x75/0xc0\n[  472.096136]  l2cap_chan_timeo\n---truncated---(CVE-2024-27399)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nphonet/pep: fix racy skb_queue_empty() use\r\n\r\nThe receive queues are protected by their respective spin-lock, not\nthe socket lock. This could lead to skb_peek() unexpectedly\nreturning NULL or a pointer to an already dequeued socket buffer.(CVE-2024-27402)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: bridge: confirm multicast packets before passing them up the stack\r\n\r\nconntrack nf_confirm logic cannot handle cloned skbs referencing\nthe same nf_conn entry, which will happen for multicast (broadcast)\nframes on bridges.\r\n\r\n Example:\n    macvlan0\n       |\n      br0\n     /  \\\n  ethX    ethY\r\n\r\n ethX (or Y) receives a L2 multicast or broadcast packet containing\n an IP packet, flow is not yet in conntrack table.\r\n\r\n 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting.\n    -\u0026gt; skb-\u0026gt;_nfct now references a unconfirmed entry\n 2. skb is broad/mcast packet. bridge now passes clones out on each bridge\n    interface.\n 3. skb gets passed up the stack.\n 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb\n    and schedules a work queue to send them out on the lower devices.\r\n\r\n    The clone skb-\u0026gt;_nfct is not a copy, it is the same entry as the\n    original skb.  The macvlan rx handler then returns RX_HANDLER_PASS.\n 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb.\r\n\r\nThe Macvlan broadcast worker and normal confirm path will race.\r\n\r\nThis race will not happen if step 2 already confirmed a clone. In that\ncase later steps perform skb_clone() with skb-\u0026gt;_nfct already confirmed (in\nhash table).  This works fine.\r\n\r\nBut such confirmation won\u0026apos;t happen when eb/ip/nftables rules dropped the\npackets before they reached the nf_confirm step in postrouting.\r\n\r\nPablo points out that nf_conntrack_bridge doesn\u0026apos;t allow use of stateful\nnat, so we can safely discard the nf_conn entry and let inet call\nconntrack again.\r\n\r\nThis doesn\u0026apos;t work for bridge netfilter: skb could have a nat\ntransformation. Also bridge nf prevents re-invocation of inet prerouting\nvia \u0026apos;sabotage_in\u0026apos; hook.\r\n\r\nWork around this problem by explicit confirmation of the entry at LOCAL_IN\ntime, before upper layer has a chance to clone the unconfirmed entry.\r\n\r\nThe downside is that this disables NAT and conntrack helpers.\r\n\r\nAlternative fix would be to add locking to all code parts that deal with\nunconfirmed packets, but even if that could be done in a sane way this\nopens up other problems, for example:\r\n\r\n-m physdev --physdev-out eth0 -j SNAT --snat-to 1.2.3.4\n-m physdev --physdev-out eth1 -j SNAT --snat-to 1.2.3.5\r\n\r\nFor multicast case, only one of such conflicting mappings will be\ncreated, conntrack only handles 1:1 NAT mappings.\r\n\r\nUsers should set create a setup that explicitly marks such traffic\nNOTRACK (conntrack bypass) to avoid this, but we cannot auto-bypass\nthem, ruleset might have accept rules for untracked traffic already,\nso user-visible behaviour would change.(CVE-2024-27415)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: altmodes/displayport: create sysfs nodes as driver\u0026apos;s default device attribute group\r\n\r\nThe DisplayPort driver\u0026apos;s sysfs nodes may be present to the userspace before\ntypec_altmode_set_drvdata() completes in dp_altmode_probe. This means that\na sysfs read can trigger a NULL pointer error by deferencing dp-\u0026gt;hpd in\nhpd_show or dp-\u0026gt;lock in pin_assignment_show, as dev_get_drvdata() returns\nNULL in those cases.\r\n\r\nRemove manual sysfs node creation in favor of adding attribute group as\ndefault for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is\nnot used here otherwise the path to the sysfs nodes is no longer compliant\nwith the ABI.(CVE-2024-35790)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPCI/PM: Drain runtime-idle callbacks before driver removal\r\n\r\nA race condition between the .runtime_idle() callback and the .remove()\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\nunhandled page fault [1].\r\n\r\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\nafter pm_runtime_get_sync() has been called, but the latter doesn\u0026apos;t really\nguarantee that.  It only guarantees that the suspend and resume callbacks\nwill not be running when it returns.\r\n\r\nHowever, if a .runtime_idle() callback is already running when\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\nstatus of the device is RPM_ACTIVE and it will return right away without\nwaiting for the former to complete.  In fact, it cannot wait for\n.runtime_idle() to complete because it may be called from that callback (it\narguably does not make much sense to do that, but it is not strictly\nprohibited).\r\n\r\nThus in general, whoever is providing a .runtime_idle() callback needs\nto protect it from running in parallel with whatever code runs after\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\npm_runtime_get_sync() has returned, but it may continue running then if it\nhas started earlier.]\r\n\r\nOne way to address that race condition is to call pm_runtime_barrier()\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\nbeing invoked) to wait for the .runtime_idle() callback to complete should\nit be running at that point.  A suitable place for doing that is in\npci_device_remove() which calls pm_runtime_get_sync() before removing the\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\nwill prevent the race in question from occurring, not just in the rtsx_pcr\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.(CVE-2024-35809)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix memory leak during rehash\r\n\r\nThe rehash delayed work migrates filters from one region to another.\nThis is done by iterating over all chunks (all the filters with the same\npriority) in the region and in each chunk iterating over all the\nfilters.\r\n\r\nIf the migration fails, the code tries to migrate the filters back to\nthe old region. However, the rollback itself can also fail in which case\nanother migration will be erroneously performed. Besides the fact that\nthis ping pong is not a very good idea, it also creates a problem.\r\n\r\nEach virtual chunk references two chunks: The currently used one\n(\u0026apos;vchunk-\u0026gt;chunk\u0026apos;) and a backup (\u0026apos;vchunk-\u0026gt;chunk2\u0026apos;). During migration the\nfirst holds the chunk we want to migrate filters to and the second holds\nthe chunk we are migrating filters from.\r\n\r\nThe code currently assumes - but does not verify - that the backup chunk\ndoes not exist (NULL) if the currently used chunk does not reference the\ntarget region. This assumption breaks when we are trying to rollback a\nrollback, resulting in the backup chunk being overwritten and leaked\n[1].\r\n\r\nFix by not rolling back a failed rollback and add a warning to avoid\nfuture cases.\r\n\r\n[1]\nWARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20\nModules linked in:\nCPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:parman_destroy+0x17/0x20\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlxsw_sp_acl_atcam_region_fini+0x19/0x60\n mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;(CVE-2024-35853)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\r\n\r\nThe rehash delayed work migrates filters from one region to another\naccording to the number of available credits.\r\n\r\nThe migrated from region is destroyed at the end of the work if the\nnumber of credits is non-negative as the assumption is that this is\nindicative of migration being complete. This assumption is incorrect as\na non-negative number of credits can also be the result of a failed\nmigration.\r\n\r\nThe destruction of a region that still has filters referencing it can\nresult in a use-after-free [1].\r\n\r\nFix by not destroying the region if migration failed.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\r\n\r\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 174:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\r\n\r\nFreed by task 7:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30(CVE-2024-35854)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update\r\n\r\nThe rule activity update delayed work periodically traverses the list of\nconfigured rules and queries their activity from the device.\r\n\r\nAs part of this task it accesses the entry pointed by \u0026apos;ventry-\u0026gt;entry\u0026apos;,\nbut this entry can be changed concurrently by the rehash delayed work,\nleading to a use-after-free [1].\r\n\r\nFix by closing the race and perform the activity query under the\n\u0026apos;vregion-\u0026gt;lock\u0026apos; mutex.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\nRead of size 8 at addr ffff8881054ed808 by task kworker/0:18/181\r\n\r\nCPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\n mlxsw_sp_acl_rule_activity_update_work+0x219/0x400\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\r\n\r\nFreed by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30(CVE-2024-35855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: Fix infinite recursion in fib6_dump_done().\r\n\r\nsyzkaller reported infinite recursive calls of fib6_dump_done() during\nnetlink socket destruction.  [1]\r\n\r\nFrom the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then\nthe response was generated.  The following recvmmsg() resumed the dump\nfor IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due\nto the fault injection.  [0]\r\n\r\n  12:01:34 executing program 3:\n  r0 = socket$nl_route(0x10, 0x3, 0x0)\n  sendmsg$nl_route(r0, ... snip ...)\n  recvmmsg(r0, ... snip ...) (fail_nth: 8)\r\n\r\nHere, fib6_dump_done() was set to nlk_sk(sk)-\u0026gt;cb.done, and the next call\nof inet6_dump_fib() set it to nlk_sk(sk)-\u0026gt;cb.args[3].  syzkaller stopped\nreceiving the response halfway through, and finally netlink_sock_destruct()\ncalled nlk_sk(sk)-\u0026gt;cb.done().\r\n\r\nfib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)-\u0026gt;cb.done() if it\nis still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)-\u0026gt;cb.done() by\nnlk_sk(sk)-\u0026gt;cb.args[3], but it has the same function, not NULL, calling\nitself recursively and hitting the stack guard page.\r\n\r\nTo avoid the issue, let\u0026apos;s set the destructor after kzalloc().\r\n\r\n[0]:\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 0\nCPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl (lib/dump_stack.c:117)\n should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153)\n should_failslab (mm/slub.c:3733)\n kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992)\n inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662)\n rtnl_dump_all (net/core/rtnetlink.c:4029)\n netlink_dump (net/netlink/af_netlink.c:2269)\n netlink_recvmsg (net/netlink/af_netlink.c:1988)\n ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801)\n ___sys_recvmsg (net/socket.c:2846)\n do_recvmmsg (net/socket.c:2943)\n __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)\r\n\r\n[1]:\nBUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb)\nstack guard page: 0000 [#1] PREEMPT SMP KASAN\nCPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nWorkqueue: events netlink_sock_destruct_work\nRIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570)\nCode: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd \u0026lt;53\u0026gt; 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d980000 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3\nRDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358\nRBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000\nR13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68\nFS:  0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;#DF\u0026gt;\n \u0026lt;/#DF\u0026gt;\n \u0026lt;TASK\u0026gt;\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n ...\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n netlink_sock_destruct (net/netlink/af_netlink.c:401)\n __sk_destruct (net/core/sock.c:2177 (discriminator 2))\n sk_destruct (net/core/sock.c:2224)\n __sk_free (net/core/sock.c:2235)\n sk_free (net/core/sock.c:2246)\n process_one_work (kernel/workqueue.c:3259)\n worker_thread (kernel/workqueue.c:3329 kernel/workqueue.\n---truncated---(CVE-2024-35886)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nerspan: make sure erspan_base_hdr is present in skb-\u0026gt;head\r\n\r\nsyzbot reported a problem in ip6erspan_rcv() [1]\r\n\r\nIssue is that ip6erspan_rcv() (and erspan_rcv()) no longer make\nsure erspan_base_hdr is present in skb linear part (skb-\u0026gt;head)\nbefore getting @ver field from it.\r\n\r\nAdd the missing pskb_may_pull() calls.\r\n\r\nv2: Reload iph pointer in erspan_rcv() after pskb_may_pull()\n    because skb-\u0026gt;head might have changed.\r\n\r\n[1]\r\n\r\n BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline]\n BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n  pskb_may_pull include/linux/skbuff.h:2756 [inline]\n  ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n  gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:460 [inline]\n  ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5538 [inline]\n  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652\n  netif_receive_skb_internal net/core/dev.c:5738 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5798\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549\n  tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  tun_alloc_skb drivers/net/tun.c:1525 [inline]\n  tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nCPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0(CVE-2024-35888)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf, sockmap: Prevent lock inversion deadlock in map delete elem\r\n\r\nsyzkaller started using corpuses where a BPF tracing program deletes\nelements from a sockmap/sockhash map. Because BPF tracing programs can be\ninvoked from any interrupt context, locks taken during a map_delete_elem\noperation must be hardirq-safe. Otherwise a deadlock due to lock inversion\nis possible, as reported by lockdep:\r\n\r\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;htab-\u0026gt;buckets[i].lock);\n                               local_irq_disable();\n                               lock(\u0026amp;host-\u0026gt;lock);\n                               lock(\u0026amp;htab-\u0026gt;buckets[i].lock);\n  \u0026lt;Interrupt\u0026gt;\n    lock(\u0026amp;host-\u0026gt;lock);\r\n\r\nLocks in sockmap are hardirq-unsafe by design. We expects elements to be\ndeleted from sockmap/sockhash only in task (normal) context with interrupts\nenabled, or in softirq context.\r\n\r\nDetect when map_delete_elem operation is invoked from a context which is\n_not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an\nerror.\r\n\r\nNote that map updates are not affected by this issue. BPF verifier does not\nallow updating sockmap/sockhash from a BPF tracing program today.(CVE-2024-35895)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: validate user input for expected length\r\n\r\nI got multiple syzbot reports showing old bugs exposed\nby BPF after commit 20f2505fb436 (\u0026quot;bpf: Try to avoid kzalloc\nin cgroup/{s,g}etsockopt\u0026quot;)\r\n\r\nsetsockopt() @optlen argument should be taken into account\nbefore copying data.\r\n\r\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\nRead of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238\r\n\r\nCPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n  __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n  do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\n  nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\nRIP: 0033:0x7fd22067dde9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9\nRDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 7238:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:4069 [inline]\n  __kmalloc_noprof+0x200/0x410 mm/slub.c:4082\n  kmalloc_noprof include/linux/slab.h:664 [inline]\n  __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\r\n\r\nThe buggy address belongs to the object at ffff88802cd73da0\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes inside of\n allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1)\r\n\r\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73\nflags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)\npage_type: 0xffffefff(slab)\nraw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122\nraw: ffff88802cd73020 000000008080007f 00000001ffffefff 00\n---truncated---(CVE-2024-35896)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Protect against int overflow for stack access size\r\n\r\nThis patch re-introduces protection against the size of access to stack\nmemory being negative; the access size can appear negative as a result\nof overflowing its signed int representation. This should not actually\nhappen, as there are other protections along the way, but we should\nprotect against it anyway. One code path was missing such protections\n(fixed in the previous patch in the series), causing out-of-bounds array\naccesses in check_stack_range_initialized(). This patch causes the\nverification of a program with such a non-sensical access size to fail.\r\n\r\nThis check used to exist in a more indirect way, but was inadvertendly\nremoved in a833a17aeac7.(CVE-2024-35905)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\r\n\r\nsyzbot reported the following uninit-value access issue [1][2]:\r\n\r\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\r\n\r\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes.(CVE-2024-35915)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: ucsi: Limit read size on v1.2\r\n\r\nBetween UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was\nincreased from 16 to 256. In order to avoid overflowing reads for older\nsystems, add a mechanism to use the read UCSI version to truncate read\nsizes on UCSI v1.2.(CVE-2024-35924)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblock: prevent division by zero in blk_rq_stat_sum()\r\n\r\nThe expression dst-\u0026gt;nr_samples + src-\u0026gt;nr_samples may\nhave zero value on overflow. It is necessary to add\na check to avoid division by zero.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with Svace.(CVE-2024-35925)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: SCO: Fix not validating setsockopt user input\r\n\r\nsyzbot reported sco_sock_setsockopt() is copying data without\nchecking user input length.\r\n\r\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\nnet/bluetooth/sco.c:893\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578(CVE-2024-35967)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngeneve: fix header validation in geneve[6]_xmit_skb\r\n\r\nsyzbot is able to trigger an uninit-value in geneve_xmit() [1]\r\n\r\nProblem : While most ip tunnel helpers (like ip_tunnel_get_dsfield())\nuses skb_protocol(skb, true), pskb_inet_may_pull() is only using\nskb-\u0026gt;protocol.\r\n\r\nIf anything else than ETH_P_IPV6 or ETH_P_IP is found in skb-\u0026gt;protocol,\npskb_inet_may_pull() does nothing at all.\r\n\r\nIf a vlan tag was provided by the caller (af_packet in the syzbot case),\nthe network header might not point to the correct location, and skb\nlinear part could be smaller than expected.\r\n\r\nAdd skb_vlan_inet_prepare() to perform a complete mac validation.\r\n\r\nUse this in geneve for the moment, I suspect we need to adopt this\nmore broadly.\r\n\r\nv4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest\n   - Only call __vlan_get_protocol() for vlan types.\r\n\r\nv2,v3 - Addressed Sabrina comments on v1 and v2\r\n\r\n[1]\r\n\r\nBUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n  geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n  geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n  __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n  netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n  xmit_one net/core/dev.c:3531 [inline]\n  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547\n  __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335\n  dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3081 [inline]\n  packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n  packet_snd net/packet/af_packet.c:3024 [inline]\n  packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nCPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024(CVE-2024-35973)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv4: check for NULL idev in ip_route_use_hint()\r\n\r\nsyzbot was able to trigger a NULL deref in fib_validate_source()\nin an old tree [1].\r\n\r\nIt appears the bug exists in latest trees.\r\n\r\nAll calls to __in_dev_get_rcu() must be checked for a NULL result.\r\n\r\n[1]\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 2 PID: 3257 Comm: syz-executor.3 Not tainted 5.10.0-syzkaller #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:fib_validate_source+0xbf/0x15a0 net/ipv4/fib_frontend.c:425\nCode: 18 f2 f2 f2 f2 42 c7 44 20 23 f3 f3 f3 f3 48 89 44 24 78 42 c6 44 20 27 f3 e8 5d 88 48 fc 4c 89 e8 48 c1 e8 03 48 89 44 24 18 \u0026lt;42\u0026gt; 80 3c 20 00 74 08 4c 89 ef e8 d2 15 98 fc 48 89 5c 24 10 41 bf\nRSP: 0018:ffffc900015fee40 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff88800f7a4000 RCX: ffff88800f4f90c0\nRDX: 0000000000000000 RSI: 0000000004001eac RDI: ffff8880160c64c0\nRBP: ffffc900015ff060 R08: 0000000000000000 R09: ffff88800f7a4000\nR10: 0000000000000002 R11: ffff88800f4f90c0 R12: dffffc0000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: ffff88800f7a4000\nFS:  00007f938acfe6c0(0000) GS:ffff888058c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f938acddd58 CR3: 000000001248e000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n  ip_route_use_hint+0x410/0x9b0 net/ipv4/route.c:2231\n  ip_rcv_finish_core+0x2c4/0x1a30 net/ipv4/ip_input.c:327\n  ip_list_rcv_finish net/ipv4/ip_input.c:612 [inline]\n  ip_sublist_rcv+0x3ed/0xe50 net/ipv4/ip_input.c:638\n  ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:673\n  __netif_receive_skb_list_ptype net/core/dev.c:5572 [inline]\n  __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5620\n  __netif_receive_skb_list net/core/dev.c:5672 [inline]\n  netif_receive_skb_list_internal+0x9f9/0xdc0 net/core/dev.c:5764\n  netif_receive_skb_list+0x55/0x3e0 net/core/dev.c:5816\n  xdp_recv_frames net/bpf/test_run.c:257 [inline]\n  xdp_test_run_batch net/bpf/test_run.c:335 [inline]\n  bpf_test_run_xdp_live+0x1818/0x1d00 net/bpf/test_run.c:363\n  bpf_prog_test_run_xdp+0x81f/0x1170 net/bpf/test_run.c:1376\n  bpf_prog_test_run+0x349/0x3c0 kernel/bpf/syscall.c:3736\n  __sys_bpf+0x45c/0x710 kernel/bpf/syscall.c:5115\n  __do_sys_bpf kernel/bpf/syscall.c:5201 [inline]\n  __se_sys_bpf kernel/bpf/syscall.c:5199 [inline]\n  __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5199(CVE-2024-36008)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nrtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation\r\n\r\nEach attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a\nstruct ifla_vf_vlan_info so the size of such attribute needs to be at least\nof sizeof(struct ifla_vf_vlan_info) which is 14 bytes.\nThe current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)\nwhich is less than sizeof(struct ifla_vf_vlan_info) so this validation\nis not enough and a too small attribute might be cast to a\nstruct ifla_vf_vlan_info, this might result in an out of bands\nread access when accessing the saved (casted) entry in ivvl.(CVE-2024-36017)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hns3: fix kernel crash when devlink reload during pf initialization\r\n\r\nThe devlink reload process will access the hardware resources,\nbut the register operation is done before the hardware is initialized.\nSo, processing the devlink reload during initialization may lead to kernel\ncrash. This patch fixes this by taking devl_lock during initialization.(CVE-2024-36021)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmmc: sdhci-msm: pervent access to suspended controller\r\n\r\nGeneric sdhci code registers LED device and uses host-\u0026gt;runtime_suspended\nflag to protect access to it. The sdhci-msm driver doesn\u0026apos;t set this flag,\nwhich causes a crash when LED is accessed while controller is runtime\nsuspended. Fix this by setting the flag correctly.(CVE-2024-36029)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: fix out-of-bounds access in ops_init\r\n\r\nnet_alloc_generic is called by net_alloc, which is called without any\nlocking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It\nis read twice, first to allocate an array, then to set s.len, which is\nlater used to limit the bounds of the array access.\r\n\r\nIt is possible that the array is allocated and another thread is\nregistering a new pernet ops, increments max_gen_ptrs, which is then used\nto set s.len with a larger than allocated length for the variable array.\r\n\r\nFix it by reading max_gen_ptrs only once in net_alloc_generic. If\nmax_gen_ptrs is later incremented, it will be caught in net_assign_generic.