{"id":"CVE-2022-48652","aliases":["DEBIAN-CVE-2022-48652","EUVD-2022-51347","GHSA-4j53-q2r4-27jv","OESA-2024-1706","OESA-2024-1707","SUSE-SU-2024:1644-1","SUSE-SU-2024:1659-1","SUSE-SU-2024:1663-1","SUSE-SU-2024:2011-1","SUSE-SU-2024:2189-1","SUSE-SU-2025:0231-1","UBUNTU-CVE-2022-48652"],"status":"published","title":"ice: Fix crash by keep old cfg when update TCs more than queues","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix crash by keep old cfg when update TCs more than queues\n\nThere are problems if allocated queues less than Traffic Classes.\n\nCommit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config\nfor DCB\") already disallow setting less queues than TCs.\n\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\n\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u003c8b\u003e 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00289,"percentile":0.21702,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2024-04-28T13:00:47Z","modified":"2026-11-03T06:03:11Z","fixes":[{"ecosystem":"Linux","package":"Kernel","fixed_in":["5.19.12"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["6.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["6.0.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["6.0.2-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.19.0"},{"fixed":"5.19.12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.2-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-136.79.0.159.oe2203sp1"}]}],"bundled":61},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-207.0.0.116.oe2203sp3"}]}],"bundled":55},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.51.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.51.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.51.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.51.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.51.1"}]}],"bundled":190},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.51.1"}]}],"bundled":190},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2.150500.6.27.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2.150500.6.27.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.1"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5_Update_13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.3.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"dtb-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.1"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2.150500.6.27.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-kvmsmall","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-obs-qa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.1"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.1"}]}],"bundled":218},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.62.2"}]}],"bundled":218},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5-RT_Update_14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.5.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.52.1"}]}],"bundled":219},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.82.1"}]}],"bundled":308},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-livepatch-SLE15-SP4_Update_27","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150400.9.3.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.1"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2"}]}],"bundled":320},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.122.2.150400.24.58.2"}]}],"bundled":320},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.106.1"}]}],"bundled":64},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.106.1"}]}],"bundled":64},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.106.1"}]}],"bundled":64},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.106.1"}]}],"bundled":64},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/7c945e5b4787db47d728120b56c934ba05f99864","tags":["x_transferred","Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/a509702cac95a8b450228a037c8542f57e538e5b","tags":["x_transferred","Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48652","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4j53-q2r4-27jv"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48652.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-48652","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1706","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47247","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52646","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52677","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52680","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52705","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52745","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52746","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52753","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52775","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52796","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52798","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52799","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52800","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52803","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52807","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52865","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52875","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27393","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27399","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27402","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27415","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35790","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35809","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35854","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35855","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35888","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35895","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35915","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35925","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35967","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35973","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36008","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36017","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36021","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36883","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36886","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36902","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36905","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36906","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36924","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36929","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36949","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36957","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36964","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1707","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47484","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52693","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52732","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52762","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52810","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52880","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52881","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26835","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-26889","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-27408","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35811","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35871","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35982","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-35984","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36917","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36928","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36954","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241644-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1141539","tags":["report"]},{"url":"https://bugzilla.suse.com/1190576","tags":["report"]},{"url":"https://bugzilla.suse.com/1192145","tags":["report"]},{"url":"https://bugzilla.suse.com/1192837","tags":["report"]},{"url":"https://bugzilla.suse.com/1193629","tags":["report"]},{"url":"https://bugzilla.suse.com/1196869","tags":["report"]},{"url":"https://bugzilla.suse.com/1200313","tags":["report"]},{"url":"https://bugzilla.suse.com/1201308","tags":["report"]},{"url":"https://bugzilla.suse.com/1201489","tags":["report"]},{"url":"https://bugzilla.suse.com/1203906","tags":["report"]},{"url":"https://bugzilla.suse.com/1203935","tags":["report"]},{"url":"https://bugzilla.suse.com/1204614","tags":["report"]},{"url":"https://bugzilla.suse.com/1207361","tags":["report"]},{"url":"https://bugzilla.suse.com/1211592","tags":["report"]},{"url":"https://bugzilla.suse.com/1213573","tags":["report"]},{"url":"https://bugzilla.suse.com/1217339","tags":["report"]},{"url":"https://bugzilla.suse.com/1217408","tags":["report"]},{"url":"https://bugzilla.suse.com/1218562","tags":["report"]},{"url":"https://bugzilla.suse.com/1218917","tags":["report"]},{"url":"https://bugzilla.suse.com/1219104","tags":["report"]},{"url":"https://bugzilla.suse.com/1219126","tags":["report"]},{"url":"https://bugzilla.suse.com/1219141","tags":["report"]},{"url":"https://bugzilla.suse.com/1219169","tags":["report"]},{"url":"https://bugzilla.suse.com/1219170","tags":["report"]},{"url":"https://bugzilla.suse.com/1219264","tags":["report"]},{"url":"https://bugzilla.suse.com/1220342","tags":["report"]},{"url":"https://bugzilla.suse.com/1220569","tags":["report"]},{"url":"https://bugzilla.suse.com/1220761","tags":["report"]},{"url":"https://bugzilla.suse.com/1221042","tags":["report"]},{"url":"https://bugzilla.suse.com/1221044","tags":["report"]},{"url":"https://bugzilla.suse.com/1221080","tags":["report"]},{"url":"https://bugzilla.suse.com/1221084","tags":["report"]},{"url":"https://bugzilla.suse.com/1221088","tags":["report"]},{"url":"https://bugzilla.suse.com/1221299","tags":["report"]},{"url":"https://bugzilla.suse.com/1221612","tags":["report"]},{"url":"https://bugzilla.suse.com/1221617","tags":["report"]},{"url":"https://bugzilla.suse.com/1221645","tags":["report"]},{"url":"https://bugzilla.suse.com/1221825","tags":["report"]},{"url":"https://bugzilla.suse.com/1222294","tags":["report"]},{"url":"https://bugzilla.suse.com/1222307","tags":["report"]},{"url":"https://bugzilla.suse.com/1222357","tags":["report"]},{"url":"https://bugzilla.suse.com/1222368","tags":["report"]},{"url":"https://bugzilla.suse.com/1222379","tags":["report"]},{"url":"https://bugzilla.suse.com/1222385","tags":["report"]},{"url":"https://bugzilla.suse.com/1222424","tags":["report"]},{"url":"https://bugzilla.suse.com/1222430","tags":["report"]},{"url":"https://bugzilla.suse.com/1222435","tags":["report"]},{"url":"https://bugzilla.suse.com/1222482","tags":["report"]},{"url":"https://bugzilla.suse.com/1222559","tags":["report"]},{"url":"https://bugzilla.suse.com/1222585","tags":["report"]},{"url":"https://bugzilla.suse.com/1222613","tags":["report"]},{"url":"https://bugzilla.suse.com/1222615","tags":["report"]},{"url":"https://bugzilla.suse.com/1222618","tags":["report"]},{"url":"https://bugzilla.suse.com/1222624","tags":["report"]},{"url":"https://bugzilla.suse.com/1222666","tags":["report"]},{"url":"https://bugzilla.suse.com/1222669","tags":["report"]},{"url":"https://bugzilla.suse.com/1222671","tags":["report"]},{"url":"https://bugzilla.suse.com/1222703","tags":["report"]},{"url":"https://bugzilla.suse.com/1222704","tags":["report"]},{"url":"https://bugzilla.suse.com/1222709","tags":["report"]},{"url":"https://bugzilla.suse.com/1222710","tags":["report"]},{"url":"https://bugzilla.suse.com/1222721","tags":["report"]},{"url":"https://bugzilla.suse.com/1222726","tags":["report"]},{"url":"https://bugzilla.suse.com/1222773","tags":["report"]},{"url":"https://bugzilla.suse.com/1222776","tags":["report"]},{"url":"https://bugzilla.suse.com/1222785","tags":["report"]},{"url":"https://bugzilla.suse.com/1222787","tags":["report"]},{"url":"https://bugzilla.suse.com/1222790","tags":["report"]},{"url":"https://bugzilla.suse.com/1222791","tags":["report"]},{"url":"https://bugzilla.suse.com/1222792","tags":["report"]},{"url":"https://bugzilla.suse.com/1222793","tags":["report"]},{"url":"https://bugzilla.suse.com/1222796","tags":["report"]},{"url":"https://bugzilla.suse.com/1222812","tags":["report"]},{"url":"https://bugzilla.suse.com/1222824","tags":["report"]},{"url":"https://bugzilla.suse.com/1222829","tags":["report"]},{"url":"https://bugzilla.suse.com/1222832","tags":["report"]},{"url":"https://bugzilla.suse.com/1222836","tags":["report"]},{"url":"https://bugzilla.suse.com/1222838","tags":["report"]},{"url":"https://bugzilla.suse.com/1222866","tags":["report"]},{"url":"https://bugzilla.suse.com/1222867","tags":["report"]},{"url":"https://bugzilla.suse.com/1222869","tags":["report"]},{"url":"https://bugzilla.suse.com/1222870","tags":["report"]},{"url":"https://bugzilla.suse.com/1222876","tags":["report"]},{"url":"https://bugzilla.suse.com/1222878","tags":["report"]},{"url":"https://bugzilla.suse.com/1222879","tags":["report"]},{"url":"https://bugzilla.suse.com/1222881","tags":["report"]},{"url":"https://bugzilla.suse.com/1222883","tags":["report"]},{"url":"https://bugzilla.suse.com/1222888","tags":["report"]},{"url":"https://bugzilla.suse.com/1222894","tags":["report"]},{"url":"https://bugzilla.suse.com/1222901","tags":["report"]},{"url":"https://bugzilla.suse.com/1222968","tags":["report"]},{"url":"https://bugzilla.suse.com/1222976","tags":["report"]},{"url":"https://bugzilla.suse.com/1223012","tags":["report"]},{"url":"https://bugzilla.suse.com/1223014","tags":["report"]},{"url":"https://bugzilla.suse.com/1223016","tags":["report"]},{"url":"https://bugzilla.suse.com/1223024","tags":["report"]},{"url":"https://bugzilla.suse.com/1223033","tags":["report"]},{"url":"https://bugzilla.suse.com/1223034","tags":["report"]},{"url":"https://bugzilla.suse.com/1223035","tags":["report"]},{"url":"https://bugzilla.suse.com/1223036","tags":["report"]},{"url":"https://bugzilla.suse.com/1223037","tags":["report"]},{"url":"https://bugzilla.suse.com/1223041","tags":["report"]},{"url":"https://bugzilla.suse.com/1223042","tags":["report"]},{"url":"https://bugzilla.suse.com/1223051","tags":["report"]},{"url":"https://bugzilla.suse.com/1223052","tags":["report"]},{"url":"https://bugzilla.suse.com/1223056","tags":["report"]},{"url":"https://bugzilla.suse.com/1223057","tags":["report"]},{"url":"https://bugzilla.suse.com/1223058","tags":["report"]},{"url":"https://bugzilla.suse.com/1223060","tags":["report"]},{"url":"https://bugzilla.suse.com/1223061","tags":["report"]},{"url":"https://bugzilla.suse.com/1223065","tags":["report"]},{"url":"https://bugzilla.suse.com/1223066","tags":["report"]},{"url":"https://bugzilla.suse.com/1223076","tags":["report"]},{"url":"https://bugzilla.suse.com/1223078","tags":["report"]},{"url":"https://bugzilla.suse.com/1223111","tags":["report"]},{"url":"https://bugzilla.suse.com/1223115","tags":["report"]},{"url":"https://bugzilla.suse.com/1223118","tags":["report"]},{"url":"https://bugzilla.suse.com/1223119","tags":["report"]},{"url":"https://bugzilla.suse.com/1223140","tags":["report"]},{"url":"https://bugzilla.suse.com/1223187","tags":["report"]},{"url":"https://bugzilla.suse.com/1223189","tags":["report"]},{"url":"https://bugzilla.suse.com/1223190","tags":["report"]},{"url":"https://bugzilla.suse.com/1223191","tags":["report"]},{"url":"https://bugzilla.suse.com/1223196","tags":["report"]},{"url":"https://bugzilla.suse.com/1223197","tags":["report"]},{"url":"https://bugzilla.suse.com/1223198","tags":["report"]},{"url":"https://bugzilla.suse.com/1223207","tags":["report"]},{"url":"https://bugzilla.suse.com/1223275","tags":["report"]},{"url":"https://bugzilla.suse.com/1223323","tags":["report"]},{"url":"https://bugzilla.suse.com/1223360","tags":["report"]},{"url":"https://bugzilla.suse.com/1223369","tags":["report"]},{"url":"https://bugzilla.suse.com/1223380","tags":["report"]},{"url":"https://bugzilla.suse.com/1223432","tags":["report"]},{"url":"https://bugzilla.suse.com/1223473","tags":["report"]},{"url":"https://bugzilla.suse.com/1223474","tags":["report"]},{"url":"https://bugzilla.suse.com/1223475","tags":["report"]},{"url":"https://bugzilla.suse.com/1223477","tags":["report"]},{"url":"https://bugzilla.suse.com/1223478","tags":["report"]},{"url":"https://bugzilla.suse.com/1223479","tags":["report"]},{"url":"https://bugzilla.suse.com/1223481","tags":["report"]},{"url":"https://bugzilla.suse.com/1223482","tags":["report"]},{"url":"https://bugzilla.suse.com/1223484","tags":["report"]},{"url":"https://bugzilla.suse.com/1223487","tags":["report"]},{"url":"https://bugzilla.suse.com/1223490","tags":["report"]},{"url":"https://bugzilla.suse.com/1223496","tags":["report"]},{"url":"https://bugzilla.suse.com/1223498","tags":["report"]},{"url":"https://bugzilla.suse.com/1223499","tags":["report"]},{"url":"https://bugzilla.suse.com/1223501","tags":["report"]},{"url":"https://bugzilla.suse.com/1223502","tags":["report"]},{"url":"https://bugzilla.suse.com/1223503","tags":["report"]},{"url":"https://bugzilla.suse.com/1223505","tags":["report"]},{"url":"https://bugzilla.suse.com/1223509","tags":["report"]},{"url":"https://bugzilla.suse.com/1223511","tags":["report"]},{"url":"https://bugzilla.suse.com/1223512","tags":["report"]},{"url":"https://bugzilla.suse.com/1223513","tags":["report"]},{"url":"https://bugzilla.suse.com/1223516","tags":["report"]},{"url":"https://bugzilla.suse.com/1223517","tags":["report"]},{"url":"https://bugzilla.suse.com/1223518","tags":["report"]},{"url":"https://bugzilla.suse.com/1223519","tags":["report"]},{"url":"https://bugzilla.suse.com/1223520","tags":["report"]},{"url":"https://bugzilla.suse.com/1223522","tags":["report"]},{"url":"https://bugzilla.suse.com/1223523","tags":["report"]},{"url":"https://bugzilla.suse.com/1223525","tags":["report"]},{"url":"https://bugzilla.suse.com/1223536","tags":["report"]},{"url":"https://bugzilla.suse.com/1223539","tags":["report"]},{"url":"https://bugzilla.suse.com/1223574","tags":["report"]},{"url":"https://bugzilla.suse.com/1223595","tags":["report"]},{"url":"https://bugzilla.suse.com/1223598","tags":["report"]},{"url":"https://bugzilla.suse.com/1223628","tags":["report"]},{"url":"https://bugzilla.suse.com/1223634","tags":["report"]},{"url":"https://bugzilla.suse.com/1223640","tags":["report"]},{"url":"https://bugzilla.suse.com/1223643","tags":["report"]},{"url":"https://bugzilla.suse.com/1223644","tags":["report"]},{"url":"https://bugzilla.suse.com/1223645","tags":["report"]},{"url":"https://bugzilla.suse.com/1223646","tags":["report"]},{"url":"https://bugzilla.suse.com/1223648","tags":["report"]},{"url":"https://bugzilla.suse.com/1223655","tags":["report"]},{"url":"https://bugzilla.suse.com/1223657","tags":["report"]},{"url":"https://bugzilla.suse.com/1223660","tags":["report"]},{"url":"https://bugzilla.suse.com/1223661","tags":["report"]},{"url":"https://bugzilla.suse.com/1223663","tags":["report"]},{"url":"https://bugzilla.suse.com/1223664","tags":["report"]},{"url":"https://bugzilla.suse.com/1223668","tags":["report"]},{"url":"https://bugzilla.suse.com/1223670","tags":["report"]},{"url":"https://bugzilla.suse.com/1223679","tags":["report"]},{"url":"https://bugzilla.suse.com/1223686","tags":["report"]},{"url":"https://bugzilla.suse.com/1223693","tags":["report"]},{"url":"https://bugzilla.suse.com/1223705","tags":["report"]},{"url":"https://bugzilla.suse.com/1223714","tags":["report"]},{"url":"https://bugzilla.suse.com/1223735","tags":["report"]},{"url":"https://bugzilla.suse.com/1223738","tags":["report"]},{"url":"https://bugzilla.suse.com/1223745","tags":["report"]},{"url":"https://bugzilla.suse.com/1223784","tags":["report"]},{"url":"https://bugzilla.suse.com/1223785","tags":["report"]},{"url":"https://bugzilla.suse.com/1223790","tags":["report"]},{"url":"https://bugzilla.suse.com/1223816","tags":["report"]},{"url":"https://bugzilla.suse.com/1223821","tags":["report"]},{"url":"https://bugzilla.suse.com/1223822","tags":["report"]},{"url":"https://bugzilla.suse.com/1223823","tags":["report"]},{"url":"https://bugzilla.suse.com/1223824","tags":["report"]},{"url":"https://bugzilla.suse.com/1223827","tags":["report"]},{"url":"https://bugzilla.suse.com/1223834","tags":["report"]},{"url":"https://bugzilla.suse.com/1223858","tags":["report"]},{"url":"https://bugzilla.suse.com/1223875","tags":["report"]},{"url":"https://bugzilla.suse.com/1223876","tags":["report"]},{"url":"https://bugzilla.suse.com/1223877","tags":["report"]},{"url":"https://bugzilla.suse.com/1223878","tags":["report"]},{"url":"https://bugzilla.suse.com/1223879","tags":["report"]},{"url":"https://bugzilla.suse.com/1223894","tags":["report"]},{"url":"https://bugzilla.suse.com/1223921","tags":["report"]},{"url":"https://bugzilla.suse.com/1223922","tags":["report"]},{"url":"https://bugzilla.suse.com/1223923","tags":["report"]},{"url":"https://bugzilla.suse.com/1223924","tags":["report"]},{"url":"https://bugzilla.suse.com/1223929","tags":["report"]},{"url":"https://bugzilla.suse.com/1223931","tags":["report"]},{"url":"https://bugzilla.suse.com/1223932","tags":["report"]},{"url":"https://bugzilla.suse.com/1223934","tags":["report"]},{"url":"https://bugzilla.suse.com/1223941","tags":["report"]},{"url":"https://bugzilla.suse.com/1223948","tags":["report"]},{"url":"https://bugzilla.suse.com/1223949","tags":["report"]},{"url":"https://bugzilla.suse.com/1223950","tags":["report"]},{"url":"https://bugzilla.suse.com/1223951","tags":["report"]},{"url":"https://bugzilla.suse.com/1223952","tags":["report"]},{"url":"https://bugzilla.suse.com/1223953","tags":["report"]},{"url":"https://bugzilla.suse.com/1223956","tags":["report"]},{"url":"https://bugzilla.suse.com/1223957","tags":["report"]},{"url":"https://bugzilla.suse.com/1223960","tags":["report"]},{"url":"https://bugzilla.suse.com/1223962","tags":["report"]},{"url":"https://bugzilla.suse.com/1223963","tags":["report"]},{"url":"https://bugzilla.suse.com/1223964","tags":["report"]},{"url":"https://bugzilla.suse.com/1223996","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47047","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47194","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47198","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47199","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47200","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47204","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47205","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47209","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47210","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47212","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47215","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47217","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47219","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48631","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48637","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48642","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48653","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48657","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48663","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48667","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48668","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48692","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48693","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48695","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48699","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48701","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52585","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52589","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52590","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52591","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52593","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52614","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52616","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52620","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52635","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52645","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52652","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6270","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0639","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-0841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2201","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22099","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23307","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23848","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-23850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26601","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26688","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26836","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26843","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26862","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26866","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26879","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26897","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26933","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26956","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26960","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26965","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26966","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26979","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26993","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27014","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27043","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27046","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27389","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241659-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1177529","tags":["report"]},{"url":"https://bugzilla.suse.com/1220901","tags":["report"]},{"url":"https://bugzilla.suse.com/1220915","tags":["report"]},{"url":"https://bugzilla.suse.com/1220935","tags":["report"]},{"url":"https://bugzilla.suse.com/1221162","tags":["report"]},{"url":"https://bugzilla.suse.com/1221791","tags":["report"]},{"url":"https://bugzilla.suse.com/1222011","tags":["report"]},{"url":"https://bugzilla.suse.com/1222051","tags":["report"]},{"url":"https://bugzilla.suse.com/1222247","tags":["report"]},{"url":"https://bugzilla.suse.com/1222266","tags":["report"]},{"url":"https://bugzilla.suse.com/1222416","tags":["report"]},{"url":"https://bugzilla.suse.com/1222422","tags":["report"]},{"url":"https://bugzilla.suse.com/1222427","tags":["report"]},{"url":"https://bugzilla.suse.com/1222428","tags":["report"]},{"url":"https://bugzilla.suse.com/1222431","tags":["report"]},{"url":"https://bugzilla.suse.com/1222437","tags":["report"]},{"url":"https://bugzilla.suse.com/1222445","tags":["report"]},{"url":"https://bugzilla.suse.com/1222449","tags":["report"]},{"url":"https://bugzilla.suse.com/1222503","tags":["report"]},{"url":"https://bugzilla.suse.com/1222520","tags":["report"