(CVE-2024-36883)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: fix UAF in error path\r\n\r\nSam Page (sam4k) working with Trend Micro Zero Day Initiative reported\na UAF in the tipc_buf_append() error path:\r\n\r\nBUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0\nlinux/net/core/skbuff.c:1183\nRead of size 8 at addr ffff88804d2a7c80 by task poc/8034\r\n\r\nCPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.0-debian-1.16.0-5 04/01/2014\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n __dump_stack linux/lib/dump_stack.c:88\n dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106\n print_address_description linux/mm/kasan/report.c:377\n print_report+0xc4/0x620 linux/mm/kasan/report.c:488\n kasan_report+0xda/0x110 linux/mm/kasan/report.c:601\n kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183\n skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026\n skb_release_all linux/net/core/skbuff.c:1094\n __kfree_skb linux/net/core/skbuff.c:1108\n kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144\n kfree_skb linux/./include/linux/skbuff.h:1244\n tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186\n tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324\n tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824\n tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159\n tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390\n udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108\n udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186\n udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346\n __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422\n ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254\n dst_input linux/./include/net/dst.h:461\n ip_rcv_finish linux/net/ipv4/ip_input.c:449\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534\n __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648\n process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976\n __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576\n napi_poll linux/net/core/dev.c:6645\n net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781\n __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553\n do_softirq linux/kernel/softirq.c:454\n do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381\n local_bh_enable linux/./include/linux/bottom_half.h:33\n rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851\n __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378\n dev_queue_xmit linux/./include/linux/netdevice.h:3169\n neigh_hh_output linux/./include/net/neighbour.h:526\n neigh_output linux/./include/net/neighbour.h:540\n ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235\n __ip_finish_output linux/net/ipv4/ip_output.c:313\n __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323\n NF_HOOK_COND linux/./include/linux/netfilter.h:303\n ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433\n dst_output linux/./include/net/dst.h:451\n ip_local_out linux/net/ipv4/ip_output.c:129\n ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492\n udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963\n udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250\n inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850\n sock_sendmsg_nosec linux/net/socket.c:730\n __sock_sendmsg linux/net/socket.c:745\n __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191\n __do_sys_sendto linux/net/socket.c:2203\n __se_sys_sendto linux/net/socket.c:2199\n __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199\n do_syscall_x64 linux/arch/x86/entry/common.c:52\n do_syscall_\n---truncated---(CVE-2024-36886)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: ensure snd_nxt is properly initialized on connect\r\n\r\nChristoph reported a splat hinting at a corrupted snd_una:\r\n\r\n  WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Modules linked in:\n  CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\n  Workqueue: events mptcp_worker\n  RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8\n  \t8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe\n  \t\u0026lt;0f\u0026gt; 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9\n  RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293\n  RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4\n  RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001\n  RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n  R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000\n  R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000\n  FS:  0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline]\n   mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline]\n   __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615\n   mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767\n   process_one_work+0x1e0/0x560 kernel/workqueue.c:3254\n   process_scheduled_works kernel/workqueue.c:3335 [inline]\n   worker_thread+0x3c7/0x640 kernel/workqueue.c:3416\n   kthread+0x121/0x170 kernel/kthread.c:388\n   ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243\n   \u0026lt;/TASK\u0026gt;\r\n\r\nWhen fallback to TCP happens early on a client socket, snd_nxt\nis not yet initialized and any incoming ack will copy such value\ninto snd_una. If the mptcp worker (dumbly) tries mptcp-level\nre-injection after such ack, that would unconditionally trigger a send\nbuffer cleanup using \u0026apos;bad\u0026apos; snd_una values.\r\n\r\nWe could easily disable re-injection for fallback sockets, but such\ndumb behavior already helped catching a few subtle issues and a very\nlow to zero impact in practice.\r\n\r\nInstead address the issue always initializing snd_nxt (and write_seq,\nfor consistency) at connect time.(CVE-2024-36889)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: fix uninitialised kfifo\r\n\r\nIf a line is requested with debounce, and that results in debouncing\nin software, and the line is subsequently reconfigured to enable edge\ndetection then the allocation of the kfifo to contain edge events is\noverlooked.  This results in events being written to and read from an\nuninitialised kfifo.  Read events are returned to userspace.\r\n\r\nInitialise the kfifo in the case where the software debounce is\nalready active.(CVE-2024-36898)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: Fix use after free in lineinfo_changed_notify\r\n\r\nThe use-after-free issue occurs as follows: when the GPIO chip device file\nis being closed by invoking gpio_chrdev_release(), watched_lines is freed\nby bitmap_free(), but the unregistration of lineinfo_changed_nb notifier\nchain failed due to waiting write rwsem. Additionally, one of the GPIO\nchip\u0026apos;s lines is also in the release process and holds the notifier chain\u0026apos;s\nread rwsem. Consequently, a race condition leads to the use-after-free of\nwatched_lines.\r\n\r\nHere is the typical stack when issue happened:\r\n\r\n[free]\ngpio_chrdev_release()\n  --\u0026gt; bitmap_free(cdev-\u0026gt;watched_lines)                  \u0026lt;-- freed\n  --\u0026gt; blocking_notifier_chain_unregister()\n    --\u0026gt; down_write(\u0026amp;nh-\u0026gt;rwsem)                          \u0026lt;-- waiting rwsem\n          --\u0026gt; __down_write_common()\n            --\u0026gt; rwsem_down_write_slowpath()\n                  --\u0026gt; schedule_preempt_disabled()\n                    --\u0026gt; schedule()\r\n\r\n[use]\nst54spi_gpio_dev_release()\n  --\u0026gt; gpio_free()\n    --\u0026gt; gpiod_free()\n      --\u0026gt; gpiod_free_commit()\n        --\u0026gt; gpiod_line_state_notify()\n          --\u0026gt; blocking_notifier_call_chain()\n            --\u0026gt; down_read(\u0026amp;nh-\u0026gt;rwsem);                  \u0026lt;-- held rwsem\n            --\u0026gt; notifier_call_chain()\n              --\u0026gt; lineinfo_changed_notify()\n                --\u0026gt; test_bit(xxxx, cdev-\u0026gt;watched_lines) \u0026lt;-- use after free\r\n\r\nThe side effect of the use-after-free issue is that a GPIO line event is\nbeing generated for userspace where it shouldn\u0026apos;t. However, since the chrdev\nis being closed, userspace won\u0026apos;t have the chance to read that event anyway.\r\n\r\nTo fix the issue, call the bitmap_free() function after the unregistration\nof lineinfo_changed_nb notifier chain.(CVE-2024-36899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: prevent NULL dereference in ip6_output()\r\n\r\nAccording to syzbot, there is a chance that ip6_dst_idev()\nreturns NULL in ip6_output(). Most places in IPv6 stack\ndeal with a NULL idev just fine, but not here.\r\n\r\nsyzbot reported:\r\n\r\ngeneral protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 9775 Comm: syz-executor.4 Not tainted 6.9.0-rc5-syzkaller-00157-g6a30653b604a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:ip6_output+0x231/0x3f0 net/ipv6/ip6_output.c:237\nCode: 3c 1e 00 49 89 df 74 08 4c 89 ef e8 19 58 db f7 48 8b 44 24 20 49 89 45 00 49 89 c5 48 8d 9d e0 05 00 00 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 38 84 c0 4c 8b 74 24 28 0f 85 61 01 00 00 8b 1b 31 ff\nRSP: 0018:ffffc9000927f0d8 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000040000\nRDX: ffffc900131f9000 RSI: 0000000000004f47 RDI: 0000000000004f48\nRBP: 0000000000000000 R08: ffffffff8a1f0b9a R09: 1ffffffff1f51fad\nR10: dffffc0000000000 R11: fffffbfff1f51fae R12: ffff8880293ec8c0\nR13: ffff88805d7fc000 R14: 1ffff1100527d91a R15: dffffc0000000000\nFS:  00007f135c6856c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000080 CR3: 0000000064096000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_xmit+0xefe/0x17f0 net/ipv6/ip6_output.c:358\n  sctp_v6_xmit+0x9f2/0x13f0 net/sctp/ipv6.c:248\n  sctp_packet_transmit+0x26ad/0x2ca0 net/sctp/output.c:653\n  sctp_packet_singleton+0x22c/0x320 net/sctp/outqueue.c:783\n  sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]\n  sctp_outq_flush+0x6d5/0x3e20 net/sctp/outqueue.c:1212\n  sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]\n  sctp_do_sm+0x59cc/0x60c0 net/sctp/sm_sideeffect.c:1169\n  sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73\n  __sctp_connect+0x9cd/0xe30 net/sctp/socket.c:1234\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-36901)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()\r\n\r\nsyzbot is able to trigger the following crash [1],\ncaused by unsafe ip6_dst_idev() use.\r\n\r\nIndeed ip6_dst_idev() can return NULL, and must always be checked.\r\n\r\n[1]\r\n\r\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]\n RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267\nCode: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c\nRSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700\nRDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760\nRBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd\nR10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000\nR13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00\nFS:  00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317\n  fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108\n  ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]\n  ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649\n  ip6_route_output include/net/ip6_route.h:93 [inline]\n  ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120\n  ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250\n  sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326\n  sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455\n  sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662\n  sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099\n  __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-36902)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets\r\n\r\nTCP_SYN_RECV state is really special, it is only used by\ncross-syn connections, mostly used by fuzzers.\r\n\r\nIn the following crash [1], syzbot managed to trigger a divide\nby zero in tcp_rcv_space_adjust()\r\n\r\nA socket makes the following state transitions,\nwithout ever calling tcp_init_transfer(),\nmeaning tcp_init_buffer_space() is also not called.\r\n\r\n         TCP_CLOSE\nconnect()\n         TCP_SYN_SENT\n         TCP_SYN_RECV\nshutdown() -\u0026gt; tcp_shutdown(sk, SEND_SHUTDOWN)\n         TCP_FIN_WAIT1\r\n\r\nTo fix this issue, change tcp_shutdown() to not\nperform a TCP_SYN_RECV -\u0026gt; TCP_FIN_WAIT1 transition,\nwhich makes no sense anyway.\r\n\r\nWhen tcp_rcv_state_process() later changes socket state\nfrom TCP_SYN_RECV to TCP_ESTABLISH, then look at\nsk-\u0026gt;sk_shutdown to finally enter TCP_FIN_WAIT1 state,\nand send a FIN packet from a sane socket state.\r\n\r\nThis means tcp_send_fin() can now be called from BH\ncontext, and must use GFP_ATOMIC allocations.\r\n\r\n[1]\ndivide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 1 PID: 5084 Comm: syz-executor358 Not tainted 6.9.0-rc6-syzkaller-00022-g98369dccd2f8 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:tcp_rcv_space_adjust+0x2df/0x890 net/ipv4/tcp_input.c:767\nCode: e3 04 4c 01 eb 48 8b 44 24 38 0f b6 04 10 84 c0 49 89 d5 0f 85 a5 03 00 00 41 8b 8e c8 09 00 00 89 e8 29 c8 48 0f af c3 31 d2 \u0026lt;48\u0026gt; f7 f1 48 8d 1c 43 49 8d 96 76 08 00 00 48 89 d0 48 c1 e8 03 48\nRSP: 0018:ffffc900031ef3f0 EFLAGS: 00010246\nRAX: 0c677a10441f8f42 RBX: 000000004fb95e7e RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000027d4b11f R08: ffffffff89e535a4 R09: 1ffffffff25e6ab7\nR10: dffffc0000000000 R11: ffffffff8135e920 R12: ffff88802a9f8d30\nR13: dffffc0000000000 R14: ffff88802a9f8d00 R15: 1ffff1100553f2da\nFS:  00005555775c0380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1155bf2304 CR3: 000000002b9f2000 CR4: 0000000000350ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  tcp_recvmsg_locked+0x106d/0x25a0 net/ipv4/tcp.c:2513\n  tcp_recvmsg+0x25d/0x920 net/ipv4/tcp.c:2578\n  inet6_recvmsg+0x16a/0x730 net/ipv6/af_inet6.c:680\n  sock_recvmsg_nosec net/socket.c:1046 [inline]\n  sock_recvmsg+0x109/0x280 net/socket.c:1068\n  ____sys_recvmsg+0x1db/0x470 net/socket.c:2803\n  ___sys_recvmsg net/socket.c:2845 [inline]\n  do_recvmmsg+0x474/0xae0 net/socket.c:2939\n  __sys_recvmmsg net/socket.c:3018 [inline]\n  __do_sys_recvmmsg net/socket.c:3041 [inline]\n  __se_sys_recvmmsg net/socket.c:3034 [inline]\n  __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3034\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7faeb6363db9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffcc1997168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faeb6363db9\nRDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000005\nRBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000001c\nR10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001(CVE-2024-36905)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nARM: 9381/1: kasan: clear stale stack poison\r\n\r\nWe found below OOB crash:\r\n\r\n[   33.452494] ==================================================================\n[   33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec\n[   33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0\n[   33.455515]\n[   33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O       6.1.25-mainline #1\n[   33.456880] Hardware name: Generic DT based system\n[   33.457555]  unwind_backtrace from show_stack+0x18/0x1c\n[   33.458326]  show_stack from dump_stack_lvl+0x40/0x4c\n[   33.459072]  dump_stack_lvl from print_report+0x158/0x4a4\n[   33.459863]  print_report from kasan_report+0x9c/0x148\n[   33.460616]  kasan_report from kasan_check_range+0x94/0x1a0\n[   33.461424]  kasan_check_range from memset+0x20/0x3c\n[   33.462157]  memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec\n[   33.463064]  refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c\n[   33.464181]  tick_nohz_idle_stop_tick from do_idle+0x264/0x354\n[   33.465029]  do_idle from cpu_startup_entry+0x20/0x24\n[   33.465769]  cpu_startup_entry from rest_init+0xf0/0xf4\n[   33.466528]  rest_init from arch_post_acpi_subsys_init+0x0/0x18\n[   33.467397]\n[   33.467644] The buggy address belongs to stack of task swapper/0/0\n[   33.468493]  and is located at offset 112 in frame:\n[   33.469172]  refresh_cpu_vm_stats.constprop.0+0x0/0x2ec\n[   33.469917]\n[   33.470165] This frame has 2 objects:\n[   33.470696]  [32, 76) \u0026apos;global_zone_diff\u0026apos;\n[   33.470729]  [112, 276) \u0026apos;global_node_diff\u0026apos;\n[   33.471294]\n[   33.472095] The buggy address belongs to the physical page:\n[   33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03\n[   33.473944] flags: 0x1000(reserved|zone=0)\n[   33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001\n[   33.475656] raw: 00000000\n[   33.476050] page dumped because: kasan: bad access detected\n[   33.476816]\n[   33.477061] Memory state around the buggy address:\n[   33.477732]  c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   33.478630]  c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00\n[   33.479526] \u0026gt;c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1\n[   33.480415]                                                ^\n[   33.481195]  c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3\n[   33.482088]  c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n[   33.482978] ==================================================================\r\n\r\nWe find the root cause of this OOB is that arm does not clear stale stack\npoison in the case of cpuidle.\r\n\r\nThis patch refer to arch/arm64/kernel/sleep.S to resolve this issue.\r\n\r\nFrom cited commit [1] that explain the problem\r\n\r\nFunctions which the compiler has instrumented for KASAN place poison on\nthe stack shadow upon entry and remove this poison prior to returning.\r\n\r\nIn the case of cpuidle, CPUs exit the kernel a number of levels deep in\nC code.  Any instrumented functions on this critical path will leave\nportions of the stack shadow poisoned.\r\n\r\nIf CPUs lose context and return to the kernel via a cold path, we\nrestore a prior context saved in __cpu_suspend_enter are forgotten, and\nwe never remove the poison they placed in the stack shadow area by\nfunctions calls between this and the actual exit of the kernel.\r\n\r\nThus, (depending on stackframe layout) subsequent calls to instrumented\nfunctions may hit this stale poison, resulting in (spurious) KASAN\nsplats to the console.\r\n\r\nTo avoid this, clear any stale poison from the idle thread for a CPU\nprior to bringing a CPU online.\r\n\r\nFrom cited commit [2]\r\n\r\nExtend to check for CONFIG_KASAN_STACK\r\n\r\n[1] commit 0d97e6d8024c (\u0026quot;arm64: kasan: clear stale stack poison\u0026quot;)\n[2] commit d56a9ef84bd0 (\u0026quot;kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK\u0026quot;)(CVE-2024-36906)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblk-iocost: do not WARN if iocg was already offlined\r\n\r\nIn iocg_pay_debt(), warn is triggered if \u0026apos;active_list\u0026apos; is empty, which\nis intended to confirm iocg is active when it has debt. However, warn\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\nis run at that time:\r\n\r\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\n  Call trace:\n  iocg_pay_debt+0x14c/0x190\n  iocg_kick_waitq+0x438/0x4c0\n  iocg_waitq_timer_fn+0xd8/0x130\n  __run_hrtimer+0x144/0x45c\n  __hrtimer_run_queues+0x16c/0x244\n  hrtimer_interrupt+0x2cc/0x7b0\r\n\r\nThe warn in this situation is meaningless. Since this iocg is being\nremoved, the state of the \u0026apos;active_list\u0026apos; is irrelevant, and \u0026apos;waitq_timer\u0026apos;\nis canceled after removing \u0026apos;active_list\u0026apos; in ioc_pd_free(), which ensures\niocg is freed after iocg_waitq_timer_fn() returns.\r\n\r\nTherefore, add the check if iocg was already offlined to avoid warn\nwhen removing a blkcg or disk.(CVE-2024-36908)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()\r\n\r\nlpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the\nhbalock.  Thus, lpfc_worker_wake_up() should not be called while holding the\nhbalock to avoid potential deadlock.(CVE-2024-36924)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: core: reject skb_copy(_expand) for fraglist GSO skbs\r\n\r\nSKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become\ninvalid. Return NULL if such an skb is passed to skb_copy or\nskb_copy_expand, in order to prevent a crash on a potential later\ncall to skb_gso_segment.(CVE-2024-36929)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\namd/amdkfd: sync all devices to wait all processes being evicted\r\n\r\nIf there are more than one device doing reset in parallel, the first\ndevice will call kfd_suspend_all_processes() to evict all processes\non all devices, this call takes time to finish. other device will\nstart reset and recover without waiting. if the process has not been\nevicted before doing recover, it will be restored, then caused page\nfault.(CVE-2024-36949)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocteontx2-af: avoid off-by-one read from userspace\r\n\r\nWe try to access count + 1 byte from userspace with memdup_user(buffer,\ncount + 1). However, the userspace only provides buffer of count bytes and\nonly these count bytes are verified to be okay to access. To ensure the\ncopied buffer is NUL terminated, we use memdup_user_nul instead.(CVE-2024-36957)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/9p: only translate RWX permissions for plain 9P2000\r\n\r\nGarbage in plain 9P2000\u0026apos;s perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u.(CVE-2024-36964)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:18:28.24858487Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1707","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/mlx5e: Fix use-after-free of encap entry in neigh update handler\r\n\r\nFunction mlx5e_rep_neigh_update() wasn\u0026apos;t updated to accommodate rtnl lock\nremoval from TC filter update path and properly handle concurrent encap\nentry insertion/deletion which can lead to following use-after-free:\r\n\r\n [23827.464923] ==================================================================\n [23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635\n [23827.472251]\n [23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5\n [23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n [23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]\n [23827.476731] Call Trace:\n [23827.477260]  dump_stack+0xbb/0x107\n [23827.477906]  print_address_description.constprop.0+0x18/0x140\n [23827.478896]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.479879]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.480905]  kasan_report.cold+0x7c/0xd8\n [23827.481701]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.482744]  kasan_check_range+0x145/0x1a0\n [23827.493112]  mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.494054]  ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core]\n [23827.495296]  mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core]\n [23827.496338]  ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core]\n [23827.497486]  ? read_word_at_a_time+0xe/0x20\n [23827.498250]  ? strscpy+0xa0/0x2a0\n [23827.498889]  process_one_work+0x8ac/0x14e0\n [23827.499638]  ? lockdep_hardirqs_on_prepare+0x400/0x400\n [23827.500537]  ? pwq_dec_nr_in_flight+0x2c0/0x2c0\n [23827.501359]  ? rwlock_bug.part.0+0x90/0x90\n [23827.502116]  worker_thread+0x53b/0x1220\n [23827.502831]  ? process_one_work+0x14e0/0x14e0\n [23827.503627]  kthread+0x328/0x3f0\n [23827.504254]  ? _raw_spin_unlock_irq+0x24/0x40\n [23827.505065]  ? __kthread_bind_mask+0x90/0x90\n [23827.505912]  ret_from_fork+0x1f/0x30\n [23827.506621]\n [23827.506987] Allocated by task 28248:\n [23827.507694]  kasan_save_stack+0x1b/0x40\n [23827.508476]  __kasan_kmalloc+0x7c/0x90\n [23827.509197]  mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core]\n [23827.510194]  mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core]\n [23827.511218]  __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core]\n [23827.512234]  mlx5e_configure_flower+0x191c/0x4870 [mlx5_core]\n [23827.513298]  tc_setup_cb_add+0x1d5/0x420\n [23827.514023]  fl_hw_replace_filter+0x382/0x6a0 [cls_flower]\n [23827.514975]  fl_change+0x2ceb/0x4a51 [cls_flower]\n [23827.515821]  tc_new_tfilter+0x89a/0x2070\n [23827.516548]  rtnetlink_rcv_msg+0x644/0x8c0\n [23827.517300]  netlink_rcv_skb+0x11d/0x340\n [23827.518021]  netlink_unicast+0x42b/0x700\n [23827.518742]  netlink_sendmsg+0x743/0xc20\n [23827.519467]  sock_sendmsg+0xb2/0xe0\n [23827.520131]  ____sys_sendmsg+0x590/0x770\n [23827.520851]  ___sys_sendmsg+0xd8/0x160\n [23827.521552]  __sys_sendmsg+0xb7/0x140\n [23827.522238]  do_syscall_64+0x3a/0x70\n [23827.522907]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n [23827.523797]\n [23827.524163] Freed by task 25948:\n [23827.524780]  kasan_save_stack+0x1b/0x40\n [23827.525488]  kasan_set_track+0x1c/0x30\n [23827.526187]  kasan_set_free_info+0x20/0x30\n [23827.526968]  __kasan_slab_free+0xed/0x130\n [23827.527709]  slab_free_freelist_hook+0xcf/0x1d0\n [23827.528528]  kmem_cache_free_bulk+0x33a/0x6e0\n [23827.529317]  kfree_rcu_work+0x55f/0xb70\n [23827.530024]  process_one_work+0x8ac/0x14e0\n [23827.530770]  worker_thread+0x53b/0x1220\n [23827.531480]  kthread+0x328/0x3f0\n [23827.532114]  ret_from_fork+0x1f/0x30\n [23827.532785]\n [23827.533147] Last potentially related work creation:\n [23827.534007]  kasan_save_stack+0x1b/0x40\n [23827.534710]  kasan_record_aux_stack+0xab/0xc0\n [23827.535492]  kvfree_call_rcu+0x31/0x7b0\n [23827.536206]  mlx5e_tc_del\n---truncated---(CVE-2021-47247)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocteontx2-af: Fix possible null pointer dereference.\r\n\r\nThis patch fixes possible null pointer dereference in files\n\u0026quot;rvu_debugfs.c\u0026quot; and \u0026quot;rvu_nix.c\u0026quot;(CVE-2021-47484)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: stmmac: Disable Tx queues when reconfiguring the interface\r\n\r\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\r\n\r\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\r\n\r\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\r\n\r\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---(CVE-2021-47558)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Fix crash by keep old cfg when update TCs more than queues\r\n\r\nThere are problems if allocated queues less than Traffic Classes.\r\n\r\nCommit a632b2a4c920 (\u0026quot;ice: ethtool: Prohibit improper channel config\nfor DCB\u0026quot;) already disallow setting less queues than TCs.