]},{"url":"https://bugzilla.suse.com/1222536","tags":["report"]},{"url":"https://bugzilla.suse.com/1222549","tags":["report"]},{"url":"https://bugzilla.suse.com/1222550","tags":["report"]},{"url":"https://bugzilla.suse.com/1222557","tags":["report"]},{"url":"https://bugzilla.suse.com/1222586","tags":["report"]},{"url":"https://bugzilla.suse.com/1222596","tags":["report"]},{"url":"https://bugzilla.suse.com/1222609","tags":["report"]},{"url":"https://bugzilla.suse.com/1222610","tags":["report"]},{"url":"https://bugzilla.suse.com/1222630","tags":["report"]},{"url":"https://bugzilla.suse.com/1222632","tags":["report"]},{"url":"https://bugzilla.suse.com/1222660","tags":["report"]},{"url":"https://bugzilla.suse.com/1222662","tags":["report"]},{"url":"https://bugzilla.suse.com/1222664","tags":["report"]},{"url":"https://bugzilla.suse.com/1222677","tags":["report"]},{"url":"https://bugzilla.suse.com/1222678","tags":["report"]},{"url":"https://bugzilla.suse.com/1222680","tags":["report"]},{"url":"https://bugzilla.suse.com/1222706","tags":["report"]},{"url":"https://bugzilla.suse.com/1222720","tags":["report"]},{"url":"https://bugzilla.suse.com/1222724","tags":["report"]},{"url":"https://bugzilla.suse.com/1222727","tags":["report"]},{"url":"https://bugzilla.suse.com/1222764","tags":["report"]},{"url":"https://bugzilla.suse.com/1222772","tags":["report"]},{"url":"https://bugzilla.suse.com/1222781","tags":["report"]},{"url":"https://bugzilla.suse.com/1222784","tags":["report"]},{"url":"https://bugzilla.suse.com/1222798","tags":["report"]},{"url":"https://bugzilla.suse.com/1222801","tags":["report"]},{"url":"https://bugzilla.suse.com/1223030","tags":["report"]},{"url":"https://bugzilla.suse.com/1223067","tags":["report"]},{"url":"https://bugzilla.suse.com/1223068","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47183","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47189","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52561","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52627","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52636","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26684","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26696","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26697","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26769","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26776","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26779","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26790","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26793","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26807","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26848","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241663-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1220492","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-267600","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242011-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065729","tags":["report"]},{"url":"https://bugzilla.suse.com/1174585","tags":["report"]},{"url":"https://bugzilla.suse.com/1190569","tags":["report"]},{"url":"https://bugzilla.suse.com/1191949","tags":["report"]},{"url":"https://bugzilla.suse.com/1192107","tags":["report"]},{"url":"https://bugzilla.suse.com/1193983","tags":["report"]},{"url":"https://bugzilla.suse.com/1194288","tags":["report"]},{"url":"https://bugzilla.suse.com/1194869","tags":["report"]},{"url":"https://bugzilla.suse.com/1196956","tags":["report"]},{"url":"https://bugzilla.suse.com/1197915","tags":["report"]},{"url":"https://bugzilla.suse.com/1208149","tags":["report"]},{"url":"https://bugzilla.suse.com/1209657","tags":["report"]},{"url":"https://bugzilla.suse.com/1209799","tags":["report"]},{"url":"https://bugzilla.suse.com/1209834","tags":["report"]},{"url":"https://bugzilla.suse.com/1213863","tags":["report"]},{"url":"https://bugzilla.suse.com/1216702","tags":["report"]},{"url":"https://bugzilla.suse.com/1217169","tags":["report"]},{"url":"https://bugzilla.suse.com/1217515","tags":["report"]},{"url":"https://bugzilla.suse.com/1218447","tags":["report"]},{"url":"https://bugzilla.suse.com/1220783","tags":["report"]},{"url":"https://bugzilla.suse.com/1221958","tags":["report"]},{"url":"https://bugzilla.suse.com/1222619","tags":["report"]},{"url":"https://bugzilla.suse.com/1223084","tags":["report"]},{"url":"https://bugzilla.suse.com/1223138","tags":["report"]},{"url":"https://bugzilla.suse.com/1223384","tags":["report"]},{"url":"https://bugzilla.suse.com/1223390","tags":["report"]},{"url":"https://bugzilla.suse.com/1223532","tags":["report"]},{"url":"https://bugzilla.suse.com/1223626","tags":["report"]},{"url":"https://bugzilla.suse.com/1223715","tags":["report"]},{"url":"https://bugzilla.suse.com/1224085","tags":["report"]},{"url":"https://bugzilla.suse.com/1224099","tags":["report"]},{"url":"https://bugzilla.suse.com/1224137","tags":["report"]},{"url":"https://bugzilla.suse.com/1224174","tags":["report"]},{"url":"https://bugzilla.suse.com/1224438","tags":["report"]},{"url":"https://bugzilla.suse.com/1224482","tags":["report"]},{"url":"https://bugzilla.suse.com/1224488","tags":["report"]},{"url":"https://bugzilla.suse.com/1224494","tags":["report"]},{"url":"https://bugzilla.suse.com/1224511","tags":["report"]},{"url":"https://bugzilla.suse.com/1224592","tags":["report"]},{"url":"https://bugzilla.suse.com/1224611","tags":["report"]},{"url":"https://bugzilla.suse.com/1224664","tags":["report"]},{"url":"https://bugzilla.suse.com/1224678","tags":["report"]},{"url":"https://bugzilla.suse.com/1224682","tags":["report"]},{"url":"https://bugzilla.suse.com/1224685","tags":["report"]},{"url":"https://bugzilla.suse.com/1224730","tags":["report"]},{"url":"https://bugzilla.suse.com/1224736","tags":["report"]},{"url":"https://bugzilla.suse.com/1224763","tags":["report"]},{"url":"https://bugzilla.suse.com/1224816","tags":["report"]},{"url":"https://bugzilla.suse.com/1224895","tags":["report"]},{"url":"https://bugzilla.suse.com/1224898","tags":["report"]},{"url":"https://bugzilla.suse.com/1224900","tags":["report"]},{"url":"https://bugzilla.suse.com/1224901","tags":["report"]},{"url":"https://bugzilla.suse.com/1224902","tags":["report"]},{"url":"https://bugzilla.suse.com/1224903","tags":["report"]},{"url":"https://bugzilla.suse.com/1224904","tags":["report"]},{"url":"https://bugzilla.suse.com/1224905","tags":["report"]},{"url":"https://bugzilla.suse.com/1224907","tags":["report"]},{"url":"https://bugzilla.suse.com/1224910","tags":["report"]},{"url":"https://bugzilla.suse.com/1224911","tags":["report"]},{"url":"https://bugzilla.suse.com/1224912","tags":["report"]},{"url":"https://bugzilla.suse.com/1224913","tags":["report"]},{"url":"https://bugzilla.suse.com/1224914","tags":["report"]},{"url":"https://bugzilla.suse.com/1224915","tags":["report"]},{"url":"https://bugzilla.suse.com/1224920","tags":["report"]},{"url":"https://bugzilla.suse.com/1224928","tags":["report"]},{"url":"https://bugzilla.suse.com/1224931","tags":["report"]},{"url":"https://bugzilla.suse.com/1224932","tags":["report"]},{"url":"https://bugzilla.suse.com/1224937","tags":["report"]},{"url":"https://bugzilla.suse.com/1224942","tags":["report"]},{"url":"https://bugzilla.suse.com/1224944","tags":["report"]},{"url":"https://bugzilla.suse.com/1224945","tags":["report"]},{"url":"https://bugzilla.suse.com/1224947","tags":["report"]},{"url":"https://bugzilla.suse.com/1224956","tags":["report"]},{"url":"https://bugzilla.suse.com/1224988","tags":["report"]},{"url":"https://bugzilla.suse.com/1225000","tags":["report"]},{"url":"https://bugzilla.suse.com/1225003","tags":["report"]},{"url":"https://bugzilla.suse.com/1225005","tags":["report"]},{"url":"https://bugzilla.suse.com/1225009","tags":["report"]},{"url":"https://bugzilla.suse.com/1225022","tags":["report"]},{"url":"https://bugzilla.suse.com/1225031","tags":["report"]},{"url":"https://bugzilla.suse.com/1225032","tags":["report"]},{"url":"https://bugzilla.suse.com/1225036","tags":["report"]},{"url":"https://bugzilla.suse.com/1225044","tags":["report"]},{"url":"https://bugzilla.suse.com/1225076","tags":["report"]},{"url":"https://bugzilla.suse.com/1225077","tags":["report"]},{"url":"https://bugzilla.suse.com/1225082","tags":["report"]},{"url":"https://bugzilla.suse.com/1225086","tags":["report"]},{"url":"https://bugzilla.suse.com/1225092","tags":["report"]},{"url":"https://bugzilla.suse.com/1225095","tags":["report"]},{"url":"https://bugzilla.suse.com/1225096","tags":["report"]},{"url":"https://bugzilla.suse.com/1225106","tags":["report"]},{"url":"https://bugzilla.suse.com/1225108","tags":["report"]},{"url":"https://bugzilla.suse.com/1225109","tags":["report"]},{"url":"https://bugzilla.suse.com/1225118","tags":["report"]},{"url":"https://bugzilla.suse.com/1225121","tags":["report"]},{"url":"https://bugzilla.suse.com/1225122","tags":["report"]},{"url":"https://bugzilla.suse.com/1225123","tags":["report"]},{"url":"https://bugzilla.suse.com/1225125","tags":["report"]},{"url":"https://bugzilla.suse.com/1225126","tags":["report"]},{"url":"https://bugzilla.suse.com/1225127","tags":["report"]},{"url":"https://bugzilla.suse.com/1225129","tags":["report"]},{"url":"https://bugzilla.suse.com/1225131","tags":["report"]},{"url":"https://bugzilla.suse.com/1225132","tags":["report"]},{"url":"https://bugzilla.suse.com/1225145","tags":["report"]},{"url":"https://bugzilla.suse.com/1225151","tags":["report"]},{"url":"https://bugzilla.suse.com/1225153","tags":["report"]},{"url":"https://bugzilla.suse.com/1225156","tags":["report"]},{"url":"https://bugzilla.suse.com/1225158","tags":["report"]},{"url":"https://bugzilla.suse.com/1225160","tags":["report"]},{"url":"https://bugzilla.suse.com/1225161","tags":["report"]},{"url":"https://bugzilla.suse.com/1225164","tags":["report"]},{"url":"https://bugzilla.suse.com/1225167","tags":["report"]},{"url":"https://bugzilla.suse.com/1225180","tags":["report"]},{"url":"https://bugzilla.suse.com/1225183","tags":["report"]},{"url":"https://bugzilla.suse.com/1225184","tags":["report"]},{"url":"https://bugzilla.suse.com/1225186","tags":["report"]},{"url":"https://bugzilla.suse.com/1225187","tags":["report"]},{"url":"https://bugzilla.suse.com/1225189","tags":["report"]},{"url":"https://bugzilla.suse.com/1225190","tags":["report"]},{"url":"https://bugzilla.suse.com/1225191","tags":["report"]},{"url":"https://bugzilla.suse.com/1225192","tags":["report"]},{"url":"https://bugzilla.suse.com/1225193","tags":["report"]},{"url":"https://bugzilla.suse.com/1225195","tags":["report"]},{"url":"https://bugzilla.suse.com/1225198","tags":["report"]},{"url":"https://bugzilla.suse.com/1225201","tags":["report"]},{"url":"https://bugzilla.suse.com/1225203","tags":["report"]},{"url":"https://bugzilla.suse.com/1225205","tags":["report"]},{"url":"https://bugzilla.suse.com/1225206","tags":["report"]},{"url":"https://bugzilla.suse.com/1225207","tags":["report"]},{"url":"https://bugzilla.suse.com/1225208","tags":["report"]},{"url":"https://bugzilla.suse.com/1225209","tags":["report"]},{"url":"https://bugzilla.suse.com/1225210","tags":["report"]},{"url":"https://bugzilla.suse.com/1225214","tags":["report"]},{"url":"https://bugzilla.suse.com/1225223","tags":["report"]},{"url":"https://bugzilla.suse.com/1225224","tags":["report"]},{"url":"https://bugzilla.suse.com/1225225","tags":["report"]},{"url":"https://bugzilla.suse.com/1225227","tags":["report"]},{"url":"https://bugzilla.suse.com/1225228","tags":["report"]},{"url":"https://bugzilla.suse.com/1225229","tags":["report"]},{"url":"https://bugzilla.suse.com/1225230","tags":["report"]},{"url":"https://bugzilla.suse.com/1225232","tags":["report"]},{"url":"https://bugzilla.suse.com/1225233","tags":["report"]},{"url":"https://bugzilla.suse.com/1225235","tags":["report"]},{"url":"https://bugzilla.suse.com/1225236","tags":["report"]},{"url":"https://bugzilla.suse.com/1225237","tags":["report"]},{"url":"https://bugzilla.suse.com/1225238","tags":["report"]},{"url":"https://bugzilla.suse.com/1225239","tags":["report"]},{"url":"https://bugzilla.suse.com/1225240","tags":["report"]},{"url":"https://bugzilla.suse.com/1225241","tags":["report"]},{"url":"https://bugzilla.suse.com/1225242","tags":["report"]},{"url":"https://bugzilla.suse.com/1225243","tags":["report"]},{"url":"https://bugzilla.suse.com/1225244","tags":["report"]},{"url":"https://bugzilla.suse.com/1225245","tags":["report"]},{"url":"https://bugzilla.suse.com/1225246","tags":["report"]},{"url":"https://bugzilla.suse.com/1225247","tags":["report"]},{"url":"https://bugzilla.suse.com/1225248","tags":["report"]},{"url":"https://bugzilla.suse.com/1225249","tags":["report"]},{"url":"https://bugzilla.suse.com/1225250","tags":["report"]},{"url":"https://bugzilla.suse.com/1225251","tags":["report"]},{"url":"https://bugzilla.suse.com/1225252","tags":["report"]},{"url":"https://bugzilla.suse.com/1225253","tags":["report"]},{"url":"https://bugzilla.suse.com/1225254","tags":["report"]},{"url":"https://bugzilla.suse.com/1225255","tags":["report"]},{"url":"https://bugzilla.suse.com/1225256","tags":["report"]},{"url":"https://bugzilla.suse.com/1225257","tags":["report"]},{"url":"https://bugzilla.suse.com/1225258","tags":["report"]},{"url":"https://bugzilla.suse.com/1225259","tags":["report"]},{"url":"https://bugzilla.suse.com/1225260","tags":["report"]},{"url":"https://bugzilla.suse.com/1225261","tags":["report"]},{"url":"https://bugzilla.suse.com/1225262","tags":["report"]},{"url":"https://bugzilla.suse.com/1225263","tags":["report"]},{"url":"https://bugzilla.suse.com/1225268","tags":["report"]},{"url":"https://bugzilla.suse.com/1225301","tags":["report"]},{"url":"https://bugzilla.suse.com/1225303","tags":["report"]},{"url":"https://bugzilla.suse.com/1225304","tags":["report"]},{"url":"https://bugzilla.suse.com/1225306","tags":["report"]},{"url":"https://bugzilla.suse.com/1225316","tags":["report"]},{"url":"https://bugzilla.suse.com/1225318","tags":["report"]},{"url":"https://bugzilla.suse.com/1225320","tags":["report"]},{"url":"https://bugzilla.suse.com/1225321","tags":["report"]},{"url":"https://bugzilla.suse.com/1225322","tags":["report"]},{"url":"https://bugzilla.suse.com/1225323","tags":["report"]},{"url":"https://bugzilla.suse.com/1225326","tags":["report"]},{"url":"https://bugzilla.suse.com/1225327","tags":["report"]},{"url":"https://bugzilla.suse.com/1225328","tags":["report"]},{"url":"https://bugzilla.suse.com/1225329","tags":["report"]},{"url":"https://bugzilla.suse.com/1225330","tags":["report"]},{"url":"https://bugzilla.suse.com/1225331","tags":["report"]},{"url":"https://bugzilla.suse.com/1225332","tags":["report"]},{"url":"https://bugzilla.suse.com/1225333","tags":["report"]},{"url":"https://bugzilla.suse.com/1225334","tags":["report"]},{"url":"https://bugzilla.suse.com/1225335","tags":["report"]},{"url":"https://bugzilla.suse.com/1225336","tags":["report"]},{"url":"https://bugzilla.suse.com/1225337","tags":["report"]},{"url":"https://bugzilla.suse.com/1225338","tags":["report"]},{"url":"https://bugzilla.suse.com/1225339","tags":["report"]},{"url":"https://bugzilla.suse.com/1225341","tags":["report"]},{"url":"https://bugzilla.suse.com/1225342","tags":["report"]},{"url":"https://bugzilla.suse.com/1225344","tags":["report"]},{"url":"https://bugzilla.suse.com/1225346","tags":["report"]},{"url":"https://bugzilla.suse.com/1225347","tags":["report"]},{"url":"https://bugzilla.suse.com/1225351","tags":["report"]},{"url":"https://bugzilla.suse.com/1225353","tags":["report"]},{"url":"https://bugzilla.suse.com/1225354","tags":["report"]},{"url":"https://bugzilla.suse.com/1225355","tags":["report"]},{"url":"https://bugzilla.suse.com/1225357","tags":["report"]},{"url":"https://bugzilla.suse.com/1225358","tags":["report"]},{"url":"https://bugzilla.suse.com/1225360","tags":["report"]},{"url":"https://bugzilla.suse.com/1225361","tags":["report"]},{"url":"https://bugzilla.suse.com/1225366","tags":["report"]},{"url":"https://bugzilla.suse.com/1225367","tags":["report"]},{"url":"https://bugzilla.suse.com/1225368","tags":["report"]},{"url":"https://bugzilla.suse.com/1225369","tags":["report"]},{"url":"https://bugzilla.suse.com/1225370","tags":["report"]},{"url":"https://bugzilla.suse.com/1225372","tags":["report"]},{"url":"https://bugzilla.suse.com/1225373","tags":["report"]},{"url":"https://bugzilla.suse.com/1225374","tags":["report"]},{"url":"https://bugzilla.suse.com/1225375","tags":["report"]},{"url":"https://bugzilla.suse.com/1225376","tags":["report"]},{"url":"https://bugzilla.suse.com/1225377","tags":["report"]},{"url":"https://bugzilla.suse.com/1225379","tags":["report"]},{"url":"https://bugzilla.suse.com/1225383","tags":["report"]},{"url":"https://bugzilla.suse.com/1225384","tags":["report"]},{"url":"https://bugzilla.suse.com/1225386","tags":["report"]},{"url":"https://bugzilla.suse.com/1225387","tags":["report"]},{"url":"https://bugzilla.suse.com/1225388","tags":["report"]},{"url":"https://bugzilla.suse.com/1225390","tags":["report"]},{"url":"https://bugzilla.suse.com/1225392","tags":["report"]},{"url":"https://bugzilla.suse.com/1225393","tags":["report"]},{"url":"https://bugzilla.suse.com/1225396","tags":["report"]},{"url":"https://bugzilla.suse.com/1225400","tags":["report"]},{"url":"https://bugzilla.suse.com/1225404","tags":["report"]},{"url":"https://bugzilla.suse.com/1225405","tags":["report"]},{"url":"https://bugzilla.suse.com/1225409","tags":["report"]},{"url":"https://bugzilla.suse.com/1225410","tags":["report"]},{"url":"https://bugzilla.suse.com/1225411","tags":["report"]},{"url":"https://bugzilla.suse.com/1225425","tags":["report"]},{"url":"https://bugzilla.suse.com/1225427","tags":["report"]},{"url":"https://bugzilla.suse.com/1225431","tags":["report"]},{"url":"https://bugzilla.suse.com/1225435","tags":["report"]},{"url":"https://bugzilla.suse.com/1225436","tags":["report"]},{"url":"https://bugzilla.suse.com/1225437","tags":["report"]},{"url":"https://bugzilla.suse.com/1225438","tags":["report"]},{"url":"https://bugzilla.suse.com/1225439","tags":["report"]},{"url":"https://bugzilla.suse.com/1225441","tags":["report"]},{"url":"https://bugzilla.suse.com/1225445","tags":["report"]},{"url":"https://bugzilla.suse.com/1225446","tags":["report"]},{"url":"https://bugzilla.suse.com/1225447","tags":["report"]},{"url":"https://bugzilla.suse.com/1225450","tags":["report"]},{"url":"https://bugzilla.suse.com/1225453","tags":["report"]},{"url":"https://bugzilla.suse.com/1225455","tags":["report"]},{"url":"https://bugzilla.suse.com/1225461","tags":["report"]},{"url":"https://bugzilla.suse.com/1225463","tags":["report"]},{"url":"https://bugzilla.suse.com/1225464","tags":["report"]},{"url":"https://bugzilla.suse.com/1225466","tags":["report"]},{"url":"https://bugzilla.suse.com/1225471","tags":["report"]},{"url":"https://bugzilla.suse.com/1225472","tags":["report"]},{"url":"https://bugzilla.suse.com/1225478","tags":["report"]},{"url":"https://bugzilla.suse.com/1225479","tags":["report"]},{"url":"https://bugzilla.suse.com/1225482","tags":["report"]},{"url":"https://bugzilla.suse.com/1225483","tags":["report"]},{"url":"https://bugzilla.suse.com/1225488","tags":["report"]},{"url":"https://bugzilla.suse.com/1225490","tags":["report"]},{"url":"https://bugzilla.suse.com/1225492","tags":["report"]},{"url":"https://bugzilla.suse.com/1225495","tags":["report"]},{"url":"https://bugzilla.suse.com/1225499","tags":["report"]},{"url":"https://bugzilla.suse.com/1225500","tags":["report"]},{"url":"https://bugzilla.suse.com/1225501","tags":["report"]},{"url":"https://bugzilla.suse.com/1225508","tags":["report"]},{"url":"https://bugzilla.suse.com/1225510","tags":["report"]},{"url":"https://bugzilla.suse.com/1225529","tags":["report"]},{"url":"https://bugzilla.suse.com/1225530","tags":["report"]},{"url":"https://bugzilla.suse.com/1225532","tags":["report"]},{"url":"https://bugzilla.suse.com/1225534","tags":["report"]},{"url":"https://bugzilla.suse.com/1225549","tags":["report"]},{"url":"https://bugzilla.suse.com/1225550","tags":["report"]},{"url":"https://bugzilla.suse.com/1225553","tags":["report"]},{"url":"https://bugzilla.suse.com/1225554","tags":["report"]},{"url":"https://bugzilla.suse.com/1225557","tags":["report"]},{"url":"https://bugzilla.suse.com/1225559","tags":["report"]},{"url":"https://bugzilla.suse.com/1225560","tags":["report"]},{"url":"https://bugzilla.suse.com/1225565","tags":["report"]},{"url":"https://bugzilla.suse.com/1225566","tags":["report"]},{"url":"https://bugzilla.suse.com/1225569","tags":["report"]},{"url":"https://bugzilla.suse.com/1225570","tags":["report"]},{"url":"https://bugzilla.suse.com/1225571","tags":["report"]},{"url":"https://bugzilla.suse.com/1225572","tags":["report"]},{"url":"https://bugzilla.suse.com/1225577","tags":["report"]},{"url":"https://bugzilla.suse.com/1225583","tags":["report"]},{"url":"https://bugzilla.suse.com/1225584","tags":["report"]},{"url":"https://bugzilla.suse.com/1225588","tags":["report"]},{"url":"https://bugzilla.suse.com/1225589","tags":["report"]},{"url":"https://bugzilla.suse.com/1225590","tags":["report"]},{"url":"https://bugzilla.suse.com/1225591","tags":["report"]},{"url":"https://bugzilla.suse.com/1225592","tags":["report"]},{"url":"https://bugzilla.suse.com/1225595","tags":["report"]},{"url":"https://bugzilla.suse.com/1225599","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-36788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47358","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47359","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47360","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47361","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47362","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47363","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47365","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47366","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47367","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47368","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47369","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47370","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47371","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47372","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47373","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47374","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47375","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47376","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47378","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47381","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47385","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47386","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47388","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47389","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47390","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47391","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47392","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47393","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47395","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47396","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47397","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47399","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47406","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47410","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47414","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47417","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47419","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47420","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47421","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47422","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47423","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47424","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47426","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47427","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47428","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47431","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47437","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47450","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47453","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47457","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47463","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47468","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47474","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47475","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47476","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47481","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47482","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47484","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47488","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47490","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47493","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47495","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47496","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47497","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47498","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47499","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47502","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47503","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47506","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47509","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47510","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47511","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47514","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47518","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47521","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47523","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47524","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47526","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47540","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47542","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47549","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47551","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47553","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47554","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47556","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47559","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47560","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47562","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47564","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-47565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48709","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52654","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52655","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52690","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52703","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52708","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52733","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52741","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52742","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52766","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52788","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52799","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52800","