\r\n\r\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\r\n\r\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u0026lt;8b\u0026gt; 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\r\n\r\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.(CVE-2022-48652)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npipe: wakeup wr_wait after setting max_usage\r\n\r\nCommit c73be61cede5 (\u0026quot;pipe: Add general notification queue support\u0026quot;) a\nregression was introduced that would lock up resized pipes under certain\nconditions. See the reproducer in [1].\r\n\r\nThe commit resizing the pipe ring size was moved to a different\nfunction, doing that moved the wakeup for pipe-\u0026gt;wr_wait before actually\nraising pipe-\u0026gt;max_usage. If a pipe was full before the resize occured it\nwould result in the wakeup never actually triggering pipe_write.\r\n\r\nSet @max_usage and @nr_accounted before waking writers if this isn\u0026apos;t a\nwatch queue.\r\n\r\n[Christian Brauner \u0026lt;brauner@kernel.org\u0026gt;: rewrite to account for watch queues](CVE-2023-52672)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nALSA: scarlett2: Add missing error checks to *_ctl_get()\r\n\r\nThe *_ctl_get() functions which call scarlett2_update_*() were not\nchecking the return value. Fix to check the return value and pass to\nthe caller.(CVE-2023-52680)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/powernv: Add a null pointer check in opal_event_init()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.(CVE-2023-52686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nACPI: video: check for error while searching for backlight device parent\r\n\r\nIf acpi_get_parent() called in acpi_video_dev_register_backlight()\nfails, for example, because acpi_ut_acquire_mutex() fails inside\nacpi_get_parent), this can lead to incorrect (uninitialized)\nacpi_parent handle being passed to acpi_get_pci_dev() for detecting\nthe parent pci device.\r\n\r\nCheck acpi_get_parent() result and set parent device only in case of success.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2023-52693)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nceph: blocklist the kclient when receiving corrupted snap trace\r\n\r\nWhen received corrupted snap trace we don\u0026apos;t know what exactly has\nhappened in MDS side. And we shouldn\u0026apos;t continue IOs and metadatas\naccess to MDS, which may corrupt or get incorrect contents.\r\n\r\nThis patch will just block all the further IO/MDS requests\nimmediately and then evict the kclient itself.\r\n\r\nThe reason why we still need to evict the kclient just after\nblocking all the further IOs is that the MDS could revoke the caps\nfaster.(CVE-2023-52732)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvirtio-blk: fix implicit overflow on virtio_max_dma_size\r\n\r\nThe following codes have an implicit conversion from size_t to u32:\n(u32)max_size = (size_t)virtio_max_dma_size(vdev);\r\n\r\nThis may lead overflow, Ex (size_t)4G -\u0026gt; (u32)0. Once\nvirtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX\ninstead.(CVE-2023-52762)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/smc: avoid data corruption caused by decline\r\n\r\nWe found a data corruption issue during testing of SMC-R on Redis\napplications.\r\n\r\nThe benchmark has a low probability of reporting a strange error as\nshown below.\r\n\r\n\u0026quot;Error: Protocol error, got \u0026quot;\\xe2\u0026quot; as reply type byte\u0026quot;\r\n\r\nFinally, we found that the retrieved error data was as follows:\r\n\r\n0xE2 0xD4 0xC3 0xD9 0x04 0x00 0x2C 0x20 0xA6 0x56 0x00 0x16 0x3E 0x0C\n0xCB 0x04 0x02 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xE2\r\n\r\nIt is quite obvious that this is a SMC DECLINE message, which means that\nthe applications received SMC protocol message.\nWe found that this was caused by the following situations:\r\n\r\nclient                  server\n        ¦  clc proposal\n        -------------\u0026gt;\n        ¦  clc accept\n        \u0026lt;-------------\n        ¦  clc confirm\n        -------------\u0026gt;\nwait llc confirm\n\t\t\tsend llc confirm\n        ¦failed llc confirm\n        ¦   x------\n(after 2s)timeout\n                        wait llc confirm rsp\r\n\r\nwait decline\r\n\r\n(after 1s) timeout\n                        (after 2s) timeout\n        ¦   decline\n        --------------\u0026gt;\n        ¦   decline\n        \u0026lt;--------------\r\n\r\nAs a result, a decline message was sent in the implementation, and this\nmessage was read from TCP by the already-fallback connection.\r\n\r\nThis patch double the client timeout as 2x of the server value,\nWith this simple change, the Decline messages should never cross or\ncollide (during Confirm link timeout).\r\n\r\nThis issue requires an immediate solution, since the protocol updates\ninvolve a more long-term solution.(CVE-2023-52775)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\r\n\r\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\nworkqueue,which takes care about pipefs superblock locking.\nIn some special scenarios, when kernel frees the pipefs sb of the\ncurrent client and immediately alloctes a new pipefs sb,\nrpc_remove_pipedir function would misjudge the existence of pipefs\nsb which is not the one it used to hold. As a result,\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\r\n\r\nTo fix this issue, rpc_remove_pipedir should check whether the\ncurrent pipefs sb is consistent with the original pipefs sb.\r\n\r\nThis error can be catched by KASAN:\n=========================================================\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\n[  250.500549] Workqueue: events rpc_free_client_work\n[  250.501001] Call Trace:\n[  250.502880]  kasan_report+0xb6/0xf0\n[  250.503209]  ? dget_parent+0x195/0x200\n[  250.503561]  dget_parent+0x195/0x200\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\n[  250.505195]  rpc_free_client_work+0xe4/0x230\n[  250.505598]  process_one_work+0x8ee/0x13b0\n...\n[   22.039056] Allocated by task 244:\n[   22.039390]  kasan_save_stack+0x22/0x50\n[   22.039758]  kasan_set_track+0x25/0x30\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\n[   22.040889]  __d_alloc+0x31/0x8e0\n[   22.041207]  d_alloc+0x44/0x1f0\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\n[   22.042459]  rpc_create_client_dir+0x34/0x150\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\n[   22.043284]  rpc_client_register+0x136/0x4e0\n[   22.043689]  rpc_new_client+0x911/0x1020\n[   22.044057]  rpc_create_xprt+0xcb/0x370\n[   22.044417]  rpc_create+0x36b/0x6c0\n...\n[   22.049524] Freed by task 0:\n[   22.049803]  kasan_save_stack+0x22/0x50\n[   22.050165]  kasan_set_track+0x25/0x30\n[   22.050520]  kasan_save_free_info+0x2b/0x50\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\n[   22.051306]  kmem_cache_free+0xa5/0x390\n[   22.051667]  rcu_core+0x62c/0x1930\n[   22.051995]  __do_softirq+0x165/0x52a\n[   22.052347]\n[   22.052503] Last potentially related work creation:\n[   22.052952]  kasan_save_stack+0x22/0x50\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\n[   22.054209]  dentry_free+0xb2/0x140\n[   22.054540]  __dentry_kill+0x3be/0x540\n[   22.054900]  shrink_dentry_list+0x199/0x510\n[   22.055293]  shrink_dcache_parent+0x190/0x240\n[   22.055703]  do_one_tree+0x11/0x40\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\n[   22.056461]  generic_shutdown_super+0x70/0x590\n[   22.056879]  kill_anon_super+0x3a/0x60\n[   22.057234]  rpc_kill_sb+0x121/0x200(CVE-2023-52803)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/jfs: Add check for negative db_l2nbperpage\r\n\r\nl2nbperpage is log2(number of blks per page), and the minimum legal\nvalue should be 0, not negative.\r\n\r\nIn the case of l2nbperpage being negative, an error will occur\nwhen subsequently used as shift exponent.\r\n\r\nSyzbot reported this bug:\r\n\r\nUBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12\nshift exponent -16777216 is negative(CVE-2023-52810)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc\r\n\r\nAny unprivileged user can attach N_GSM0710 ldisc, but it requires\nCAP_NET_ADMIN to create a GSM network anyway.\r\n\r\nRequire initial namespace CAP_NET_ADMIN to do that.(CVE-2023-52880)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: do not accept ACK of bytes we never sent\r\n\r\nThis patch is based on a detailed report and ideas from Yepeng Pan\nand Christian Rossow.\r\n\r\nACK seq validation is currently following RFC 5961 5.2 guidelines:\r\n\r\n   The ACK value is considered acceptable only if\n   it is in the range of ((SND.UNA - MAX.SND.WND) \u0026lt;= SEG.ACK \u0026lt;=\n   SND.NXT).  All incoming segments whose ACK value doesn\u0026apos;t satisfy the\n   above condition MUST be discarded and an ACK sent back.  It needs to\n   be noted that RFC 793 on page 72 (fifth check) says: \u0026quot;If the ACK is a\n   duplicate (SEG.ACK \u0026lt; SND.UNA), it can be ignored.  If the ACK\n   acknowledges something not yet sent (SEG.ACK \u0026gt; SND.NXT) then send an\n   ACK, drop the segment, and return\u0026quot;.  The \u0026quot;ignored\u0026quot; above implies that\n   the processing of the incoming data segment continues, which means\n   the ACK value is treated as acceptable.  This mitigation makes the\n   ACK check more stringent since any ACK \u0026lt; SND.UNA wouldn\u0026apos;t be\n   accepted, instead only ACKs that are in the range ((SND.UNA -\n   MAX.SND.WND) \u0026lt;= SEG.ACK \u0026lt;= SND.NXT) get through.\r\n\r\nThis can be refined for new (and possibly spoofed) flows,\nby not accepting ACK for bytes that were never sent.\r\n\r\nThis greatly improves TCP security at a little cost.\r\n\r\nI added a Fixes: tag to make sure this patch will reach stable trees,\neven if the \u0026apos;blamed\u0026apos; patch was adhering to the RFC.\r\n\r\ntp-\u0026gt;bytes_acked was added in linux-4.2\r\n\r\nFollowing packetdrill test (courtesy of Yepeng Pan) shows\nthe issue at hand:\r\n\r\n0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3\n+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0\n+0 bind(3, ..., ...) = 0\n+0 listen(3, 1024) = 0\r\n\r\n// ---------------- Handshake ------------------- //\r\n\r\n// when window scale is set to 14 the window size can be extended to\n// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet\n// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)\n// ,though this ack number acknowledges some data never\n// sent by the server.\r\n\r\n+0 \u0026lt; S 0:0(0) win 65535 \u0026lt;mss 1400,nop,wscale 14\u0026gt;\n+0 \u0026gt; S. 0:0(0) ack 1 \u0026lt;...\u0026gt;\n+0 \u0026lt; . 1:1(0) ack 1 win 65535\n+0 accept(3, ..., ...) = 4\r\n\r\n// For the established connection, we send an ACK packet,\n// the ack packet uses ack number 1 - 1073725300 + 2^32,\n// where 2^32 is used to wrap around.\n// Note: we used 1073725300 instead of 1073725440 to avoid possible\n// edge cases.\n// 1 - 1073725300 + 2^32 = 3221241997\r\n\r\n// Oops, old kernels happily accept this packet.\n+0 \u0026lt; . 1:1001(1000) ack 3221241997 win 65535\r\n\r\n// After the kernel fix the following will be replaced by a challenge ACK,\n// and prior malicious frame would be dropped.\n+0 \u0026gt; . 1:1(0) ack 1001(CVE-2023-52881)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: set dormant flag on hook register failure\r\n\r\nWe need to set the dormant flag again if we fail to register\nthe hooks.\r\n\r\nDuring memory pressure hook registration can fail and we end up\nwith a table marked as active but no registered hooks.\r\n\r\nOn table/base chain deletion, nf_tables will attempt to unregister\nthe hook again which yields a warn splat from the nftables core.(CVE-2024-26835)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: hci_core: Fix possible buffer overflow\r\n\r\nstruct hci_dev_info has a fixed size name[8] field so in the event that\nhdev-\u0026gt;name is bigger than that strcpy would attempt to write past its\nsize, so this fixes this problem by switching to use strscpy.(CVE-2024-26889)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxen-netfront: Add missing skb_mark_for_recycle\r\n\r\nNotice that skb_mark_for_recycle() is introduced later than fixes tag in\ncommit 6a5bcd84e886 (\u0026quot;page_pool: Allow drivers to hint on SKB recycling\u0026quot;).\r\n\r\nIt is believed that fixes tag were missing a call to page_pool_release_page()\nbetween v5.9 to v5.14, after which is should have used skb_mark_for_recycle().\nSince v6.6 the call page_pool_release_page() were removed (in\ncommit 535b9c61bdef (\u0026quot;net: page_pool: hide page_pool_release_page()\u0026quot;)\nand remaining callers converted (in commit 6bfef2ec0172 (\u0026quot;Merge branch\n\u0026apos;net-page_pool-remove-page_pool_release_page\u0026apos;\u0026quot;)).\r\n\r\nThis leak became visible in v6.8 via commit dba1b8a7ab68 (\u0026quot;mm/page_pool: catch\npage_pool memory leaks\u0026quot;).(CVE-2024-27393)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nphonet/pep: fix racy skb_queue_empty() use\r\n\r\nThe receive queues are protected by their respective spin-lock, not\nthe socket lock. This could lead to skb_peek() unexpectedly\nreturning NULL or a pointer to an already dequeued socket buffer.(CVE-2024-27402)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\r\n\r\nThe Linked list element and pointer are not stored in the same memory as\nthe eDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred.(CVE-2024-27408)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: altmodes/displayport: create sysfs nodes as driver\u0026apos;s default device attribute group\r\n\r\nThe DisplayPort driver\u0026apos;s sysfs nodes may be present to the userspace before\ntypec_altmode_set_drvdata() completes in dp_altmode_probe. This means that\na sysfs read can trigger a NULL pointer error by deferencing dp-\u0026gt;hpd in\nhpd_show or dp-\u0026gt;lock in pin_assignment_show, as dev_get_drvdata() returns\nNULL in those cases.\r\n\r\nRemove manual sysfs node creation in favor of adding attribute group as\ndefault for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is\nnot used here otherwise the path to the sysfs nodes is no longer compliant\nwith the ABI.(CVE-2024-35790)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPCI/PM: Drain runtime-idle callbacks before driver removal\r\n\r\nA race condition between the .runtime_idle() callback and the .remove()\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\nunhandled page fault [1].\r\n\r\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\nafter pm_runtime_get_sync() has been called, but the latter doesn\u0026apos;t really\nguarantee that.  It only guarantees that the suspend and resume callbacks\nwill not be running when it returns.\r\n\r\nHowever, if a .runtime_idle() callback is already running when\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\nstatus of the device is RPM_ACTIVE and it will return right away without\nwaiting for the former to complete.  In fact, it cannot wait for\n.runtime_idle() to complete because it may be called from that callback (it\narguably does not make much sense to do that, but it is not strictly\nprohibited).\r\n\r\nThus in general, whoever is providing a .runtime_idle() callback needs\nto protect it from running in parallel with whatever code runs after\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\npm_runtime_get_sync() has returned, but it may continue running then if it\nhas started earlier.]\r\n\r\nOne way to address that race condition is to call pm_runtime_barrier()\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\nbeing invoked) to wait for the .runtime_idle() callback to complete should\nit be running at that point.  A suitable place for doing that is in\npci_device_remove() which calls pm_runtime_get_sync() before removing the\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\nwill prevent the race in question from occurring, not just in the rtsx_pcr\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.(CVE-2024-35809)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\r\n\r\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\r\n\r\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\r\n\r\n-\u0026gt;brcmf_usb_probe\n  -\u0026gt;brcmf_usb_probe_cb\n    -\u0026gt;brcmf_attach\n      -\u0026gt;brcmf_bus_started\n        -\u0026gt;brcmf_cfg80211_attach\n          -\u0026gt;wl_init_priv\n            -\u0026gt;brcmf_init_escan\n              -\u0026gt;INIT_WORK(\u0026amp;cfg-\u0026gt;escan_timeout_work,\n\t\t  brcmf_cfg80211_escan_timeout_worker);\r\n\r\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\r\n\r\nbrcmf_usb_disconnect\n  -\u0026gt;brcmf_usb_disconnect_cb\n    -\u0026gt;brcmf_detach\n      -\u0026gt;brcmf_cfg80211_detach\n        -\u0026gt;kfree(cfg);\r\n\r\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\r\n\r\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\r\n\r\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free](CVE-2024-35811)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix memory leak during rehash\r\n\r\nThe rehash delayed work migrates filters from one region to another.\nThis is done by iterating over all chunks (all the filters with the same\npriority) in the region and in each chunk iterating over all the\nfilters.\r\n\r\nIf the migration fails, the code tries to migrate the filters back to\nthe old region. However, the rollback itself can also fail in which case\nanother migration will be erroneously performed. Besides the fact that\nthis ping pong is not a very good idea, it also creates a problem.\r\n\r\nEach virtual chunk references two chunks: The currently used one\n(\u0026apos;vchunk-\u0026gt;chunk\u0026apos;) and a backup (\u0026apos;vchunk-\u0026gt;chunk2\u0026apos;). During migration the\nfirst holds the chunk we want to migrate filters to and the second holds\nthe chunk we are migrating filters from.\r\n\r\nThe code currently assumes - but does not verify - that the backup chunk\ndoes not exist (NULL) if the currently used chunk does not reference the\ntarget region. This assumption breaks when we are trying to rollback a\nrollback, resulting in the backup chunk being overwritten and leaked\n[1].\r\n\r\nFix by not rolling back a failed rollback and add a warning to avoid\nfuture cases.\r\n\r\n[1]\nWARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20\nModules linked in:\nCPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:parman_destroy+0x17/0x20\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlxsw_sp_acl_atcam_region_fini+0x19/0x60\n mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;(CVE-2024-35853)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\r\n\r\nThe rehash delayed work migrates filters from one region to another\naccording to the number of available credits.\r\n\r\nThe migrated from region is destroyed at the end of the work if the\nnumber of credits is non-negative as the assumption is that this is\nindicative of migration being complete. This assumption is incorrect as\na non-negative number of credits can also be the result of a failed\nmigration.\r\n\r\nThe destruction of a region that still has filters referencing it can\nresult in a use-after-free [1].\r\n\r\nFix by not destroying the region if migration failed.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\r\n\r\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 174:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\r\n\r\nFreed by task 7:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30(CVE-2024-35854)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nriscv: process: Fix kernel gp leakage\r\n\r\nchildregs represents the registers which are active for the new thread\nin user context. For a kernel thread, childregs-\u0026gt;gp is never used since\nthe kernel gp is not touched by switch_to. For a user mode helper, the\ngp value can be observed in user space after execve or possibly by other\nmeans.\r\n\r\n[From the email thread]\r\n\r\nThe /* Kernel thread */ comment is somewhat inaccurate in that it is also used\nfor user_mode_helper threads, which exec a user process, e.g. /sbin/init or\nwhen /proc/sys/kernel/core_pattern is a pipe. Such threads do not have\nPF_KTHREAD set and are valid targets for ptrace etc. even before they exec.\r\n\r\nchildregs is the *user* context during syscall execution and it is observable\nfrom userspace in at least five ways:\r\n\r\n1. kernel_execve does not currently clear integer registers, so the starting\n   register state for PID 1 and other user processes started by the kernel has\n   sp = user stack, gp = kernel __global_pointer$, all other integer registers\n   zeroed by the memset in the patch comment.\r\n\r\n   This is a bug in its own right, but I\u0026apos;m unwilling to bet that it is the only\n   way to exploit the issue addressed by this patch.\r\n\r\n2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread\n   before it execs, but ptrace requires SIGSTOP to be delivered which can only\n   happen at user/kernel boundaries.\r\n\r\n3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for\n   user_mode_helpers before the exec completes, but gp is not one of the\n   registers it returns.\r\n\r\n4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel\n   addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses\n   are also exposed via PERF_SAMPLE_REGS_USER which is permitted under\n   LOCKDOWN_PERF. I have not attempted to write exploit code.\r\n\r\n5. Much of the tracing infrastructure allows access to user registers. I have\n   not attempted to determine which forms of tracing allow access to user\n   registers without already allowing access to kernel registers.(CVE-2024-35871)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nerspan: make sure erspan_base_hdr is present in skb-\u0026gt;head\r\n\r\nsyzbot reported a problem in ip6erspan_rcv() [1]\r\n\r\nIssue is that ip6erspan_rcv() (and erspan_rcv()) no longer make\nsure erspan_base_hdr is present in skb linear part (skb-\u0026gt;head)\nbefore getting @ver field from it.\r\n\r\nAdd the missing pskb_may_pull() calls.\r\n\r\nv2: Reload iph pointer in erspan_rcv() after pskb_may_pull()\n    because skb-\u0026gt;head might have changed.\r\n\r\n[1]\r\n\r\n BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline]\n BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n  pskb_may_pull include/linux/skbuff.h:2756 [inline]\n  ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n  gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:460 [inline]\n  ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5538 [inline]\n  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652\n  netif_receive_skb_internal net/core/dev.c:5738 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5798\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549\n  tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  tun_alloc_skb drivers/net/tun.c:1525 [inline]\n  tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nCPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0(CVE-2024-35888)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf, sockmap: Prevent lock inversion deadlock in map delete elem\r\n\r\nsyzkaller started using corpuses where a BPF tracing program deletes\nelements from a sockmap/sockhash map. Because BPF tracing programs can be\ninvoked from any interrupt context, locks taken during a map_delete_elem\noperation must be hardirq-safe. Otherwise a deadlock due to lock inversion\nis possible, as reported by lockdep:\r\n\r\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;htab-\u0026gt;buckets[i].lock);\n                               local_irq_disable();\n                               lock(\u0026amp;host-\u0026gt;lock);\n                               lock(\u0026amp;htab-\u0026gt;buckets[i].lock);\n  \u0026lt;Interrupt\u0026gt;\n    lock(\u0026amp;host-\u0026gt;lock);\r\n\r\nLocks in sockmap are hardirq-unsafe by design. We expects elements to be\ndeleted from sockmap/sockhash only in task (normal) context with interrupts\nenabled, or in softirq context.\r\n\r\nDetect when map_delete_elem operation is invoked from a context which is\n_not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an\nerror.\r\n\r\nNote that map updates are not affected by this issue. BPF verifier does not\nallow updating sockmap/sockhash from a BPF tracing program today.(CVE-2024-35895)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: validate user input for expected length\r\n\r\nI got multiple syzbot reports showing old bugs exposed\nby BPF after commit 20f2505fb436 (\u0026quot;bpf: Try to avoid kzalloc\nin cgroup/{s,g}etsockopt\u0026quot;)\r\n\r\nsetsockopt() @optlen argument should be taken into account\nbefore copying data.\r\n\r\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\nRead of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238\r\n\r\nCPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n  __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n  do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\n  nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\nRIP: 0033:0x7fd22067dde9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9\nRDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 7238:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:4069 [inline]\n  __kmalloc_noprof+0x200/0x410 mm/slub.c:4082\n  kmalloc_noprof include/linux/slab.h:664 [inline]\n  __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\r\n\r\nThe buggy address belongs to the object at ffff88802cd73da0\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes inside of\n allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1)\r\n\r\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73\nflags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)\npage_type: 0xffffefff(slab)\nraw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122\nraw: ffff88802cd73020 000000008080007f 00000001ffffefff 00\n---truncated---(CVE-2024-35896)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Protect against int overflow for stack access size\r\n\r\nThis patch re-introduces protection against the size of access to stack\nmemory being negative; the access size can appear negative as a result\nof overflowing its signed int representation. This should not actually\nhappen, as there are other protections along the way, but we should\nprotect against it anyway. One code path was missing such protections\n(fixed in the previous patch in the series), causing out-of-bounds array\naccesses in check_stack_range_initialized(). This patch causes the\nverification of a program with such a non-sensical access size to fail.\r\n\r\nThis check used to exist in a more indirect way, but was inadvertendly\nremoved in a833a17aeac7.(CVE-2024-35905)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: ucsi: Limit read size on v1.2\r\n\r\nBetween UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was\nincreased from 16 to 256. In order to avoid overflowing reads for older\nsystems, add a mechanism to use the read UCSI version to truncate read\nsizes on UCSI v1.2.(CVE-2024-35924)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: SCO: Fix not validating setsockopt user input\r\n\r\nsyzbot reported sco_sock_setsockopt() is copying data without\nchecking user input length.\r\n\r\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\nnet/bluetooth/sco.c:893\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578(CVE-2024-35967)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngeneve: fix header validation in geneve[6]_xmit_skb\r\n\r\nsyzbot is able to trigger an uninit-value in geneve_xmit() [1]\r\n\r\nProblem : While most ip tunnel helpers (like ip_tunnel_get_dsfield())\nuses skb_protocol(skb, true), pskb_inet_may_pull() is only using\nskb-\u0026gt;protocol.\r\n\r\nIf anything else than ETH_P_IPV6 or ETH_P_IP is found in skb-\u0026gt;protocol,\npskb_inet_may_pull() does nothing at all.\r\n\r\nIf a vlan tag was provided by the caller (af_packet in the syzbot case),\nthe network header might not point to the correct location, and skb\nlinear part could be smaller than expected.\r\n\r\nAdd skb_vlan_inet_prepare() to perform a complete mac validation.\r\n\r\nUse this in geneve for the moment, I suspect we need to adopt this\nmore broadly.\r\n\r\nv4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest\n   - Only call __vlan_get_protocol() for vlan types.\r\n\r\nv2,v3 - Addressed Sabrina comments on v1 and v2\r\n\r\n[1]\r\n\r\nBUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n  geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n  geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n  __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n  netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n  xmit_one net/core/dev.c:3531 [inline]\n  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547\n  __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335\n  dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3081 [inline]\n  packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n  packet_snd net/packet/af_packet.c:3024 [inline]\n  packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nCPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024(CVE-2024-35973)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbatman-adv: Avoid infinite loop trying to resize local TT\r\n\r\nIf the MTU of one of an attached interface becomes too small to transmit\nthe local translation table then it must be resized to fit inside all\nfragments (when enabled) or a single packet.\r\n\r\nBut if the MTU becomes too low to transmit even the header + the VLAN\nspecific part then the resizing of the local TT will never succeed. This\ncan for example happen when the usable space is 110 bytes and 11 VLANs are\non top of batman-adv. In this case, at least 116 byte would be needed.\nThere will just be an endless spam of\r\n\r\n   batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)\r\n\r\nin the log but the function will never finish. Problem here is that the\ntimeout will be halved all the time and will then stagnate at 0 and\ntherefore never be able to reduce the table even more.\r\n\r\nThere are other scenarios possible with a similar result. The number of\nBATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too\nhigh to fit inside a packet. Such a scenario can therefore happen also with\nonly a single VLAN + 7 non-purgable addresses - requiring at least 120\nbytes.\r\n\r\nWhile this should be handled proactively when:\r\n\r\n* interface with too low MTU is added\n* VLAN is added\n* non-purgeable local mac is added\n* MTU of an attached interface is reduced\n* fragmentation setting gets disabled (which most likely requires dropping\n  attached interfaces)\r\n\r\nnot all of these scenarios can be prevented because batman-adv is only\nconsuming events without the the possibility to prevent these actions\n(non-purgable MAC address added, MTU of an attached interface is reduced).\nIt is therefore necessary to also make sure that the code is able to handle\nalso the situations when there were already incompatible system\nconfiguration are present.(CVE-2024-35982)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni2c: smbus: fix NULL function pointer dereference\r\n\r\nBaruch reported an OOPS when using the designware controller as target\nonly. Target-only modes break the assumption of one transfer function\nalways being available. Fix this by always checking the pointer in\n__i2c_transfer.\r\n\r\n[wsa: dropped the simplification in core-smbus to avoid theoretical regressions](CVE-2024-35984)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nrtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation\r\n\r\nEach attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a\nstruct ifla_vf_vlan_info so the size of such attribute needs to be at least\nof sizeof(struct ifla_vf_vlan_info) which is 14 bytes.\nThe current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)\nwhich is less than sizeof(struct ifla_vf_vlan_info) so this validation\nis not enough and a too small attribute might be cast to a\nstruct ifla_vf_vlan_info, this might result in an out of bands\nread access when accessing the saved (casted) entry in ivvl.(CVE-2024-36017)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmmc: sdhci-msm: pervent access to suspended controller\r\n\r\nGeneric sdhci code registers LED device and uses host-\u0026gt;runtime_suspended\nflag to protect access to it. The sdhci-msm driver doesn\u0026apos;t set this flag,\nwhich causes a crash when LED is accessed while controller is runtime\nsuspended. Fix this by setting the flag correctly.(CVE-2024-36029)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: fix out-of-bounds access in ops_init\r\n\r\nnet_alloc_generic is called by net_alloc, which is called without any\nlocking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It\nis read twice, first to allocate an array, then to set s.len, which is\nlater used to limit the bounds of the array access.\r\n\r\nIt is possible that the array is allocated and another thread is\nregistering a new pernet ops, increments max_gen_ptrs, which is then used\nto set s.len with a larger than allocated length for the variable array.\r\n\r\nFix it by reading max_gen_ptrs only once in net_alloc_generic. If\nmax_gen_ptrs is later incremented, it will be caught in net_assign_generic.(CVE-2024-36883)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: fix UAF in error path\r\n\r\nSam Page (sam4k) working with Trend Micro Zero Day Initiative reported\na UAF in the tipc_buf_append() error path:\r\n\r\nBUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0\nlinux/net/core/skbuff.c:1183\nRead of size 8 at addr ffff88804d2a7c80 by task poc/8034\r\n\r\nCPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.0-debian-1.16.0-5 04/01/2014\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n __dump_stack linux/lib/dump_stack.c:88\n dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106\n print_address_description linux/mm/kasan/report.c:377\n print_report+0xc4/0x620 linux/mm/kasan/report.c:488\n kasan_report+0xda/0x110 linux/mm/kasan/report.c:601\n kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183\n skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026\n skb_release_all linux/net/core/skbuff.c:1094\n __kfree_skb linux/net/core/skbuff.c:1108\n kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144\n kfree_skb linux/./include/linux/skbuff.h:1244\n tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186\n tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324\n tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824\n tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159\n tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390\n udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108\n udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186\n udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346\n __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422\n ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254\n dst_input linux/./include/net/dst.h:461\n ip_rcv_finish linux/net/ipv4/ip_input.c:449\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534\n __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648\n process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976\n __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576\n napi_poll linux/net/core/dev.c:6645\n net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781\n __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553\n do_softirq linux/kernel/softirq.c:454\n do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381\n local_bh_enable linux/./include/linux/bottom_half.h:33\n rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851\n __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378\n dev_queue_xmit linux/./include/linux/netdevice.h:3169\n neigh_hh_output linux/./include/net/neighbour.h:526\n neigh_output linux/./include/net/neighbour.h:540\n ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235\n __ip_finish_output linux/net/ipv4/ip_output.c:313\n __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323\n NF_HOOK_COND linux/./include/linux/netfilter.h:303\n ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433\n dst_output linux/./include/net/dst.h:451\n ip_local_out linux/net/ipv4/ip_output.c:129\n ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492\n udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963\n udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250\n inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850\n sock_sendmsg_nosec linux/net/socket.c:730\n __sock_sendmsg linux/net/socket.c:745\n __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191\n __do_sys_sendto linux/net/socket.c:2203\n __se_sys_sendto linux/net/socket.c:2199\n __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199\n do_syscall_x64 linux/arch/x86/entry/common.c:52\n do_syscall_\n---truncated---(CVE-2024-36886)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: ensure snd_nxt is properly initialized on connect\r\n\r\nChristoph reported a splat hinting at a corrupted snd_una:\r\n\r\n  WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Modules linked in:\n  CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\n  Workqueue: events mptcp_worker\n  RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8\n  \t8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe\n  \t\u0026lt;0f\u0026gt; 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9\n  RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293\n  RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4\n  RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001\n  RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n  R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000\n  R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000\n  FS:  0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline]\n   mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline]\n   __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615\n   mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767\n   process_one_work+0x1e0/0x560 kernel/workqueue.c:3254\n   process_scheduled_works kernel/workqueue.c:3335 [inline]\n   worker_thread+0x3c7/0x640 kernel/workqueue.c:3416\n   kthread+0x121/0x170 kernel/kthread.c:388\n   ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243\n   \u0026lt;/TASK\u0026gt;\r\n\r\nWhen fallback to TCP happens early on a client socket, snd_nxt\nis not yet initialized and any incoming ack will copy such value\ninto snd_una. If the mptcp worker (dumbly) tries mptcp-level\nre-injection after such ack, that would unconditionally trigger a send\nbuffer cleanup using \u0026apos;bad\u0026apos; snd_una values.\r\n\r\nWe could easily disable re-injection for fallback sockets, but such\ndumb behavior already helped catching a few subtle issues and a very\nlow to zero impact in practice.\r\n\r\nInstead address the issue always initializing snd_nxt (and write_seq,\nfor consistency) at connect time.(CVE-2024-36889)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: fix uninitialised kfifo\r\n\r\nIf a line is requested with debounce, and that results in debouncing\nin software, and the line is subsequently reconfigured to enable edge\ndetection then the allocation of the kfifo to contain edge events is\noverlooked.  This results in events being written to and read from an\nuninitialised kfifo.  Read events are returned to userspace.\r\n\r\nInitialise the kfifo in the case where the software debounce is\nalready active.(CVE-2024-36898)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: Fix use after free in lineinfo_changed_notify\r\n\r\nThe use-after-free issue occurs as follows: when the GPIO chip device file\nis being closed by invoking gpio_chrdev_release(), watched_lines is freed\nby bitmap_free(), but the unregistration of lineinfo_changed_nb notifier\nchain failed due to waiting write rwsem. Additionally, one of the GPIO\nchip\u0026apos;s lines is also in the release process and holds the notifier chain\u0026apos;s\nread rwsem. Consequently, a race condition leads to the use-after-free of\nwatched_lines.\r\n\r\nHere is the typical stack when issue happened:\r\n\r\n[free]\ngpio_chrdev_release()\n  --\u0026gt; bitmap_free(cdev-\u0026gt;watched_lines)                  \u0026lt;-- freed\n  --\u0026gt; blocking_notifier_chain_unregister()\n    --\u0026gt; down_write(\u0026amp;nh-\u0026gt;rwsem)                          \u0026lt;-- waiting rwsem\n          --\u0026gt; __down_write_common()\n            --\u0026gt; rwsem_down_write_slowpath()\n                  --\u0026gt; schedule_preempt_disabled()\n                    --\u0026gt; schedule()\r\n\r\n[use]\nst54spi_gpio_dev_release()\n  --\u0026gt; gpio_free()\n    --\u0026gt; gpiod_free()\n      --\u0026gt; gpiod_free_commit()\n        --\u0026gt; gpiod_line_state_notify()\n          --\u0026gt; blocking_notifier_call_chain()\n            --\u0026gt; down_read(\u0026amp;nh-\u0026gt;rwsem);                  \u0026lt;-- held rwsem\n            --\u0026gt; notifier_call_chain()\n              --\u0026gt; lineinfo_changed_notify()\n                --\u0026gt; test_bit(xxxx, cdev-\u0026gt;watched_lines) \u0026lt;-- use after free\r\n\r\nThe side effect of the use-after-free issue is that a GPIO line event is\nbeing generated for userspace where it shouldn\u0026apos;t. However, since the chrdev\nis being closed, userspace won\u0026apos;t have the chance to read that event anyway.\r\n\r\nTo fix the issue, call the bitmap_free() function after the unregistration\nof lineinfo_changed_nb notifier chain.(CVE-2024-36899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: prevent NULL dereference in ip6_output()\r\n\r\nAccording to syzbot, there is a chance that ip6_dst_idev()\nreturns NULL in ip6_output(). Most places in IPv6 stack\ndeal with a NULL idev just fine, but not here.\r\n\r\nsyzbot reported:\r\n\r\ngeneral protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 9775 Comm: syz-executor.4 Not tainted 6.9.0-rc5-syzkaller-00157-g6a30653b604a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:ip6_output+0x231/0x3f0 net/ipv6/ip6_output.c:237\nCode: 3c 1e 00 49 89 df 74 08 4c 89 ef e8 19 58 db f7 48 8b 44 24 20 49 89 45 00 49 89 c5 48 8d 9d e0 05 00 00 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 38 84 c0 4c 8b 74 24 28 0f 85 61 01 00 00 8b 1b 31 ff\nRSP: 0018:ffffc9000927f0d8 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000040000\nRDX: ffffc900131f9000 RSI: 0000000000004f47 RDI: 0000000000004f48\nRBP: 0000000000000000 R08: ffffffff8a1f0b9a R09: 1ffffffff1f51fad\nR10: dffffc0000000000 R11: fffffbfff1f51fae R12: ffff8880293ec8c0\nR13: ffff88805d7fc000 R14: 1ffff1100527d91a R15: dffffc0000000000\nFS:  00007f135c6856c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000080 CR3: 0000000064096000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_xmit+0xefe/0x17f0 net/ipv6/ip6_output.c:358\n  sctp_v6_xmit+0x9f2/0x13f0 net/sctp/ipv6.c:248\n  sctp_packet_transmit+0x26ad/0x2ca0 net/sctp/output.c:653\n  sctp_packet_singleton+0x22c/0x320 net/sctp/outqueue.c:783\n  sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]\n  sctp_outq_flush+0x6d5/0x3e20 net/sctp/outqueue.c:1212\n  sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]\n  sctp_do_sm+0x59cc/0x60c0 net/sctp/sm_sideeffect.c:1169\n  sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73\n  __sctp_connect+0x9cd/0xe30 net/sctp/socket.c:1234\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-36901)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()\r\n\r\nsyzbot is able to trigger the following crash [1],\ncaused by unsafe ip6_dst_idev() use.\r\n\r\nIndeed ip6_dst_idev() can return NULL, and must always be checked.\r\n\r\n[1]\r\n\r\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]\n RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267\nCode: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c\nRSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700\nRDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760\nRBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd\nR10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000\nR13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00\nFS:  00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317\n  fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108\n  ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]\n  ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649\n  ip6_route_output include/net/ip6_route.h:93 [inline]\n  ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120\n  ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250\n  sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326\n  sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455\n  sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662\n  sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099\n  __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-36902)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: Fix potential uninit-value access in __ip6_make_skb()\r\n\r\nAs it was done in commit fc1092f51567 (\u0026quot;ipv4: Fix uninit-value access in\n__ip_make_skb()\u0026quot;) for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6-\u0026gt;flowi6_flags\ninstead of testing HDRINCL on the socket to avoid a race condition which\ncauses uninit-value access.(CVE-2024-36903)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nARM: 9381/1: kasan: clear stale stack poison\r\n\r\nWe found below OOB crash:\r\n\r\n[   33.452494] ==================================================================\n[   33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec\n[   33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0\n[   33.455515]\n[   33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O       6.1.25-mainline #1\n[   33.456880] Hardware name: Generic DT based system\n[   33.457555]  unwind_backtrace from show_stack+0x18/0x1c\n[   33.458326]  show_stack from dump_stack_lvl+0x40/0x4c\n[   33.459072]  dump_stack_lvl from print_report+0x158/0x4a4\n[   33.459863]  print_report from kasan_report+0x9c/0x148\n[   33.460616]  kasan_report from kasan_check_range+0x94/0x1a0\n[   33.461424]  kasan_check_range from memset+0x20/0x3c\n[   33.462157]  memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec\n[   33.463064]  refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c\n[   33.464181]  tick_nohz_idle_stop_tick from do_idle+0x264/0x354\n[   33.465029]  do_idle from cpu_startup_entry+0x20/0x24\n[   33.465769]  cpu_startup_entry from rest_init+0xf0/0xf4\n[   33.466528]  rest_init from arch_post_acpi_subsys_init+0x0/0x18\n[   33.467397]\n[   33.467644] The buggy address belongs to stack of task swapper/0/0\n[   33.468493]  and is located at offset 112 in frame:\n[   33.469172]  refresh_cpu_vm_stats.constprop.0+0x0/0x2ec\n[   33.469917]\n[   33.470165] This frame has 2 objects:\n[   33.470696]  [32, 76) \u0026apos;global_zone_diff\u0026apos;\n[   33.470729]  [112, 276) \u0026apos;global_node_diff\u0026apos;\n[   33.471294]\n[   33.472095] The buggy address belongs to the physical page:\n[   33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03\n[   33.473944] flags: 0x1000(reserved|zone=0)\n[   33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001\n[   33.475656] raw: 00000000\n[   33.476050] page dumped because: kasan: bad access detected\n[   33.476816]\n[   33.477061] Memory state around the buggy address:\n[   33.477732]  c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   33.478630]  c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00\n[   33.479526] \u0026gt;c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1\n[   33.480415]                                                ^\n[   33.481195]  c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3\n[   33.482088]  c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n[   33.482978] ==================================================================\r\n\r\nWe find the root cause of this OOB is that arm does not clear stale stack\npoison in the case of cpuidle.\r\n\r\nThis patch refer to arch/arm64/kernel/sleep.S to resolve this issue.\r\n\r\nFrom cited commit [1] that explain the problem\r\n\r\nFunctions which the compiler has instrumented for KASAN place poison on\nthe stack shadow upon entry and remove this poison prior to returning.\r\n\r\nIn the case of cpuidle, CPUs exit the kernel a number of levels deep in\nC code.  Any instrumented functions on this critical path will leave\nportions of the stack shadow poisoned.\r\n\r\nIf CPUs lose context and return to the kernel via a cold path, we\nrestore a prior context saved in __cpu_suspend_enter are forgotten, and\nwe never remove the poison they placed in the stack shadow area by\nfunctions calls between this and the actual exit of the kernel.\r\n\r\nThus, (depending on stackframe layout) subsequent calls to instrumented\nfunctions may hit this stale poison, resulting in (spurious) KASAN\nsplats to the console.\r\n\r\nTo avoid this, clear any stale poison from the idle thread for a CPU\nprior to bringing a CPU online.\r\n\r\nFrom cited commit [2]\r\n\r\nExtend to check for CONFIG_KASAN_STACK\r\n\r\n[1] commit 0d97e6d8024c (\u0026quot;arm64: kasan: clear stale stack poison\u0026quot;)\n[2] commit d56a9ef84bd0 (\u0026quot;kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK\u0026quot;)(CVE-2024-36906)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblk-iocost: do not WARN if iocg was already offlined\r\n\r\nIn iocg_pay_debt(), warn is triggered if \u0026apos;active_list\u0026apos; is empty, which\nis intended to confirm iocg is active when it has debt. However, warn\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\nis run at that time:\r\n\r\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\n  Call trace:\n  iocg_pay_debt+0x14c/0x190\n  iocg_kick_waitq+0x438/0x4c0\n  iocg_waitq_timer_fn+0xd8/0x130\n  __run_hrtimer+0x144/0x45c\n  __hrtimer_run_queues+0x16c/0x244\n  hrtimer_interrupt+0x2cc/0x7b0\r\n\r\nThe warn in this situation is meaningless. Since this iocg is being\nremoved, the state of the \u0026apos;active_list\u0026apos; is irrelevant, and \u0026apos;waitq_timer\u0026apos;\nis canceled after removing \u0026apos;active_list\u0026apos; in ioc_pd_free(), which ensures\niocg is freed after iocg_waitq_timer_fn() returns.\r\n\r\nTherefore, add the check if iocg was already offlined to avoid warn\nwhen removing a blkcg or disk.(CVE-2024-36908)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblock: fix overflow in blk_ioctl_discard()\r\n\r\nThere is no check for overflow of \u0026apos;start + len\u0026apos; in blk_ioctl_discard().\nHung task occurs if submit an discard ioctl with the following param:\n  start = 0x80000000000ff000, len = 0x8000000000fff000;\nAdd the overflow validation now.(CVE-2024-36917)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()\r\n\r\nlpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the\nhbalock.  Thus, lpfc_worker_wake_up() should not be called while holding the\nhbalock to avoid potential deadlock.(CVE-2024-36924)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/qeth: Fix kernel panic after setting hsuid\r\n\r\nSymptom:\nWhen the hsuid attribute is set for the first time on an IQD Layer3\ndevice while the corresponding network interface is already UP,\nthe kernel will try to execute a napi function pointer that is NULL.