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52810","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52816","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52819","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52821","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52832","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52834","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52844","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52865","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52876","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52877","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-27413","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35811","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35815","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35817","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35863","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35867","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35895","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-35914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-36926","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242189-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210335","tags":["report"]},{"url":"https://bugzilla.suse.com/1224909","tags":["report"]},{"url":"https://bugzilla.suse.com/1225380","tags":["report"]},{"url":"https://bugzilla.suse.com/1225486","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39698","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4148","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-1829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-47233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-6531","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250231-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1170891","tags":["report"]},{"url":"https://bugzilla.suse.com/1173139","tags":["report"]},{"url":"https://bugzilla.suse.com/1185010","tags":["report"]},{"url":"https://bugzilla.suse.com/1189998","tags":["report"]},{"url":"https://bugzilla.suse.com/1190358","tags":["report"]},{"url":"https://bugzilla.suse.com/1190428","tags":["report"]},{"url":"https://bugzilla.suse.com/1209798","tags":["report"]},{"url":"https://bugzilla.suse.com/1215304","tags":["report"]},{"url":"https://bugzilla.suse.com/1230697","tags":["report"]},{"url":"https://bugzilla.suse.com/1232436","tags":["report"]},{"url":"https://bugzilla.suse.com/1233070","tags":["report"]},{"url":"https://bugzilla.suse.com/1233642","tags":["report"]},{"url":"https://bugzilla.suse.com/1234281","tags":["report"]},{"url":"https://bugzilla.suse.com/1234282","tags":["report"]},{"url":"https://bugzilla.suse.com/1234846","tags":["report"]},{"url":"https://bugzilla.suse.com/1234853","tags":["report"]},{"url":"https://bugzilla.suse.com/1234891","tags":["report"]},{"url":"https://bugzilla.suse.com/1234921","tags":["report"]},{"url":"https://bugzilla.suse.com/1234960","tags":["report"]},{"url":"https://bugzilla.suse.com/1234963","tags":["report"]},{"url":"https://bugzilla.suse.com/1235004","tags":["report"]},{"url":"https://bugzilla.suse.com/1235035","tags":["report"]},{"url":"https://bugzilla.suse.com/1235054","tags":["report"]},{"url":"https://bugzilla.suse.com/1235056","tags":["report"]},{"url":"https://bugzilla.suse.com/1235061","tags":["report"]},{"url":"https://bugzilla.suse.com/1235073","tags":["report"]},{"url":"https://bugzilla.suse.com/1235220","tags":["report"]},{"url":"https://bugzilla.suse.com/1235224","tags":["report"]},{"url":"https://bugzilla.suse.com/1235246","tags":["report"]},{"url":"https://bugzilla.suse.com/1235507","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-42327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-49035","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-50154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53095","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53156","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53173","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53179","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53214","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53239","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53240","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-53241","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56548","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56570","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56598","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56605","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-8805","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-48652","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48652","tags":["report"]},{"url":"https://git.kernel.org/linus/a509702cac95a8b450228a037c8542f57e538e5b","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-48652","title":"ice: Fix crash by keep old cfg when update TCs more than queues","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix crash by keep old cfg when update TCs more than queues\n\nThere are problems if allocated queues less than Traffic Classes.\n\nCommit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config\nfor DCB\") already disallow setting less queues than TCs.\n\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\n\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u003c8b\u003e 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.","status":"published","published":"2024-04-28T13:00:47.842Z","modified":"2026-08-05T08:51:37.429Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2022-51347","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix crash by keep old cfg when update TCs more than queues\n\nThere are problems if allocated queues less than Traffic Classes.\n\nCommit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config\nfor DCB\") already disallow setting less queues than TCs.\n\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\n\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u003c8b\u003e 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.","status":"published","published":"2024-04-28T13:00:47Z","modified":"2026-08-05T08:51:37Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:21.386596Z"}],"ghsa":[{"id":"GHSA-4j53-q2r4-27jv","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix crash by keep old...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix crash by keep old cfg when update TCs more than queues\n\nThere are problems if allocated queues less than Traffic Classes.\n\nCommit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config\nfor DCB\") already disallow setting less queues than TCs.\n\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\n\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u003c8b\u003e 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.","status":"published","published":"2024-04-28T15:30:30Z","modified":"2025-09-18T15:31:21Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:03:39.228327Z"}],"nvd":[{"id":"CVE-2022-48652","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix crash by keep old cfg when update TCs more than queues\n\nThere are problems if allocated queues less than Traffic Classes.\n\nCommit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config\nfor DCB\") already disallow setting less queues than TCs.\n\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\n\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u003c8b\u003e 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.","status":"published","published":"2024-04-28T13:15:07.477Z","modified":"2026-08-04T10:17:14.28Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:40.49892Z"}],"osv":[{"id":"CVE-2022-48652","title":"ice: Fix crash by keep old cfg when update TCs more than queues","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nice: Fix crash by keep old cfg when update TCs more than queues\n\nThere are problems if allocated queues less than Traffic Classes.\n\nCommit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config\nfor DCB\") already disallow setting less queues than TCs.\n\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\n\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u003c8b\u003e 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\n\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.","status":"published","published":"2024-04-28T13:00:47.842Z","modified":"2026-10-28T02:30:20.91073847Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:27.776402Z"},{"id":"OESA-2024-1706","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/mlx5e: Fix use-after-free of encap entry in neigh update handler\r\n\r\nFunction mlx5e_rep_neigh_update() wasn\u0026apos;t updated to accommodate rtnl lock\nremoval from TC filter update path and properly handle concurrent encap\nentry insertion/deletion which can lead to following use-after-free:\r\n\r\n [23827.464923] ==================================================================\n [23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635\n [23827.472251]\n [23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5\n [23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n [23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]\n [23827.476731] Call Trace:\n [23827.477260]  dump_stack+0xbb/0x107\n [23827.477906]  print_address_description.constprop.0+0x18/0x140\n [23827.478896]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.479879]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.480905]  kasan_report.cold+0x7c/0xd8\n [23827.481701]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.482744]  kasan_check_range+0x145/0x1a0\n [23827.493112]  mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.494054]  ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core]\n [23827.495296]  mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core]\n [23827.496338]  ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core]\n [23827.497486]  ? read_word_at_a_time+0xe/0x20\n [23827.498250]  ? strscpy+0xa0/0x2a0\n [23827.498889]  process_one_work+0x8ac/0x14e0\n [23827.499638]  ? lockdep_hardirqs_on_prepare+0x400/0x400\n [23827.500537]  ? pwq_dec_nr_in_flight+0x2c0/0x2c0\n [23827.501359]  ? rwlock_bug.part.0+0x90/0x90\n [23827.502116]  worker_thread+0x53b/0x1220\n [23827.502831]  ? process_one_work+0x14e0/0x14e0\n [23827.503627]  kthread+0x328/0x3f0\n [23827.504254]  ? _raw_spin_unlock_irq+0x24/0x40\n [23827.505065]  ? __kthread_bind_mask+0x90/0x90\n [23827.505912]  ret_from_fork+0x1f/0x30\n [23827.506621]\n [23827.506987] Allocated by task 28248:\n [23827.507694]  kasan_save_stack+0x1b/0x40\n [23827.508476]  __kasan_kmalloc+0x7c/0x90\n [23827.509197]  mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core]\n [23827.510194]  mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core]\n [23827.511218]  __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core]\n [23827.512234]  mlx5e_configure_flower+0x191c/0x4870 [mlx5_core]\n [23827.513298]  tc_setup_cb_add+0x1d5/0x420\n [23827.514023]  fl_hw_replace_filter+0x382/0x6a0 [cls_flower]\n [23827.514975]  fl_change+0x2ceb/0x4a51 [cls_flower]\n [23827.515821]  tc_new_tfilter+0x89a/0x2070\n [23827.516548]  rtnetlink_rcv_msg+0x644/0x8c0\n [23827.517300]  netlink_rcv_skb+0x11d/0x340\n [23827.518021]  netlink_unicast+0x42b/0x700\n [23827.518742]  netlink_sendmsg+0x743/0xc20\n [23827.519467]  sock_sendmsg+0xb2/0xe0\n [23827.520131]  ____sys_sendmsg+0x590/0x770\n [23827.520851]  ___sys_sendmsg+0xd8/0x160\n [23827.521552]  __sys_sendmsg+0xb7/0x140\n [23827.522238]  do_syscall_64+0x3a/0x70\n [23827.522907]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n [23827.523797]\n [23827.524163] Freed by task 25948:\n [23827.524780]  kasan_save_stack+0x1b/0x40\n [23827.525488]  kasan_set_track+0x1c/0x30\n [23827.526187]  kasan_set_free_info+0x20/0x30\n [23827.526968]  __kasan_slab_free+0xed/0x130\n [23827.527709]  slab_free_freelist_hook+0xcf/0x1d0\n [23827.528528]  kmem_cache_free_bulk+0x33a/0x6e0\n [23827.529317]  kfree_rcu_work+0x55f/0xb70\n [23827.530024]  process_one_work+0x8ac/0x14e0\n [23827.530770]  worker_thread+0x53b/0x1220\n [23827.531480]  kthread+0x328/0x3f0\n [23827.532114]  ret_from_fork+0x1f/0x30\n [23827.532785]\n [23827.533147] Last potentially related work creation:\n [23827.534007]  kasan_save_stack+0x1b/0x40\n [23827.534710]  kasan_record_aux_stack+0xab/0xc0\n [23827.535492]  kvfree_call_rcu+0x31/0x7b0\n [23827.536206]  mlx5e_tc_del\n---truncated---(CVE-2021-47247)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA: Verify port when creating flow rule\r\n\r\nValidate port value provided by the user and with that remove no longer\nneeded validation by the driver.  The missing check in the mlx5_ib driver\ncould cause to the below oops.\r\n\r\nCall trace:\n  _create_flow_rule+0x2d4/0xf28 [mlx5_ib]\n  mlx5_ib_create_flow+0x2d0/0x5b0 [mlx5_ib]\n  ib_uverbs_ex_create_flow+0x4cc/0x624 [ib_uverbs]\n  ib_uverbs_handler_UVERBS_METHOD_INVOKE_WRITE+0xd4/0x150 [ib_uverbs]\n  ib_uverbs_cmd_verbs.isra.7+0xb28/0xc50 [ib_uverbs]\n  ib_uverbs_ioctl+0x158/0x1d0 [ib_uverbs]\n  do_vfs_ioctl+0xd0/0xaf0\n  ksys_ioctl+0x84/0xb4\n  __arm64_sys_ioctl+0x28/0xc4\n  el0_svc_common.constprop.3+0xa4/0x254\n  el0_svc_handler+0x84/0xa0\n  el0_svc+0x10/0x26c\n Code: b9401260 f9615681 51000400 8b001c20 (f9403c1a)(CVE-2021-47265)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmISDN: fix possible use-after-free in HFC_cleanup()\r\n\r\nThis module\u0026apos;s remove path calls del_timer(). However, that function\ndoes not wait until the timer handler finishes. This means that the\ntimer handler may still be running after the driver\u0026apos;s remove function\nhas finished, which would result in a use-after-free.\r\n\r\nFix by calling del_timer_sync(), which makes sure the timer handler\nhas finished, and unable to re-schedule itself.(CVE-2021-47356)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: stmmac: Disable Tx queues when reconfiguring the interface\r\n\r\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\r\n\r\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\r\n\r\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\r\n\r\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---(CVE-2021-47558)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Fix crash by keep old cfg when update TCs more than queues\r\n\r\nThere are problems if allocated queues less than Traffic Classes.\r\n\r\nCommit a632b2a4c920 (\u0026quot;ice: ethtool: Prohibit improper channel config\nfor DCB\u0026quot;) already disallow setting less queues than TCs.\r\n\r\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\r\n\r\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u0026lt;8b\u0026gt; 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\r\n\r\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.(CVE-2022-48652)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\naio: fix mremap after fork null-deref\r\n\r\nCommit e4a0d3e720e7 (\u0026quot;aio: Make it possible to remap aio ring\u0026quot;) introduced\na null-deref if mremap is called on an old aio mapping after fork as\nmm-\u0026gt;ioctx_table will be set to NULL.\r\n\r\n[jmoyer@redhat.com: fix 80 column issue](CVE-2023-52646)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nriscv: Check if the code to patch lies in the exit section\r\n\r\nOtherwise we fall through to vmalloc_to_page() which panics since the\naddress does not lie in the vmalloc region.(CVE-2023-52677)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nALSA: scarlett2: Add missing error checks to *_ctl_get()\r\n\r\nThe *_ctl_get() functions which call scarlett2_update_*() were not\nchecking the return value. Fix to check the return value and pass to\nthe caller.(CVE-2023-52680)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/powernv: Add a null pointer check in opal_event_init()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.(CVE-2023-52686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: openvswitch: fix possible memory leak in ovs_meter_cmd_set()\r\n\r\nold_meter needs to be free after it is detached regardless of whether\nthe new meter is successfully attached.(CVE-2023-52702)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnilfs2: fix underflow in second superblock position calculations\r\n\r\nMacro NILFS_SB2_OFFSET_BYTES, which computes the position of the second\nsuperblock, underflows when the argument device size is less than 4096\nbytes.  Therefore, when using this macro, it is necessary to check in\nadvance that the device size is not less than a lower limit, or at least\nthat underflow does not occur.\r\n\r\nThe current nilfs2 implementation lacks this check, causing out-of-bound\nblock access when mounting devices smaller than 4096 bytes:\r\n\r\n I/O error, dev loop0, sector 36028797018963960 op 0x0:(READ) flags 0x0\n phys_seg 1 prio class 2\n NILFS (loop0): unable to read secondary superblock (blocksize = 1024)\r\n\r\nIn addition, when trying to resize the filesystem to a size below 4096\nbytes, this underflow occurs in nilfs_resize_fs(), passing a huge number\nof segments to nilfs_sufile_resize(), corrupting parameters such as the\nnumber of segments in superblocks.  This causes excessive loop iterations\nin nilfs_sufile_resize() during a subsequent resize ioctl, causing\nsemaphore ns_segctor_sem to block for a long time and hang the writer\nthread:\r\n\r\n INFO: task segctord:5067 blocked for more than 143 seconds.\n      Not tainted 6.2.0-rc8-syzkaller-00015-gf6feea56f66d #0\n \u0026quot;echo 0 \u0026gt; /proc/sys/kernel/hung_task_timeout_secs\u0026quot; disables this message.\n task:segctord        state:D stack:23456 pid:5067  ppid:2\n flags:0x00004000\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  context_switch kernel/sched/core.c:5293 [inline]\n  __schedule+0x1409/0x43f0 kernel/sched/core.c:6606\n  schedule+0xc3/0x190 kernel/sched/core.c:6682\n  rwsem_down_write_slowpath+0xfcf/0x14a0 kernel/locking/rwsem.c:1190\n  nilfs_transaction_lock+0x25c/0x4f0 fs/nilfs2/segment.c:357\n  nilfs_segctor_thread_construct fs/nilfs2/segment.c:2486 [inline]\n  nilfs_segctor_thread+0x52f/0x1140 fs/nilfs2/segment.c:2570\n  kthread+0x270/0x300 kernel/kthread.c:376\n  ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308\n  \u0026lt;/TASK\u0026gt;\n ...\n Call Trace:\n  \u0026lt;TASK\u0026gt;\n  folio_mark_accessed+0x51c/0xf00 mm/swap.c:515\n  __nilfs_get_page_block fs/nilfs2/page.c:42 [inline]\n  nilfs_grab_buffer+0x3d3/0x540 fs/nilfs2/page.c:61\n  nilfs_mdt_submit_block+0xd7/0x8f0 fs/nilfs2/mdt.c:121\n  nilfs_mdt_read_block+0xeb/0x430 fs/nilfs2/mdt.c:176\n  nilfs_mdt_get_block+0x12d/0xbb0 fs/nilfs2/mdt.c:251\n  nilfs_sufile_get_segment_usage_block fs/nilfs2/sufile.c:92 [inline]\n  nilfs_sufile_truncate_range fs/nilfs2/sufile.c:679 [inline]\n  nilfs_sufile_resize+0x7a3/0x12b0 fs/nilfs2/sufile.c:777\n  nilfs_resize_fs+0x20c/0xed0 fs/nilfs2/super.c:422\n  nilfs_ioctl_resize fs/nilfs2/ioctl.c:1033 [inline]\n  nilfs_ioctl+0x137c/0x2440 fs/nilfs2/ioctl.c:1301\n  ...\r\n\r\nThis fixes these issues by inserting appropriate minimum device size\nchecks or anti-underflow checks, depending on where the macro is used.(CVE-2023-52705)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nIB/IPoIB: Fix legacy IPoIB due to wrong number of queues\r\n\r\nThe cited commit creates child PKEY interfaces over netlink will\nmultiple tx and rx queues, but some devices doesn\u0026apos;t support more than 1\ntx and 1 rx queues. This causes to a crash when traffic is sent over the\nPKEY interface due to the parent having a single queue but the child\nhaving multiple queues.\r\n\r\nThis patch fixes the number of queues to 1 for legacy IPoIB at the\nearliest possible point in time.\r\n\r\nBUG: kernel NULL pointer dereference, address: 000000000000036b\nPGD 0 P4D 0\nOops: 0000 [#1] SMP\nCPU: 4 PID: 209665 Comm: python3 Not tainted 6.1.0_for_upstream_min_debug_2022_12_12_17_02 #1\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nRIP: 0010:kmem_cache_alloc+0xcb/0x450\nCode: ce 7e 49 8b 50 08 49 83 78 10 00 4d 8b 28 0f 84 cb 02 00 00 4d 85 ed 0f 84 c2 02 00 00 41 8b 44 24 28 48 8d 4a\n01 49 8b 3c 24 \u0026lt;49\u0026gt; 8b 5c 05 00 4c 89 e8 65 48 0f c7 0f 0f 94 c0 84 c0 74 b8 41 8b\nRSP: 0018:ffff88822acbbab8 EFLAGS: 00010202\nRAX: 0000000000000070 RBX: ffff8881c28e3e00 RCX: 00000000064f8dae\nRDX: 00000000064f8dad RSI: 0000000000000a20 RDI: 0000000000030d00\nRBP: 0000000000000a20 R08: ffff8882f5d30d00 R09: ffff888104032f40\nR10: ffff88810fade828 R11: 736f6d6570736575 R12: ffff88810081c000\nR13: 00000000000002fb R14: ffffffff817fc865 R15: 0000000000000000\nFS:  00007f9324ff9700(0000) GS:ffff8882f5d00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 000000000000036b CR3: 00000001125af004 CR4: 0000000000370ea0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n skb_clone+0x55/0xd0\n ip6_finish_output2+0x3fe/0x690\n ip6_finish_output+0xfa/0x310\n ip6_send_skb+0x1e/0x60\n udp_v6_send_skb+0x1e5/0x420\n udpv6_sendmsg+0xb3c/0xe60\n ? ip_mc_finish_output+0x180/0x180\n ? __switch_to_asm+0x3a/0x60\n ? __switch_to_asm+0x34/0x60\n sock_sendmsg+0x33/0x40\n __sys_sendto+0x103/0x160\n ? _copy_to_user+0x21/0x30\n ? kvm_clock_get_cycles+0xd/0x10\n ? ktime_get_ts64+0x49/0xe0\n __x64_sys_sendto+0x25/0x30\n do_syscall_64+0x3d/0x90\n entry_SYSCALL_64_after_hwframe+0x46/0xb0\nRIP: 0033:0x7f9374f1ed14\nCode: 42 41 f8 ff 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b\n7c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 68 41 f8 ff 48 8b\nRSP: 002b:00007f9324ff7bd0 EFLAGS: 00000293 ORIG_RAX: 000000000000002c\nRAX: ffffffffffffffda RBX: 00007f9324ff7cc8 RCX: 00007f9374f1ed14\nRDX: 00000000000002fb RSI: 00007f93000052f0 RDI: 0000000000000030\nRBP: 0000000000000000 R08: 00007f9324ff7d40 R09: 000000000000001c\nR10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000\nR13: 000000012a05f200 R14: 0000000000000001 R15: 00007f9374d57bdc\n \u0026lt;/TASK\u0026gt;(CVE-2023-52745)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()\r\n\r\n  int type = nla_type(nla);\r\n\r\n  if (type \u0026gt; XFRMA_MAX) {\n            return -EOPNOTSUPP;\n  }\r\n\r\n@type is then used as an array index and can be used\nas a Spectre v1 gadget.\r\n\r\n  if (nla_len(nla) \u0026lt; compat_policy[type].len) {\r\n\r\narray_index_nospec() can be used to prevent leaking\ncontent of kernel memory to malicious users.(CVE-2023-52746)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Avoid NULL dereference of timing generator\r\n\r\n[Why \u0026amp; How]\nCheck whether assigned timing generator is NULL or not before\naccessing its funcs to prevent NULL dereference.(CVE-2023-52753)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/smc: avoid data corruption caused by decline\r\n\r\nWe found a data corruption issue during testing of SMC-R on Redis\napplications.\r\n\r\nThe benchmark has a low probability of reporting a strange error as\nshown below.\r\n\r\n\u0026quot;Error: Protocol error, got \u0026quot;\\xe2\u0026quot; as reply type byte\u0026quot;\r\n\r\nFinally, we found that the retrieved error data was as follows:\r\n\r\n0xE2 0xD4 0xC3 0xD9 0x04 0x00 0x2C 0x20 0xA6 0x56 0x00 0x16 0x3E 0x0C\n0xCB 0x04 0x02 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xE2\r\n\r\nIt is quite obvious that this is a SMC DECLINE message, which means that\nthe applications received SMC protocol message.\nWe found that this was caused by the following situations:\r\n\r\nclient                  server\n        ¦  clc proposal\n        -------------\u0026gt;\n        ¦  clc accept\n        \u0026lt;-------------\n        ¦  clc confirm\n        -------------\u0026gt;\nwait llc confirm\n\t\t\tsend llc confirm\n        ¦failed llc confirm\n        ¦   x------\n(after 2s)timeout\n                        wait llc confirm rsp\r\n\r\nwait decline\r\n\r\n(after 1s) timeout\n                        (after 2s) timeout\n        ¦   decline\n        --------------\u0026gt;\n        ¦   decline\n        \u0026lt;--------------\r\n\r\nAs a result, a decline message was sent in the implementation, and this\nmessage was read from TCP by the already-fallback connection.\r\n\r\nThis patch double the client timeout as 2x of the server value,\nWith this simple change, the Decline messages should never cross or\ncollide (during Confirm link timeout).\r\n\r\nThis issue requires an immediate solution, since the protocol updates\ninvolve a more long-term solution.(CVE-2023-52775)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipvlan: add ipvlan_route_v6_outbound() helper\r\n\r\nInspired by syzbot reports using a stack of multiple ipvlan devices.\r\n\r\nReduce stack size needed in ipvlan_process_v6_outbound() by moving\nthe flowi6 struct used for the route lookup in an non inlined\nhelper. ipvlan_route_v6_outbound() needs 120 bytes on the stack,\nimmediately reclaimed.\r\n\r\nAlso make sure ipvlan_process_v4_outbound() is not inlined.\r\n\r\nWe might also have to lower MAX_NEST_DEV, because only syzbot uses\nsetups with more than four stacked devices.\r\n\r\nBUG: TASK stack guard page was hit at ffffc9000e803ff8 (stack is ffffc9000e804000..ffffc9000e808000)\nstack guard page: 0000 [#1] SMP KASAN\nCPU: 0 PID: 13442 Comm: syz-executor.4 Not tainted 6.1.52-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023\nRIP: 0010:kasan_check_range+0x4/0x2a0 mm/kasan/generic.c:188\nCode: 48 01 c6 48 89 c7 e8 db 4e c1 03 31 c0 5d c3 cc 0f 0b eb 02 0f 0b b8 ea ff ff ff 5d c3 cc 00 00 cc cc 00 00 cc cc 55 48 89 e5 \u0026lt;41\u0026gt; 57 41 56 41 55 41 54 53 b0 01 48 85 f6 0f 84 a4 01 00 00 48 89\nRSP: 0018:ffffc9000e804000 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff817e5bf2\nRDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff887c6568\nRBP: ffffc9000e804000 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff92001d0080c\nR13: dffffc0000000000 R14: ffffffff87e6b100 R15: 0000000000000000\nFS: 00007fd0c55826c0(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000e803ff8 CR3: 0000000170ef7000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u0026lt;#DF\u0026gt;\n\u0026lt;/#DF\u0026gt;\n\u0026lt;TASK\u0026gt;\n[\u0026lt;ffffffff81f281d1\u0026gt;] __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\n[\u0026lt;ffffffff817e5bf2\u0026gt;] instrument_atomic_read include/linux/instrumented.h:72 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] cpumask_test_cpu include/linux/cpumask.h:506 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] cpu_online include/linux/cpumask.h:1092 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] trace_lock_acquire include/trace/events/lock.h:24 [inline]\n[\u0026lt;ffffffff817e5bf2\u0026gt;] lock_acquire+0xe2/0x590 kernel/locking/lockdep.c:5632\n[\u0026lt;ffffffff8563221e\u0026gt;] rcu_lock_acquire+0x2e/0x40 include/linux/rcupdate.h:306\n[\u0026lt;ffffffff8561464d\u0026gt;] rcu_read_lock include/linux/rcupdate.h:747 [inline]\n[\u0026lt;ffffffff8561464d\u0026gt;] ip6_pol_route+0x15d/0x1440 net/ipv6/route.c:2221\n[\u0026lt;ffffffff85618120\u0026gt;] ip6_pol_route_output+0x50/0x80 net/ipv6/route.c:2606\n[\u0026lt;ffffffff856f65b5\u0026gt;] pol_lookup_func include/net/ip6_fib.h:584 [inline]\n[\u0026lt;ffffffff856f65b5\u0026gt;] fib6_rule_lookup+0x265/0x620 net/ipv6/fib6_rules.c:116\n[\u0026lt;ffffffff85618009\u0026gt;] ip6_route_output_flags_noref+0x2d9/0x3a0 net/ipv6/route.c:2638\n[\u0026lt;ffffffff8561821a\u0026gt;] ip6_route_output_flags+0xca/0x340 net/ipv6/route.c:2651\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ip6_route_output include/net/ip6_route.h:100 [inline]\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:473 [inline]\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]\n[\u0026lt;ffffffff838bd5a3\u0026gt;] ipvlan_queue_xmit+0xc33/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677\n[\u0026lt;ffffffff838c2909\u0026gt;] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229\n[\u0026lt;ffffffff84d03900\u0026gt;] netdev_start_xmit include/linux/netdevice.h:4966 [inline]\n[\u0026lt;ffffffff84d03900\u0026gt;] xmit_one net/core/dev.c:3644 [inline]\n[\u0026lt;ffffffff84d03900\u0026gt;] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660\n[\u0026lt;ffffffff84d080e2\u0026gt;] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324\n[\u0026lt;ffffffff855ce4cd\u0026gt;] dev_queue_xmit include/linux/netdevice.h:3067 [inline]\n[\u0026lt;ffffffff855ce4cd\u0026gt;] neigh_hh_output include/net/neighbour.h:529 [inline]\n[\u0026lt;f\n---truncated---(CVE-2023-52796)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath11k: fix dfs radar event locking\r\n\r\nThe ath11k active pdevs are protected by RCU but the DFS radar event\nhandling code calling ath11k_mac_get_ar_by_pdev_id() was not marked as a\nread-side critical section.\r\n\r\nMark the code in question as an RCU read-side critical section to avoid\nany potential use-after-free issues.\r\n\r\nCompile tested only.(CVE-2023-52798)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\njfs: fix array-index-out-of-bounds in dbFindLeaf\r\n\r\nCurrently while searching for dmtree_t for sufficient free blocks there\nis an array out of bounds while getting element in tp-\u0026gt;dm_stree. To add\nthe required check for out of bound we first need to determine the type\nof dmtree. Thus added an extra parameter to dbFindLeaf so that the type\nof tree can be determined and the required check can be applied.(CVE-2023-52799)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: ath11k: fix htt pktlog locking\r\n\r\nThe ath11k active pdevs are protected by RCU but the htt pktlog handling\ncode calling ath11k_mac_get_ar_by_pdev_id() was not marked as a\nread-side critical section.\r\n\r\nMark the code in question as an RCU read-side critical section to avoid\nany potential use-after-free issues.\r\n\r\nCompile tested only.(CVE-2023-52800)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\r\n\r\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\nworkqueue,which takes care about pipefs superblock locking.\nIn some special scenarios, when kernel frees the pipefs sb of the\ncurrent client and immediately alloctes a new pipefs sb,\nrpc_remove_pipedir function would misjudge the existence of pipefs\nsb which is not the one it used to hold. As a result,\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\r\n\r\nTo fix this issue, rpc_remove_pipedir should check whether the\ncurrent pipefs sb is consistent with the original pipefs sb.\r\n\r\nThis error can be catched by KASAN:\n=========================================================\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\n[  250.500549] Workqueue: events rpc_free_client_work\n[  250.501001] Call Trace:\n[  250.502880]  kasan_report+0xb6/0xf0\n[  250.503209]  ? dget_parent+0x195/0x200\n[  250.503561]  dget_parent+0x195/0x200\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\n[  250.505195]  rpc_free_client_work+0xe4/0x230\n[  250.505598]  process_one_work+0x8ee/0x13b0\n...\n[   22.039056] Allocated by task 244:\n[   22.039390]  kasan_save_stack+0x22/0x50\n[   22.039758]  kasan_set_track+0x25/0x30\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\n[   22.040889]  __d_alloc+0x31/0x8e0\n[   22.041207]  d_alloc+0x44/0x1f0\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\n[   22.042459]  rpc_create_client_dir+0x34/0x150\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\n[   22.043284]  rpc_client_register+0x136/0x4e0\n[   22.043689]  rpc_new_client+0x911/0x1020\n[   22.044057]  rpc_create_xprt+0xcb/0x370\n[   22.044417]  rpc_create+0x36b/0x6c0\n...\n[   22.049524] Freed by task 0:\n[   22.049803]  kasan_save_stack+0x22/0x50\n[   22.050165]  kasan_set_track+0x25/0x30\n[   22.050520]  kasan_save_free_info+0x2b/0x50\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\n[   22.051306]  kmem_cache_free+0xa5/0x390\n[   22.051667]  rcu_core+0x62c/0x1930\n[   22.051995]  __do_softirq+0x165/0x52a\n[   22.052347]\n[   22.052503] Last potentially related work creation:\n[   22.052952]  kasan_save_stack+0x22/0x50\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\n[   22.054209]  dentry_free+0xb2/0x140\n[   22.054540]  __dentry_kill+0x3be/0x540\n[   22.054900]  shrink_dentry_list+0x199/0x510\n[   22.055293]  shrink_dcache_parent+0x190/0x240\n[   22.055703]  do_one_tree+0x11/0x40\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\n[   22.056461]  generic_shutdown_super+0x70/0x590\n[   22.056879]  kill_anon_super+0x3a/0x60\n[   22.057234]  rpc_kill_sb+0x121/0x200(CVE-2023-52803)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs\r\n\r\nThe hns3 driver define an array of string to show the coalesce\ninfo, but if the kernel adds a new mode or a new state,\nout-of-bounds access may occur when coalesce info is read via\ndebugfs, this patch fix the problem.(CVE-2023-52807)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nclk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data\r\n\r\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.(CVE-2023-52865)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nclk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data\r\n\r\nAdd the check for the return value of mtk_alloc_clk_data() in order to\navoid NULL pointer dereference.(CVE-2023-52875)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxen-netfront: Add missing skb_mark_for_recycle\r\n\r\nNotice that skb_mark_for_recycle() is introduced later than fixes tag in\ncommit 6a5bcd84e886 (\u0026quot;page_pool: Allow drivers to hint on SKB recycling\u0026quot;).\r\n\r\nIt is believed that fixes tag were missing a call to page_pool_release_page()\nbetween v5.9 to v5.14, after which is should have used skb_mark_for_recycle().\nSince v6.6 the call page_pool_release_page() were removed (in\ncommit 535b9c61bdef (\u0026quot;net: page_pool: hide page_pool_release_page()\u0026quot;)\nand remaining callers converted (in commit 6bfef2ec0172 (\u0026quot;Merge branch\n\u0026apos;net-page_pool-remove-page_pool_release_page\u0026apos;\u0026quot;)).\r\n\r\nThis leak became visible in v6.8 via commit dba1b8a7ab68 (\u0026quot;mm/page_pool: catch\npage_pool memory leaks\u0026quot;).(CVE-2024-27393)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout\r\n\r\nThere is a race condition between l2cap_chan_timeout() and\nl2cap_chan_del(). When we use l2cap_chan_del() to delete the\nchannel, the chan-\u0026gt;conn will be set to null. But the conn could\nbe dereferenced again in the mutex_lock() of l2cap_chan_timeout().\nAs a result the null pointer dereference bug will happen. The\nKASAN report triggered by POC is shown below:\r\n\r\n[  472.074580] ==================================================================\n[  472.075284] BUG: KASAN: null-ptr-deref in mutex_lock+0x68/0xc0\n[  472.075308] Write of size 8 at addr 0000000000000158 by task kworker/0:0/7\n[  472.075308]\n[  472.075308] CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.9.0-rc5-00356-g78c0094a146b #36\n[  472.075308] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4\n[  472.075308] Workqueue: events l2cap_chan_timeout\n[  472.075308] Call Trace:\n[  472.075308]  \u0026lt;TASK\u0026gt;\n[  472.075308]  dump_stack_lvl+0x137/0x1a0\n[  472.075308]  print_report+0x101/0x250\n[  472.075308]  ? __virt_addr_valid+0x77/0x160\n[  472.075308]  ? mutex_lock+0x68/0xc0\n[  472.075308]  kasan_report+0x139/0x170\n[  472.075308]  ? mutex_lock+0x68/0xc0\n[  472.075308]  kasan_check_range+0x2c3/0x2e0\n[  472.075308]  mutex_lock+0x68/0xc0\n[  472.075308]  l2cap_chan_timeout+0x181/0x300\n[  472.075308]  process_one_work+0x5d2/0xe00\n[  472.075308]  worker_thread+0xe1d/0x1660\n[  472.075308]  ? pr_cont_work+0x5e0/0x5e0\n[  472.075308]  kthread+0x2b7/0x350\n[  472.075308]  ? pr_cont_work+0x5e0/0x5e0\n[  472.075308]  ? kthread_blkcg+0xd0/0xd0\n[  472.075308]  ret_from_fork+0x4d/0x80\n[  472.075308]  ? kthread_blkcg+0xd0/0xd0\n[  472.075308]  ret_from_fork_asm+0x11/0x20\n[  472.075308]  \u0026lt;/TASK\u0026gt;\n[  472.075308] ==================================================================\n[  472.094860] Disabling lock debugging due to kernel taint\n[  472.096136] BUG: kernel NULL pointer dereference, address: 0000000000000158\n[  472.096136] #PF: supervisor write access in kernel mode\n[  472.096136] #PF: error_code(0x0002) - not-present page\n[  472.096136] PGD 0 P4D 0\n[  472.096136] Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI\n[  472.096136] CPU: 0 PID: 7 Comm: kworker/0:0 Tainted: G    B              6.9.0-rc5-00356-g78c0094a146b #36\n[  472.096136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu4\n[  472.096136] Workqueue: events l2cap_chan_timeout\n[  472.096136] RIP: 0010:mutex_lock+0x88/0xc0\n[  472.096136] Code: be 08 00 00 00 e8 f8 23 1f fd 4c 89 f7 be 08 00 00 00 e8 eb 23 1f fd 42 80 3c 23 00 74 08 48 88\n[  472.096136] RSP: 0018:ffff88800744fc78 EFLAGS: 00000246\n[  472.096136] RAX: 0000000000000000 RBX: 1ffff11000e89f8f RCX: ffffffff8457c865\n[  472.096136] RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffff88800744fc78\n[  472.096136] RBP: 0000000000000158 R08: ffff88800744fc7f R09: 1ffff11000e89f8f\n[  472.096136] R10: dffffc0000000000 R11: ffffed1000e89f90 R12: dffffc0000000000\n[  472.096136] R13: 0000000000000158 R14: ffff88800744fc78 R15: ffff888007405a00\n[  472.096136] FS:  0000000000000000(0000) GS:ffff88806d200000(0000) knlGS:0000000000000000\n[  472.096136] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  472.096136] CR2: 0000000000000158 CR3: 000000000da32000 CR4: 00000000000006f0\n[  472.096136] Call Trace:\n[  472.096136]  \u0026lt;TASK\u0026gt;\n[  472.096136]  ? __die_body+0x8d/0xe0\n[  472.096136]  ? page_fault_oops+0x6b8/0x9a0\n[  472.096136]  ? kernelmode_fixup_or_oops+0x20c/0x2a0\n[  472.096136]  ? do_user_addr_fault+0x1027/0x1340\n[  472.096136]  ? _printk+0x7a/0xa0\n[  472.096136]  ? mutex_lock+0x68/0xc0\n[  472.096136]  ? add_taint+0x42/0xd0\n[  472.096136]  ? exc_page_fault+0x6a/0x1b0\n[  472.096136]  ? asm_exc_page_fault+0x26/0x30\n[  472.096136]  ? mutex_lock+0x75/0xc0\n[  472.096136]  ? mutex_lock+0x88/0xc0\n[  472.096136]  ? mutex_lock+0x75/0xc0\n[  472.096136]  l2cap_chan_timeo\n---truncated---(CVE-2024-27399)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nphonet/pep: fix racy skb_queue_empty() use\r\n\r\nThe receive queues are protected by their respective spin-lock, not\nthe socket lock. This could lead to skb_peek() unexpectedly\nreturning NULL or a pointer to an already dequeued socket buffer.(CVE-2024-27402)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: bridge: confirm multicast packets before passing them up the stack\r\n\r\nconntrack nf_confirm logic cannot handle cloned skbs referencing\nthe same nf_conn entry, which will happen for multicast (broadcast)\nframes on bridges.\r\n\r\n Example:\n    macvlan0\n       |\n      br0\n     /  \\\n  ethX    ethY\r\n\r\n ethX (or Y) receives a L2 multicast or broadcast packet containing\n an IP packet, flow is not yet in conntrack table.\r\n\r\n 1. skb passes through bridge and fake-ip (br_netfilter)Prerouting.\n    -\u0026gt; skb-\u0026gt;_nfct now references a unconfirmed entry\n 2. skb is broad/mcast packet. bridge now passes clones out on each bridge\n    interface.\n 3. skb gets passed up the stack.\n 4. In macvlan case, macvlan driver retains clone(s) of the mcast skb\n    and schedules a work queue to send them out on the lower devices.\r\n\r\n    The clone skb-\u0026gt;_nfct is not a copy, it is the same entry as the\n    original skb.  The macvlan rx handler then returns RX_HANDLER_PASS.\n 5. Normal conntrack hooks (in NF_INET_LOCAL_IN) confirm the orig skb.\r\n\r\nThe Macvlan broadcast worker and normal confirm path will race.\r\n\r\nThis race will not happen if step 2 already confirmed a clone. In that\ncase later steps perform skb_clone() with skb-\u0026gt;_nfct already confirmed (in\nhash table).  This works fine.\r\n\r\nBut such confirmation won\u0026apos;t happen when eb/ip/nftables rules dropped the\npackets before they reached the nf_confirm step in postrouting.\r\n\r\nPablo points out that nf_conntrack_bridge doesn\u0026apos;t allow use of stateful\nnat, so we can safely discard the nf_conn entry and let inet call\nconntrack again.\r\n\r\nThis doesn\u0026apos;t work for bridge netfilter: skb could have a nat\ntransformation. Also bridge nf prevents re-invocation of inet prerouting\nvia \u0026apos;sabotage_in\u0026apos; hook.\r\n\r\nWork around this problem by explicit confirmation of the entry at LOCAL_IN\ntime, before upper layer has a chance to clone the unconfirmed entry.\r\n\r\nThe downside is that this disables NAT and conntrack helpers.\r\n\r\nAlternative fix would be to add locking to all code parts that deal with\nunconfirmed packets, but even if that could be done in a sane way this\nopens up other problems, for example:\r\n\r\n-m physdev --physdev-out eth0 -j SNAT --snat-to 1.2.3.4\n-m physdev --physdev-out eth1 -j SNAT --snat-to 1.2.3.5\r\n\r\nFor multicast case, only one of such conflicting mappings will be\ncreated, conntrack only handles 1:1 NAT mappings.\r\n\r\nUsers should set create a setup that explicitly marks such traffic\nNOTRACK (conntrack bypass) to avoid this, but we cannot auto-bypass\nthem, ruleset might have accept rules for untracked traffic already,\nso user-visible behaviour would change.(CVE-2024-27415)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: altmodes/displayport: create sysfs nodes as driver\u0026apos;s default device attribute group\r\n\r\nThe DisplayPort driver\u0026apos;s sysfs nodes may be present to the userspace before\ntypec_altmode_set_drvdata() completes in dp_altmode_probe. This means that\na sysfs read can trigger a NULL pointer error by deferencing dp-\u0026gt;hpd in\nhpd_show or dp-\u0026gt;lock in pin_assignment_show, as dev_get_drvdata() returns\nNULL in those cases.\r\n\r\nRemove manual sysfs node creation in favor of adding attribute group as\ndefault for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is\nnot used here otherwise the path to the sysfs nodes is no longer compliant\nwith the ABI.(CVE-2024-35790)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPCI/PM: Drain runtime-idle callbacks before driver removal\r\n\r\nA race condition between the .runtime_idle() callback and the .remove()\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\nunhandled page fault [1].\r\n\r\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\nafter pm_runtime_get_sync() has been called, but the latter doesn\u0026apos;t really\nguarantee that.  It only guarantees that the suspend and resume callbacks\nwill not be running when it returns.\r\n\r\nHowever, if a .runtime_idle() callback is already running when\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\nstatus of the device is RPM_ACTIVE and it will return right away without\nwaiting for the former to complete.  In fact, it cannot wait for\n.runtime_idle() to complete because it may be called from that callback (it\narguably does not make much sense to do that, but it is not strictly\nprohibited).\r\n\r\nThus in general, whoever is providing a .runtime_idle() callback needs\nto protect it from running in parallel with whatever code runs after\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\npm_runtime_get_sync() has returned, but it may continue running then if it\nhas started earlier.]\r\n\r\nOne way to address that race condition is to call pm_runtime_barrier()\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\nbeing invoked) to wait for the .runtime_idle() callback to complete should\nit be running at that point.  A suitable place for doing that is in\npci_device_remove() which calls pm_runtime_get_sync() before removing the\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\nwill prevent the race in question from occurring, not just in the rtsx_pcr\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.(CVE-2024-35809)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix memory leak during rehash\r\n\r\nThe rehash delayed work migrates filters from one region to another.\nThis is done by iterating over all chunks (all the filters with the same\npriority) in the region and in each chunk iterating over all the\nfilters.\r\n\r\nIf the migration fails, the code tries to migrate the filters back to\nthe old region. However, the rollback itself can also fail in which case\nanother migration will be erroneously performed. Besides the fact that\nthis ping pong is not a very good idea, it also creates a problem.\r\n\r\nEach virtual chunk references two chunks: The currently used one\n(\u0026apos;vchunk-\u0026gt;chunk\u0026apos;) and a backup (\u0026apos;vchunk-\u0026gt;chunk2\u0026apos;). During migration the\nfirst holds the chunk we want to migrate filters to and the second holds\nthe chunk we are migrating filters from.\r\n\r\nThe code currently assumes - but does not verify - that the backup chunk\ndoes not exist (NULL) if the currently used chunk does not reference the\ntarget region. This assumption breaks when we are trying to rollback a\nrollback, resulting in the backup chunk being overwritten and leaked\n[1].\r\n\r\nFix by not rolling back a failed rollback and add a warning to avoid\nfuture cases.\r\n\r\n[1]\nWARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20\nModules linked in:\nCPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:parman_destroy+0x17/0x20\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlxsw_sp_acl_atcam_region_fini+0x19/0x60\n mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;(CVE-2024-35853)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\r\n\r\nThe rehash delayed work migrates filters from one region to another\naccording to the number of available credits.\r\n\r\nThe migrated from region is destroyed at the end of the work if the\nnumber of credits is non-negative as the assumption is that this is\nindicative of migration being complete. This assumption is incorrect as\na non-negative number of credits can also be the result of a failed\nmigration.\r\n\r\nThe destruction of a region that still has filters referencing it can\nresult in a use-after-free [1].\r\n\r\nFix by not destroying the region if migration failed.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\r\n\r\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 174:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\r\n\r\nFreed by task 7:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30(CVE-2024-35854)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update\r\n\r\nThe rule activity update delayed work periodically traverses the list of\nconfigured rules and queries their activity from the device.\r\n\r\nAs part of this task it accesses the entry pointed by \u0026apos;ventry-\u0026gt;entry\u0026apos;,\nbut this entry can be changed concurrently by the rehash delayed work,\nleading to a use-after-free [1].\r\n\r\nFix by closing the race and perform the activity query under the\n\u0026apos;vregion-\u0026gt;lock\u0026apos; mutex.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\nRead of size 8 at addr ffff8881054ed808 by task kworker/0:18/181\r\n\r\nCPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140\n mlxsw_sp_acl_rule_activity_update_work+0x219/0x400\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\r\n\r\nFreed by task 1039:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30(CVE-2024-35855)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: Fix infinite recursion in fib6_dump_done().\r\n\r\nsyzkaller reported infinite recursive calls of fib6_dump_done() during\nnetlink socket destruction.  [1]\r\n\r\nFrom the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and then\nthe response was generated.  The following recvmmsg() resumed the dump\nfor IPv6, but the first call of inet6_dump_fib() failed at kzalloc() due\nto the fault injection.  [0]\r\n\r\n  12:01:34 executing program 3:\n  r0 = socket$nl_route(0x10, 0x3, 0x0)\n  sendmsg$nl_route(r0, ... snip ...)\n  recvmmsg(r0, ... snip ...) (fail_nth: 8)\r\n\r\nHere, fib6_dump_done() was set to nlk_sk(sk)-\u0026gt;cb.done, and the next call\nof inet6_dump_fib() set it to nlk_sk(sk)-\u0026gt;cb.args[3].  syzkaller stopped\nreceiving the response halfway through, and finally netlink_sock_destruct()\ncalled nlk_sk(sk)-\u0026gt;cb.done().\r\n\r\nfib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)-\u0026gt;cb.done() if it\nis still not NULL.  fib6_dump_end() rewrites nlk_sk(sk)-\u0026gt;cb.done() by\nnlk_sk(sk)-\u0026gt;cb.args[3], but it has the same function, not NULL, calling\nitself recursively and hitting the stack guard page.\r\n\r\nTo avoid the issue, let\u0026apos;s set the destructor after kzalloc().\r\n\r\n[0]:\nFAULT_INJECTION: forcing a failure.\nname failslab, interval 1, probability 0, space 0, times 0\nCPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl (lib/dump_stack.c:117)\n should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153)\n should_failslab (mm/slub.c:3733)\n kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992)\n inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662)\n rtnl_dump_all (net/core/rtnetlink.c:4029)\n netlink_dump (net/netlink/af_netlink.c:2269)\n netlink_recvmsg (net/netlink/af_netlink.c:1988)\n ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801)\n ___sys_recvmsg (net/socket.c:2846)\n do_recvmmsg (net/socket.c:2943)\n __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)\r\n\r\n[1]:\nBUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb)\nstack guard page: 0000 [#1] PREEMPT SMP KASAN\nCPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014\nWorkqueue: events netlink_sock_destruct_work\nRIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570)\nCode: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd \u0026lt;53\u0026gt; 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ff\nRSP: 0018:ffffc9000d980000 EFLAGS: 00010293\nRAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3\nRDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358\nRBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000\nR13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68\nFS:  0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0\nPKRU: 55555554\nCall Trace:\n \u0026lt;#DF\u0026gt;\n \u0026lt;/#DF\u0026gt;\n \u0026lt;TASK\u0026gt;\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n ...\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1))\n netlink_sock_destruct (net/netlink/af_netlink.c:401)\n __sk_destruct (net/core/sock.c:2177 (discriminator 2))\n sk_destruct (net/core/sock.c:2224)\n __sk_free (net/core/sock.c:2235)\n sk_free (net/core/sock.c:2246)\n process_one_work (kernel/workqueue.c:3259)\n worker_thread (kernel/workqueue.c:3329 kernel/workqueue.\n---truncated---(CVE-2024-35886)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nerspan: make sure erspan_base_hdr is present in skb-\u0026gt;head\r\n\r\nsyzbot reported a problem in ip6erspan_rcv() [1]\r\n\r\nIssue is that ip6erspan_rcv() (and erspan_rcv()) no longer make\nsure erspan_base_hdr is present in skb linear part (skb-\u0026gt;head)\nbefore getting @ver field from it.\r\n\r\nAdd the missing pskb_may_pull() calls.\r\n\r\nv2: Reload iph pointer in erspan_rcv() after pskb_may_pull()\n    because skb-\u0026gt;head might have changed.\r\n\r\n[1]\r\n\r\n BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline]\n BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n  pskb_may_pull include/linux/skbuff.h:2756 [inline]\n  ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n  gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:460 [inline]\n  ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5538 [inline]\n  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652\n  netif_receive_skb_internal net/core/dev.c:5738 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5798\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549\n  tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  tun_alloc_skb drivers/net/tun.c:1525 [inline]\n  tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nCPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0(CVE-2024-35888)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf, sockmap: Prevent lock inversion deadlock in map delete elem\r\n\r\nsyzkaller started using corpuses where a BPF tracing program deletes\nelements from a sockmap/sockhash map. Because BPF tracing programs can be\ninvoked from any interrupt context, locks taken during a map_delete_elem\noperation must be hardirq-safe. Otherwise a deadlock due to lock inversion\nis possible, as reported by lockdep:\r\n\r\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;htab-\u0026gt;buckets[i].lock);\n                               local_irq_disable();\n                               lock(\u0026amp;host-\u0026gt;lock);\n                               lock(\u0026amp;htab-\u0026gt;buckets[i].lock);\n  \u0026lt;Interrupt\u0026gt;\n    lock(\u0026amp;host-\u0026gt;lock);\r\n\r\nLocks in sockmap are hardirq-unsafe by design. We expects elements to be\ndeleted from sockmap/sockhash only in task (normal) context with interrupts\nenabled, or in softirq context.\r\n\r\nDetect when map_delete_elem operation is invoked from a context which is\n_not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an\nerror.\r\n\r\nNote that map updates are not affected by this issue. BPF verifier does not\nallow updating sockmap/sockhash from a BPF tracing program today.(CVE-2024-35895)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: validate user input for expected length\r\n\r\nI got multiple syzbot reports showing old bugs exposed\nby BPF after commit 20f2505fb436 (\u0026quot;bpf: Try to avoid kzalloc\nin cgroup/{s,g}etsockopt\u0026quot;)\r\n\r\nsetsockopt() @optlen argument should be taken into account\nbefore copying data.\r\n\r\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\nRead of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238\r\n\r\nCPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n  __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n  do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\n  nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\nRIP: 0033:0x7fd22067dde9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9\nRDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 7238:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:4069 [inline]\n  __kmalloc_noprof+0x200/0x410 mm/slub.c:4082\n  kmalloc_noprof include/linux/slab.h:664 [inline]\n  __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\r\n\r\nThe buggy address belongs to the object at ffff88802cd73da0\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes inside of\n allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1)\r\n\r\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73\nflags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)\npage_type: 0xffffefff(slab)\nraw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122\nraw: ffff88802cd73020 000000008080007f 00000001ffffefff 00\n---truncated---(CVE-2024-35896)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Protect against int overflow for stack access size\r\n\r\nThis patch re-introduces protection against the size of access to stack\nmemory being negative; the access size can appear negative as a result\nof overflowing its signed int representation. This should not actually\nhappen, as there are other protections along the way, but we should\nprotect against it anyway. One code path was missing such protections\n(fixed in the previous patch in the series), causing out-of-bounds array\naccesses in check_stack_range_initialized(). This patch causes the\nverification of a program with such a non-sensical access size to fail.