\r\n\r\nExample:\n---------------------------------------------------------------------------\n[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP\n[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6\nnft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de\ns_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod\n qdio ccwgroup pkey zcrypt\n[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1\n[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)\n[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)\n[ 2057.572748]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3\n[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000\n[ 2057.572754]            00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80\n[ 2057.572756]            000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8\n[ 2057.572758]            00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68\n[ 2057.572762] Krnl Code:#0000000000000000: 0000                illegal\n                         \u0026gt;0000000000000002: 0000                illegal\n                          0000000000000004: 0000                illegal\n                          0000000000000006: 0000                illegal\n                          0000000000000008: 0000                illegal\n                          000000000000000a: 0000                illegal\n                          000000000000000c: 0000                illegal\n                          000000000000000e: 0000                illegal\n[ 2057.572800] Call Trace:\n[ 2057.572801] ([\u0026lt;00000000ec639700\u0026gt;] 0xec639700)\n[ 2057.572803]  [\u0026lt;00000000913183e2\u0026gt;] net_rx_action+0x2ba/0x398\n[ 2057.572809]  [\u0026lt;0000000091515f76\u0026gt;] __do_softirq+0x11e/0x3a0\n[ 2057.572813]  [\u0026lt;0000000090ce160c\u0026gt;] do_softirq_own_stack+0x3c/0x58\n[ 2057.572817] ([\u0026lt;0000000090d2cbd6\u0026gt;] do_softirq.part.1+0x56/0x60)\n[ 2057.572822]  [\u0026lt;0000000090d2cc60\u0026gt;] __local_bh_enable_ip+0x80/0x98\n[ 2057.572825]  [\u0026lt;0000000091314706\u0026gt;] __dev_queue_xmit+0x2be/0xd70\n[ 2057.572827]  [\u0026lt;000003ff803dd6d6\u0026gt;] afiucv_hs_send+0x24e/0x300 [af_iucv]\n[ 2057.572830]  [\u0026lt;000003ff803dd88a\u0026gt;] iucv_send_ctrl+0x102/0x138 [af_iucv]\n[ 2057.572833]  [\u0026lt;000003ff803de72a\u0026gt;] iucv_sock_connect+0x37a/0x468 [af_iucv]\n[ 2057.572835]  [\u0026lt;00000000912e7e90\u0026gt;] __sys_connect+0xa0/0xd8\n[ 2057.572839]  [\u0026lt;00000000912e9580\u0026gt;] sys_socketcall+0x228/0x348\n[ 2057.572841]  [\u0026lt;0000000091514e1a\u0026gt;] system_call+0x2a6/0x2c8\n[ 2057.572843] Last Breaking-Event-Address:\n[ 2057.572844]  [\u0026lt;0000000091317e44\u0026gt;] __napi_poll+0x4c/0x1d8\n[ 2057.572846]\n[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt\n-------------------------------------------------------------------------------------------\r\n\r\nAnalysis:\nThere is one napi structure per out_q: card-\u0026gt;qdio.out_qs[i].napi\nThe napi.poll functions are set during qeth_open().\r\n\r\nSince\ncommit 1cfef80d4c2b (\u0026quot;s390/qeth: Don\u0026apos;t call dev_close/dev_open (DOWN/UP)\u0026quot;)\nqeth_set_offline()/qeth_set_online() no longer call dev_close()/\ndev_open(). So if qeth_free_qdio_queues() cleared\ncard-\u0026gt;qdio.out_qs[i].napi.poll while the network interface was UP and the\ncard was offline, they are not set again.\r\n\r\nReproduction:\nchzdev -e $devno layer2=0\nip link set dev $network_interface up\necho 0 \u0026gt; /sys/bus/ccw\n---truncated---(CVE-2024-36928)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: core: reject skb_copy(_expand) for fraglist GSO skbs\r\n\r\nSKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become\ninvalid. Return NULL if such an skb is passed to skb_copy or\nskb_copy_expand, in order to prevent a crash on a potential later\ncall to skb_gso_segment.(CVE-2024-36929)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\namd/amdkfd: sync all devices to wait all processes being evicted\r\n\r\nIf there are more than one device doing reset in parallel, the first\ndevice will call kfd_suspend_all_processes() to evict all processes\non all devices, this call takes time to finish. other device will\nstart reset and recover without waiting. if the process has not been\nevicted before doing recover, it will be restored, then caused page\nfault.(CVE-2024-36949)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: fix a possible memleak in tipc_buf_append\r\n\r\n__skb_linearize() doesn\u0026apos;t free the skb when it fails, so move\n\u0026apos;*buf = NULL\u0026apos; after __skb_linearize(), so that the skb can be\nfreed on the err path.(CVE-2024-36954)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocteontx2-af: avoid off-by-one read from userspace\r\n\r\nWe try to access count + 1 byte from userspace with memdup_user(buffer,\ncount + 1). However, the userspace only provides buffer of count bytes and\nonly these count bytes are verified to be okay to access. To ensure the\ncopied buffer is NUL terminated, we use memdup_user_nul instead.(CVE-2024-36957)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/9p: only translate RWX permissions for plain 9P2000\r\n\r\nGarbage in plain 9P2000\u0026apos;s perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u.(CVE-2024-36964)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:17:24.569488947Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2021-47558","title":"CVE-2021-47558 in linux - Patched by Root","description":"Root has patched CVE-2021-47558 in the linux package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-23T09:13:41Z","modified":"2026-08-23T10:15:08.652135851Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:28.544053Z"},{"id":"UBUNTU-CVE-2021-47558","description":"In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Disable Tx queues when reconfiguring the interface The Tx queues were not disabled in situations where the driver needed to stop the interface to apply a new configuration. This could result in a kernel panic when doing any of the 3 following actions: * reconfiguring the number of queues (ethtool -L) * reconfiguring the size of the ring buffers (ethtool -G) * installing/removing an XDP program (ip l set dev ethX xdp) Prevent the panic by making sure netif_tx_disable is called when stopping an interface. Without this patch, the following kernel panic can be observed when doing any of the actions above: Unable to handle kernel paging request at virtual address ffff80001238d040 [....]  Call trace:   dwmac4_set_addr+0x8/0x10   dev_hard_start_xmit+0xe4/0x1ac   sch_direct_xmit+0xe8/0x39c   __dev_queue_xmit+0x3ec/0xaf0   dev_queue_xmit+0x14/0x20 [...] [ end trace 0000000000000002 ]---","status":"published","published":"2024-05-24T15:15:00Z","modified":"2025-10-24T04:52:29Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:48.688001Z"},{"id":"SUSE-SU-2024:2008-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)\n- CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)\n- CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)\n- CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).\n- CVE-2023-42755: Check user supplied offsets (bsc#1215702).\n- CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).\n- CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).\n- CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).\n- CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).\n- CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).\n- CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).\n- CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).\n- CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).\n- CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).\n- CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (CVE-2023-52698 bsc#1224621)\n- CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)\n- CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).\n- CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).\n- CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).\n- CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs (bsc#1225097).\n- CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).\n- CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).\n- CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).\n- CVE-2024-26679: Fixed read sk-\u003esk_family once in inet_recv_error() (bsc#1222385).\n- CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated (bsc#1222464).\n- CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).\n- CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).\n- CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).\n- CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)\n- CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).\n- CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).\n- CVE-2024-26900: Fixed kmemleak of rdev-\u003eserial (bsc#1223046).\n- CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)\n- CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).\n- CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).\n- CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).\n- CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).\n- CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).\n- CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).\n- CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).\n- CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)\n- CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)\n- CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).\n- CVE-2024-35791: Flush pages under kvm-\u003elock to fix UAF in  svm_register_enc_region() (bsc#1224725).\n- CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).\n- CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).\n- CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).\n- CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).\n- CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).\n- CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).\n- CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).\n- CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).\n- CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765).\n- CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).\n- CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).\n- CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).\n- CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).\n- CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).\n- CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).\n- CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).\n- CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).\n- CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).\n- CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).\n- CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).\n- CVE-2024-35885: Stop interface during shutdown (bsc#1224519).\n- CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).\n- CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).\n- CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).\n- CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).\n- CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).\n- CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).\n- CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).\n- CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).\n- CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).\n- CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).\n- CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).\n- CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).\n- CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).\n- CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).\n- CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).\n- CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).\n- CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).\n- CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).\n\nThe following non-security bugs were fixed:\n\n- 9p: explicitly deny setlease attempts (git-fixes).\n- ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).\n- ACPI: disable -Wstringop-truncation (git-fixes).\n- ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).\n- ACPI: LPSS: Advertise number of chip selects via property (git-fixes).\n- admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET (git-fixes).\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- ALSA: core: Fix NULL module pointer assignment at card init (git-fixes).\n- ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup (git-fixes).\n- ALSA: line6: Zero-initialize message buffers (stable-fixes).\n- ARM: 9381/1: kasan: clear stale stack poison (git-fixes).\n- ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).\n- ASoC: Intel: avs: Fix potential integer overflow (git-fixes).\n- ASoC: Intel: avs: ssm4567: Do not ignore route checks (git-fixes).\n- ASoC: Intel: Disable route checks for Skylake boards (git-fixes).\n- ASoC: kirkwood: Fix potential NULL dereference (git-fixes).\n- ASoC: mediatek: mt8192: fix register configuration for tdm (git-fixes).\n- ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).\n- ASoC: meson: axg-fifo: use threaded irq to check periods (git-fixes).\n- ASoC: tas2552: Add TX path for capturing AUDIO-OUT data (git-fixes).\n- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).\n- ata: pata_legacy: make legacy_exit() work again (git-fixes).\n- ata: sata_gemini: Check clk_enable() result (stable-fixes).\n- autofs: use wake_up() instead of wake_up_interruptible(() (bsc#1224166).\n- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (git-fixes).\n- Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (git-fixes).\n- Bluetooth: hci_sync: Do not double print name in add/remove adv_monitor (bsc#1216358).\n- Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (git-fixes).\n- Bluetooth: msft: fix slab-use-after-free in msft_do_close() (git-fixes).\n- Bluetooth: qca: add missing firmware sanity checks (git-fixes).\n- Bluetooth: qca: Fix error code in qca_read_fw_build_info() (git-fixes).\n- Bluetooth: qca: fix firmware check error path (git-fixes).\n- Bluetooth: qca: fix info leak when fetching fw build id (git-fixes).\n- Bluetooth: qca: fix NVM configuration parsing (git-fixes).\n- bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)\n- bpf: decouple prune and jump points (bsc#1225756).\n- bpf: fix precision backtracking instruction iteration (bsc#1225756).\n- bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END (git-fixes).\n- bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).\n- bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756).\n- bpf: remove unnecessary prune and jump points (bsc#1225756).\n- btrfs: add error messages to all unrecognized mount options (git-fixes)\n- btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)\n- btrfs: extend locking to all space_info members accesses (git-fixes)\n- btrfs: fix btrfs_submit_compressed_write cgroup attribution (git-fixes)\n- btrfs: fix fallocate to use file_modified to update permissions consistently (git-fixes)\n- btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)\n- btrfs: fix missing blkdev_put() call in btrfs_scan_one_device() (git-fixes)\n- btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)\n- btrfs: fix qgroup reserve overflow the qgroup limit (git-fixes)\n- btrfs: fix silent failure when deleting root reference (git-fixes)\n- btrfs: fix use-after-free after failure to create a snapshot (git-fixes)\n- btrfs: free exchange changeset on failures (git-fixes)\n- btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: make search_csum_tree return 0 if we get -EFBIG (git-fixes)\n- btrfs: prevent copying too big compressed lzo segment (git-fixes)\n- btrfs: remove BUG_ON(!eie) in find_parent_nodes (git-fixes)\n- btrfs: remove BUG_ON() in find_parent_nodes() (git-fixes)\n- btrfs: repair super block num_devices automatically (git-fixes)\n- btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling (git-fixes)\n- btrfs: send: ensure send_fd is writable (git-fixes)\n- btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)\n- btrfs: send: in case of IO error log it (git-fixes)\n- btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)\n- btrfs: tree-checker: check item_size for dev_item (git-fixes)\n- btrfs: tree-checker: check item_size for inode_item (git-fixes)\n- cifs: account for primary channel in the interface list (bsc#1224020).\n- cifs: cifs_chan_is_iface_active should be called with chan_lock held (bsc#1224020).\n- cifs: distribute channels across interfaces based on speed (bsc#1224020).\n- cifs: do not pass cifs_sb when trying to add channels (bsc#1224020).\n- cifs: failure to add channel on iface should bump up weight (git-fixes, bsc#1224020).\n- cifs: fix charset issue in reconnection (bsc#1224020).\n- cifs: fix leak of iface for primary channel (git-fixes, bsc#1224020).\n- cifs: handle cases where a channel is closed (bsc#1224020).\n- cifs: handle cases where multiple sessions share connection (bsc#1224020).\n- cifs: reconnect work should have reference on server struct (bsc#1224020).\n- clk: Do not hold prepare_lock when calling kref_put() (stable-fixes).\n- clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).\n- counter: stm32-lptimer-cnt: Provide defines for clock polarities (git-fixes).\n- counter: stm32-timer-cnt: Provide defines for slave mode selection (git-fixes).\n- cppc_cpufreq: Fix possible null pointer dereference (git-fixes).\n- cpu/hotplug: Remove the 'cpu' member of cpuhp_cpu_state (git-fixes).\n- cpumask: Add for_each_cpu_from() (bsc#1225053).\n- crypto: bcm - Fix pointer arithmetic (git-fixes).\n- crypto: ccp - drop platform ifdef checks (git-fixes).\n- crypto: ecdsa - Fix module auto-load on add-key (git-fixes).\n- crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).\n- dmaengine: axi-dmac: fix possible race in remove() (git-fixes).\n- dmaengine: idma64: Add check for dma_set_max_seg_size (git-fixes).\n- dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users (git-fixes).\n- dm-multipath: dont't attempt SG_IO on non-SCSI-disks (bsc#1223575).\n- docs: kernel_include.py: Cope with docutils 0.21 (stable-fixes).\n- drivers/nvme: Add quirks for device 126f:2262 (git-fixes).\n- drm/amd/display: Atom Integrated System Info v2_2 for DCN35 (stable-fixes).\n- drm/amd/display: Fix division by zero in setup_dsc_config (stable-fixes).\n- drm/amd/display: Fix potential index out of bounds in color transformation function (git-fixes).\n- drm/amd/display: Handle Y carry-over in VCP X.Y calculation (stable-fixes).\n- drm/amd: Flush GFXOFF requests in prepare stage (git-fixes).\n- drm/amdgpu: Refine IB schedule error logging (stable-fixes).\n- drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (git-fixes).\n- drm/arm/malidp: fix a possible null pointer dereference (git-fixes).\n- drm/bridge: anx7625: Do not log an error when DSI host can't be found (git-fixes).\n- drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference (git-fixes).\n- drm/bridge: dpc3433: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: icn6211: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt8912b: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt9611: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: fix support for jeida-18 and jeida-24 (git-fixes).\n- drm/connector: Add \\n to message about demoting connector force-probes (git-fixes).\n- drm/i915/bios: Fix parsing backlight BDB data (git-fixes).\n- drm/lcdif: Do not disable clocks on already suspended hardware (git-fixes).\n- drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).\n- drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).\n- drm/meson: dw-hdmi: power up phy on device init (git-fixes).\n- drm/meson: vclk: fix calculation of 59.94 fractional rates (git-fixes).\n- drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).\n- drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).\n- drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk (git-fixes).\n- drm/nouveau/dp: Do not probe eDP ports twice harder (stable-fixes).\n- drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD does not assert (git-fixes).\n- drm/panel: novatek-nt35950: Do not log an error when DSI host can't be found (git-fixes).\n- drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector (git-fixes).\n- drm: vc4: Fix possible null pointer dereference (git-fixes).\n- dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)\n- dyndbg: fix old BUG_ON in \u003econtrol parser (stable-fixes).\n- efi: libstub: only free priv.runtime_map when allocated (git-fixes).\n- extcon: max8997: select IRQ_DOMAIN instead of depending on it (git-fixes).\n- fail_function: fix wrong use of fei_attr_remove().\n- fbdev: savage: Handle err return when savagefb_check_var failed (git-fixes).\n- fbdev: shmobile: fix snprintf truncation (git-fixes).\n- fbdev: sisfb: hide unused variables (git-fixes).\n- firewire: ohci: mask bus reset interrupts between ISR and bottom half (stable-fixes).\n- firmware: dmi-id: add a release callback function (git-fixes).\n- firmware: raspberrypi: Use correct device for DMA mappings (git-fixes).\n- fs/9p: drop inodes immediately on non-.L too (git-fixes).\n- fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes).\n- fs/9p: translate O_TRUNC into OTRUNC (git-fixes).\n- gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpu: host1x: Do not setup DMA for virtual devices (stable-fixes).\n- HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors (git-fixes).\n- hwmon: (corsair-cpro) Protect ccp-\u003ewait_input_report with a spinlock (git-fixes).\n- hwmon: (corsair-cpro) Use a separate buffer for sending commands (git-fixes).\n- hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() (git-fixes).\n- hwmon: (lm70) fix links in doc and comments (git-fixes).\n- hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us (git-fixes).\n- i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame (git-fixes).\n- i3c: master: svc: fix invalidate IBI type and miss call client IBI handler (git-fixes).\n- IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- iio: core: Leave private pointer NULL when no private data supplied (git-fixes).\n- iio: pressure: dps310: support negative temperature values (git-fixes).\n- Input: cyapa - add missing input core locking to suspend/resume functions (git-fixes).\n- Input: ims-pcu - fix printf string overflow (git-fixes).\n- Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation (git-fixes).\n- iomap: Fix inline extent handling in iomap_readpage (git-fixes)\n- iomap: iomap: fix memory corruption when recording errors during writeback (git-fixes)\n- iomap: Support partial direct I/O on user copy failures (git-fixes)\n- iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)\n- io_uring/unix: drop usage of io_uring socket (git-fixes).\n- irqchip/gic-v3-its: Prevent double free on error (git-fixes).\n- jffs2: prevent xattr node from overflowing the eraseblock (git-fixes).\n- kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756).\n- kcm: do not sense pfmemalloc status in kcm_sendpage() (git-fixes bsc#1223959)\n- KEYS: trusted: Do not use WARN when encode fails (git-fixes).\n- KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).\n- KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1224794).\n- KVM: x86: Delete duplicate documentation for KVM_X86_SET_MSR_FILTER (git-fixes).\n- leds: pwm: Disable PWM when going to suspend (git-fixes).\n- libsubcmd: Fix parse-options memory leak (git-fixes).\n- locking/atomic: Make test_and_*_bit() ordered on failure (git-fixes).\n- media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries (git-fixes).\n- media: dt-bindings: ovti,ov2680: Fix the power supply names (git-fixes).\n- media: mc: mark the media devnode as registered from the, start (git-fixes).\n- media: ngene: Add dvb_ca_en50221_init return value check (git-fixes).\n- media: stk1160: fix bounds checking in stk1160_copy_video() (git-fixes).\n- mei: me: add lunar lake point M DID (stable-fixes).\n- mfd: intel-lpss: Revert 'Add missing check for platform_get_resource' (git-fixes).\n- mfd: ti_am335x_tscadc: Support the correctly spelled DT property (git-fixes).\n- mfd: tqmx86: Specify IO port register range more precisely (git-fixes).\n- mlxbf_gige: Enable the GigE port in mlxbf_gige_open (git-fixes).\n- mlxbf_gige: Fix intermittent no ip issue (git-fixes).\n- mlxbf_gige: stop PHY during open() error paths (git-fixes).\n- mmc: sdhci_am654: Add tuning algorithm for delay chain (git-fixes).\n- mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).\n- mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() (git-fixes).\n- mtd: rawnand: hynix: fixed typo (git-fixes).\n- net: do not sense pfmemalloc status in skb_append_pagefrags() (git-fixes bsc#1223959)\n- netfilter: nf_tables: bail out early if hardware offload is not supported (git-fixes bsc#1223961)\n- net: introduce __skb_fill_page_desc_noacc (git-fixes bsc#1223959)\n- net: nfc: remove inappropriate attrs check (stable-fixes).\n- net: qualcomm: rmnet: fix global oob in rmnet_policy (git-fixes).\n- net: usb: ax88179_178a: fix link status when link is set to down/up (git-fixes).\n- net:usb:qmi_wwan: support Rolling modules (stable-fixes).\n- net: usb: smsc95xx: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: sr9700: stop lying about skb-\u003etruesize (git-fixes).\n- net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).\n- nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() (git-fixes).\n- nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).\n- nilfs2: fix out-of-range warning (git-fixes).\n- nilfs2: fix unexpected freezing of nilfs_segctor_sync() (git-fixes).\n- nilfs2: fix use-after-free of timer for log writer thread (git-fixes).\n- nilfs2: make superblock data array index computation sparse friendly (git-fixes).\n- nvme: ensure disabling pairs with unquiesce (bsc#1224534).\n- nvme: fix miss command type check (git-fixes).\n- nvme: fix multipath batched completion accounting (git-fixes).