\r\n\r\nThis check used to exist in a more indirect way, but was inadvertendly\nremoved in a833a17aeac7.(CVE-2024-35905)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnfc: nci: Fix uninit-value in nci_dev_up and nci_ntf_packet\r\n\r\nsyzbot reported the following uninit-value access issue [1][2]:\r\n\r\nnci_rx_work() parses and processes received packet. When the payload\nlength is zero, each message type handler reads uninitialized payload\nand KMSAN detects this issue. The receipt of a packet with a zero-size\npayload is considered unexpected, and therefore, such packets should be\nsilently discarded.\r\n\r\nThis patch resolved this issue by checking payload size before calling\neach message type handler codes.(CVE-2024-35915)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: ucsi: Limit read size on v1.2\r\n\r\nBetween UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was\nincreased from 16 to 256. In order to avoid overflowing reads for older\nsystems, add a mechanism to use the read UCSI version to truncate read\nsizes on UCSI v1.2.(CVE-2024-35924)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblock: prevent division by zero in blk_rq_stat_sum()\r\n\r\nThe expression dst-\u0026gt;nr_samples + src-\u0026gt;nr_samples may\nhave zero value on overflow. It is necessary to add\na check to avoid division by zero.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with Svace.(CVE-2024-35925)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: SCO: Fix not validating setsockopt user input\r\n\r\nsyzbot reported sco_sock_setsockopt() is copying data without\nchecking user input length.\r\n\r\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\nnet/bluetooth/sco.c:893\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578(CVE-2024-35967)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngeneve: fix header validation in geneve[6]_xmit_skb\r\n\r\nsyzbot is able to trigger an uninit-value in geneve_xmit() [1]\r\n\r\nProblem : While most ip tunnel helpers (like ip_tunnel_get_dsfield())\nuses skb_protocol(skb, true), pskb_inet_may_pull() is only using\nskb-\u0026gt;protocol.\r\n\r\nIf anything else than ETH_P_IPV6 or ETH_P_IP is found in skb-\u0026gt;protocol,\npskb_inet_may_pull() does nothing at all.\r\n\r\nIf a vlan tag was provided by the caller (af_packet in the syzbot case),\nthe network header might not point to the correct location, and skb\nlinear part could be smaller than expected.\r\n\r\nAdd skb_vlan_inet_prepare() to perform a complete mac validation.\r\n\r\nUse this in geneve for the moment, I suspect we need to adopt this\nmore broadly.\r\n\r\nv4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest\n   - Only call __vlan_get_protocol() for vlan types.\r\n\r\nv2,v3 - Addressed Sabrina comments on v1 and v2\r\n\r\n[1]\r\n\r\nBUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n  geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n  geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n  __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n  netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n  xmit_one net/core/dev.c:3531 [inline]\n  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547\n  __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335\n  dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3081 [inline]\n  packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n  packet_snd net/packet/af_packet.c:3024 [inline]\n  packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nCPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024(CVE-2024-35973)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv4: check for NULL idev in ip_route_use_hint()\r\n\r\nsyzbot was able to trigger a NULL deref in fib_validate_source()\nin an old tree [1].\r\n\r\nIt appears the bug exists in latest trees.\r\n\r\nAll calls to __in_dev_get_rcu() must be checked for a NULL result.\r\n\r\n[1]\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 2 PID: 3257 Comm: syz-executor.3 Not tainted 5.10.0-syzkaller #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:fib_validate_source+0xbf/0x15a0 net/ipv4/fib_frontend.c:425\nCode: 18 f2 f2 f2 f2 42 c7 44 20 23 f3 f3 f3 f3 48 89 44 24 78 42 c6 44 20 27 f3 e8 5d 88 48 fc 4c 89 e8 48 c1 e8 03 48 89 44 24 18 \u0026lt;42\u0026gt; 80 3c 20 00 74 08 4c 89 ef e8 d2 15 98 fc 48 89 5c 24 10 41 bf\nRSP: 0018:ffffc900015fee40 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff88800f7a4000 RCX: ffff88800f4f90c0\nRDX: 0000000000000000 RSI: 0000000004001eac RDI: ffff8880160c64c0\nRBP: ffffc900015ff060 R08: 0000000000000000 R09: ffff88800f7a4000\nR10: 0000000000000002 R11: ffff88800f4f90c0 R12: dffffc0000000000\nR13: 0000000000000000 R14: 0000000000000000 R15: ffff88800f7a4000\nFS:  00007f938acfe6c0(0000) GS:ffff888058c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f938acddd58 CR3: 000000001248e000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n  ip_route_use_hint+0x410/0x9b0 net/ipv4/route.c:2231\n  ip_rcv_finish_core+0x2c4/0x1a30 net/ipv4/ip_input.c:327\n  ip_list_rcv_finish net/ipv4/ip_input.c:612 [inline]\n  ip_sublist_rcv+0x3ed/0xe50 net/ipv4/ip_input.c:638\n  ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:673\n  __netif_receive_skb_list_ptype net/core/dev.c:5572 [inline]\n  __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5620\n  __netif_receive_skb_list net/core/dev.c:5672 [inline]\n  netif_receive_skb_list_internal+0x9f9/0xdc0 net/core/dev.c:5764\n  netif_receive_skb_list+0x55/0x3e0 net/core/dev.c:5816\n  xdp_recv_frames net/bpf/test_run.c:257 [inline]\n  xdp_test_run_batch net/bpf/test_run.c:335 [inline]\n  bpf_test_run_xdp_live+0x1818/0x1d00 net/bpf/test_run.c:363\n  bpf_prog_test_run_xdp+0x81f/0x1170 net/bpf/test_run.c:1376\n  bpf_prog_test_run+0x349/0x3c0 kernel/bpf/syscall.c:3736\n  __sys_bpf+0x45c/0x710 kernel/bpf/syscall.c:5115\n  __do_sys_bpf kernel/bpf/syscall.c:5201 [inline]\n  __se_sys_bpf kernel/bpf/syscall.c:5199 [inline]\n  __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5199(CVE-2024-36008)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nrtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation\r\n\r\nEach attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a\nstruct ifla_vf_vlan_info so the size of such attribute needs to be at least\nof sizeof(struct ifla_vf_vlan_info) which is 14 bytes.\nThe current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)\nwhich is less than sizeof(struct ifla_vf_vlan_info) so this validation\nis not enough and a too small attribute might be cast to a\nstruct ifla_vf_vlan_info, this might result in an out of bands\nread access when accessing the saved (casted) entry in ivvl.(CVE-2024-36017)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: hns3: fix kernel crash when devlink reload during pf initialization\r\n\r\nThe devlink reload process will access the hardware resources,\nbut the register operation is done before the hardware is initialized.\nSo, processing the devlink reload during initialization may lead to kernel\ncrash. This patch fixes this by taking devl_lock during initialization.(CVE-2024-36021)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmmc: sdhci-msm: pervent access to suspended controller\r\n\r\nGeneric sdhci code registers LED device and uses host-\u0026gt;runtime_suspended\nflag to protect access to it. The sdhci-msm driver doesn\u0026apos;t set this flag,\nwhich causes a crash when LED is accessed while controller is runtime\nsuspended. Fix this by setting the flag correctly.(CVE-2024-36029)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: fix out-of-bounds access in ops_init\r\n\r\nnet_alloc_generic is called by net_alloc, which is called without any\nlocking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It\nis read twice, first to allocate an array, then to set s.len, which is\nlater used to limit the bounds of the array access.\r\n\r\nIt is possible that the array is allocated and another thread is\nregistering a new pernet ops, increments max_gen_ptrs, which is then used\nto set s.len with a larger than allocated length for the variable array.\r\n\r\nFix it by reading max_gen_ptrs only once in net_alloc_generic. If\nmax_gen_ptrs is later incremented, it will be caught in net_assign_generic.(CVE-2024-36883)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: fix UAF in error path\r\n\r\nSam Page (sam4k) working with Trend Micro Zero Day Initiative reported\na UAF in the tipc_buf_append() error path:\r\n\r\nBUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0\nlinux/net/core/skbuff.c:1183\nRead of size 8 at addr ffff88804d2a7c80 by task poc/8034\r\n\r\nCPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.0-debian-1.16.0-5 04/01/2014\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n __dump_stack linux/lib/dump_stack.c:88\n dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106\n print_address_description linux/mm/kasan/report.c:377\n print_report+0xc4/0x620 linux/mm/kasan/report.c:488\n kasan_report+0xda/0x110 linux/mm/kasan/report.c:601\n kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183\n skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026\n skb_release_all linux/net/core/skbuff.c:1094\n __kfree_skb linux/net/core/skbuff.c:1108\n kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144\n kfree_skb linux/./include/linux/skbuff.h:1244\n tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186\n tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324\n tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824\n tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159\n tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390\n udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108\n udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186\n udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346\n __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422\n ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254\n dst_input linux/./include/net/dst.h:461\n ip_rcv_finish linux/net/ipv4/ip_input.c:449\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534\n __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648\n process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976\n __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576\n napi_poll linux/net/core/dev.c:6645\n net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781\n __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553\n do_softirq linux/kernel/softirq.c:454\n do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381\n local_bh_enable linux/./include/linux/bottom_half.h:33\n rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851\n __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378\n dev_queue_xmit linux/./include/linux/netdevice.h:3169\n neigh_hh_output linux/./include/net/neighbour.h:526\n neigh_output linux/./include/net/neighbour.h:540\n ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235\n __ip_finish_output linux/net/ipv4/ip_output.c:313\n __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323\n NF_HOOK_COND linux/./include/linux/netfilter.h:303\n ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433\n dst_output linux/./include/net/dst.h:451\n ip_local_out linux/net/ipv4/ip_output.c:129\n ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492\n udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963\n udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250\n inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850\n sock_sendmsg_nosec linux/net/socket.c:730\n __sock_sendmsg linux/net/socket.c:745\n __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191\n __do_sys_sendto linux/net/socket.c:2203\n __se_sys_sendto linux/net/socket.c:2199\n __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199\n do_syscall_x64 linux/arch/x86/entry/common.c:52\n do_syscall_\n---truncated---(CVE-2024-36886)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: ensure snd_nxt is properly initialized on connect\r\n\r\nChristoph reported a splat hinting at a corrupted snd_una:\r\n\r\n  WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Modules linked in:\n  CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\n  Workqueue: events mptcp_worker\n  RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8\n  \t8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe\n  \t\u0026lt;0f\u0026gt; 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9\n  RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293\n  RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4\n  RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001\n  RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n  R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000\n  R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000\n  FS:  0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline]\n   mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline]\n   __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615\n   mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767\n   process_one_work+0x1e0/0x560 kernel/workqueue.c:3254\n   process_scheduled_works kernel/workqueue.c:3335 [inline]\n   worker_thread+0x3c7/0x640 kernel/workqueue.c:3416\n   kthread+0x121/0x170 kernel/kthread.c:388\n   ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243\n   \u0026lt;/TASK\u0026gt;\r\n\r\nWhen fallback to TCP happens early on a client socket, snd_nxt\nis not yet initialized and any incoming ack will copy such value\ninto snd_una. If the mptcp worker (dumbly) tries mptcp-level\nre-injection after such ack, that would unconditionally trigger a send\nbuffer cleanup using \u0026apos;bad\u0026apos; snd_una values.\r\n\r\nWe could easily disable re-injection for fallback sockets, but such\ndumb behavior already helped catching a few subtle issues and a very\nlow to zero impact in practice.\r\n\r\nInstead address the issue always initializing snd_nxt (and write_seq,\nfor consistency) at connect time.(CVE-2024-36889)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: fix uninitialised kfifo\r\n\r\nIf a line is requested with debounce, and that results in debouncing\nin software, and the line is subsequently reconfigured to enable edge\ndetection then the allocation of the kfifo to contain edge events is\noverlooked.  This results in events being written to and read from an\nuninitialised kfifo.  Read events are returned to userspace.\r\n\r\nInitialise the kfifo in the case where the software debounce is\nalready active.(CVE-2024-36898)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: Fix use after free in lineinfo_changed_notify\r\n\r\nThe use-after-free issue occurs as follows: when the GPIO chip device file\nis being closed by invoking gpio_chrdev_release(), watched_lines is freed\nby bitmap_free(), but the unregistration of lineinfo_changed_nb notifier\nchain failed due to waiting write rwsem. Additionally, one of the GPIO\nchip\u0026apos;s lines is also in the release process and holds the notifier chain\u0026apos;s\nread rwsem. Consequently, a race condition leads to the use-after-free of\nwatched_lines.\r\n\r\nHere is the typical stack when issue happened:\r\n\r\n[free]\ngpio_chrdev_release()\n  --\u0026gt; bitmap_free(cdev-\u0026gt;watched_lines)                  \u0026lt;-- freed\n  --\u0026gt; blocking_notifier_chain_unregister()\n    --\u0026gt; down_write(\u0026amp;nh-\u0026gt;rwsem)                          \u0026lt;-- waiting rwsem\n          --\u0026gt; __down_write_common()\n            --\u0026gt; rwsem_down_write_slowpath()\n                  --\u0026gt; schedule_preempt_disabled()\n                    --\u0026gt; schedule()\r\n\r\n[use]\nst54spi_gpio_dev_release()\n  --\u0026gt; gpio_free()\n    --\u0026gt; gpiod_free()\n      --\u0026gt; gpiod_free_commit()\n        --\u0026gt; gpiod_line_state_notify()\n          --\u0026gt; blocking_notifier_call_chain()\n            --\u0026gt; down_read(\u0026amp;nh-\u0026gt;rwsem);                  \u0026lt;-- held rwsem\n            --\u0026gt; notifier_call_chain()\n              --\u0026gt; lineinfo_changed_notify()\n                --\u0026gt; test_bit(xxxx, cdev-\u0026gt;watched_lines) \u0026lt;-- use after free\r\n\r\nThe side effect of the use-after-free issue is that a GPIO line event is\nbeing generated for userspace where it shouldn\u0026apos;t. However, since the chrdev\nis being closed, userspace won\u0026apos;t have the chance to read that event anyway.\r\n\r\nTo fix the issue, call the bitmap_free() function after the unregistration\nof lineinfo_changed_nb notifier chain.(CVE-2024-36899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: prevent NULL dereference in ip6_output()\r\n\r\nAccording to syzbot, there is a chance that ip6_dst_idev()\nreturns NULL in ip6_output(). Most places in IPv6 stack\ndeal with a NULL idev just fine, but not here.\r\n\r\nsyzbot reported:\r\n\r\ngeneral protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 9775 Comm: syz-executor.4 Not tainted 6.9.0-rc5-syzkaller-00157-g6a30653b604a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:ip6_output+0x231/0x3f0 net/ipv6/ip6_output.c:237\nCode: 3c 1e 00 49 89 df 74 08 4c 89 ef e8 19 58 db f7 48 8b 44 24 20 49 89 45 00 49 89 c5 48 8d 9d e0 05 00 00 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 38 84 c0 4c 8b 74 24 28 0f 85 61 01 00 00 8b 1b 31 ff\nRSP: 0018:ffffc9000927f0d8 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000040000\nRDX: ffffc900131f9000 RSI: 0000000000004f47 RDI: 0000000000004f48\nRBP: 0000000000000000 R08: ffffffff8a1f0b9a R09: 1ffffffff1f51fad\nR10: dffffc0000000000 R11: fffffbfff1f51fae R12: ffff8880293ec8c0\nR13: ffff88805d7fc000 R14: 1ffff1100527d91a R15: dffffc0000000000\nFS:  00007f135c6856c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000080 CR3: 0000000064096000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_xmit+0xefe/0x17f0 net/ipv6/ip6_output.c:358\n  sctp_v6_xmit+0x9f2/0x13f0 net/sctp/ipv6.c:248\n  sctp_packet_transmit+0x26ad/0x2ca0 net/sctp/output.c:653\n  sctp_packet_singleton+0x22c/0x320 net/sctp/outqueue.c:783\n  sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]\n  sctp_outq_flush+0x6d5/0x3e20 net/sctp/outqueue.c:1212\n  sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]\n  sctp_do_sm+0x59cc/0x60c0 net/sctp/sm_sideeffect.c:1169\n  sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73\n  __sctp_connect+0x9cd/0xe30 net/sctp/socket.c:1234\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-36901)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()\r\n\r\nsyzbot is able to trigger the following crash [1],\ncaused by unsafe ip6_dst_idev() use.\r\n\r\nIndeed ip6_dst_idev() can return NULL, and must always be checked.\r\n\r\n[1]\r\n\r\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]\n RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267\nCode: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c\nRSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700\nRDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760\nRBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd\nR10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000\nR13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00\nFS:  00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317\n  fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108\n  ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]\n  ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649\n  ip6_route_output include/net/ip6_route.h:93 [inline]\n  ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120\n  ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250\n  sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326\n  sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455\n  sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662\n  sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099\n  __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-36902)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets\r\n\r\nTCP_SYN_RECV state is really special, it is only used by\ncross-syn connections, mostly used by fuzzers.\r\n\r\nIn the following crash [1], syzbot managed to trigger a divide\nby zero in tcp_rcv_space_adjust()\r\n\r\nA socket makes the following state transitions,\nwithout ever calling tcp_init_transfer(),\nmeaning tcp_init_buffer_space() is also not called.\r\n\r\n         TCP_CLOSE\nconnect()\n         TCP_SYN_SENT\n         TCP_SYN_RECV\nshutdown() -\u0026gt; tcp_shutdown(sk, SEND_SHUTDOWN)\n         TCP_FIN_WAIT1\r\n\r\nTo fix this issue, change tcp_shutdown() to not\nperform a TCP_SYN_RECV -\u0026gt; TCP_FIN_WAIT1 transition,\nwhich makes no sense anyway.\r\n\r\nWhen tcp_rcv_state_process() later changes socket state\nfrom TCP_SYN_RECV to TCP_ESTABLISH, then look at\nsk-\u0026gt;sk_shutdown to finally enter TCP_FIN_WAIT1 state,\nand send a FIN packet from a sane socket state.\r\n\r\nThis means tcp_send_fin() can now be called from BH\ncontext, and must use GFP_ATOMIC allocations.\r\n\r\n[1]\ndivide error: 0000 [#1] PREEMPT SMP KASAN NOPTI\nCPU: 1 PID: 5084 Comm: syz-executor358 Not tainted 6.9.0-rc6-syzkaller-00022-g98369dccd2f8 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:tcp_rcv_space_adjust+0x2df/0x890 net/ipv4/tcp_input.c:767\nCode: e3 04 4c 01 eb 48 8b 44 24 38 0f b6 04 10 84 c0 49 89 d5 0f 85 a5 03 00 00 41 8b 8e c8 09 00 00 89 e8 29 c8 48 0f af c3 31 d2 \u0026lt;48\u0026gt; f7 f1 48 8d 1c 43 49 8d 96 76 08 00 00 48 89 d0 48 c1 e8 03 48\nRSP: 0018:ffffc900031ef3f0 EFLAGS: 00010246\nRAX: 0c677a10441f8f42 RBX: 000000004fb95e7e RCX: 0000000000000000\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000\nRBP: 0000000027d4b11f R08: ffffffff89e535a4 R09: 1ffffffff25e6ab7\nR10: dffffc0000000000 R11: ffffffff8135e920 R12: ffff88802a9f8d30\nR13: dffffc0000000000 R14: ffff88802a9f8d00 R15: 1ffff1100553f2da\nFS:  00005555775c0380(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f1155bf2304 CR3: 000000002b9f2000 CR4: 0000000000350ef0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  tcp_recvmsg_locked+0x106d/0x25a0 net/ipv4/tcp.c:2513\n  tcp_recvmsg+0x25d/0x920 net/ipv4/tcp.c:2578\n  inet6_recvmsg+0x16a/0x730 net/ipv6/af_inet6.c:680\n  sock_recvmsg_nosec net/socket.c:1046 [inline]\n  sock_recvmsg+0x109/0x280 net/socket.c:1068\n  ____sys_recvmsg+0x1db/0x470 net/socket.c:2803\n  ___sys_recvmsg net/socket.c:2845 [inline]\n  do_recvmmsg+0x474/0xae0 net/socket.c:2939\n  __sys_recvmmsg net/socket.c:3018 [inline]\n  __do_sys_recvmmsg net/socket.c:3041 [inline]\n  __se_sys_recvmmsg net/socket.c:3034 [inline]\n  __x64_sys_recvmmsg+0x199/0x250 net/socket.c:3034\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7faeb6363db9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffcc1997168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b\nRAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007faeb6363db9\nRDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000005\nRBP: 0000000000000000 R08: 0000000000000000 R09: 000000000000001c\nR10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000\nR13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001(CVE-2024-36905)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nARM: 9381/1: kasan: clear stale stack poison\r\n\r\nWe found below OOB crash:\r\n\r\n[   33.452494] ==================================================================\n[   33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec\n[   33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0\n[   33.455515]\n[   33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O       6.1.25-mainline #1\n[   33.456880] Hardware name: Generic DT based system\n[   33.457555]  unwind_backtrace from show_stack+0x18/0x1c\n[   33.458326]  show_stack from dump_stack_lvl+0x40/0x4c\n[   33.459072]  dump_stack_lvl from print_report+0x158/0x4a4\n[   33.459863]  print_report from kasan_report+0x9c/0x148\n[   33.460616]  kasan_report from kasan_check_range+0x94/0x1a0\n[   33.461424]  kasan_check_range from memset+0x20/0x3c\n[   33.462157]  memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec\n[   33.463064]  refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c\n[   33.464181]  tick_nohz_idle_stop_tick from do_idle+0x264/0x354\n[   33.465029]  do_idle from cpu_startup_entry+0x20/0x24\n[   33.465769]  cpu_startup_entry from rest_init+0xf0/0xf4\n[   33.466528]  rest_init from arch_post_acpi_subsys_init+0x0/0x18\n[   33.467397]\n[   33.467644] The buggy address belongs to stack of task swapper/0/0\n[   33.468493]  and is located at offset 112 in frame:\n[   33.469172]  refresh_cpu_vm_stats.constprop.0+0x0/0x2ec\n[   33.469917]\n[   33.470165] This frame has 2 objects:\n[   33.470696]  [32, 76) \u0026apos;global_zone_diff\u0026apos;\n[   33.470729]  [112, 276) \u0026apos;global_node_diff\u0026apos;\n[   33.471294]\n[   33.472095] The buggy address belongs to the physical page:\n[   33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03\n[   33.473944] flags: 0x1000(reserved|zone=0)\n[   33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001\n[   33.475656] raw: 00000000\n[   33.476050] page dumped because: kasan: bad access detected\n[   33.476816]\n[   33.477061] Memory state around the buggy address:\n[   33.477732]  c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   33.478630]  c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00\n[   33.479526] \u0026gt;c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1\n[   33.480415]                                                ^\n[   33.481195]  c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3\n[   33.482088]  c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n[   33.482978] ==================================================================\r\n\r\nWe find the root cause of this OOB is that arm does not clear stale stack\npoison in the case of cpuidle.\r\n\r\nThis patch refer to arch/arm64/kernel/sleep.S to resolve this issue.\r\n\r\nFrom cited commit [1] that explain the problem\r\n\r\nFunctions which the compiler has instrumented for KASAN place poison on\nthe stack shadow upon entry and remove this poison prior to returning.\r\n\r\nIn the case of cpuidle, CPUs exit the kernel a number of levels deep in\nC code.  Any instrumented functions on this critical path will leave\nportions of the stack shadow poisoned.\r\n\r\nIf CPUs lose context and return to the kernel via a cold path, we\nrestore a prior context saved in __cpu_suspend_enter are forgotten, and\nwe never remove the poison they placed in the stack shadow area by\nfunctions calls between this and the actual exit of the kernel.\r\n\r\nThus, (depending on stackframe layout) subsequent calls to instrumented\nfunctions may hit this stale poison, resulting in (spurious) KASAN\nsplats to the console.\r\n\r\nTo avoid this, clear any stale poison from the idle thread for a CPU\nprior to bringing a CPU online.\r\n\r\nFrom cited commit [2]\r\n\r\nExtend to check for CONFIG_KASAN_STACK\r\n\r\n[1] commit 0d97e6d8024c (\u0026quot;arm64: kasan: clear stale stack poison\u0026quot;)\n[2] commit d56a9ef84bd0 (\u0026quot;kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK\u0026quot;)(CVE-2024-36906)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblk-iocost: do not WARN if iocg was already offlined\r\n\r\nIn iocg_pay_debt(), warn is triggered if \u0026apos;active_list\u0026apos; is empty, which\nis intended to confirm iocg is active when it has debt. However, warn\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\nis run at that time:\r\n\r\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\n  Call trace:\n  iocg_pay_debt+0x14c/0x190\n  iocg_kick_waitq+0x438/0x4c0\n  iocg_waitq_timer_fn+0xd8/0x130\n  __run_hrtimer+0x144/0x45c\n  __hrtimer_run_queues+0x16c/0x244\n  hrtimer_interrupt+0x2cc/0x7b0\r\n\r\nThe warn in this situation is meaningless. Since this iocg is being\nremoved, the state of the \u0026apos;active_list\u0026apos; is irrelevant, and \u0026apos;waitq_timer\u0026apos;\nis canceled after removing \u0026apos;active_list\u0026apos; in ioc_pd_free(), which ensures\niocg is freed after iocg_waitq_timer_fn() returns.\r\n\r\nTherefore, add the check if iocg was already offlined to avoid warn\nwhen removing a blkcg or disk.(CVE-2024-36908)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()\r\n\r\nlpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the\nhbalock.  Thus, lpfc_worker_wake_up() should not be called while holding the\nhbalock to avoid potential deadlock.(CVE-2024-36924)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: core: reject skb_copy(_expand) for fraglist GSO skbs\r\n\r\nSKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become\ninvalid. Return NULL if such an skb is passed to skb_copy or\nskb_copy_expand, in order to prevent a crash on a potential later\ncall to skb_gso_segment.(CVE-2024-36929)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\namd/amdkfd: sync all devices to wait all processes being evicted\r\n\r\nIf there are more than one device doing reset in parallel, the first\ndevice will call kfd_suspend_all_processes() to evict all processes\non all devices, this call takes time to finish. other device will\nstart reset and recover without waiting. if the process has not been\nevicted before doing recover, it will be restored, then caused page\nfault.(CVE-2024-36949)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocteontx2-af: avoid off-by-one read from userspace\r\n\r\nWe try to access count + 1 byte from userspace with memdup_user(buffer,\ncount + 1). However, the userspace only provides buffer of count bytes and\nonly these count bytes are verified to be okay to access. To ensure the\ncopied buffer is NUL terminated, we use memdup_user_nul instead.(CVE-2024-36957)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/9p: only translate RWX permissions for plain 9P2000\r\n\r\nGarbage in plain 9P2000\u0026apos;s perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u.(CVE-2024-36964)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:18:28.24858487Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1707","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/mlx5e: Fix use-after-free of encap entry in neigh update handler\r\n\r\nFunction mlx5e_rep_neigh_update() wasn\u0026apos;t updated to accommodate rtnl lock\nremoval from TC filter update path and properly handle concurrent encap\nentry insertion/deletion which can lead to following use-after-free:\r\n\r\n [23827.464923] ==================================================================\n [23827.469446] BUG: KASAN: use-after-free in mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.470971] Read of size 4 at addr ffff8881d132228c by task kworker/u20:6/21635\n [23827.472251]\n [23827.472615] CPU: 9 PID: 21635 Comm: kworker/u20:6 Not tainted 5.13.0-rc3+ #5\n [23827.473788] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n [23827.475639] Workqueue: mlx5e mlx5e_rep_neigh_update [mlx5_core]\n [23827.476731] Call Trace:\n [23827.477260]  dump_stack+0xbb/0x107\n [23827.477906]  print_address_description.constprop.0+0x18/0x140\n [23827.478896]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.479879]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.480905]  kasan_report.cold+0x7c/0xd8\n [23827.481701]  ? mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.482744]  kasan_check_range+0x145/0x1a0\n [23827.493112]  mlx5e_encap_take+0x72/0x140 [mlx5_core]\n [23827.494054]  ? mlx5e_tc_tun_encap_info_equal_generic+0x140/0x140 [mlx5_core]\n [23827.495296]  mlx5e_rep_neigh_update+0x41e/0x5e0 [mlx5_core]\n [23827.496338]  ? mlx5e_rep_neigh_entry_release+0xb80/0xb80 [mlx5_core]\n [23827.497486]  ? read_word_at_a_time+0xe/0x20\n [23827.498250]  ? strscpy+0xa0/0x2a0\n [23827.498889]  process_one_work+0x8ac/0x14e0\n [23827.499638]  ? lockdep_hardirqs_on_prepare+0x400/0x400\n [23827.500537]  ? pwq_dec_nr_in_flight+0x2c0/0x2c0\n [23827.501359]  ? rwlock_bug.part.0+0x90/0x90\n [23827.502116]  worker_thread+0x53b/0x1220\n [23827.502831]  ? process_one_work+0x14e0/0x14e0\n [23827.503627]  kthread+0x328/0x3f0\n [23827.504254]  ? _raw_spin_unlock_irq+0x24/0x40\n [23827.505065]  ? __kthread_bind_mask+0x90/0x90\n [23827.505912]  ret_from_fork+0x1f/0x30\n [23827.506621]\n [23827.506987] Allocated by task 28248:\n [23827.507694]  kasan_save_stack+0x1b/0x40\n [23827.508476]  __kasan_kmalloc+0x7c/0x90\n [23827.509197]  mlx5e_attach_encap+0xde1/0x1d40 [mlx5_core]\n [23827.510194]  mlx5e_tc_add_fdb_flow+0x397/0xc40 [mlx5_core]\n [23827.511218]  __mlx5e_add_fdb_flow+0x519/0xb30 [mlx5_core]\n [23827.512234]  mlx5e_configure_flower+0x191c/0x4870 [mlx5_core]\n [23827.513298]  tc_setup_cb_add+0x1d5/0x420\n [23827.514023]  fl_hw_replace_filter+0x382/0x6a0 [cls_flower]\n [23827.514975]  fl_change+0x2ceb/0x4a51 [cls_flower]\n [23827.515821]  tc_new_tfilter+0x89a/0x2070\n [23827.516548]  rtnetlink_rcv_msg+0x644/0x8c0\n [23827.517300]  netlink_rcv_skb+0x11d/0x340\n [23827.518021]  netlink_unicast+0x42b/0x700\n [23827.518742]  netlink_sendmsg+0x743/0xc20\n [23827.519467]  sock_sendmsg+0xb2/0xe0\n [23827.520131]  ____sys_sendmsg+0x590/0x770\n [23827.520851]  ___sys_sendmsg+0xd8/0x160\n [23827.521552]  __sys_sendmsg+0xb7/0x140\n [23827.522238]  do_syscall_64+0x3a/0x70\n [23827.522907]  entry_SYSCALL_64_after_hwframe+0x44/0xae\n [23827.523797]\n [23827.524163] Freed by task 25948:\n [23827.524780]  kasan_save_stack+0x1b/0x40\n [23827.525488]  kasan_set_track+0x1c/0x30\n [23827.526187]  kasan_set_free_info+0x20/0x30\n [23827.526968]  __kasan_slab_free+0xed/0x130\n [23827.527709]  slab_free_freelist_hook+0xcf/0x1d0\n [23827.528528]  kmem_cache_free_bulk+0x33a/0x6e0\n [23827.529317]  kfree_rcu_work+0x55f/0xb70\n [23827.530024]  process_one_work+0x8ac/0x14e0\n [23827.530770]  worker_thread+0x53b/0x1220\n [23827.531480]  kthread+0x328/0x3f0\n [23827.532114]  ret_from_fork+0x1f/0x30\n [23827.532785]\n [23827.533147] Last potentially related work creation:\n [23827.534007]  kasan_save_stack+0x1b/0x40\n [23827.534710]  kasan_record_aux_stack+0xab/0xc0\n [23827.535492]  kvfree_call_rcu+0x31/0x7b0\n [23827.536206]  mlx5e_tc_del\n---truncated---(CVE-2021-47247)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocteontx2-af: Fix possible null pointer dereference.\r\n\r\nThis patch fixes possible null pointer dereference in files\n\u0026quot;rvu_debugfs.c\u0026quot; and \u0026quot;rvu_nix.c\u0026quot;(CVE-2021-47484)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: stmmac: Disable Tx queues when reconfiguring the interface\r\n\r\nThe Tx queues were not disabled in situations where the driver needed to\nstop the interface to apply a new configuration. This could result in a\nkernel panic when doing any of the 3 following actions:\n* reconfiguring the number of queues (ethtool -L)\n* reconfiguring the size of the ring buffers (ethtool -G)\n* installing/removing an XDP program (ip l set dev ethX xdp)\r\n\r\nPrevent the panic by making sure netif_tx_disable is called when stopping\nan interface.\r\n\r\nWithout this patch, the following kernel panic can be observed when doing\nany of the actions above:\r\n\r\nUnable to handle kernel paging request at virtual address ffff80001238d040\n[....]\n Call trace:\n  dwmac4_set_addr+0x8/0x10\n  dev_hard_start_xmit+0xe4/0x1ac\n  sch_direct_xmit+0xe8/0x39c\n  __dev_queue_xmit+0x3ec/0xaf0\n  dev_queue_xmit+0x14/0x20\n[...]\n[ end trace 0000000000000002 ]---(CVE-2021-47558)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nice: Fix crash by keep old cfg when update TCs more than queues\r\n\r\nThere are problems if allocated queues less than Traffic Classes.\r\n\r\nCommit a632b2a4c920 (\u0026quot;ice: ethtool: Prohibit improper channel config\nfor DCB\u0026quot;) already disallow setting less queues than TCs.\r\n\r\nAnother case is if we first set less queues, and later update more TCs\nconfig due to LLDP, ice_vsi_cfg_tc() will failed but left dirty\nnum_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.\r\n\r\n[   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated.\n[   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)!\n[   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0\n[   95.969621] general protection fault: 0000 [#1] SMP NOPTI\n[   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1\n[   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021\n[   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60\n[   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u0026lt;8b\u0026gt; 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c\n[   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206\n[   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0\n[   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200\n[   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000\n[   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100\n[   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460\n[   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000\n[   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0\n[   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[   95.971530] PKRU: 55555554\n[   95.971573] Call Trace:\n[   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice]\n[   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice]\n[   95.971774]  ice_vsi_open+0x25/0x120 [ice]\n[   95.971843]  ice_open_internal+0xb8/0x1f0 [ice]\n[   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice]\n[   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice]\n[   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice]\n[   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice]\n[   95.972220]  dcbnl_ieee_set+0x89/0x230\n[   95.972279]  ? dcbnl_ieee_del+0x150/0x150\n[   95.972341]  dcb_doit+0x124/0x1b0\n[   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0\n[   95.972457]  ? dcb_doit+0x14d/0x1b0\n[   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280\n[   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100\n[   95.972661]  netlink_rcv_skb+0xcf/0xf0\n[   95.972720]  netlink_unicast+0x16d/0x220\n[   95.972781]  netlink_sendmsg+0x2ba/0x3a0\n[   95.975891]  sock_sendmsg+0x4c/0x50\n[   95.979032]  ___sys_sendmsg+0x2e4/0x300\n[   95.982147]  ? kmem_cache_alloc+0x13e/0x190\n[   95.985242]  ? __wake_up_common_lock+0x79/0x90\n[   95.988338]  ? __check_object_size+0xac/0x1b0\n[   95.991440]  ? _copy_to_user+0x22/0x30\n[   95.994539]  ? move_addr_to_user+0xbb/0xd0\n[   95.997619]  ? __sys_sendmsg+0x53/0x80\n[   96.000664]  __sys_sendmsg+0x53/0x80\n[   96.003747]  do_syscall_64+0x5b/0x1d0\n[   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca\r\n\r\nOnly update num_txq/rxq when passed check, and restore tc_cfg if setup\nqueue map failed.(CVE-2022-48652)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npipe: wakeup wr_wait after setting max_usage\r\n\r\nCommit c73be61cede5 (\u0026quot;pipe: Add general notification queue support\u0026quot;) a\nregression was introduced that would lock up resized pipes under certain\nconditions. See the reproducer in [1].\r\n\r\nThe commit resizing the pipe ring size was moved to a different\nfunction, doing that moved the wakeup for pipe-\u0026gt;wr_wait before actually\nraising pipe-\u0026gt;max_usage. If a pipe was full before the resize occured it\nwould result in the wakeup never actually triggering pipe_write.\r\n\r\nSet @max_usage and @nr_accounted before waking writers if this isn\u0026apos;t a\nwatch queue.\r\n\r\n[Christian Brauner \u0026lt;brauner@kernel.org\u0026gt;: rewrite to account for watch queues](CVE-2023-52672)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nALSA: scarlett2: Add missing error checks to *_ctl_get()\r\n\r\nThe *_ctl_get() functions which call scarlett2_update_*() were not\nchecking the return value. Fix to check the return value and pass to\nthe caller.(CVE-2023-52680)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\npowerpc/powernv: Add a null pointer check in opal_event_init()\r\n\r\nkasprintf() returns a pointer to dynamically allocated memory\nwhich can be NULL upon failure.(CVE-2023-52686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nACPI: video: check for error while searching for backlight device parent\r\n\r\nIf acpi_get_parent() called in acpi_video_dev_register_backlight()\nfails, for example, because acpi_ut_acquire_mutex() fails inside\nacpi_get_parent), this can lead to incorrect (uninitialized)\nacpi_parent handle being passed to acpi_get_pci_dev() for detecting\nthe parent pci device.\r\n\r\nCheck acpi_get_parent() result and set parent device only in case of success.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.(CVE-2023-52693)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nceph: blocklist the kclient when receiving corrupted snap trace\r\n\r\nWhen received corrupted snap trace we don\u0026apos;t know what exactly has\nhappened in MDS side. And we shouldn\u0026apos;t continue IOs and metadatas\naccess to MDS, which may corrupt or get incorrect contents.\r\n\r\nThis patch will just block all the further IO/MDS requests\nimmediately and then evict the kclient itself.\r\n\r\nThe reason why we still need to evict the kclient just after\nblocking all the further IOs is that the MDS could revoke the caps\nfaster.(CVE-2023-52732)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nvirtio-blk: fix implicit overflow on virtio_max_dma_size\r\n\r\nThe following codes have an implicit conversion from size_t to u32:\n(u32)max_size = (size_t)virtio_max_dma_size(vdev);\r\n\r\nThis may lead overflow, Ex (size_t)4G -\u0026gt; (u32)0. Once\nvirtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX\ninstead.(CVE-2023-52762)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/smc: avoid data corruption caused by decline\r\n\r\nWe found a data corruption issue during testing of SMC-R on Redis\napplications.\r\n\r\nThe benchmark has a low probability of reporting a strange error as\nshown below.\r\n\r\n\u0026quot;Error: Protocol error, got \u0026quot;\\xe2\u0026quot; as reply type byte\u0026quot;\r\n\r\nFinally, we found that the retrieved error data was as follows:\r\n\r\n0xE2 0xD4 0xC3 0xD9 0x04 0x00 0x2C 0x20 0xA6 0x56 0x00 0x16 0x3E 0x0C\n0xCB 0x04 0x02 0x01 0x00 0x00 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0xE2\r\n\r\nIt is quite obvious that this is a SMC DECLINE message, which means that\nthe applications received SMC protocol message.\nWe found that this was caused by the following situations:\r\n\r\nclient                  server\n        ¦  clc proposal\n        -------------\u0026gt;\n        ¦  clc accept\n        \u0026lt;-------------\n        ¦  clc confirm\n        -------------\u0026gt;\nwait llc confirm\n\t\t\tsend llc confirm\n        ¦failed llc confirm\n        ¦   x------\n(after 2s)timeout\n                        wait llc confirm rsp\r\n\r\nwait decline\r\n\r\n(after 1s) timeout\n                        (after 2s) timeout\n        ¦   decline\n        --------------\u0026gt;\n        ¦   decline\n        \u0026lt;--------------\r\n\r\nAs a result, a decline message was sent in the implementation, and this\nmessage was read from TCP by the already-fallback connection.\r\n\r\nThis patch double the client timeout as 2x of the server value,\nWith this simple change, the Decline messages should never cross or\ncollide (during Confirm link timeout).\r\n\r\nThis issue requires an immediate solution, since the protocol updates\ninvolve a more long-term solution.(CVE-2023-52775)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nSUNRPC: Fix RPC client cleaned up the freed pipefs dentries\r\n\r\nRPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()\nworkqueue,which takes care about pipefs superblock locking.\nIn some special scenarios, when kernel frees the pipefs sb of the\ncurrent client and immediately alloctes a new pipefs sb,\nrpc_remove_pipedir function would misjudge the existence of pipefs\nsb which is not the one it used to hold. As a result,\nthe rpc_remove_pipedir would clean the released freed pipefs dentries.\r\n\r\nTo fix this issue, rpc_remove_pipedir should check whether the\ncurrent pipefs sb is consistent with the original pipefs sb.\r\n\r\nThis error can be catched by KASAN:\n=========================================================\n[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200\n[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503\n[  250.500549] Workqueue: events rpc_free_client_work\n[  250.501001] Call Trace:\n[  250.502880]  kasan_report+0xb6/0xf0\n[  250.503209]  ? dget_parent+0x195/0x200\n[  250.503561]  dget_parent+0x195/0x200\n[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10\n[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90\n[  250.504781]  rpc_remove_client_dir+0xf5/0x150\n[  250.505195]  rpc_free_client_work+0xe4/0x230\n[  250.505598]  process_one_work+0x8ee/0x13b0\n...\n[   22.039056] Allocated by task 244:\n[   22.039390]  kasan_save_stack+0x22/0x50\n[   22.039758]  kasan_set_track+0x25/0x30\n[   22.040109]  __kasan_slab_alloc+0x59/0x70\n[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240\n[   22.040889]  __d_alloc+0x31/0x8e0\n[   22.041207]  d_alloc+0x44/0x1f0\n[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140\n[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110\n[   22.042459]  rpc_create_client_dir+0x34/0x150\n[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0\n[   22.043284]  rpc_client_register+0x136/0x4e0\n[   22.043689]  rpc_new_client+0x911/0x1020\n[   22.044057]  rpc_create_xprt+0xcb/0x370\n[   22.044417]  rpc_create+0x36b/0x6c0\n...\n[   22.049524] Freed by task 0:\n[   22.049803]  kasan_save_stack+0x22/0x50\n[   22.050165]  kasan_set_track+0x25/0x30\n[   22.050520]  kasan_save_free_info+0x2b/0x50\n[   22.050921]  __kasan_slab_free+0x10e/0x1a0\n[   22.051306]  kmem_cache_free+0xa5/0x390\n[   22.051667]  rcu_core+0x62c/0x1930\n[   22.051995]  __do_softirq+0x165/0x52a\n[   22.052347]\n[   22.052503] Last potentially related work creation:\n[   22.052952]  kasan_save_stack+0x22/0x50\n[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0\n[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0\n[   22.054209]  dentry_free+0xb2/0x140\n[   22.054540]  __dentry_kill+0x3be/0x540\n[   22.054900]  shrink_dentry_list+0x199/0x510\n[   22.055293]  shrink_dcache_parent+0x190/0x240\n[   22.055703]  do_one_tree+0x11/0x40\n[   22.056028]  shrink_dcache_for_umount+0x61/0x140\n[   22.056461]  generic_shutdown_super+0x70/0x590\n[   22.056879]  kill_anon_super+0x3a/0x60\n[   22.057234]  rpc_kill_sb+0x121/0x200(CVE-2023-52803)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/jfs: Add check for negative db_l2nbperpage\r\n\r\nl2nbperpage is log2(number of blks per page), and the minimum legal\nvalue should be 0, not negative.\r\n\r\nIn the case of l2nbperpage being negative, an error will occur\nwhen subsequently used as shift exponent.\r\n\r\nSyzbot reported this bug:\r\n\r\nUBSAN: shift-out-of-bounds in fs/jfs/jfs_dmap.c:799:12\nshift exponent -16777216 is negative(CVE-2023-52810)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc\r\n\r\nAny unprivileged user can attach N_GSM0710 ldisc, but it requires\nCAP_NET_ADMIN to create a GSM network anyway.\r\n\r\nRequire initial namespace CAP_NET_ADMIN to do that.(CVE-2023-52880)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntcp: do not accept ACK of bytes we never sent\r\n\r\nThis patch is based on a detailed report and ideas from Yepeng Pan\nand Christian Rossow.\r\n\r\nACK seq validation is currently following RFC 5961 5.2 guidelines:\r\n\r\n   The ACK value is considered acceptable only if\n   it is in the range of ((SND.UNA - MAX.SND.WND) \u0026lt;= SEG.ACK \u0026lt;=\n   SND.NXT).  All incoming segments whose ACK value doesn\u0026apos;t satisfy the\n   above condition MUST be discarded and an ACK sent back.  It needs to\n   be noted that RFC 793 on page 72 (fifth check) says: \u0026quot;If the ACK is a\n   duplicate (SEG.ACK \u0026lt; SND.UNA), it can be ignored.  If the ACK\n   acknowledges something not yet sent (SEG.ACK \u0026gt; SND.NXT) then send an\n   ACK, drop the segment, and return\u0026quot;.  The \u0026quot;ignored\u0026quot; above implies that\n   the processing of the incoming data segment continues, which means\n   the ACK value is treated as acceptable.  This mitigation makes the\n   ACK check more stringent since any ACK \u0026lt; SND.UNA wouldn\u0026apos;t be\n   accepted, instead only ACKs that are in the range ((SND.UNA -\n   MAX.SND.WND) \u0026lt;= SEG.ACK \u0026lt;= SND.NXT) get through.\r\n\r\nThis can be refined for new (and possibly spoofed) flows,\nby not accepting ACK for bytes that were never sent.\r\n\r\nThis greatly improves TCP security at a little cost.\r\n\r\nI added a Fixes: tag to make sure this patch will reach stable trees,\neven if the \u0026apos;blamed\u0026apos; patch was adhering to the RFC.\r\n\r\ntp-\u0026gt;bytes_acked was added in linux-4.2\r\n\r\nFollowing packetdrill test (courtesy of Yepeng Pan) shows\nthe issue at hand:\r\n\r\n0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3\n+0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0\n+0 bind(3, ..., ...) = 0\n+0 listen(3, 1024) = 0\r\n\r\n// ---------------- Handshake ------------------- //\r\n\r\n// when window scale is set to 14 the window size can be extended to\n// 65535 * (2^14) = 1073725440. Linux would accept an ACK packet\n// with ack number in (Server_ISN+1-1073725440. Server_ISN+1)\n// ,though this ack number acknowledges some data never\n// sent by the server.\r\n\r\n+0 \u0026lt; S 0:0(0) win 65535 \u0026lt;mss 1400,nop,wscale 14\u0026gt;\n+0 \u0026gt; S. 0:0(0) ack 1 \u0026lt;...\u0026gt;\n+0 \u0026lt; . 1:1(0) ack 1 win 65535\n+0 accept(3, ..., ...) = 4\r\n\r\n// For the established connection, we send an ACK packet,\n// the ack packet uses ack number 1 - 1073725300 + 2^32,\n// where 2^32 is used to wrap around.\n// Note: we used 1073725300 instead of 1073725440 to avoid possible\n// edge cases.\n// 1 - 1073725300 + 2^32 = 3221241997\r\n\r\n// Oops, old kernels happily accept this packet.\n+0 \u0026lt; . 1:1001(1000) ack 3221241997 win 65535\r\n\r\n// After the kernel fix the following will be replaced by a challenge ACK,\n// and prior malicious frame would be dropped.\n+0 \u0026gt; . 1:1(0) ack 1001(CVE-2023-52881)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: set dormant flag on hook register failure\r\n\r\nWe need to set the dormant flag again if we fail to register\nthe hooks.\r\n\r\nDuring memory pressure hook registration can fail and we end up\nwith a table marked as active but no registered hooks.\r\n\r\nOn table/base chain deletion, nf_tables will attempt to unregister\nthe hook again which yields a warn splat from the nftables core.(CVE-2024-26835)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: hci_core: Fix possible buffer overflow\r\n\r\nstruct hci_dev_info has a fixed size name[8] field so in the event that\nhdev-\u0026gt;name is bigger than that strcpy would attempt to write past its\nsize, so this fixes this problem by switching to use strscpy.(CVE-2024-26889)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxen-netfront: Add missing skb_mark_for_recycle\r\n\r\nNotice that skb_mark_for_recycle() is introduced later than fixes tag in\ncommit 6a5bcd84e886 (\u0026quot;page_pool: Allow drivers to hint on SKB recycling\u0026quot;).\r\n\r\nIt is believed that fixes tag were missing a call to page_pool_release_page()\nbetween v5.9 to v5.14, after which is should have used skb_mark_for_recycle().\nSince v6.6 the call page_pool_release_page() were removed (in\ncommit 535b9c61bdef (\u0026quot;net: page_pool: hide page_pool_release_page()\u0026quot;)\nand remaining callers converted (in commit 6bfef2ec0172 (\u0026quot;Merge branch\n\u0026apos;net-page_pool-remove-page_pool_release_page\u0026apos;\u0026quot;)).\r\n\r\nThis leak became visible in v6.8 via commit dba1b8a7ab68 (\u0026quot;mm/page_pool: catch\npage_pool memory leaks\u0026quot;).(CVE-2024-27393)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nphonet/pep: fix racy skb_queue_empty() use\r\n\r\nThe receive queues are protected by their respective spin-lock, not\nthe socket lock. This could lead to skb_peek() unexpectedly\nreturning NULL or a pointer to an already dequeued socket buffer.(CVE-2024-27402)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: dw-edma: eDMA: Add sync read before starting the DMA transfer in remote setup\r\n\r\nThe Linked list element and pointer are not stored in the same memory as\nthe eDMA controller register. If the doorbell register is toggled before\nthe full write of the linked list a race condition error will occur.\nIn remote setup we can only use a readl to the memory to assure the full\nwrite has occurred.(CVE-2024-27408)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: altmodes/displayport: create sysfs nodes as driver\u0026apos;s default device attribute group\r\n\r\nThe DisplayPort driver\u0026apos;s sysfs nodes may be present to the userspace before\ntypec_altmode_set_drvdata() completes in dp_altmode_probe. This means that\na sysfs read can trigger a NULL pointer error by deferencing dp-\u0026gt;hpd in\nhpd_show or dp-\u0026gt;lock in pin_assignment_show, as dev_get_drvdata() returns\nNULL in those cases.\r\n\r\nRemove manual sysfs node creation in favor of adding attribute group as\ndefault for devices bound to the driver. The ATTRIBUTE_GROUPS() macro is\nnot used here otherwise the path to the sysfs nodes is no longer compliant\nwith the ABI.(CVE-2024-35790)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPCI/PM: Drain runtime-idle callbacks before driver removal\r\n\r\nA race condition between the .runtime_idle() callback and the .remove()\ncallback in the rtsx_pcr PCI driver leads to a kernel crash due to an\nunhandled page fault [1].\r\n\r\nThe problem is that rtsx_pci_runtime_idle() is not expected to be running\nafter pm_runtime_get_sync() has been called, but the latter doesn\u0026apos;t really\nguarantee that.  It only guarantees that the suspend and resume callbacks\nwill not be running when it returns.\r\n\r\nHowever, if a .runtime_idle() callback is already running when\npm_runtime_get_sync() is called, the latter will notice that the runtime PM\nstatus of the device is RPM_ACTIVE and it will return right away without\nwaiting for the former to complete.  In fact, it cannot wait for\n.runtime_idle() to complete because it may be called from that callback (it\narguably does not make much sense to do that, but it is not strictly\nprohibited).\r\n\r\nThus in general, whoever is providing a .runtime_idle() callback needs\nto protect it from running in parallel with whatever code runs after\npm_runtime_get_sync().  [Note that .runtime_idle() will not start after\npm_runtime_get_sync() has returned, but it may continue running then if it\nhas started earlier.]