\n- nvme-multipath: fix io accounting on failover (git-fixes).\n- nvmet: fix ns enable/disable possible hang (git-fixes).\n- PCI: dwc: Detect iATU settings after getting 'addr_space' resource (git-fixes).\n- PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host (git-fixes).\n- PCI: dwc: Use the bitmap API to allocate bitmaps (git-fixes).\n- PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id (git-fixes).\n- PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).\n- pinctrl: armada-37xx: remove an unused variable (git-fixes).\n- pinctrl: core: delete incorrect free in pinctrl_enable() (git-fixes).\n- pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin() (stable-fixes).\n- pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (git-fixes).\n- pinctrl/meson: fix typo in PDM's pin name (git-fixes).\n- pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T (git-fixes).\n- platform/x86/intel-uncore-freq: Do not present root domain on error (git-fixes).\n- platform/x86: xiaomi-wmi: Fix race condition when reporting key events (git-fixes).\n- powerpc/eeh: Permanently disable the removed device (bsc#1223991 ltc#205740).\n- powerpc/eeh: Small refactor of eeh_handle_normal_event() (bsc#1223991 ltc#205740).\n- powerpc/eeh: Use a goto for recovery failures (bsc#1223991 ltc#205740).\n- powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).\n- powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- powerpc/uaccess: Fix build errors seen with GCC 13/14 (bsc#1194869).\n- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).\n- power: rt9455: hide unused rt9455_boost_voltage_values (git-fixes).\n- ppdev: Add an error check in register_device (git-fixes).\n- printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1225616).\n- qibfs: fix dentry leak (git-fixes)\n- RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)\n- RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)\n- RDMA/hns: Fix GMV table pagesize (git-fixes)\n- RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)\n- RDMA/hns: Fix UAF for cq async event (git-fixes)\n- RDMA/hns: Modify the print level of CQE error (git-fixes)\n- RDMA/hns: Use complete parentheses in macros (git-fixes)\n- RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)\n- RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)\n- RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)\n- RDMA/rxe: Add ibdev_dbg macros for rxe (git-fixes)\n- RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)\n- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)\n- RDMA/rxe: Fix the problem 'mutex_destroy missing' (git-fixes)\n- RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_net.c (git-fixes)\n- RDMA/rxe: Split rxe_run_task() into two subroutines (git-fixes)\n- regulator: bd71828: Do not overwrite runtime voltages (git-fixes).\n- regulator: core: fix debugfs creation regression (git-fixes).\n- regulator: mt6360: De-capitalize devicetree regulator subnodes (git-fixes).\n- remoteproc: mediatek: Make sure IPI buffer fits in L2TCM (git-fixes).\n- Rename colliding patches before origin/cve/linux-5.14-LTSS -\u003e SLE15-SP5 merge\n- Revert 'cifs: reconnect work should have reference on server struct' (git-fixes, bsc#1224020).\n- Revert 'drm/bridge: ti-sn65dsi83: Fix enable error path' (git-fixes).\n- ring-buffer: Fix a race between readers and resize checks (git-fixes).\n- s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes bsc#1224795).\n- s390/cio: fix tracepoint subchannel type field (git-fixes bsc#1224796).\n- s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224346).\n- s390/ipl: Fix incorrect initialization of len fields in nvme reipl block (git-fixes bsc#1225139).\n- s390/ipl: Fix incorrect initialization of nvme dump block (git-fixes bsc#1225138).\n- sched/topology: Optimize topology_span_sane() (bsc#1225053).\n- scsi: arcmsr: Support new PCI device IDs 1883 and 1886 (git-fixes).\n- scsi: bfa: Fix function pointer type mismatch for hcb_qe-\u003ecbfn (git-fixes).\n- scsi: core: Consult supported VPD page list prior to fetching page (git-fixes).\n- scsi: core: Fix unremoved procfs host directory regression (git-fixes).\n- scsi: csiostor: Avoid function pointer casts (git-fixes).\n- scsi: libfc: Do not schedule abort twice (git-fixes).\n- scsi: libfc: Fix up timeout error in fc_fcp_rec_error() (git-fixes).\n- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).\n- scsi: lpfc: Change default logging level for unsolicited CT MIB commands (bsc#1225842).\n- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask (bsc#1225842).\n- scsi: lpfc: Clear deferred RSCN processing flag when driver is unloading (bsc#1225842).\n- scsi: lpfc: Copyright updates for 14.4.0.2 patches (bsc#1225842).\n- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list (bsc#1225842).\n- scsi: lpfc: Update logging of protection type for T10 DIF I/O (bsc#1225842).\n- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).\n- scsi: mpt3sas: Prevent sending diag_reset when the controller is ready (git-fixes).\n- scsi: mylex: Fix sysfs buffer lengths (git-fixes).\n- scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (git-fixes).\n- scsi: sd: Unregister device if device_add_disk() failed in sd_probe() (git-fixes).\n- selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).\n- serial: 8250_bcm7271: use default_mux_rate if possible (git-fixes).\n- serial: kgdboc: Fix NMI-safety problems from keyboard reset code (stable-fixes).\n- serial: max3100: Fix bitwise types (git-fixes).\n- serial: max3100: Lock port-\u003elock when calling uart_handle_cts_change() (git-fixes).\n- serial: max3100: Update uart_driver_registered on driver removal (git-fixes).\n- serial: sc16is7xx: add proper sched.h include for sched_set_fifo() (git-fixes).\n- serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler (git-fixes).\n- serial: sh-sci: protect invalidating RXDMA on shutdown (git-fixes).\n- smb3: show beginning time for per share stats (bsc#1224020).\n- smb: client: ensure to try all targets when finding nested links (bsc#1224020).\n- smb: client: fix mount when dns_resolver key is not available (git-fixes, bsc#1224020).\n- smb: client: get rid of dfs code dep in namespace.c (bsc#1224020).\n- smb: client: get rid of dfs naming in automount code (bsc#1224020).\n- smb: client: introduce DFS_CACHE_TGT_LIST() (bsc#1224020).\n- smb: client: reduce stack usage in cifs_try_adding_channels() (bsc#1224020).\n- smb: client: remove extra @chan_count check in __cifs_put_smb_ses() (bsc#1224020).\n- smb: client: rename cifs_dfs_ref.c to namespace.c (bsc#1224020).\n- soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).\n- soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request (git-fixes).\n- Sort recent BHI patches\n- speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).\n- spmi: Add a check for remove callback when removing a SPMI driver (git-fixes).\n- spmi: hisi-spmi-controller: Do not override device identifier (git-fixes).\n- swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331). \n- swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)\n- swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)\n- swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)\n- sysv: do not call sb_bread() with pointers_lock held (git-fixes).\n- thermal/drivers/tsens: Fix null pointer dereference (git-fixes).\n- tools/latency-collector: Fix -Wformat-security compile warns (git-fixes).\n- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer (bsc#1225535)\n- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (git-fixes).\n- tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test (git-fixes).\n- tracing: hide unused ftrace_event_id_fops (git-fixes).\n- tty: n_gsm: fix missing receive state reset after mode switch (git-fixes).\n- tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (git-fixes).\n- Update patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch (bsc#1222893).\n- Update patches.suse/scsi-qedf-Don-t-process-stag-work-during-unload.patch (bsc#1214852)\n- Update patches.suse/scsi-qedf-Wait-for-stag-work-during-unload.patch (bsc#1214852)\n- usb: aqc111: stop lying about skb-\u003etruesize (git-fixes).\n- USB: core: Add hub_get() and hub_put() routines (git-fixes).\n- USB: core: Fix access violation during port device removal (git-fixes).\n- USB: core: Fix deadlock in port 'disable' sysfs attribute (git-fixes).\n- usb: dwc3: core: Prevent phy suspend during init (Git-fixes).\n- usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).\n- usb: typec: tipd: fix event checking for tps6598x (git-fixes).\n- usb: typec: ucsi: displayport: Fix potential deadlock (git-fixes).\n- VMCI: Fix an error handling path in vmci_guest_probe_device() (git-fixes).\n- VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (stable-fixes).\n- vmci: prevent speculation leaks by sanitizing event in event_deliver() (git-fixes).\n- watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (git-fixes).\n- watchdog: ixp4xx: Make sure restart always works (git-fixes).\n- watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin (git-fixes).\n- wifi: ar5523: enable proper endpoint verification (git-fixes).\n- wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).\n- wifi: ath10k: poll service ready message before failing (git-fixes).\n- wifi: ath10k: populate board data for WCN3990 (git-fixes).\n- wifi: ath11k: do not force enable power save on non-running vdevs (git-fixes).\n- wifi: carl9170: add a proper sanity check for endpoints (git-fixes).\n- wifi: carl9170: re-fix fortified-memset warning (git-fixes).\n- wifi: cfg80211: fix rdev_dump_mpp() arguments order (stable-fixes).\n- wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc (stable-fixes).\n- wifi: mwl8k: initialize cmd-\u003eaddr[] properly (git-fixes).\n- x86/boot: Ignore NMIs during very early boot (git-fixes).\n- x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).\n- x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (git-fixes).\n- x86/bugs: Fix BHI documentation (git-fixes).\n- x86/bugs: Fix BHI handling of RRSBA (git-fixes).\n- x86/bugs: Fix BHI retpoline check (git-fixes).\n- x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).\n- x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).\n- x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (git-fixes).\n- x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (git-fixes).\n- x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram (git-fixes).\n- x86/kvm: Do not try to disable kvmclock if it was not enabled (git-fixes).\n- x86/lib: Fix overflow when counting digits (git-fixes).\n- x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).\n- x86/nmi: Drop unused declaration of proc_nmi_enabled() (git-fixes).\n- x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO (git-fixes).\n- x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler (git-fixes).\n- x86/sme: Fix memory encryption setting if enabled by default and not overridden (git-fixes).\n- x86/tdx: Preserve shared bit on mprotect() (git-fixes).\n- xfs: add missing cmap-\u003ebr_state = XFS_EXT_NORM update (git-fixes).\n- xfs: fix exception caused by unexpected illegal bestcount in leaf dir (git-fixes).\n- xfs: Fix false ENOSPC when performing direct write on a delalloc extent in cow fork (git-fixes).\n- xfs: fix imprecise logic in xchk_btree_check_block_owner (git-fixes).\n- xfs: fix inode reservation space for removing transaction (git-fixes).\n- xfs: shrink failure needs to hold AGI buffer (git-fixes).\n","status":"published","published":"2024-06-12T11:33:43Z","modified":"2026-02-04T03:04:59.394977Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2011-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).\n- CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).\n- CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).\n- CVE-2024-26929: Fixed double free of fcport (bsc#1223715).\n- CVE-2024-26930: Fixed double free of the ha-\u003evp_map pointer (bsc#1223626).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).\n- CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).\n- CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).\n- CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).\n- CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).\n- CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).\n- CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).\n- CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).\n\nThe following non-security bugs were fixed:\n\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- filemap: remove use of wait bookmarks (bsc#1224085).\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).\n- powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).\n- powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n- supported.conf: support tcp_dctcp module (jsc#PED-8111)\n","status":"published","published":"2024-06-12T16:39:51Z","modified":"2026-02-04T02:22:35.130887Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2019-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).\n- CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).\n- CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).\n- CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).\n- CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).\n- CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).\n- CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)\n- CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).\n- CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).\n- CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).\n- CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).\n- CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).\n- CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).\n- CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765).\n- CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).\n- CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).\n- CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).\n- CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).\n- CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).\n- CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224672).\n- CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated (bsc#1222464).\n- CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).\n- CVE-2023-42755: Check user supplied offsets (bsc#1215702).\n- CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).\n- CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (CVE-2023-52698 bsc#1224621)\n- CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).\n- CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs (bsc#1225097).\n- CVE-2024-27431: Fixed Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).\n- CVE-2024-35860: struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).\n- CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).\n- CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).\n- CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).\n- CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).\n- CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).\n- CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).\n- CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).\n- CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)\n- CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).\n- CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).\n- CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).\n- CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).\n- CVE-2024-35885: Stop interface during shutdown (bsc#1224519).\n- CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).\n- CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).\n- CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).\n- CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).\n- CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).\n- CVE-2024-35791: Flush pages under kvm-\u003elock to fix UAF in  svm_register_enc_region() (bsc#1224725).\n- CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).\n- CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).\n- CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).\n- CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).\n- CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).\n- CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).\n- CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).\n- CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).\n- CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).\n- CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)\n- CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).\n- CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).\n- CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).\n- CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).\n- CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).\n- CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).\n- CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).\n- CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).\n- CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).\n- CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).\n- CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).\n- CVE-2024-26900: Fixed kmemleak of rdev-\u003eserial (bsc#1223046).\n- CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).\n- CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).\n- CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).\n- CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).\n- CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)\n- CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)\n- CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).\n\nThe following non-security bugs were fixed:\n\n- 9p: explicitly deny setlease attempts (git-fixes).\n- ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).\n- ACPI: disable -Wstringop-truncation (git-fixes).\n- ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).\n- ACPI: LPSS: Advertise number of chip selects via property (git-fixes).\n- admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET (git-fixes).\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- ALSA: core: Fix NULL module pointer assignment at card init (git-fixes).\n- ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup (git-fixes).\n- ALSA: line6: Zero-initialize message buffers (stable-fixes).\n- ARM: 9381/1: kasan: clear stale stack poison (git-fixes).\n- ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).\n- ASoC: Intel: avs: Fix potential integer overflow (git-fixes).\n- ASoC: Intel: avs: ssm4567: Do not ignore route checks (git-fixes).\n- ASoC: Intel: Disable route checks for Skylake boards (git-fixes).\n- ASoC: kirkwood: Fix potential NULL dereference (git-fixes).\n- ASoC: mediatek: mt8192: fix register configuration for tdm (git-fixes).\n- ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).\n- ASoC: meson: axg-fifo: use threaded irq to check periods (git-fixes).\n- ASoC: tas2552: Add TX path for capturing AUDIO-OUT data (git-fixes).\n- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).\n- ata: pata_legacy: make legacy_exit() work again (git-fixes).\n- ata: sata_gemini: Check clk_enable() result (stable-fixes).\n- autofs: use wake_up() instead of wake_up_interruptible(() (bsc#1224166).\n- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (git-fixes).\n- Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (git-fixes).\n- Bluetooth: hci_sync: Do not double print name in add/remove adv_monitor (bsc#1216358).\n- Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (git-fixes).\n- Bluetooth: msft: fix slab-use-after-free in msft_do_close() (git-fixes).\n- Bluetooth: qca: add missing firmware sanity checks (git-fixes).\n- Bluetooth: qca: Fix error code in qca_read_fw_build_info() (git-fixes).\n- Bluetooth: qca: fix firmware check error path (git-fixes).\n- Bluetooth: qca: fix info leak when fetching fw build id (git-fixes).\n- Bluetooth: qca: fix NVM configuration parsing (git-fixes).\n- bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)\n- bpf: decouple prune and jump points (bsc#1225756).\n- bpf: fix precision backtracking instruction iteration (bsc#1225756).\n- bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END (git-fixes).\n- bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).\n- bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756).\n- bpf: remove unnecessary prune and jump points (bsc#1225756).\n- btrfs: add error messages to all unrecognized mount options (git-fixes)\n- btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)\n- btrfs: extend locking to all space_info members accesses (git-fixes)\n- btrfs: fix btrfs_submit_compressed_write cgroup attribution (git-fixes)\n- btrfs: fix fallocate to use file_modified to update permissions consistently (git-fixes)\n- btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)\n- btrfs: fix missing blkdev_put() call in btrfs_scan_one_device() (git-fixes)\n- btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)\n- btrfs: fix qgroup reserve overflow the qgroup limit (git-fixes)\n- btrfs: fix silent failure when deleting root reference (git-fixes)\n- btrfs: fix use-after-free after failure to create a snapshot (git-fixes)\n- btrfs: free exchange changeset on failures (git-fixes)\n- btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: make search_csum_tree return 0 if we get -EFBIG (git-fixes)\n- btrfs: prevent copying too big compressed lzo segment (git-fixes)\n- btrfs: remove BUG_ON(!eie) in find_parent_nodes (git-fixes)\n- btrfs: remove BUG_ON() in find_parent_nodes() (git-fixes)\n- btrfs: repair super block num_devices automatically (git-fixes)\n- btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling (git-fixes)\n- btrfs: send: ensure send_fd is writable (git-fixes)\n- btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)\n- btrfs: send: in case of IO error log it (git-fixes)\n- btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)\n- btrfs: tree-checker: check item_size for dev_item (git-fixes)\n- btrfs: tree-checker: check item_size for inode_item (git-fixes)\n- cifs: account for primary channel in the interface list (bsc#1224020).\n- cifs: cifs_chan_is_iface_active should be called with chan_lock held (bsc#1224020).\n- cifs: distribute channels across interfaces based on speed (bsc#1224020).\n- cifs: do not pass cifs_sb when trying to add channels (bsc#1224020).\n- cifs: failure to add channel on iface should bump up weight (git-fixes, bsc#1224020).\n- cifs: fix charset issue in reconnection (bsc#1224020).\n- cifs: fix leak of iface for primary channel (git-fixes, bsc#1224020).\n- cifs: handle cases where a channel is closed (bsc#1224020).\n- cifs: handle cases where multiple sessions share connection (bsc#1224020).\n- cifs: reconnect work should have reference on server struct (bsc#1224020).\n- clk: Do not hold prepare_lock when calling kref_put() (stable-fixes).\n- clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).\n- counter: stm32-lptimer-cnt: Provide defines for clock polarities (git-fixes).\n- counter: stm32-timer-cnt: Provide defines for slave mode selection (git-fixes).\n- cppc_cpufreq: Fix possible null pointer dereference (git-fixes).\n- cpu/hotplug: Remove the 'cpu' member of cpuhp_cpu_state (git-fixes).\n- cpumask: Add for_each_cpu_from() (bsc#1225053).\n- crypto: bcm - Fix pointer arithmetic (git-fixes).\n- crypto: ccp - drop platform ifdef checks (git-fixes).\n- crypto: ecdsa - Fix module auto-load on add-key (git-fixes).\n- crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).\n- dm-multipath: dont't attempt SG_IO on non-SCSI-disks (bsc#1223575).\n- dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users (git-fixes).\n- dmaengine: axi-dmac: fix possible race in remove() (git-fixes).\n- dmaengine: idma64: Add check for dma_set_max_seg_size (git-fixes).\n- docs: kernel_include.py: Cope with docutils 0.21 (stable-fixes).\n- drivers/nvme: Add quirks for device 126f:2262 (git-fixes).\n- drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference (git-fixes).\n- drm: vc4: Fix possible null pointer dereference (git-fixes).\n- drm/amd: Flush GFXOFF requests in prepare stage (git-fixes).\n- drm/amd/display: Atom Integrated System Info v2_2 for DCN35 (stable-fixes).\n- drm/amd/display: Fix division by zero in setup_dsc_config (stable-fixes).\n- drm/amd/display: Fix potential index out of bounds in color transformation function (git-fixes).\n- drm/amd/display: Handle Y carry-over in VCP X.Y calculation (stable-fixes).\n- drm/amdgpu: Refine IB schedule error logging (stable-fixes).\n- drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (git-fixes).\n- drm/arm/malidp: fix a possible null pointer dereference (git-fixes).\n- drm/bridge: anx7625: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: dpc3433: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: icn6211: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt8912b: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt9611: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: fix support for jeida-18 and jeida-24 (git-fixes).\n- drm/connector: Add \\n to message about demoting connector force-probes (git-fixes).\n- drm/i915/bios: Fix parsing backlight BDB data (git-fixes).\n- drm/lcdif: Do not disable clocks on already suspended hardware (git-fixes).\n- drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).\n- drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).\n- drm/meson: dw-hdmi: power up phy on device init (git-fixes).\n- drm/meson: vclk: fix calculation of 59.94 fractional rates (git-fixes).\n- drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).\n- drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).\n- drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk (git-fixes).\n- drm/nouveau/dp: Do not probe eDP ports twice harder (stable-fixes).\n- drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD does not assert (git-fixes).\n- drm/panel: novatek-nt35950: Do not log an error when DSI host can't be found (git-fixes).\n- drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector (git-fixes).\n- dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)\n- dyndbg: fix old BUG_ON in \u003econtrol parser (stable-fixes).\n- efi: libstub: only free priv.runtime_map when allocated (git-fixes).\n- extcon: max8997: select IRQ_DOMAIN instead of depending on it (git-fixes).\n- fail_function: fix wrong use of fei_attr_remove().\n- fbdev: savage: Handle err return when savagefb_check_var failed (git-fixes).\n- fbdev: shmobile: fix snprintf truncation (git-fixes).\n- fbdev: sisfb: hide unused variables (git-fixes).\n- firewire: ohci: mask bus reset interrupts between ISR and bottom half (stable-fixes).\n- firmware: dmi-id: add a release callback function (git-fixes).\n- firmware: raspberrypi: Use correct device for DMA mappings (git-fixes).\n- fs/9p: drop inodes immediately on non-.L too (git-fixes).\n- fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes).\n- fs/9p: translate O_TRUNC into OTRUNC (git-fixes).\n- gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpu: host1x: Do not setup DMA for virtual devices (stable-fixes).\n- HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors (git-fixes).\n- hwmon: (corsair-cpro) Protect ccp-\u003ewait_input_report with a spinlock (git-fixes).\n- hwmon: (corsair-cpro) Use a separate buffer for sending commands (git-fixes).\n- hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() (git-fixes).\n- hwmon: (lm70) fix links in doc and comments (git-fixes).\n- hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us (git-fixes).\n- i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame (git-fixes).\n- i3c: master: svc: fix invalidate IBI type and miss call client IBI handler (git-fixes).\n- IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- iio: core: Leave private pointer NULL when no private data supplied (git-fixes).\n- iio: pressure: dps310: support negative temperature values (git-fixes).\n- Input: cyapa - add missing input core locking to suspend/resume functions (git-fixes).\n- Input: ims-pcu - fix printf string overflow (git-fixes).\n- Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation (git-fixes).\n- io_uring/unix: drop usage of io_uring socket (git-fixes).\n- iomap: Fix inline extent handling in iomap_readpage (git-fixes)\n- iomap: iomap: fix memory corruption when recording errors during writeback (git-fixes)\n- iomap: Support partial direct I/O on user copy failures (git-fixes)\n- iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)\n- jffs2: prevent xattr node from overflowing the eraseblock (git-fixes).\n- kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756).\n- kcm: do not sense pfmemalloc status in kcm_sendpage() (git-fixes bsc#1223959)\n- KEYS: trusted: Do not use WARN when encode fails (git-fixes).\n- KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).\n- KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1224794).\n- KVM: x86: Delete duplicate documentation for KVM_X86_SET_MSR_FILTER (git-fixes).\n- leds: pwm: Disable PWM when going to suspend (git-fixes).\n- libsubcmd: Fix parse-options memory leak (git-fixes).\n- locking/atomic: Make test_and_*_bit() ordered on failure (git-fixes).\n- media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries (git-fixes).\n- media: dt-bindings: ovti,ov2680: Fix the power supply names (git-fixes).\n- media: mc: mark the media devnode as registered from the, start (git-fixes).\n- media: ngene: Add dvb_ca_en50221_init return value check (git-fixes).\n- media: stk1160: fix bounds checking in stk1160_copy_video() (git-fixes).\n- mei: me: add lunar lake point M DID (stable-fixes).\n- mfd: intel-lpss: Revert 'Add missing check for platform_get_resource' (git-fixes).\n- mfd: ti_am335x_tscadc: Support the correctly spelled DT property (git-fixes).\n- mfd: tqmx86: Specify IO port register range more precisely (git-fixes).\n- mlxbf_gige: Enable the GigE port in mlxbf_gige_open (git-fixes).\n- mlxbf_gige: Fix intermittent no ip issue (git-fixes).\n- mlxbf_gige: stop PHY during open() error paths (git-fixes).\n- mmc: sdhci_am654: Add tuning algorithm for delay chain (git-fixes).\n- mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).\n- mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() (git-fixes).\n- mtd: rawnand: hynix: fixed typo (git-fixes).\n- net: do not sense pfmemalloc status in skb_append_pagefrags() (git-fixes bsc#1223959)\n- net: introduce __skb_fill_page_desc_noacc (git-fixes bsc#1223959)\n- net: nfc: remove inappropriate attrs check (stable-fixes).\n- net: qualcomm: rmnet: fix global oob in rmnet_policy (git-fixes).\n- net: usb: ax88179_178a: fix link status when link is set to down/up (git-fixes).\n- net: usb: smsc95xx: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: sr9700: stop lying about skb-\u003etruesize (git-fixes).\n- net:usb:qmi_wwan: support Rolling modules (stable-fixes).\n- netfilter: nf_tables: bail out early if hardware offload is not supported (git-fixes bsc#1223961)\n- nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() (git-fixes).\n- nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).\n- nilfs2: fix out-of-range warning (git-fixes).\n- nilfs2: fix unexpected freezing of nilfs_segctor_sync() (git-fixes).\n- nilfs2: fix use-after-free of timer for log writer thread (git-fixes).\n- nilfs2: make superblock data array index computation sparse friendly (git-fixes).\n- nvme-multipath: fix io accounting on failover (git-fixes).\n- nvme: ensure disabling pairs with unquiesce (bsc#1224534).\n- nvme: fix miss command type check (git-fixes).\n- nvme: fix multipath batched completion accounting (git-fixes).\n- nvmet: fix ns enable/disable possible hang (git-fixes).\n- PCI: dwc: Detect iATU settings after getting 'addr_space' resource (git-fixes).\n- PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host (git-fixes).\n- PCI: dwc: Use the bitmap API to allocate bitmaps (git-fixes).\n- PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id (git-fixes).\n- PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).\n- PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 (git-fixes).\n- pinctrl: armada-37xx: remove an unused variable (git-fixes).\n- pinctrl: core: delete incorrect free in pinctrl_enable() (git-fixes).\n- pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin() (stable-fixes).\n- pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (git-fixes).\n- pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T (git-fixes).\n- pinctrl/meson: fix typo in PDM's pin name (git-fixes).\n- platform/x86: xiaomi-wmi: Fix race condition when reporting key events (git-fixes).\n- platform/x86/intel-uncore-freq: Do not present root domain on error (git-fixes).\n- power: rt9455: hide unused rt9455_boost_voltage_values (git-fixes).\n- powerpc/eeh: Permanently disable the removed device (bsc#1223991 ltc#205740).\n- powerpc/eeh: Small refactor of eeh_handle_normal_event() (bsc#1223991 ltc#205740).\n- powerpc/eeh: Use a goto for recovery failures (bsc#1223991 ltc#205740).\n- powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).\n- powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- powerpc/uaccess: Fix build errors seen with GCC 13/14 (bsc#1194869).\n- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).\n- ppdev: Add an error check in register_device (git-fixes).\n- printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1225616).\n- qibfs: fix dentry leak (git-fixes)\n- RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)\n- RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)\n- RDMA/hns: Fix GMV table pagesize (git-fixes)\n- RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)\n- RDMA/hns: Fix UAF for cq async event (git-fixes)\n- RDMA/hns: Modify the print level of CQE error (git-fixes)\n- RDMA/hns: Use complete parentheses in macros (git-fixes)\n- RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)\n- RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)\n- RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)\n- RDMA/rxe: Add ibdev_dbg macros for rxe (git-fixes)\n- RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)\n- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)\n- RDMA/rxe: Fix the problem 'mutex_destroy missing' (git-fixes)\n- RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_net.c (git-fixes)\n- RDMA/rxe: Split rxe_run_task() into two subroutines (git-fixes)\n- regulator: bd71828: Do not overwrite runtime voltages (git-fixes).\n- regulator: core: fix debugfs creation regression (git-fixes).\n- regulator: mt6360: De-capitalize devicetree regulator subnodes (git-fixes).\n- remoteproc: mediatek: Make sure IPI buffer fits in L2TCM (git-fixes).\n- ring-buffer: Fix a race between readers and resize checks (git-fixes).\n- s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes bsc#1224795).\n- s390/cio: fix tracepoint subchannel type field (git-fixes bsc#1224796).\n- s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224346).\n- s390/ipl: Fix incorrect initialization of len fields in nvme reipl block (git-fixes bsc#1225139).\n- s390/ipl: Fix incorrect initialization of nvme dump block (git-fixes bsc#1225138).\n- sched/topology: Optimize topology_span_sane() (bsc#1225053).\n- scsi: arcmsr: Support new PCI device IDs 1883 and 1886 (git-fixes).\n- scsi: bfa: Fix function pointer type mismatch for hcb_qe-\u003ecbfn (git-fixes).\n- scsi: core: Consult supported VPD page list prior to fetching page (git-fixes).\n- scsi: core: Fix unremoved procfs host directory regression (git-fixes).\n- scsi: csiostor: Avoid function pointer casts (git-fixes).\n- scsi: libfc: Do not schedule abort twice (git-fixes).\n- scsi: libfc: Fix up timeout error in fc_fcp_rec_error() (git-fixes).\n- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).\n- scsi: lpfc: Change default logging level for unsolicited CT MIB commands (bsc#1225842).\n- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask (bsc#1225842).\n- scsi: lpfc: Clear deferred RSCN processing flag when driver is unloading (bsc#1225842).\n- scsi: lpfc: Copyright updates for 14.4.0.2 patches (bsc#1225842).\n- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list (bsc#1225842).\n- scsi: lpfc: Update logging of protection type for T10 DIF I/O (bsc#1225842).\n- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).\n- scsi: mpt3sas: Prevent sending diag_reset when the controller is ready (git-fixes).\n- scsi: mylex: Fix sysfs buffer lengths (git-fixes).\n- scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (git-fixes).\n- scsi: sd: Unregister device if device_add_disk() failed in sd_probe() (git-fixes).\n- selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).\n- serial: 8250_bcm7271: use default_mux_rate if possible (git-fixes).\n- serial: kgdboc: Fix NMI-safety problems from keyboard reset code (stable-fixes).\n- serial: max3100: Fix bitwise types (git-fixes).\n- serial: max3100: Lock port-\u003elock when calling uart_handle_cts_change() (git-fixes).\n- serial: max3100: Update uart_driver_registered on driver removal (git-fixes).\n- serial: sc16is7xx: add proper sched.h include for sched_set_fifo() (git-fixes).\n- serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler (git-fixes).\n- serial: sh-sci: protect invalidating RXDMA on shutdown (git-fixes).\n- smb: client: ensure to try all targets when finding nested links (bsc#1224020).\n- smb: client: fix mount when dns_resolver key is not available (git-fixes, bsc#1224020).\n- smb: client: get rid of dfs code dep in namespace.c (bsc#1224020).\n- smb: client: get rid of dfs naming in automount code (bsc#1224020).\n- smb: client: introduce DFS_CACHE_TGT_LIST() (bsc#1224020).\n- smb: client: reduce stack usage in cifs_try_adding_channels() (bsc#1224020).\n- smb: client: remove extra @chan_count check in __cifs_put_smb_ses() (bsc#1224020).\n- smb: client: rename cifs_dfs_ref.c to namespace.c (bsc#1224020).\n- smb3: show beginning time for per share stats (bsc#1224020).\n- soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).\n- soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request (git-fixes).\n- speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).\n- spmi: Add a check for remove callback when removing a SPMI driver (git-fixes).\n- spmi: hisi-spmi-controller: Do not override device identifier (git-fixes).\n- swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331).\n- swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)\n- swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)\n- swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)\n- sysv: do not call sb_bread() with pointers_lock held (git-fixes).\n- thermal/drivers/tsens: Fix null pointer dereference (git-fixes).\n- tools/latency-collector: Fix -Wformat-security compile warns (git-fixes).\n- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer (bsc#1225535)\n- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (git-fixes).\n- tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test (git-fixes).\n- tracing: hide unused ftrace_event_id_fops (git-fixes).\n- tty: n_gsm: fix missing receive state reset after mode switch (git-fixes).\n- tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (git-fixes).\n- usb: aqc111: stop lying about skb-\u003etruesize (git-fixes).\n- usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).\n- usb: typec: tipd: fix event checking for tps6598x (git-fixes).\n- usb: typec: ucsi: displayport: Fix potential deadlock (git-fixes).\n- VMCI: Fix an error handling path in vmci_guest_probe_device() (git-fixes).\n- VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (stable-fixes).\n- vmci: prevent speculation leaks by sanitizing event in event_deliver() (git-fixes).\n- watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (git-fixes).\n- watchdog: ixp4xx: Make sure restart always works (git-fixes).\n- watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin (git-fixes).\n- wifi: ar5523: enable proper endpoint verification (git-fixes).\n- wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).\n- wifi: ath10k: poll service ready message before failing (git-fixes).\n- wifi: ath10k: populate board data for WCN3990 (git-fixes).\n- wifi: ath11k: do not force enable power save on non-running vdevs (git-fixes).\n- wifi: carl9170: add a proper sanity check for endpoints (git-fixes).\n- wifi: carl9170: re-fix fortified-memset warning (git-fixes).\n- wifi: cfg80211: fix rdev_dump_mpp() arguments order (stable-fixes).\n- wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc (stable-fixes).\n- wifi: mwl8k: initialize cmd-\u003eaddr[] properly (git-fixes).\n- x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram (git-fixes).\n- x86/boot: Ignore NMIs during very early boot (git-fixes).\n- x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (git-fixes).\n- x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).\n- x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (git-fixes).\n- x86/kvm: Do not try to disable kvmclock if it was not enabled (git-fixes).\n- x86/lib: Fix overflow when counting digits (git-fixes).\n- x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).\n- x86/nmi: Drop unused declaration of proc_nmi_enabled() (git-fixes).\n- x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO (git-fixes).\n- x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler (git-fixes).\n- x86/sme: Fix memory encryption setting if enabled by default and not overridden (git-fixes).\n- x86/tdx: Preserve shared bit on mprotect() (git-fixes).\n- xfs: add missing cmap-\u003ebr_state = XFS_EXT_NORM update (git-fixes).\n- xfs: fix exception caused by unexpected illegal bestcount in leaf dir (git-fixes).\n- xfs: Fix false ENOSPC when performing direct write on a delalloc extent in cow fork (git-fixes).\n- xfs: fix imprecise logic in xchk_btree_check_block_owner (git-fixes).\n- xfs: fix inode reservation space for removing transaction (git-fixes).\n- xfs: shrink failure needs to hold AGI buffer (git-fixes).\n","status":"published","published":"2024-06-13T10:40:58Z","modified":"2026-02-04T04:34:29.47959Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2189-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).\n- CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).\n- CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).\n- CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).\n- CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).\n- CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).\n- CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).\n- CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).\n- CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).\n- CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).\n- CVE-2024-26929: Fixed double free of fcport (bsc#1223715).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2024-26930: Fixed double free of the ha-\u003evp_map pointer (bsc#1223626).\n- CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).\n\nThe following non-security bugs were fixed:\n\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- filemap: remove use of wait bookmarks (bsc#1224085).\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).\n- powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).\n- powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n","status":"published","published":"2024-06-25T06:34:56Z","modified":"2026-02-04T03:48:02.097364Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2024:2190-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2021-47548: Fixed a possible array out-of=bounds (bsc#1225506)\n- CVE-2022-48689: Fixed data-race in lru_add_fn (bsc#1223959)\n- CVE-2022-48691: Fixed memory leak in netfilter (bsc#1223961)\n- CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).\n- CVE-2023-42755: Check user supplied offsets (bsc#1215702).\n- CVE-2023-52586: Fixed  mutex lock in control vblank irq (bsc#1221081).\n- CVE-2023-52618: Fixed string overflow in block/rnbd-srv (bsc#1221615).\n- CVE-2023-52655: Check packet for fixup for true limit (bsc#1217169).\n- CVE-2023-52656: Dropped any code related to SCM_RIGHTS (bsc#1224187).\n- CVE-2023-52660: Fiedx IRQ handling due to shared interrupts  (bsc#1224443).\n- CVE-2023-52664: Eliminate double free in error handling logic  (bsc#1224747).\n- CVE-2023-52671: Fixed hang/underflow when transitioning to ODM4:1 (bsc#1224729).\n- CVE-2023-52674: Add clamp() in scarlett2_mixer_ctl_put()  (bsc#1224727).\n- CVE-2023-52680: Fixed missing error checks to *_ctl_get()  (bsc#1224608).\n- CVE-2023-52692: Fixed missing error check to  scarlett2_usb_set_config() (bsc#1224628).\n- CVE-2023-52698: Fixed memory leak in netlbl_calipso_add_pass()  (bsc#1224621)\n- CVE-2023-52746: Prevent potential spectre v1 gadget in xfrm_xlate32_attr()  (bsc#1225114)\n- CVE-2023-52757: Fixed potential deadlock when releasing mids  (bsc#1225548).\n- CVE-2023-52795: Fixed use after free in vhost_vdpa_probe()  (bsc#1225085).\n- CVE-2023-52796: Add ipvlan_route_v6_outbound() helper (bsc#1224930).\n- CVE-2023-52807: Fixed out-of-bounds access may occur when coalesce  info is read via debugfs (bsc#1225097).\n- CVE-2023-52860: Fixed null pointer dereference in hisi_hns3 (bsc#1224936).\n- CVE-2023-6531: Fixed a use-after-free flaw due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic()on the socket that the SKB is queued on (bsc#1218447).\n- CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).\n- CVE-2024-26643: Fixed mark set as dead when unbinding anonymous  set with timeout (bsc#1221829).\n- CVE-2024-26679: Fixed read sk-\u003esk_family once in inet_recv_error() (bsc#1222385).\n- CVE-2024-26692: Fixed regression in writes when non-standard maximum write  size negotiated (bsc#1222464).\n- CVE-2024-26700: Fixed drm/amd/display: Fix MST Null Ptr for RV (bsc#1222870) \n- CVE-2024-26715: Fixed NULL pointer dereference in  dwc3_gadget_suspend (bsc#1222561).\n- CVE-2024-26742: Fixed disable_managed_interrupts (git-fixes  bsc#1222608).\n- CVE-2024-26775: Fixed potential deadlock at set_capacity (bsc#1222627).\n- CVE-2024-26777: Error out if pixclock equals zero in fbdev/sis (bsc#1222765)\n- CVE-2024-26778: Error out if pixclock equals zero in fbdev/savage (bsc#1222770)\n- CVE-2024-26791: Fixed properly validate device names in btrfs (bsc#1222793)\n- CVE-2024-26822: Set correct id, uid and cruid for multiuser  automounts (bsc#1223011).\n- CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-26839: Fixed a memleak in init_credit_return() (bsc#1222975)\n- CVE-2024-26876: Fixed crash on irq during probe (bsc#1223119).\n- CVE-2024-26900: Fixed kmemleak of rdev-\u003eserial (bsc#1223046).\n- CVE-2024-26907: Fixed a fortify source warning while accessing Eth segment in mlx5 (bsc#1223203).\n- CVE-2024-26915: Reset IH OVERFLOW_CLEAR bit (bsc#1223207)\n- CVE-2024-26919: Fixed debugfs directory leak (bsc#1223847).\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).\n- CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).\n- CVE-2024-26939: Fixed UAF on destroy against retire race (bsc#1223679).\n- CVE-2024-26958: Fixed UAF in direct writes (bsc#1223653).\n- CVE-2024-27042: Fixed potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (bsc#1223823).\n- CVE-2024-27395: Fixed Use-After-Free in ovs_ct_exit (bsc#1224098).\n- CVE-2024-27396: Fixed Use-After-Free in gtp_dellink (bsc#1224096).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2024-27401: Fixed user_length taken into account when  fetching packet contents (bsc#1224181).\n- CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).\n- CVE-2024-27417: Fixed potential 'struct net' leak in inet6_rtm_getaddr()  (bsc#1224721)\n- CVE-2024-27419: Fixed data-races around sysctl_net_busy_read  (bsc#1224759)\n- CVE-2024-27431: Zero-initialise xdp_rxq_info struct before running  XDP program (bsc#1224718).\n- CVE-2024-35791: Flush pages under kvm-\u003elock to fix UAF in  svm_register_enc_region() (bsc#1224725).\n- CVE-2024-35799: Prevent crash when disable stream (bsc#1224740).\n- CVE-2024-35804: Mark target gfn of emulated atomic instruction as  dirty (bsc#1224638).\n- CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).\n- CVE-2024-35852: Fixed memory leak when canceling rehash  work (bsc#1224502).\n- CVE-2024-35854: Fixed possible use-after-free during  rehash (bsc#1224636).\n- CVE-2024-35860: Struct bpf_link and bpf_link_ops kABI workaround  (bsc#1224531).\n- CVE-2024-35861: Fixed potential UAF in  cifs_signal_cifsd_for_reconnect() (bsc#1224766).\n- CVE-2024-35862: Fixed potential UAF in smb2_is_network_name_deleted()  (bsc#1224764).\n- CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).\n- CVE-2024-35864: Fixed potential UAF in smb2_is_valid_lease_break()  (bsc#1224765,).\n- CVE-2024-35865: Fixed potential UAF in smb2_is_valid_oplock_break()  (bsc#1224668).\n- CVE-2024-35866: Fixed potential UAF in cifs_dump_full_key()  (bsc#1224667).\n- CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).\n- CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).\n- CVE-2024-35869: Guarantee refcounted children from parent session  (bsc#1224679).\n- CVE-2024-35870: Fixed UAF in smb2_reconnect_server() (bsc#1224020,  bsc#1224672).\n- CVE-2024-35872: Fixed GUP-fast succeeding on secretmem folios  (bsc#1224530).\n- CVE-2024-35875: Require seeding RNG with RDRAND on CoCo systems (bsc#1224665).\n- CVE-2024-35877: Fixed VM_PAT handling in COW mappings (bsc#1224525).\n- CVE-2024-35878: Prevent NULL pointer dereference in vsnprintf()  (bsc#1224671).\n- CVE-2024-35879: kABI workaround for drivers/of/dynamic.c (bsc#1224524).\n- CVE-2024-35885: Stop interface during shutdown (bsc#1224519).\n- CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).\n- CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).\n- CVE-2024-35907: Call request_irq() after NAPI initialized  (bsc#1224492).\n- CVE-2024-35924: Limit read size on v1.2 (bsc#1224657).\n- CVE-2024-35939: Fixed leak pages on dma_set_decrypted() failure (bsc#1224535).\n- CVE-2024-35943: Fixed a null pointer dereference in omap_prm_domain_init (bsc#1224649).\n- CVE-2024-35944: Fixed memcpy() run-time warning in dg_dispatch_as_host()  (bsc#1224648).\n- CVE-2024-35951: Fixed the error path in panfrost_mmu_map_fault_addr() (bsc#1224701).\n- CVE-2024-35959: Fixed mlx5e_priv_init() cleanup flow (bsc#1224666).\n- CVE-2024-35964: Fixed not validating setsockopt user input  (bsc#1224581).\n- CVE-2024-35969: Fixed race condition between ipv6_get_ifaddr and ipv6_del_addr  (bsc#1224580).\n- CVE-2024-35973: Fixed header validation in geneve[6]_xmit_skb  (bsc#1224586).\n- CVE-2024-35976: Validate user input for XDP_{UMEM|COMPLETION}_FILL_RING  (bsc#1224575).\n- CVE-2024-35998: Fixed lock ordering potential deadlock in  cifs_sync_mid_result (bsc#1224549).\n- CVE-2024-35999: Fixed missing lock when picking channel (bsc#1224550).\n- CVE-2024-36006: Fixed incorrect list API usage  (bsc#1224541).\n- CVE-2024-36007: Fixed warning during rehash  (bsc#1224543).\n- CVE-2024-36938: Fixed NULL pointer dereference in  sk_psock_skb_ingress_enqueue (bsc#1225761).\n\nThe following non-security bugs were fixed:\n\n- 9p: explicitly deny setlease attempts (git-fixes).\n- ACPI: bus: Indicate support for _TFP thru _OSC (git-fixes).\n- ACPI: disable -Wstringop-truncation (git-fixes).\n- ACPI: Fix Generic Initiator Affinity _OSC bit (git-fixes).\n- ACPI: LPSS: Advertise number of chip selects via property (git-fixes).\n- admin-guide/hw-vuln/core-scheduling: fix return type of PR_SCHED_CORE_GET (git-fixes).\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- ALSA: core: Fix NULL module pointer assignment at card init (git-fixes).\n- ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup (git-fixes).\n- ALSA: line6: Zero-initialize message buffers (stable-fixes).