\r\n\r\nOne way to address that race condition is to call pm_runtime_barrier()\nafter pm_runtime_get_sync() (not before it, because a nonzero value of the\nruntime PM usage counter is necessary to prevent runtime PM callbacks from\nbeing invoked) to wait for the .runtime_idle() callback to complete should\nit be running at that point.  A suitable place for doing that is in\npci_device_remove() which calls pm_runtime_get_sync() before removing the\ndriver, so it may as well call pm_runtime_barrier() subsequently, which\nwill prevent the race in question from occurring, not just in the rtsx_pcr\ndriver, but in any PCI drivers providing .runtime_idle() callbacks.(CVE-2024-35809)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach\r\n\r\nThis is the candidate patch of CVE-2023-47233 :\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-47233\r\n\r\nIn brcm80211 driver,it starts with the following invoking chain\nto start init a timeout worker:\r\n\r\n-\u0026gt;brcmf_usb_probe\n  -\u0026gt;brcmf_usb_probe_cb\n    -\u0026gt;brcmf_attach\n      -\u0026gt;brcmf_bus_started\n        -\u0026gt;brcmf_cfg80211_attach\n          -\u0026gt;wl_init_priv\n            -\u0026gt;brcmf_init_escan\n              -\u0026gt;INIT_WORK(\u0026amp;cfg-\u0026gt;escan_timeout_work,\n\t\t  brcmf_cfg80211_escan_timeout_worker);\r\n\r\nIf we disconnect the USB by hotplug, it will call\nbrcmf_usb_disconnect to make cleanup. The invoking chain is :\r\n\r\nbrcmf_usb_disconnect\n  -\u0026gt;brcmf_usb_disconnect_cb\n    -\u0026gt;brcmf_detach\n      -\u0026gt;brcmf_cfg80211_detach\n        -\u0026gt;kfree(cfg);\r\n\r\nWhile the timeout woker may still be running. This will cause\na use-after-free bug on cfg in brcmf_cfg80211_escan_timeout_worker.\r\n\r\nFix it by deleting the timer and canceling the worker in\nbrcmf_cfg80211_detach.\r\n\r\n[arend.vanspriel@broadcom.com: keep timer delete as is and cancel work just before free](CVE-2024-35811)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix memory leak during rehash\r\n\r\nThe rehash delayed work migrates filters from one region to another.\nThis is done by iterating over all chunks (all the filters with the same\npriority) in the region and in each chunk iterating over all the\nfilters.\r\n\r\nIf the migration fails, the code tries to migrate the filters back to\nthe old region. However, the rollback itself can also fail in which case\nanother migration will be erroneously performed. Besides the fact that\nthis ping pong is not a very good idea, it also creates a problem.\r\n\r\nEach virtual chunk references two chunks: The currently used one\n(\u0026apos;vchunk-\u0026gt;chunk\u0026apos;) and a backup (\u0026apos;vchunk-\u0026gt;chunk2\u0026apos;). During migration the\nfirst holds the chunk we want to migrate filters to and the second holds\nthe chunk we are migrating filters from.\r\n\r\nThe code currently assumes - but does not verify - that the backup chunk\ndoes not exist (NULL) if the currently used chunk does not reference the\ntarget region. This assumption breaks when we are trying to rollback a\nrollback, resulting in the backup chunk being overwritten and leaked\n[1].\r\n\r\nFix by not rolling back a failed rollback and add a warning to avoid\nfuture cases.\r\n\r\n[1]\nWARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20\nModules linked in:\nCPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G        W          6.9.0-rc2-custom-00784-gc6a05c468a0b #14\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nRIP: 0010:parman_destroy+0x17/0x20\n[...]\nCall Trace:\n \u0026lt;TASK\u0026gt;\n mlxsw_sp_acl_atcam_region_fini+0x19/0x60\n mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470\n process_one_work+0x151/0x370\n worker_thread+0x2cb/0x3e0\n kthread+0xd0/0x100\n ret_from_fork+0x34/0x50\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;(CVE-2024-35853)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash\r\n\r\nThe rehash delayed work migrates filters from one region to another\naccording to the number of available credits.\r\n\r\nThe migrated from region is destroyed at the end of the work if the\nnumber of credits is non-negative as the assumption is that this is\nindicative of migration being complete. This assumption is incorrect as\na non-negative number of credits can also be the result of a failed\nmigration.\r\n\r\nThe destruction of a region that still has filters referencing it can\nresult in a use-after-free [1].\r\n\r\nFix by not destroying the region if migration failed.\r\n\r\n[1]\nBUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\nRead of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858\r\n\r\nCPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G        W          6.9.0-rc2-custom-00782-gf2275c2157d8 #5\nHardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019\nWorkqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work\nCall Trace:\n \u0026lt;TASK\u0026gt;\n dump_stack_lvl+0xc6/0x120\n print_report+0xce/0x670\n kasan_report+0xd7/0x110\n mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230\n mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70\n mlxsw_sp_acl_atcam_entry_del+0x81/0x210\n mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 174:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x8f/0xa0\n __kmalloc+0x19c/0x360\n mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30\r\n\r\nFreed by task 7:\n kasan_save_stack+0x33/0x60\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3b/0x60\n poison_slab_object+0x102/0x170\n __kasan_slab_free+0x14/0x30\n kfree+0xc1/0x290\n mlxsw_sp_acl_tcam_region_destroy+0x272/0x310\n mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300\n process_one_work+0x8eb/0x19b0\n worker_thread+0x6c9/0xf70\n kthread+0x2c9/0x3b0\n ret_from_fork+0x4d/0x80\n ret_from_fork_asm+0x1a/0x30(CVE-2024-35854)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nriscv: process: Fix kernel gp leakage\r\n\r\nchildregs represents the registers which are active for the new thread\nin user context. For a kernel thread, childregs-\u0026gt;gp is never used since\nthe kernel gp is not touched by switch_to. For a user mode helper, the\ngp value can be observed in user space after execve or possibly by other\nmeans.\r\n\r\n[From the email thread]\r\n\r\nThe /* Kernel thread */ comment is somewhat inaccurate in that it is also used\nfor user_mode_helper threads, which exec a user process, e.g. /sbin/init or\nwhen /proc/sys/kernel/core_pattern is a pipe. Such threads do not have\nPF_KTHREAD set and are valid targets for ptrace etc. even before they exec.\r\n\r\nchildregs is the *user* context during syscall execution and it is observable\nfrom userspace in at least five ways:\r\n\r\n1. kernel_execve does not currently clear integer registers, so the starting\n   register state for PID 1 and other user processes started by the kernel has\n   sp = user stack, gp = kernel __global_pointer$, all other integer registers\n   zeroed by the memset in the patch comment.\r\n\r\n   This is a bug in its own right, but I\u0026apos;m unwilling to bet that it is the only\n   way to exploit the issue addressed by this patch.\r\n\r\n2. ptrace(PTRACE_GETREGSET): you can PTRACE_ATTACH to a user_mode_helper thread\n   before it execs, but ptrace requires SIGSTOP to be delivered which can only\n   happen at user/kernel boundaries.\r\n\r\n3. /proc/*/task/*/syscall: this is perfectly happy to read pt_regs for\n   user_mode_helpers before the exec completes, but gp is not one of the\n   registers it returns.\r\n\r\n4. PERF_SAMPLE_REGS_USER: LOCKDOWN_PERF normally prevents access to kernel\n   addresses via PERF_SAMPLE_REGS_INTR, but due to this bug kernel addresses\n   are also exposed via PERF_SAMPLE_REGS_USER which is permitted under\n   LOCKDOWN_PERF. I have not attempted to write exploit code.\r\n\r\n5. Much of the tracing infrastructure allows access to user registers. I have\n   not attempted to determine which forms of tracing allow access to user\n   registers without already allowing access to kernel registers.(CVE-2024-35871)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nerspan: make sure erspan_base_hdr is present in skb-\u0026gt;head\r\n\r\nsyzbot reported a problem in ip6erspan_rcv() [1]\r\n\r\nIssue is that ip6erspan_rcv() (and erspan_rcv()) no longer make\nsure erspan_base_hdr is present in skb linear part (skb-\u0026gt;head)\nbefore getting @ver field from it.\r\n\r\nAdd the missing pskb_may_pull() calls.\r\n\r\nv2: Reload iph pointer in erspan_rcv() after pskb_may_pull()\n    because skb-\u0026gt;head might have changed.\r\n\r\n[1]\r\n\r\n BUG: KMSAN: uninit-value in pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n BUG: KMSAN: uninit-value in pskb_may_pull include/linux/skbuff.h:2756 [inline]\n BUG: KMSAN: uninit-value in ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n BUG: KMSAN: uninit-value in gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  pskb_may_pull_reason include/linux/skbuff.h:2742 [inline]\n  pskb_may_pull include/linux/skbuff.h:2756 [inline]\n  ip6erspan_rcv net/ipv6/ip6_gre.c:541 [inline]\n  gre_rcv+0x11f8/0x1930 net/ipv6/ip6_gre.c:610\n  ip6_protocol_deliver_rcu+0x1d4c/0x2ca0 net/ipv6/ip6_input.c:438\n  ip6_input_finish net/ipv6/ip6_input.c:483 [inline]\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492\n  ip6_mc_input+0xa7e/0xc80 net/ipv6/ip6_input.c:586\n  dst_input include/net/dst.h:460 [inline]\n  ip6_rcv_finish+0x955/0x970 net/ipv6/ip6_input.c:79\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ipv6_rcv+0xde/0x390 net/ipv6/ip6_input.c:310\n  __netif_receive_skb_one_core net/core/dev.c:5538 [inline]\n  __netif_receive_skb+0x1da/0xa00 net/core/dev.c:5652\n  netif_receive_skb_internal net/core/dev.c:5738 [inline]\n  netif_receive_skb+0x58/0x660 net/core/dev.c:5798\n  tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1549\n  tun_get_user+0x5566/0x69e0 drivers/net/tun.c:2002\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  tun_alloc_skb drivers/net/tun.c:1525 [inline]\n  tun_get_user+0x209a/0x69e0 drivers/net/tun.c:1846\n  tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048\n  call_write_iter include/linux/fs.h:2108 [inline]\n  new_sync_write fs/read_write.c:497 [inline]\n  vfs_write+0xb63/0x1520 fs/read_write.c:590\n  ksys_write+0x20f/0x4c0 fs/read_write.c:643\n  __do_sys_write fs/read_write.c:655 [inline]\n  __se_sys_write fs/read_write.c:652 [inline]\n  __x64_sys_write+0x93/0xe0 fs/read_write.c:652\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nCPU: 1 PID: 5045 Comm: syz-executor114 Not tainted 6.9.0-rc1-syzkaller-00021-g962490525cff #0(CVE-2024-35888)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf, sockmap: Prevent lock inversion deadlock in map delete elem\r\n\r\nsyzkaller started using corpuses where a BPF tracing program deletes\nelements from a sockmap/sockhash map. Because BPF tracing programs can be\ninvoked from any interrupt context, locks taken during a map_delete_elem\noperation must be hardirq-safe. Otherwise a deadlock due to lock inversion\nis possible, as reported by lockdep:\r\n\r\n       CPU0                    CPU1\n       ----                    ----\n  lock(\u0026amp;htab-\u0026gt;buckets[i].lock);\n                               local_irq_disable();\n                               lock(\u0026amp;host-\u0026gt;lock);\n                               lock(\u0026amp;htab-\u0026gt;buckets[i].lock);\n  \u0026lt;Interrupt\u0026gt;\n    lock(\u0026amp;host-\u0026gt;lock);\r\n\r\nLocks in sockmap are hardirq-unsafe by design. We expects elements to be\ndeleted from sockmap/sockhash only in task (normal) context with interrupts\nenabled, or in softirq context.\r\n\r\nDetect when map_delete_elem operation is invoked from a context which is\n_not_ hardirq-unsafe, that is interrupts are disabled, and bail out with an\nerror.\r\n\r\nNote that map updates are not affected by this issue. BPF verifier does not\nallow updating sockmap/sockhash from a BPF tracing program today.(CVE-2024-35895)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: validate user input for expected length\r\n\r\nI got multiple syzbot reports showing old bugs exposed\nby BPF after commit 20f2505fb436 (\u0026quot;bpf: Try to avoid kzalloc\nin cgroup/{s,g}etsockopt\u0026quot;)\r\n\r\nsetsockopt() @optlen argument should be taken into account\nbefore copying data.\r\n\r\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n BUG: KASAN: slab-out-of-bounds in copy_from_sockptr include/linux/sockptr.h:55 [inline]\n BUG: KASAN: slab-out-of-bounds in do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n BUG: KASAN: slab-out-of-bounds in do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\nRead of size 96 at addr ffff88802cd73da0 by task syz-executor.4/7238\r\n\r\nCPU: 1 PID: 7238 Comm: syz-executor.4 Not tainted 6.9.0-rc2-next-20240403-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  __dump_stack lib/dump_stack.c:88 [inline]\n  dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114\n  print_address_description mm/kasan/report.c:377 [inline]\n  print_report+0x169/0x550 mm/kasan/report.c:488\n  kasan_report+0x143/0x180 mm/kasan/report.c:601\n  kasan_check_range+0x282/0x290 mm/kasan/generic.c:189\n  __asan_memcpy+0x29/0x70 mm/kasan/shadow.c:105\n  copy_from_sockptr_offset include/linux/sockptr.h:49 [inline]\n  copy_from_sockptr include/linux/sockptr.h:55 [inline]\n  do_replace net/ipv4/netfilter/ip_tables.c:1111 [inline]\n  do_ipt_set_ctl+0x902/0x3dd0 net/ipv4/netfilter/ip_tables.c:1627\n  nf_setsockopt+0x295/0x2c0 net/netfilter/nf_sockopt.c:101\n  do_sock_setsockopt+0x3af/0x720 net/socket.c:2311\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\nRIP: 0033:0x7fd22067dde9\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u0026lt;48\u0026gt; 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007fd21f9ff0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036\nRAX: ffffffffffffffda RBX: 00007fd2207abf80 RCX: 00007fd22067dde9\nRDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003\nRBP: 00007fd2206ca47a R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000020000880 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000000b R14: 00007fd2207abf80 R15: 00007ffd2d0170d8\n \u0026lt;/TASK\u0026gt;\r\n\r\nAllocated by task 7238:\n  kasan_save_stack mm/kasan/common.c:47 [inline]\n  kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n  poison_kmalloc_redzone mm/kasan/common.c:370 [inline]\n  __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387\n  kasan_kmalloc include/linux/kasan.h:211 [inline]\n  __do_kmalloc_node mm/slub.c:4069 [inline]\n  __kmalloc_noprof+0x200/0x410 mm/slub.c:4082\n  kmalloc_noprof include/linux/slab.h:664 [inline]\n  __cgroup_bpf_run_filter_setsockopt+0xd47/0x1050 kernel/bpf/cgroup.c:1869\n  do_sock_setsockopt+0x6b4/0x720 net/socket.c:2293\n  __sys_setsockopt+0x1ae/0x250 net/socket.c:2334\n  __do_sys_setsockopt net/socket.c:2343 [inline]\n  __se_sys_setsockopt net/socket.c:2340 [inline]\n  __x64_sys_setsockopt+0xb5/0xd0 net/socket.c:2340\n do_syscall_64+0xfb/0x240\n entry_SYSCALL_64_after_hwframe+0x72/0x7a\r\n\r\nThe buggy address belongs to the object at ffff88802cd73da0\n which belongs to the cache kmalloc-8 of size 8\nThe buggy address is located 0 bytes inside of\n allocated 1-byte region [ffff88802cd73da0, ffff88802cd73da1)\r\n\r\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802cd73020 pfn:0x2cd73\nflags: 0xfff80000000000(node=0|zone=1|lastcpupid=0xfff)\npage_type: 0xffffefff(slab)\nraw: 00fff80000000000 ffff888015041280 dead000000000100 dead000000000122\nraw: ffff88802cd73020 000000008080007f 00000001ffffefff 00\n---truncated---(CVE-2024-35896)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Protect against int overflow for stack access size\r\n\r\nThis patch re-introduces protection against the size of access to stack\nmemory being negative; the access size can appear negative as a result\nof overflowing its signed int representation. This should not actually\nhappen, as there are other protections along the way, but we should\nprotect against it anyway. One code path was missing such protections\n(fixed in the previous patch in the series), causing out-of-bounds array\naccesses in check_stack_range_initialized(). This patch causes the\nverification of a program with such a non-sensical access size to fail.\r\n\r\nThis check used to exist in a more indirect way, but was inadvertendly\nremoved in a833a17aeac7.(CVE-2024-35905)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: typec: ucsi: Limit read size on v1.2\r\n\r\nBetween UCSI 1.2 and UCSI 2.0, the size of the MESSAGE_IN region was\nincreased from 16 to 256. In order to avoid overflowing reads for older\nsystems, add a mechanism to use the read UCSI version to truncate read\nsizes on UCSI v1.2.(CVE-2024-35924)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nBluetooth: SCO: Fix not validating setsockopt user input\r\n\r\nsyzbot reported sco_sock_setsockopt() is copying data without\nchecking user input length.\r\n\r\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr_offset\ninclude/linux/sockptr.h:49 [inline]\nBUG: KASAN: slab-out-of-bounds in copy_from_sockptr\ninclude/linux/sockptr.h:55 [inline]\nBUG: KASAN: slab-out-of-bounds in sco_sock_setsockopt+0xc0b/0xf90\nnet/bluetooth/sco.c:893\nRead of size 4 at addr ffff88805f7b15a3 by task syz-executor.5/12578(CVE-2024-35967)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngeneve: fix header validation in geneve[6]_xmit_skb\r\n\r\nsyzbot is able to trigger an uninit-value in geneve_xmit() [1]\r\n\r\nProblem : While most ip tunnel helpers (like ip_tunnel_get_dsfield())\nuses skb_protocol(skb, true), pskb_inet_may_pull() is only using\nskb-\u0026gt;protocol.\r\n\r\nIf anything else than ETH_P_IPV6 or ETH_P_IP is found in skb-\u0026gt;protocol,\npskb_inet_may_pull() does nothing at all.\r\n\r\nIf a vlan tag was provided by the caller (af_packet in the syzbot case),\nthe network header might not point to the correct location, and skb\nlinear part could be smaller than expected.\r\n\r\nAdd skb_vlan_inet_prepare() to perform a complete mac validation.\r\n\r\nUse this in geneve for the moment, I suspect we need to adopt this\nmore broadly.\r\n\r\nv4 - Jakub reported v3 broke l2_tos_ttl_inherit.sh selftest\n   - Only call __vlan_get_protocol() for vlan types.\r\n\r\nv2,v3 - Addressed Sabrina comments on v1 and v2\r\n\r\n[1]\r\n\r\nBUG: KMSAN: uninit-value in geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n BUG: KMSAN: uninit-value in geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n  geneve_xmit_skb drivers/net/geneve.c:910 [inline]\n  geneve_xmit+0x302d/0x5420 drivers/net/geneve.c:1030\n  __netdev_start_xmit include/linux/netdevice.h:4903 [inline]\n  netdev_start_xmit include/linux/netdevice.h:4917 [inline]\n  xmit_one net/core/dev.c:3531 [inline]\n  dev_hard_start_xmit+0x247/0xa20 net/core/dev.c:3547\n  __dev_queue_xmit+0x348d/0x52c0 net/core/dev.c:4335\n  dev_queue_xmit include/linux/netdevice.h:3091 [inline]\n  packet_xmit+0x9c/0x6c0 net/packet/af_packet.c:276\n  packet_snd net/packet/af_packet.c:3081 [inline]\n  packet_sendmsg+0x8bb0/0x9ef0 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nUninit was created at:\n  slab_post_alloc_hook mm/slub.c:3804 [inline]\n  slab_alloc_node mm/slub.c:3845 [inline]\n  kmem_cache_alloc_node+0x613/0xc50 mm/slub.c:3888\n  kmalloc_reserve+0x13d/0x4a0 net/core/skbuff.c:577\n  __alloc_skb+0x35b/0x7a0 net/core/skbuff.c:668\n  alloc_skb include/linux/skbuff.h:1318 [inline]\n  alloc_skb_with_frags+0xc8/0xbf0 net/core/skbuff.c:6504\n  sock_alloc_send_pskb+0xa81/0xbf0 net/core/sock.c:2795\n  packet_alloc_skb net/packet/af_packet.c:2930 [inline]\n  packet_snd net/packet/af_packet.c:3024 [inline]\n  packet_sendmsg+0x722d/0x9ef0 net/packet/af_packet.c:3113\n  sock_sendmsg_nosec net/socket.c:730 [inline]\n  __sock_sendmsg+0x30f/0x380 net/socket.c:745\n  __sys_sendto+0x685/0x830 net/socket.c:2191\n  __do_sys_sendto net/socket.c:2203 [inline]\n  __se_sys_sendto net/socket.c:2199 [inline]\n  __x64_sys_sendto+0x125/0x1d0 net/socket.c:2199\n do_syscall_64+0xd5/0x1f0\n entry_SYSCALL_64_after_hwframe+0x6d/0x75\r\n\r\nCPU: 0 PID: 5033 Comm: syz-executor346 Not tainted 6.9.0-rc1-syzkaller-00005-g928a87efa423 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024(CVE-2024-35973)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbatman-adv: Avoid infinite loop trying to resize local TT\r\n\r\nIf the MTU of one of an attached interface becomes too small to transmit\nthe local translation table then it must be resized to fit inside all\nfragments (when enabled) or a single packet.\r\n\r\nBut if the MTU becomes too low to transmit even the header + the VLAN\nspecific part then the resizing of the local TT will never succeed. This\ncan for example happen when the usable space is 110 bytes and 11 VLANs are\non top of batman-adv. In this case, at least 116 byte would be needed.\nThere will just be an endless spam of\r\n\r\n   batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (110)\r\n\r\nin the log but the function will never finish. Problem here is that the\ntimeout will be halved all the time and will then stagnate at 0 and\ntherefore never be able to reduce the table even more.\r\n\r\nThere are other scenarios possible with a similar result. The number of\nBATADV_TT_CLIENT_NOPURGE entries in the local TT can for example be too\nhigh to fit inside a packet. Such a scenario can therefore happen also with\nonly a single VLAN + 7 non-purgable addresses - requiring at least 120\nbytes.\r\n\r\nWhile this should be handled proactively when:\r\n\r\n* interface with too low MTU is added\n* VLAN is added\n* non-purgeable local mac is added\n* MTU of an attached interface is reduced\n* fragmentation setting gets disabled (which most likely requires dropping\n  attached interfaces)\r\n\r\nnot all of these scenarios can be prevented because batman-adv is only\nconsuming events without the the possibility to prevent these actions\n(non-purgable MAC address added, MTU of an attached interface is reduced).\nIt is therefore necessary to also make sure that the code is able to handle\nalso the situations when there were already incompatible system\nconfiguration are present.(CVE-2024-35982)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ni2c: smbus: fix NULL function pointer dereference\r\n\r\nBaruch reported an OOPS when using the designware controller as target\nonly. Target-only modes break the assumption of one transfer function\nalways being available. Fix this by always checking the pointer in\n__i2c_transfer.\r\n\r\n[wsa: dropped the simplification in core-smbus to avoid theoretical regressions](CVE-2024-35984)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nrtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation\r\n\r\nEach attribute inside a nested IFLA_VF_VLAN_LIST is assumed to be a\nstruct ifla_vf_vlan_info so the size of such attribute needs to be at least\nof sizeof(struct ifla_vf_vlan_info) which is 14 bytes.\nThe current size validation in do_setvfinfo is against NLA_HDRLEN (4 bytes)\nwhich is less than sizeof(struct ifla_vf_vlan_info) so this validation\nis not enough and a too small attribute might be cast to a\nstruct ifla_vf_vlan_info, this might result in an out of bands\nread access when accessing the saved (casted) entry in ivvl.(CVE-2024-36017)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmmc: sdhci-msm: pervent access to suspended controller\r\n\r\nGeneric sdhci code registers LED device and uses host-\u0026gt;runtime_suspended\nflag to protect access to it. The sdhci-msm driver doesn\u0026apos;t set this flag,\nwhich causes a crash when LED is accessed while controller is runtime\nsuspended. Fix this by setting the flag correctly.(CVE-2024-36029)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: fix out-of-bounds access in ops_init\r\n\r\nnet_alloc_generic is called by net_alloc, which is called without any\nlocking. It reads max_gen_ptrs, which is changed under pernet_ops_rwsem. It\nis read twice, first to allocate an array, then to set s.len, which is\nlater used to limit the bounds of the array access.\r\n\r\nIt is possible that the array is allocated and another thread is\nregistering a new pernet ops, increments max_gen_ptrs, which is then used\nto set s.len with a larger than allocated length for the variable array.\r\n\r\nFix it by reading max_gen_ptrs only once in net_alloc_generic. If\nmax_gen_ptrs is later incremented, it will be caught in net_assign_generic.(CVE-2024-36883)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: fix UAF in error path\r\n\r\nSam Page (sam4k) working with Trend Micro Zero Day Initiative reported\na UAF in the tipc_buf_append() error path:\r\n\r\nBUG: KASAN: slab-use-after-free in kfree_skb_list_reason+0x47e/0x4c0\nlinux/net/core/skbuff.c:1183\nRead of size 8 at addr ffff88804d2a7c80 by task poc/8034\r\n\r\nCPU: 1 PID: 8034 Comm: poc Not tainted 6.8.2 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS\n1.16.0-debian-1.16.0-5 04/01/2014\nCall Trace:\n \u0026lt;IRQ\u0026gt;\n __dump_stack linux/lib/dump_stack.c:88\n dump_stack_lvl+0xd9/0x1b0 linux/lib/dump_stack.c:106\n print_address_description linux/mm/kasan/report.c:377\n print_report+0xc4/0x620 linux/mm/kasan/report.c:488\n kasan_report+0xda/0x110 linux/mm/kasan/report.c:601\n kfree_skb_list_reason+0x47e/0x4c0 linux/net/core/skbuff.c:1183\n skb_release_data+0x5af/0x880 linux/net/core/skbuff.c:1026\n skb_release_all linux/net/core/skbuff.c:1094\n __kfree_skb linux/net/core/skbuff.c:1108\n kfree_skb_reason+0x12d/0x210 linux/net/core/skbuff.c:1144\n kfree_skb linux/./include/linux/skbuff.h:1244\n tipc_buf_append+0x425/0xb50 linux/net/tipc/msg.c:186\n tipc_link_input+0x224/0x7c0 linux/net/tipc/link.c:1324\n tipc_link_rcv+0x76e/0x2d70 linux/net/tipc/link.c:1824\n tipc_rcv+0x45f/0x10f0 linux/net/tipc/node.c:2159\n tipc_udp_recv+0x73b/0x8f0 linux/net/tipc/udp_media.c:390\n udp_queue_rcv_one_skb+0xad2/0x1850 linux/net/ipv4/udp.c:2108\n udp_queue_rcv_skb+0x131/0xb00 linux/net/ipv4/udp.c:2186\n udp_unicast_rcv_skb+0x165/0x3b0 linux/net/ipv4/udp.c:2346\n __udp4_lib_rcv+0x2594/0x3400 linux/net/ipv4/udp.c:2422\n ip_protocol_deliver_rcu+0x30c/0x4e0 linux/net/ipv4/ip_input.c:205\n ip_local_deliver_finish+0x2e4/0x520 linux/net/ipv4/ip_input.c:233\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_local_deliver+0x18e/0x1f0 linux/net/ipv4/ip_input.c:254\n dst_input linux/./include/net/dst.h:461\n ip_rcv_finish linux/net/ipv4/ip_input.c:449\n NF_HOOK linux/./include/linux/netfilter.h:314\n NF_HOOK linux/./include/linux/netfilter.h:308\n ip_rcv+0x2c5/0x5d0 linux/net/ipv4/ip_input.c:569\n __netif_receive_skb_one_core+0x199/0x1e0 linux/net/core/dev.c:5534\n __netif_receive_skb+0x1f/0x1c0 linux/net/core/dev.c:5648\n process_backlog+0x101/0x6b0 linux/net/core/dev.c:5976\n __napi_poll.constprop.0+0xba/0x550 linux/net/core/dev.c:6576\n napi_poll linux/net/core/dev.c:6645\n net_rx_action+0x95a/0xe90 linux/net/core/dev.c:6781\n __do_softirq+0x21f/0x8e7 linux/kernel/softirq.c:553\n do_softirq linux/kernel/softirq.c:454\n do_softirq+0xb2/0xf0 linux/kernel/softirq.c:441\n \u0026lt;/IRQ\u0026gt;\n \u0026lt;TASK\u0026gt;\n __local_bh_enable_ip+0x100/0x120 linux/kernel/softirq.c:381\n local_bh_enable linux/./include/linux/bottom_half.h:33\n rcu_read_unlock_bh linux/./include/linux/rcupdate.h:851\n __dev_queue_xmit+0x871/0x3ee0 linux/net/core/dev.c:4378\n dev_queue_xmit linux/./include/linux/netdevice.h:3169\n neigh_hh_output linux/./include/net/neighbour.h:526\n neigh_output linux/./include/net/neighbour.h:540\n ip_finish_output2+0x169f/0x2550 linux/net/ipv4/ip_output.c:235\n __ip_finish_output linux/net/ipv4/ip_output.c:313\n __ip_finish_output+0x49e/0x950 linux/net/ipv4/ip_output.c:295\n ip_finish_output+0x31/0x310 linux/net/ipv4/ip_output.c:323\n NF_HOOK_COND linux/./include/linux/netfilter.h:303\n ip_output+0x13b/0x2a0 linux/net/ipv4/ip_output.c:433\n dst_output linux/./include/net/dst.h:451\n ip_local_out linux/net/ipv4/ip_output.c:129\n ip_send_skb+0x3e5/0x560 linux/net/ipv4/ip_output.c:1492\n udp_send_skb+0x73f/0x1530 linux/net/ipv4/udp.c:963\n udp_sendmsg+0x1a36/0x2b40 linux/net/ipv4/udp.c:1250\n inet_sendmsg+0x105/0x140 linux/net/ipv4/af_inet.c:850\n sock_sendmsg_nosec linux/net/socket.c:730\n __sock_sendmsg linux/net/socket.c:745\n __sys_sendto+0x42c/0x4e0 linux/net/socket.c:2191\n __do_sys_sendto linux/net/socket.c:2203\n __se_sys_sendto linux/net/socket.c:2199\n __x64_sys_sendto+0xe0/0x1c0 linux/net/socket.c:2199\n do_syscall_x64 linux/arch/x86/entry/common.c:52\n do_syscall_\n---truncated---(CVE-2024-36886)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmptcp: ensure snd_nxt is properly initialized on connect\r\n\r\nChristoph reported a splat hinting at a corrupted snd_una:\r\n\r\n  WARNING: CPU: 1 PID: 38 at net/mptcp/protocol.c:1005 __mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Modules linked in:\n  CPU: 1 PID: 38 Comm: kworker/1:1 Not tainted 6.9.0-rc1-gbbeac67456c9 #59\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014\n  Workqueue: events mptcp_worker\n  RIP: 0010:__mptcp_clean_una+0x4b3/0x620 net/mptcp/protocol.c:1005\n  Code: be 06 01 00 00 bf 06 01 00 00 e8 a8 12 e7 fe e9 00 fe ff ff e8\n  \t8e 1a e7 fe 0f b7 ab 3e 02 00 00 e9 d3 fd ff ff e8 7d 1a e7 fe\n  \t\u0026lt;0f\u0026gt; 0b 4c 8b bb e0 05 00 00 e9 74 fc ff ff e8 6a 1a e7 fe 0f 0b e9\n  RSP: 0018:ffffc9000013fd48 EFLAGS: 00010293\n  RAX: 0000000000000000 RBX: ffff8881029bd280 RCX: ffffffff82382fe4\n  RDX: ffff8881003cbd00 RSI: ffffffff823833c3 RDI: 0000000000000001\n  RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n  R10: 0000000000000000 R11: fefefefefefefeff R12: ffff888138ba8000\n  R13: 0000000000000106 R14: ffff8881029bd908 R15: ffff888126560000\n  FS:  0000000000000000(0000) GS:ffff88813bd00000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007f604a5dae38 CR3: 0000000101dac002 CR4: 0000000000170ef0\n  Call Trace:\n   \u0026lt;TASK\u0026gt;\n   __mptcp_clean_una_wakeup net/mptcp/protocol.c:1055 [inline]\n   mptcp_clean_una_wakeup net/mptcp/protocol.c:1062 [inline]\n   __mptcp_retrans+0x7f/0x7e0 net/mptcp/protocol.c:2615\n   mptcp_worker+0x434/0x740 net/mptcp/protocol.c:2767\n   process_one_work+0x1e0/0x560 kernel/workqueue.c:3254\n   process_scheduled_works kernel/workqueue.c:3335 [inline]\n   worker_thread+0x3c7/0x640 kernel/workqueue.c:3416\n   kthread+0x121/0x170 kernel/kthread.c:388\n   ret_from_fork+0x44/0x50 arch/x86/kernel/process.c:147\n   ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243\n   \u0026lt;/TASK\u0026gt;\r\n\r\nWhen fallback to TCP happens early on a client socket, snd_nxt\nis not yet initialized and any incoming ack will copy such value\ninto snd_una. If the mptcp worker (dumbly) tries mptcp-level\nre-injection after such ack, that would unconditionally trigger a send\nbuffer cleanup using \u0026apos;bad\u0026apos; snd_una values.