\n- ARM: 9381/1: kasan: clear stale stack poison (git-fixes).\n- ASoC: Intel: avs: Fix ASRC module initialization (git-fixes).\n- ASoC: Intel: avs: Fix potential integer overflow (git-fixes).\n- ASoC: Intel: avs: ssm4567: Do not ignore route checks (git-fixes).\n- ASoC: Intel: Disable route checks for Skylake boards (git-fixes).\n- ASoC: kirkwood: Fix potential NULL dereference (git-fixes).\n- ASoC: mediatek: mt8192: fix register configuration for tdm (git-fixes).\n- ASoC: meson: axg-fifo: use FIELD helpers (stable-fixes).\n- ASoC: meson: axg-fifo: use threaded irq to check periods (git-fixes).\n- ASoC: tas2552: Add TX path for capturing AUDIO-OUT data (git-fixes).\n- ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value (git-fixes).\n- ata: pata_legacy: make legacy_exit() work again (git-fixes).\n- ata: sata_gemini: Check clk_enable() result (stable-fixes).\n- autofs: use wake_up() instead of wake_up_interruptible(() (bsc#1224166).\n- Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (git-fixes).\n- Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() (git-fixes).\n- Bluetooth: hci_sync: Do not double print name in add/remove adv_monitor (bsc#1216358).\n- Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (git-fixes).\n- Bluetooth: msft: fix slab-use-after-free in msft_do_close() (git-fixes).\n- Bluetooth: qca: add missing firmware sanity checks (git-fixes).\n- Bluetooth: qca: Fix error code in qca_read_fw_build_info() (git-fixes).\n- Bluetooth: qca: fix firmware check error path (git-fixes).\n- Bluetooth: qca: fix info leak when fetching fw build id (git-fixes).\n- Bluetooth: qca: fix NVM configuration parsing (git-fixes).\n- bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (git-fixes)\n- bpf: decouple prune and jump points (bsc#1225756).\n- bpf: fix precision backtracking instruction iteration (bsc#1225756).\n- bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END (git-fixes).\n- bpf: handle ldimm64 properly in check_cfg() (bsc#1225756).\n- bpf: mostly decouple jump history management from is_state_visited() (bsc#1225756).\n- bpf: remove unnecessary prune and jump points (bsc#1225756).\n- btrfs: add error messages to all unrecognized mount options (git-fixes)\n- btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: export: handle invalid inode or root reference in btrfs_get_parent() (git-fixes)\n- btrfs: extend locking to all space_info members accesses (git-fixes)\n- btrfs: fix btrfs_submit_compressed_write cgroup attribution (git-fixes)\n- btrfs: fix information leak in btrfs_ioctl_logical_to_ino() (git-fixes)\n- btrfs: fix missing blkdev_put() call in btrfs_scan_one_device() (git-fixes)\n- btrfs: fix off-by-one chunk length calculation at contains_pending_extent() (git-fixes)\n- btrfs: fix qgroup reserve overflow the qgroup limit (git-fixes)\n- btrfs: fix silent failure when deleting root reference (git-fixes)\n- btrfs: fix use-after-free after failure to create a snapshot (git-fixes)\n- btrfs: free exchange changeset on failures (git-fixes)\n- btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (git-fixes)\n- btrfs: make search_csum_tree return 0 if we get -EFBIG (git-fixes)\n- btrfs: prevent copying too big compressed lzo segment (git-fixes)\n- btrfs: remove BUG_ON(!eie) in find_parent_nodes (git-fixes)\n- btrfs: remove BUG_ON() in find_parent_nodes() (git-fixes)\n- btrfs: repair super block num_devices automatically (git-fixes)\n- btrfs: replace the BUG_ON in btrfs_del_root_ref with proper error handling (git-fixes)\n- btrfs: send: ensure send_fd is writable (git-fixes)\n- btrfs: send: handle path ref underflow in header iterate_inode_ref() (git-fixes)\n- btrfs: send: in case of IO error log it (git-fixes)\n- btrfs: send: return EOPNOTSUPP on unknown flags (git-fixes)\n- btrfs: tree-checker: check item_size for dev_item (git-fixes)\n- btrfs: tree-checker: check item_size for inode_item (git-fixes)\n- cifs: account for primary channel in the interface list (bsc#1224020).\n- cifs: cifs_chan_is_iface_active should be called with chan_lock held (bsc#1224020).\n- cifs: distribute channels across interfaces based on speed (bsc#1224020).\n- cifs: do not pass cifs_sb when trying to add channels (bsc#1224020).\n- cifs: failure to add channel on iface should bump up weight (git-fixes, bsc#1224020).\n- cifs: fix charset issue in reconnection (bsc#1224020).\n- cifs: fix leak of iface for primary channel (git-fixes, bsc#1224020).\n- cifs: handle cases where a channel is closed (bsc#1224020).\n- cifs: handle cases where multiple sessions share connection (bsc#1224020).\n- cifs: reconnect work should have reference on server struct (bsc#1224020).\n- clk: Do not hold prepare_lock when calling kref_put() (stable-fixes).\n- clk: qcom: mmcc-msm8998: fix venus clock issue (git-fixes).\n- counter: stm32-lptimer-cnt: Provide defines for clock polarities (git-fixes).\n- counter: stm32-timer-cnt: Provide defines for slave mode selection (git-fixes).\n- cppc_cpufreq: Fix possible null pointer dereference (git-fixes).\n- cpu/hotplug: Remove the 'cpu' member of cpuhp_cpu_state (git-fixes).\n- cpumask: Add for_each_cpu_from() (bsc#1225053).\n- crypto: bcm - Fix pointer arithmetic (git-fixes).\n- crypto: ccp - drop platform ifdef checks (git-fixes).\n- crypto: ecdsa - Fix module auto-load on add-key (git-fixes).\n- crypto: x86/nh-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha256-avx2 - add missing vzeroupper (git-fixes).\n- crypto: x86/sha512-avx2 - add missing vzeroupper (git-fixes).\n- dmaengine: axi-dmac: fix possible race in remove() (git-fixes).\n- dmaengine: idma64: Add check for dma_set_max_seg_size (git-fixes).\n- dm/amd/pm: Fix problems with reboot/shutdown for some SMU 13.0.4/13.0.11 users (git-fixes).\n- dm-multipath: dont't attempt SG_IO on non-SCSI-disks (bsc#1223575).\n- docs: kernel_include.py: Cope with docutils 0.21 (stable-fixes).\n- drivers/nvme: Add quirks for device 126f:2262 (git-fixes).\n- drm/amd/display: Atom Integrated System Info v2_2 for DCN35 (stable-fixes).\n- drm/amd/display: Fix division by zero in setup_dsc_config (stable-fixes).\n- drm/amd/display: Fix potential index out of bounds in color transformation function (git-fixes).\n- drm/amd/display: Handle Y carry-over in VCP X.Y calculation (stable-fixes).\n- drm/amd: Flush GFXOFF requests in prepare stage (git-fixes).\n- drm/amdgpu: Refine IB schedule error logging (stable-fixes).\n- drm/amdkfd: do not allow mapping the MMIO HDP page with large pages (git-fixes).\n- drm/arm/malidp: fix a possible null pointer dereference (git-fixes).\n- drm/bridge: anx7625: Do not log an error when DSI host can't be found (git-fixes).\n- drm: bridge: cdns-mhdp8546: Fix possible null pointer dereference (git-fixes).\n- drm/bridge: dpc3433: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: icn6211: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt8912b: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: lt9611: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: Do not log an error when DSI host can't be found (git-fixes).\n- drm/bridge: tc358775: fix support for jeida-18 and jeida-24 (git-fixes).\n- drm/connector: Add \\n to message about demoting connector force-probes (git-fixes).\n- drm/i915/bios: Fix parsing backlight BDB data (git-fixes).\n- drm/lcdif: Do not disable clocks on already suspended hardware (git-fixes).\n- drm/mediatek: Add 0 size check to mtk_drm_gem_obj (git-fixes).\n- drm/meson: dw-hdmi: add bandgap setting for g12 (git-fixes).\n- drm/meson: dw-hdmi: power up phy on device init (git-fixes).\n- drm/meson: vclk: fix calculation of 59.94 fractional rates (git-fixes).\n- drm/msm/dp: allow voltage swing / pre emphasis of 3 (git-fixes).\n- drm/msm/dpu: Always flush the slave INTF on the CTL (git-fixes).\n- drm/msm/dsi: Print dual-DSI-adjusted pclk instead of original mode pclk (git-fixes).\n- drm/nouveau/dp: Do not probe eDP ports twice harder (stable-fixes).\n- drm/panel: atna33xc20: Fix unbalanced regulator in the case HPD does not assert (git-fixes).\n- drm/panel: novatek-nt35950: Do not log an error when DSI host can't be found (git-fixes).\n- drm/panel: simple: Add missing Innolux G121X1-L03 format, flags, connector (git-fixes).\n- drm: vc4: Fix possible null pointer dereference (git-fixes).\n- dt-bindings: clock: qcom: Add missing UFS QREF clocks (git-fixes)\n- dyndbg: fix old BUG_ON in \u003econtrol parser (stable-fixes).\n- efi: libstub: only free priv.runtime_map when allocated (git-fixes).\n- extcon: max8997: select IRQ_DOMAIN instead of depending on it (git-fixes).\n- fail_function: fix wrong use of fei_attr_remove().\n- fbdev: savage: Handle err return when savagefb_check_var failed (git-fixes).\n- fbdev: shmobile: fix snprintf truncation (git-fixes).\n- fbdev: sisfb: hide unused variables (git-fixes).\n- firewire: ohci: mask bus reset interrupts between ISR and bottom half (stable-fixes).\n- firmware: dmi-id: add a release callback function (git-fixes).\n- firmware: raspberrypi: Use correct device for DMA mappings (git-fixes).\n- fs/9p: drop inodes immediately on non-.L too (git-fixes).\n- fs/9p: only translate RWX permissions for plain 9P2000 (git-fixes).\n- fs/9p: translate O_TRUNC into OTRUNC (git-fixes).\n- gpio: crystalcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpio: wcove: Use -ENOTSUPP consistently (stable-fixes).\n- gpu: host1x: Do not setup DMA for virtual devices (stable-fixes).\n- HID: intel-ish-hid: ipc: Add check for pci_alloc_irq_vectors (git-fixes).\n- hwmon: (corsair-cpro) Protect ccp-\u003ewait_input_report with a spinlock (git-fixes).\n- hwmon: (corsair-cpro) Use a separate buffer for sending commands (git-fixes).\n- hwmon: (corsair-cpro) Use complete_all() instead of complete() in ccp_raw_event() (git-fixes).\n- hwmon: (lm70) fix links in doc and comments (git-fixes).\n- hwmon: (pmbus/ucd9000) Increase delay from 250 to 500us (git-fixes).\n- i3c: master: svc: change ENXIO to EAGAIN when IBI occurs during start frame (git-fixes).\n- i3c: master: svc: fix invalidate IBI type and miss call client IBI handler (git-fixes).\n- IB/mlx5: Use __iowrite64_copy() for write combining stores (git-fixes)\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- iio: core: Leave private pointer NULL when no private data supplied (git-fixes).\n- iio: pressure: dps310: support negative temperature values (git-fixes).\n- Input: cyapa - add missing input core locking to suspend/resume functions (git-fixes).\n- Input: ims-pcu - fix printf string overflow (git-fixes).\n- Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation (git-fixes).\n- iomap: Fix inline extent handling in iomap_readpage (git-fixes)\n- iomap: iomap: fix memory corruption when recording errors during writeback (git-fixes)\n- iomap: Support partial direct I/O on user copy failures (git-fixes)\n- iommu/dma: Force swiotlb_max_mapping_size on an untrusted device (bsc#1224331)\n- io_uring/unix: drop usage of io_uring socket (git-fixes).\n- irqchip/gic-v3-its: Prevent double free on error (git-fixes).\n- jffs2: prevent xattr node from overflowing the eraseblock (git-fixes).\n- kABI: bpf: struct bpf_insn_aux_data kABI workaround (bsc#1225756).\n- kcm: do not sense pfmemalloc status in kcm_sendpage() (git-fixes bsc#1223959)\n- KEYS: trusted: Do not use WARN when encode fails (git-fixes).\n- KEYS: trusted: Fix memory leak in tpm2_key_encode() (git-fixes).\n- KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M (git-fixes bsc#1224794).\n- leds: pwm: Disable PWM when going to suspend (git-fixes).\n- libsubcmd: Fix parse-options memory leak (git-fixes).\n- locking/atomic: Make test_and_*_bit() ordered on failure (git-fixes).\n- media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries (git-fixes).\n- media: dt-bindings: ovti,ov2680: Fix the power supply names (git-fixes).\n- media: mc: mark the media devnode as registered from the, start (git-fixes).\n- media: ngene: Add dvb_ca_en50221_init return value check (git-fixes).\n- media: stk1160: fix bounds checking in stk1160_copy_video() (git-fixes).\n- mei: me: add lunar lake point M DID (stable-fixes).\n- mfd: intel-lpss: Revert 'Add missing check for platform_get_resource' (git-fixes).\n- mfd: ti_am335x_tscadc: Support the correctly spelled DT property (git-fixes).\n- mfd: tqmx86: Specify IO port register range more precisely (git-fixes).\n- mlxbf_gige: Enable the GigE port in mlxbf_gige_open (git-fixes).\n- mlxbf_gige: Fix intermittent no ip issue (git-fixes).\n- mlxbf_gige: stop PHY during open() error paths (git-fixes).\n- mmc: sdhci_am654: Add tuning algorithm for delay chain (git-fixes).\n- mmc: sdhci_am654: Write ITAPDLY for DDR52 timing (git-fixes).\n- Move upstreamed patches into sorted section\n- mtd: core: Report error if first mtd_otp_size() call fails in mtd_otp_nvmem_add() (git-fixes).\n- mtd: rawnand: hynix: fixed typo (git-fixes).\n- net: do not sense pfmemalloc status in skb_append_pagefrags() (git-fixes bsc#1223959)\n- netfilter: nf_tables: bail out early if hardware offload is not supported (git-fixes bsc#1223961)\n- net: introduce __skb_fill_page_desc_noacc (git-fixes bsc#1223959)\n- net: nfc: remove inappropriate attrs check (stable-fixes).\n- net: qualcomm: rmnet: fix global oob in rmnet_policy (git-fixes).\n- net: usb: ax88179_178a: fix link status when link is set to down/up (git-fixes).\n- net:usb:qmi_wwan: support Rolling modules (stable-fixes).\n- net: usb: smsc95xx: stop lying about skb-\u003etruesize (git-fixes).\n- net: usb: sr9700: stop lying about skb-\u003etruesize (git-fixes).\n- net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).\n- nfc: nci: Fix handling of zero-length payload packets in nci_rx_work() (git-fixes).\n- nfc: nci: Fix uninit-value in nci_rx_work (git-fixes).\n- nilfs2: fix out-of-range warning (git-fixes).\n- nilfs2: fix unexpected freezing of nilfs_segctor_sync() (git-fixes).\n- nilfs2: fix use-after-free of timer for log writer thread (git-fixes).\n- nilfs2: make superblock data array index computation sparse friendly (git-fixes).\n- nvme: ensure disabling pairs with unquiesce (bsc#1224534).\n- nvme: fix miss command type check (git-fixes).\n- nvme: fix multipath batched completion accounting (git-fixes).\n- nvme-multipath: fix io accounting on failover (git-fixes).\n- nvmet: fix ns enable/disable possible hang (git-fixes).\n- PCI: dwc: Detect iATU settings after getting 'addr_space' resource (git-fixes).\n- PCI: dwc: ep: Fix DBI access failure for drivers requiring refclk from host (git-fixes).\n- PCI: dwc: Use the bitmap API to allocate bitmaps (git-fixes).\n- PCI/EDR: Align EDR_PORT_DPC_ENABLE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI/EDR: Align EDR_PORT_LOCATE_DSM with PCI Firmware r3.3 (git-fixes).\n- PCI: rockchip-ep: Remove wrong mask on subsys_vendor_id (git-fixes).\n- PCI: tegra194: Fix probe path for Endpoint mode (git-fixes).\n- pinctrl: armada-37xx: remove an unused variable (git-fixes).\n- pinctrl: core: delete incorrect free in pinctrl_enable() (git-fixes).\n- pinctrl: core: handle radix_tree_insert() errors in pinctrl_register_one_pin() (stable-fixes).\n- pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map() (git-fixes).\n- pinctrl/meson: fix typo in PDM's pin name (git-fixes).\n- pinctrl: pinctrl-aspeed-g6: Fix register offset for pinconf of GPIOR-T (git-fixes).\n- platform/x86/intel-uncore-freq: Do not present root domain on error (git-fixes).\n- platform/x86: xiaomi-wmi: Fix race condition when reporting key events (git-fixes).\n- powerpc/eeh: Permanently disable the removed device (bsc#1223991 ltc#205740).\n- powerpc/eeh: Small refactor of eeh_handle_normal_event() (bsc#1223991 ltc#205740).\n- powerpc/eeh: Use a goto for recovery failures (bsc#1223991 ltc#205740).\n- powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).\n- powerpc/pseries/lparcfg: drop error message from guest name lookup (bsc#1187716 ltc#193451 git-fixes).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- powerpc/uaccess: Fix build errors seen with GCC 13/14 (bsc#1194869).\n- powerpc/uaccess: Use YZ asm constraint for ld (bsc#1194869).\n- power: rt9455: hide unused rt9455_boost_voltage_values (git-fixes).\n- ppdev: Add an error check in register_device (git-fixes).\n- printk: Update @console_may_schedule in console_trylock_spinning() (bsc#1225616).\n- qibfs: fix dentry leak (git-fixes)\n- RDMA/hns: Add max_ah and cq moderation capacities in query_device() (git-fixes)\n- RDMA/hns: Fix deadlock on SRQ async events. (git-fixes)\n- RDMA/hns: Fix GMV table pagesize (git-fixes)\n- RDMA/hns: Fix return value in hns_roce_map_mr_sg (git-fixes)\n- RDMA/hns: Fix UAF for cq async event (git-fixes)\n- RDMA/hns: Modify the print level of CQE error (git-fixes)\n- RDMA/hns: Use complete parentheses in macros (git-fixes)\n- RDMA/IPoIB: Fix format truncation compilation errors (git-fixes)\n- RDMA/mlx5: Adding remote atomic access flag to updatable flags (git-fixes)\n- RDMA/mlx5: Fix port number for counter query in multi-port configuration (git-fixes)\n- RDMA/rxe: Add ibdev_dbg macros for rxe (git-fixes)\n- RDMA/rxe: Fix incorrect rxe_put in error path (git-fixes)\n- RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt (git-fixes)\n- RDMA/rxe: Fix the problem 'mutex_destroy missing' (git-fixes)\n- RDMA/rxe: Replace pr_xxx by rxe_dbg_xxx in rxe_net.c (git-fixes)\n- RDMA/rxe: Split rxe_run_task() into two subroutines (git-fixes)\n- regulator: bd71828: Do not overwrite runtime voltages (git-fixes).\n- regulator: core: fix debugfs creation regression (git-fixes).\n- regulator: mt6360: De-capitalize devicetree regulator subnodes (git-fixes).\n- remoteproc: mediatek: Make sure IPI buffer fits in L2TCM (git-fixes).\n- Revert 'cifs: reconnect work should have reference on server struct' (git-fixes, bsc#1224020).\n- Revert 'drm/bridge: ti-sn65dsi83: Fix enable error path' (git-fixes).\n- ring-buffer: Fix a race between readers and resize checks (git-fixes).\n- s390/bpf: Emit a barrier for BPF_FETCH instructions (git-fixes bsc#1224795).\n- s390/cio: fix tracepoint subchannel type field (git-fixes bsc#1224796).\n- s390/cpum_cf: make crypto counters upward compatible across machine types (bsc#1224346).\n- s390/ipl: Fix incorrect initialization of len fields in nvme reipl block (git-fixes bsc#1225139).\n- s390/ipl: Fix incorrect initialization of nvme dump block (git-fixes bsc#1225138).\n- sched/topology: Optimize topology_span_sane() (bsc#1225053).\n- scsi: arcmsr: Support new PCI device IDs 1883 and 1886 (git-fixes).\n- scsi: bfa: Fix function pointer type mismatch for hcb_qe-\u003ecbfn (git-fixes).\n- scsi: core: Consult supported VPD page list prior to fetching page (git-fixes).\n- scsi: core: Fix unremoved procfs host directory regression (git-fixes).\n- scsi: csiostor: Avoid function pointer casts (git-fixes).\n- scsi: libfc: Do not schedule abort twice (git-fixes).\n- scsi: libfc: Fix up timeout error in fc_fcp_rec_error() (git-fixes).\n- scsi: lpfc: Add support for 32 byte CDBs (bsc#1225842).\n- scsi: lpfc: Change default logging level for unsolicited CT MIB commands (bsc#1225842).\n- scsi: lpfc: Change lpfc_hba hba_flag member into a bitmask (bsc#1225842).\n- scsi: lpfc: Clear deferred RSCN processing flag when driver is unloading (bsc#1225842).\n- scsi: lpfc: Copyright updates for 14.4.0.2 patches (bsc#1225842).\n- scsi: lpfc: Introduce rrq_list_lock to protect active_rrq_list (bsc#1225842).\n- scsi: lpfc: Update logging of protection type for T10 DIF I/O (bsc#1225842).\n- scsi: lpfc: Update lpfc version to 14.4.0.2 (bsc#1225842).\n- scsi: mpt3sas: Prevent sending diag_reset when the controller is ready (git-fixes).\n- scsi: mylex: Fix sysfs buffer lengths (git-fixes).\n- scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (git-fixes).\n- scsi: sd: Unregister device if device_add_disk() failed in sd_probe() (git-fixes).\n- selftests/pidfd: Fix config for pidfd_setns_test (git-fixes).\n- serial: 8250_bcm7271: use default_mux_rate if possible (git-fixes).\n- serial: kgdboc: Fix NMI-safety problems from keyboard reset code (stable-fixes).\n- serial: max3100: Fix bitwise types (git-fixes).\n- serial: max3100: Lock port-\u003elock when calling uart_handle_cts_change() (git-fixes).\n- serial: sc16is7xx: add proper sched.h include for sched_set_fifo() (git-fixes).\n- serial: sc16is7xx: fix bug in sc16is7xx_set_baud() when using prescaler (git-fixes).\n- serial: sh-sci: protect invalidating RXDMA on shutdown (git-fixes).\n- smb3: show beginning time for per share stats (bsc#1224020).\n- smb: client: ensure to try all targets when finding nested links (bsc#1224020).\n- smb: client: fix mount when dns_resolver key is not available (git-fixes, bsc#1224020).\n- smb: client: get rid of dfs code dep in namespace.c (bsc#1224020).\n- smb: client: get rid of dfs naming in automount code (bsc#1224020).\n- smb: client: introduce DFS_CACHE_TGT_LIST() (bsc#1224020).\n- smb: client: reduce stack usage in cifs_try_adding_channels() (bsc#1224020).\n- smb: client: remove extra @chan_count check in __cifs_put_smb_ses() (bsc#1224020).\n- smb: client: rename cifs_dfs_ref.c to namespace.c (bsc#1224020).\n- soc: mediatek: cmdq: Fix typo of CMDQ_JUMP_RELATIVE (git-fixes).\n- soc: qcom: rpmh-rsc: Enhance check for VRM in-flight request (git-fixes).\n- Sort recent BHI patches\n- speakup: Fix sizeof() vs ARRAY_SIZE() bug (git-fixes).\n- spmi: Add a check for remove callback when removing a SPMI driver (git-fixes).\n- spmi: hisi-spmi-controller: Do not override device identifier (git-fixes).\n- swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (bsc#1224331). \n- swiotlb: Fix alignment checks when both allocation and DMA masks are (bsc#1224331)\n- swiotlb: Fix double-allocation of slots due to broken alignment (bsc#1224331)\n- swiotlb: Honour dma_alloc_coherent() alignment in swiotlb_alloc() (bsc#1224331)\n- sysv: do not call sb_bread() with pointers_lock held (git-fixes).\n- thermal/drivers/tsens: Fix null pointer dereference (git-fixes).\n- tools/latency-collector: Fix -Wformat-security compile warns (git-fixes).\n- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer (bsc#1225535)\n- tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer (git-fixes).\n- tracing: Add MODULE_DESCRIPTION() to preemptirq_delay_test (git-fixes).\n- tracing: hide unused ftrace_event_id_fops (git-fixes).\n- tty: n_gsm: fix missing receive state reset after mode switch (git-fixes).\n- tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (git-fixes).\n- usb: aqc111: stop lying about skb-\u003etruesize (git-fixes).\n- USB: core: Add hub_get() and hub_put() routines (git-fixes).\n- USB: core: Fix access violation during port device removal (git-fixes).\n- USB: core: Fix deadlock in port 'disable' sysfs attribute (git-fixes).\n- usb: dwc3: core: Prevent phy suspend during init (Git-fixes).\n- usb: gadget: u_audio: Clear uac pointer when freed (git-fixes).\n- usb: typec: tipd: fix event checking for tps6598x (git-fixes).\n- usb: typec: ucsi: displayport: Fix potential deadlock (git-fixes).\n- VMCI: Fix an error handling path in vmci_guest_probe_device() (git-fixes).\n- VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (stable-fixes).\n- vmci: prevent speculation leaks by sanitizing event in event_deliver() (git-fixes).\n- watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger (git-fixes).\n- watchdog: ixp4xx: Make sure restart always works (git-fixes).\n- watchdog: rti_wdt: Set min_hw_heartbeat_ms to accommodate a safety margin (git-fixes).\n- wifi: ar5523: enable proper endpoint verification (git-fixes).\n- wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger() (git-fixes).\n- wifi: ath10k: poll service ready message before failing (git-fixes).\n- wifi: ath10k: populate board data for WCN3990 (git-fixes).\n- wifi: ath11k: do not force enable power save on non-running vdevs (git-fixes).\n- wifi: carl9170: add a proper sanity check for endpoints (git-fixes).\n- wifi: carl9170: re-fix fortified-memset warning (git-fixes).\n- wifi: cfg80211: fix rdev_dump_mpp() arguments order (stable-fixes).\n- wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc (stable-fixes).\n- wifi: mwl8k: initialize cmd-\u003eaddr[] properly (git-fixes).\n- x86/boot: Ignore NMIs during very early boot (git-fixes).\n- x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).\n- x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (git-fixes).\n- x86/bugs: Fix BHI documentation (git-fixes).\n- x86/bugs: Fix BHI handling of RRSBA (git-fixes).\n- x86/bugs: Fix BHI retpoline check (git-fixes).\n- x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).\n- x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).\n- x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (git-fixes).\n- x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (git-fixes).\n- x86: Fix CPUIDLE_FLAG_IRQ_ENABLE leaking timer reprogram (git-fixes).\n- x86/kvm: Do not try to disable kvmclock if it was not enabled (git-fixes).\n- x86/lib: Fix overflow when counting digits (git-fixes).\n- x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (git-fixes).\n- x86/nmi: Drop unused declaration of proc_nmi_enabled() (git-fixes).\n- x86/retpoline: Do the necessary fixup to the Zen3/4 srso return thunk for !SRSO (git-fixes).\n- x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler (git-fixes).\n- x86/sme: Fix memory encryption setting if enabled by default and not overridden (git-fixes).\n- x86/tdx: Preserve shared bit on mprotect() (git-fixes).\n- xfs: fix exception caused by unexpected illegal bestcount in leaf dir (git-fixes).\n- xfs: Fix false ENOSPC when performing direct write on a delalloc extent in cow fork (git-fixes).\n- xfs: fix imprecise logic in xchk_btree_check_block_owner (git-fixes).\n- xfs: fix inode reservation space for removing transaction (git-fixes).\n- xfs: shrink failure needs to hold AGI buffer (git-fixes).\n","status":"published","published":"2024-06-25T08:50:52Z","modified":"2026-02-04T03:07:05.716244Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}