\r\n\r\nWe could easily disable re-injection for fallback sockets, but such\ndumb behavior already helped catching a few subtle issues and a very\nlow to zero impact in practice.\r\n\r\nInstead address the issue always initializing snd_nxt (and write_seq,\nfor consistency) at connect time.(CVE-2024-36889)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: fix uninitialised kfifo\r\n\r\nIf a line is requested with debounce, and that results in debouncing\nin software, and the line is subsequently reconfigured to enable edge\ndetection then the allocation of the kfifo to contain edge events is\noverlooked.  This results in events being written to and read from an\nuninitialised kfifo.  Read events are returned to userspace.\r\n\r\nInitialise the kfifo in the case where the software debounce is\nalready active.(CVE-2024-36898)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpiolib: cdev: Fix use after free in lineinfo_changed_notify\r\n\r\nThe use-after-free issue occurs as follows: when the GPIO chip device file\nis being closed by invoking gpio_chrdev_release(), watched_lines is freed\nby bitmap_free(), but the unregistration of lineinfo_changed_nb notifier\nchain failed due to waiting write rwsem. Additionally, one of the GPIO\nchip\u0026apos;s lines is also in the release process and holds the notifier chain\u0026apos;s\nread rwsem. Consequently, a race condition leads to the use-after-free of\nwatched_lines.\r\n\r\nHere is the typical stack when issue happened:\r\n\r\n[free]\ngpio_chrdev_release()\n  --\u0026gt; bitmap_free(cdev-\u0026gt;watched_lines)                  \u0026lt;-- freed\n  --\u0026gt; blocking_notifier_chain_unregister()\n    --\u0026gt; down_write(\u0026amp;nh-\u0026gt;rwsem)                          \u0026lt;-- waiting rwsem\n          --\u0026gt; __down_write_common()\n            --\u0026gt; rwsem_down_write_slowpath()\n                  --\u0026gt; schedule_preempt_disabled()\n                    --\u0026gt; schedule()\r\n\r\n[use]\nst54spi_gpio_dev_release()\n  --\u0026gt; gpio_free()\n    --\u0026gt; gpiod_free()\n      --\u0026gt; gpiod_free_commit()\n        --\u0026gt; gpiod_line_state_notify()\n          --\u0026gt; blocking_notifier_call_chain()\n            --\u0026gt; down_read(\u0026amp;nh-\u0026gt;rwsem);                  \u0026lt;-- held rwsem\n            --\u0026gt; notifier_call_chain()\n              --\u0026gt; lineinfo_changed_notify()\n                --\u0026gt; test_bit(xxxx, cdev-\u0026gt;watched_lines) \u0026lt;-- use after free\r\n\r\nThe side effect of the use-after-free issue is that a GPIO line event is\nbeing generated for userspace where it shouldn\u0026apos;t. However, since the chrdev\nis being closed, userspace won\u0026apos;t have the chance to read that event anyway.\r\n\r\nTo fix the issue, call the bitmap_free() function after the unregistration\nof lineinfo_changed_nb notifier chain.(CVE-2024-36899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: prevent NULL dereference in ip6_output()\r\n\r\nAccording to syzbot, there is a chance that ip6_dst_idev()\nreturns NULL in ip6_output(). Most places in IPv6 stack\ndeal with a NULL idev just fine, but not here.\r\n\r\nsyzbot reported:\r\n\r\ngeneral protection fault, probably for non-canonical address 0xdffffc00000000bc: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x00000000000005e0-0x00000000000005e7]\nCPU: 0 PID: 9775 Comm: syz-executor.4 Not tainted 6.9.0-rc5-syzkaller-00157-g6a30653b604a #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:ip6_output+0x231/0x3f0 net/ipv6/ip6_output.c:237\nCode: 3c 1e 00 49 89 df 74 08 4c 89 ef e8 19 58 db f7 48 8b 44 24 20 49 89 45 00 49 89 c5 48 8d 9d e0 05 00 00 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 0f b6 04 38 84 c0 4c 8b 74 24 28 0f 85 61 01 00 00 8b 1b 31 ff\nRSP: 0018:ffffc9000927f0d8 EFLAGS: 00010202\nRAX: 00000000000000bc RBX: 00000000000005e0 RCX: 0000000000040000\nRDX: ffffc900131f9000 RSI: 0000000000004f47 RDI: 0000000000004f48\nRBP: 0000000000000000 R08: ffffffff8a1f0b9a R09: 1ffffffff1f51fad\nR10: dffffc0000000000 R11: fffffbfff1f51fae R12: ffff8880293ec8c0\nR13: ffff88805d7fc000 R14: 1ffff1100527d91a R15: dffffc0000000000\nFS:  00007f135c6856c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000020000080 CR3: 0000000064096000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  NF_HOOK include/linux/netfilter.h:314 [inline]\n  ip6_xmit+0xefe/0x17f0 net/ipv6/ip6_output.c:358\n  sctp_v6_xmit+0x9f2/0x13f0 net/sctp/ipv6.c:248\n  sctp_packet_transmit+0x26ad/0x2ca0 net/sctp/output.c:653\n  sctp_packet_singleton+0x22c/0x320 net/sctp/outqueue.c:783\n  sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]\n  sctp_outq_flush+0x6d5/0x3e20 net/sctp/outqueue.c:1212\n  sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]\n  sctp_do_sm+0x59cc/0x60c0 net/sctp/sm_sideeffect.c:1169\n  sctp_primitive_ASSOCIATE+0x95/0xc0 net/sctp/primitive.c:73\n  __sctp_connect+0x9cd/0xe30 net/sctp/socket.c:1234\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-36901)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()\r\n\r\nsyzbot is able to trigger the following crash [1],\ncaused by unsafe ip6_dst_idev() use.\r\n\r\nIndeed ip6_dst_idev() can return NULL, and must always be checked.\r\n\r\n[1]\r\n\r\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI\nKASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\nCPU: 0 PID: 31648 Comm: syz-executor.0 Not tainted 6.9.0-rc4-next-20240417-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024\n RIP: 0010:__fib6_rule_action net/ipv6/fib6_rules.c:237 [inline]\n RIP: 0010:fib6_rule_action+0x241/0x7b0 net/ipv6/fib6_rules.c:267\nCode: 02 00 00 49 8d 9f d8 00 00 00 48 89 d8 48 c1 e8 03 42 80 3c 20 00 74 08 48 89 df e8 f9 32 bf f7 48 8b 1b 48 89 d8 48 c1 e8 03 \u0026lt;42\u0026gt; 80 3c 20 00 74 08 48 89 df e8 e0 32 bf f7 4c 8b 03 48 89 ef 4c\nRSP: 0018:ffffc9000fc1f2f0 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 1a772f98c8186700\nRDX: 0000000000000003 RSI: ffffffff8bcac4e0 RDI: ffffffff8c1f9760\nRBP: ffff8880673fb980 R08: ffffffff8fac15ef R09: 1ffffffff1f582bd\nR10: dffffc0000000000 R11: fffffbfff1f582be R12: dffffc0000000000\nR13: 0000000000000080 R14: ffff888076509000 R15: ffff88807a029a00\nFS:  00007f55e82ca6c0(0000) GS:ffff8880b9400000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b31d23000 CR3: 0000000022b66000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u0026lt;TASK\u0026gt;\n  fib_rules_lookup+0x62c/0xdb0 net/core/fib_rules.c:317\n  fib6_rule_lookup+0x1fd/0x790 net/ipv6/fib6_rules.c:108\n  ip6_route_output_flags_noref net/ipv6/route.c:2637 [inline]\n  ip6_route_output_flags+0x38e/0x610 net/ipv6/route.c:2649\n  ip6_route_output include/net/ip6_route.h:93 [inline]\n  ip6_dst_lookup_tail+0x189/0x11a0 net/ipv6/ip6_output.c:1120\n  ip6_dst_lookup_flow+0xb9/0x180 net/ipv6/ip6_output.c:1250\n  sctp_v6_get_dst+0x792/0x1e20 net/sctp/ipv6.c:326\n  sctp_transport_route+0x12c/0x2e0 net/sctp/transport.c:455\n  sctp_assoc_add_peer+0x614/0x15c0 net/sctp/associola.c:662\n  sctp_connect_new_asoc+0x31d/0x6c0 net/sctp/socket.c:1099\n  __sctp_connect+0x66d/0xe30 net/sctp/socket.c:1197\n  sctp_connect net/sctp/socket.c:4819 [inline]\n  sctp_inet_connect+0x149/0x1f0 net/sctp/socket.c:4834\n  __sys_connect_file net/socket.c:2048 [inline]\n  __sys_connect+0x2df/0x310 net/socket.c:2065\n  __do_sys_connect net/socket.c:2075 [inline]\n  __se_sys_connect net/socket.c:2072 [inline]\n  __x64_sys_connect+0x7a/0x90 net/socket.c:2072\n  do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n  do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f(CVE-2024-36902)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: Fix potential uninit-value access in __ip6_make_skb()\r\n\r\nAs it was done in commit fc1092f51567 (\u0026quot;ipv4: Fix uninit-value access in\n__ip_make_skb()\u0026quot;) for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6-\u0026gt;flowi6_flags\ninstead of testing HDRINCL on the socket to avoid a race condition which\ncauses uninit-value access.(CVE-2024-36903)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nARM: 9381/1: kasan: clear stale stack poison\r\n\r\nWe found below OOB crash:\r\n\r\n[   33.452494] ==================================================================\n[   33.453513] BUG: KASAN: stack-out-of-bounds in refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec\n[   33.454660] Write of size 164 at addr c1d03d30 by task swapper/0/0\n[   33.455515]\n[   33.455767] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G           O       6.1.25-mainline #1\n[   33.456880] Hardware name: Generic DT based system\n[   33.457555]  unwind_backtrace from show_stack+0x18/0x1c\n[   33.458326]  show_stack from dump_stack_lvl+0x40/0x4c\n[   33.459072]  dump_stack_lvl from print_report+0x158/0x4a4\n[   33.459863]  print_report from kasan_report+0x9c/0x148\n[   33.460616]  kasan_report from kasan_check_range+0x94/0x1a0\n[   33.461424]  kasan_check_range from memset+0x20/0x3c\n[   33.462157]  memset from refresh_cpu_vm_stats.constprop.0+0xcc/0x2ec\n[   33.463064]  refresh_cpu_vm_stats.constprop.0 from tick_nohz_idle_stop_tick+0x180/0x53c\n[   33.464181]  tick_nohz_idle_stop_tick from do_idle+0x264/0x354\n[   33.465029]  do_idle from cpu_startup_entry+0x20/0x24\n[   33.465769]  cpu_startup_entry from rest_init+0xf0/0xf4\n[   33.466528]  rest_init from arch_post_acpi_subsys_init+0x0/0x18\n[   33.467397]\n[   33.467644] The buggy address belongs to stack of task swapper/0/0\n[   33.468493]  and is located at offset 112 in frame:\n[   33.469172]  refresh_cpu_vm_stats.constprop.0+0x0/0x2ec\n[   33.469917]\n[   33.470165] This frame has 2 objects:\n[   33.470696]  [32, 76) \u0026apos;global_zone_diff\u0026apos;\n[   33.470729]  [112, 276) \u0026apos;global_node_diff\u0026apos;\n[   33.471294]\n[   33.472095] The buggy address belongs to the physical page:\n[   33.472862] page:3cd72da8 refcount:1 mapcount:0 mapping:00000000 index:0x0 pfn:0x41d03\n[   33.473944] flags: 0x1000(reserved|zone=0)\n[   33.474565] raw: 00001000 ed741470 ed741470 00000000 00000000 00000000 ffffffff 00000001\n[   33.475656] raw: 00000000\n[   33.476050] page dumped because: kasan: bad access detected\n[   33.476816]\n[   33.477061] Memory state around the buggy address:\n[   33.477732]  c1d03c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n[   33.478630]  c1d03c80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00\n[   33.479526] \u0026gt;c1d03d00: 00 04 f2 f2 f2 f2 00 00 00 00 00 00 f1 f1 f1 f1\n[   33.480415]                                                ^\n[   33.481195]  c1d03d80: 00 00 00 00 00 00 00 00 00 00 04 f3 f3 f3 f3 f3\n[   33.482088]  c1d03e00: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00\n[   33.482978] ==================================================================\r\n\r\nWe find the root cause of this OOB is that arm does not clear stale stack\npoison in the case of cpuidle.\r\n\r\nThis patch refer to arch/arm64/kernel/sleep.S to resolve this issue.\r\n\r\nFrom cited commit [1] that explain the problem\r\n\r\nFunctions which the compiler has instrumented for KASAN place poison on\nthe stack shadow upon entry and remove this poison prior to returning.\r\n\r\nIn the case of cpuidle, CPUs exit the kernel a number of levels deep in\nC code.  Any instrumented functions on this critical path will leave\nportions of the stack shadow poisoned.\r\n\r\nIf CPUs lose context and return to the kernel via a cold path, we\nrestore a prior context saved in __cpu_suspend_enter are forgotten, and\nwe never remove the poison they placed in the stack shadow area by\nfunctions calls between this and the actual exit of the kernel.\r\n\r\nThus, (depending on stackframe layout) subsequent calls to instrumented\nfunctions may hit this stale poison, resulting in (spurious) KASAN\nsplats to the console.\r\n\r\nTo avoid this, clear any stale poison from the idle thread for a CPU\nprior to bringing a CPU online.\r\n\r\nFrom cited commit [2]\r\n\r\nExtend to check for CONFIG_KASAN_STACK\r\n\r\n[1] commit 0d97e6d8024c (\u0026quot;arm64: kasan: clear stale stack poison\u0026quot;)\n[2] commit d56a9ef84bd0 (\u0026quot;kasan, arm64: unpoison stack only with CONFIG_KASAN_STACK\u0026quot;)(CVE-2024-36906)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblk-iocost: do not WARN if iocg was already offlined\r\n\r\nIn iocg_pay_debt(), warn is triggered if \u0026apos;active_list\u0026apos; is empty, which\nis intended to confirm iocg is active when it has debt. However, warn\ncan be triggered during a blkcg or disk removal, if iocg_waitq_timer_fn()\nis run at that time:\r\n\r\n  WARNING: CPU: 0 PID: 2344971 at block/blk-iocost.c:1402 iocg_pay_debt+0x14c/0x190\n  Call trace:\n  iocg_pay_debt+0x14c/0x190\n  iocg_kick_waitq+0x438/0x4c0\n  iocg_waitq_timer_fn+0xd8/0x130\n  __run_hrtimer+0x144/0x45c\n  __hrtimer_run_queues+0x16c/0x244\n  hrtimer_interrupt+0x2cc/0x7b0\r\n\r\nThe warn in this situation is meaningless. Since this iocg is being\nremoved, the state of the \u0026apos;active_list\u0026apos; is irrelevant, and \u0026apos;waitq_timer\u0026apos;\nis canceled after removing \u0026apos;active_list\u0026apos; in ioc_pd_free(), which ensures\niocg is freed after iocg_waitq_timer_fn() returns.\r\n\r\nTherefore, add the check if iocg was already offlined to avoid warn\nwhen removing a blkcg or disk.(CVE-2024-36908)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nblock: fix overflow in blk_ioctl_discard()\r\n\r\nThere is no check for overflow of \u0026apos;start + len\u0026apos; in blk_ioctl_discard().\nHung task occurs if submit an discard ioctl with the following param:\n  start = 0x80000000000ff000, len = 0x8000000000fff000;\nAdd the overflow validation now.(CVE-2024-36917)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()\r\n\r\nlpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the\nhbalock.  Thus, lpfc_worker_wake_up() should not be called while holding the\nhbalock to avoid potential deadlock.(CVE-2024-36924)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/qeth: Fix kernel panic after setting hsuid\r\n\r\nSymptom:\nWhen the hsuid attribute is set for the first time on an IQD Layer3\ndevice while the corresponding network interface is already UP,\nthe kernel will try to execute a napi function pointer that is NULL.\r\n\r\nExample:\n---------------------------------------------------------------------------\n[ 2057.572696] illegal operation: 0001 ilc:1 [#1] SMP\n[ 2057.572702] Modules linked in: af_iucv qeth_l3 zfcp scsi_transport_fc sunrpc nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6\nnft_reject nft_ct nf_tables_set nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables libcrc32c nfnetlink ghash_s390 prng xts aes_s390 des_s390 de\ns_generic sha3_512_s390 sha3_256_s390 sha512_s390 vfio_ccw vfio_mdev mdev vfio_iommu_type1 eadm_sch vfio ext4 mbcache jbd2 qeth_l2 bridge stp llc dasd_eckd_mod qeth dasd_mod\n qdio ccwgroup pkey zcrypt\n[ 2057.572739] CPU: 6 PID: 60182 Comm: stress_client Kdump: loaded Not tainted 4.18.0-541.el8.s390x #1\n[ 2057.572742] Hardware name: IBM 3931 A01 704 (LPAR)\n[ 2057.572744] Krnl PSW : 0704f00180000000 0000000000000002 (0x2)\n[ 2057.572748]            R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:3 PM:0 RI:0 EA:3\n[ 2057.572751] Krnl GPRS: 0000000000000004 0000000000000000 00000000a3b008d8 0000000000000000\n[ 2057.572754]            00000000a3b008d8 cb923a29c779abc5 0000000000000000 00000000814cfd80\n[ 2057.572756]            000000000000012c 0000000000000000 00000000a3b008d8 00000000a3b008d8\n[ 2057.572758]            00000000bab6d500 00000000814cfd80 0000000091317e46 00000000814cfc68\n[ 2057.572762] Krnl Code:#0000000000000000: 0000                illegal\n                         \u0026gt;0000000000000002: 0000                illegal\n                          0000000000000004: 0000                illegal\n                          0000000000000006: 0000                illegal\n                          0000000000000008: 0000                illegal\n                          000000000000000a: 0000                illegal\n                          000000000000000c: 0000                illegal\n                          000000000000000e: 0000                illegal\n[ 2057.572800] Call Trace:\n[ 2057.572801] ([\u0026lt;00000000ec639700\u0026gt;] 0xec639700)\n[ 2057.572803]  [\u0026lt;00000000913183e2\u0026gt;] net_rx_action+0x2ba/0x398\n[ 2057.572809]  [\u0026lt;0000000091515f76\u0026gt;] __do_softirq+0x11e/0x3a0\n[ 2057.572813]  [\u0026lt;0000000090ce160c\u0026gt;] do_softirq_own_stack+0x3c/0x58\n[ 2057.572817] ([\u0026lt;0000000090d2cbd6\u0026gt;] do_softirq.part.1+0x56/0x60)\n[ 2057.572822]  [\u0026lt;0000000090d2cc60\u0026gt;] __local_bh_enable_ip+0x80/0x98\n[ 2057.572825]  [\u0026lt;0000000091314706\u0026gt;] __dev_queue_xmit+0x2be/0xd70\n[ 2057.572827]  [\u0026lt;000003ff803dd6d6\u0026gt;] afiucv_hs_send+0x24e/0x300 [af_iucv]\n[ 2057.572830]  [\u0026lt;000003ff803dd88a\u0026gt;] iucv_send_ctrl+0x102/0x138 [af_iucv]\n[ 2057.572833]  [\u0026lt;000003ff803de72a\u0026gt;] iucv_sock_connect+0x37a/0x468 [af_iucv]\n[ 2057.572835]  [\u0026lt;00000000912e7e90\u0026gt;] __sys_connect+0xa0/0xd8\n[ 2057.572839]  [\u0026lt;00000000912e9580\u0026gt;] sys_socketcall+0x228/0x348\n[ 2057.572841]  [\u0026lt;0000000091514e1a\u0026gt;] system_call+0x2a6/0x2c8\n[ 2057.572843] Last Breaking-Event-Address:\n[ 2057.572844]  [\u0026lt;0000000091317e44\u0026gt;] __napi_poll+0x4c/0x1d8\n[ 2057.572846]\n[ 2057.572847] Kernel panic - not syncing: Fatal exception in interrupt\n-------------------------------------------------------------------------------------------\r\n\r\nAnalysis:\nThere is one napi structure per out_q: card-\u0026gt;qdio.out_qs[i].napi\nThe napi.poll functions are set during qeth_open().\r\n\r\nSince\ncommit 1cfef80d4c2b (\u0026quot;s390/qeth: Don\u0026apos;t call dev_close/dev_open (DOWN/UP)\u0026quot;)\nqeth_set_offline()/qeth_set_online() no longer call dev_close()/\ndev_open(). So if qeth_free_qdio_queues() cleared\ncard-\u0026gt;qdio.out_qs[i].napi.poll while the network interface was UP and the\ncard was offline, they are not set again.\r\n\r\nReproduction:\nchzdev -e $devno layer2=0\nip link set dev $network_interface up\necho 0 \u0026gt; /sys/bus/ccw\n---truncated---(CVE-2024-36928)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: core: reject skb_copy(_expand) for fraglist GSO skbs\r\n\r\nSKB_GSO_FRAGLIST skbs must not be linearized, otherwise they become\ninvalid. Return NULL if such an skb is passed to skb_copy or\nskb_copy_expand, in order to prevent a crash on a potential later\ncall to skb_gso_segment.(CVE-2024-36929)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\namd/amdkfd: sync all devices to wait all processes being evicted\r\n\r\nIf there are more than one device doing reset in parallel, the first\ndevice will call kfd_suspend_all_processes() to evict all processes\non all devices, this call takes time to finish. other device will\nstart reset and recover without waiting. if the process has not been\nevicted before doing recover, it will be restored, then caused page\nfault.(CVE-2024-36949)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: fix a possible memleak in tipc_buf_append\r\n\r\n__skb_linearize() doesn\u0026apos;t free the skb when it fails, so move\n\u0026apos;*buf = NULL\u0026apos; after __skb_linearize(), so that the skb can be\nfreed on the err path.(CVE-2024-36954)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocteontx2-af: avoid off-by-one read from userspace\r\n\r\nWe try to access count + 1 byte from userspace with memdup_user(buffer,\ncount + 1). However, the userspace only provides buffer of count bytes and\nonly these count bytes are verified to be okay to access. To ensure the\ncopied buffer is NUL terminated, we use memdup_user_nul instead.(CVE-2024-36957)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nfs/9p: only translate RWX permissions for plain 9P2000\r\n\r\nGarbage in plain 9P2000\u0026apos;s perm bits is allowed through, which causes it\nto be able to set (among others) the suid bit. This was presumably not\nthe intent since the unix extended bits are handled explicitly and\nconditionally on .u.(CVE-2024-36964)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:17:24.569488947Z","cvss":[{"version":"3.1","score":0,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:N","level":"none"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2022-48652","description":"In the Linux kernel, the following vulnerability has been resolved: ice: Fix crash by keep old cfg when update TCs more than queues There are problems if allocated queues less than Traffic Classes. Commit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config for DCB\") already disallow setting less queues than TCs. Another case is if we first set less queues, and later update more TCs config due to LLDP, ice_vsi_cfg_tc() will failed but left dirty num_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access. [   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated. [   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)! [   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0 [   95.969621] general protection fault: 0000 [#1] SMP NOPTI [   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G U  W  O     --------- -t - 4.18.0 #1 [   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021 [   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60 [   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u003c8b\u003e 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c [   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206 [   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0 [   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200 [   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000 [   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100 [   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460 [   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000 [   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0 [   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [   95.971530] PKRU: 55555554 [   95.971573] Call Trace: [   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice] [   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice] [   95.971774]  ice_vsi_open+0x25/0x120 [ice] [   95.971843]  ice_open_internal+0xb8/0x1f0 [ice] [   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice] [   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice] [   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice] [   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice] [   95.972220]  dcbnl_ieee_set+0x89/0x230 [   95.972279]  ? dcbnl_ieee_del+0x150/0x150 [   95.972341]  dcb_doit+0x124/0x1b0 [   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0 [   95.972457]  ? dcb_doit+0x14d/0x1b0 [   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280 [   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100 [   95.972661]  netlink_rcv_skb+0xcf/0xf0 [   95.972720]  netlink_unicast+0x16d/0x220 [   95.972781]  netlink_sendmsg+0x2ba/0x3a0 [   95.975891]  sock_sendmsg+0x4c/0x50 [   95.979032]  ___sys_sendmsg+0x2e4/0x300 [   95.982147]  ? kmem_cache_alloc+0x13e/0x190 [   95.985242]  ? __wake_up_common_lock+0x79/0x90 [   95.988338]  ? __check_object_size+0xac/0x1b0 [   95.991440]  ? _copy_to_user+0x22/0x30 [   95.994539]  ? move_addr_to_user+0xbb/0xd0 [   95.997619]  ? __sys_sendmsg+0x53/0x80 [   96.000664]  __sys_sendmsg+0x53/0x80 [   96.003747]  do_syscall_64+0x5b/0x1d0 [   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca Only update num_txq/rxq when passed check, and restore tc_cfg if setup queue map failed.","status":"published","published":"2024-04-28T13:15:00Z","modified":"2026-08-06T03:07:20.319128286Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"DEBIAN-CVE-2022-48652","description":"In the Linux kernel, the following vulnerability has been resolved:  ice: Fix crash by keep old cfg when update TCs more than queues  There are problems if allocated queues less than Traffic Classes.  Commit a632b2a4c920 (\"ice: ethtool: Prohibit improper channel config for DCB\") already disallow setting less queues than TCs.  Another case is if we first set less queues, and later update more TCs config due to LLDP, ice_vsi_cfg_tc() will failed but left dirty num_txq/rxq and tc_cfg in vsi, that will cause invalid pointer access.  [   95.968089] ice 0000:3b:00.1: More TCs defined than queues/rings allocated. [   95.968092] ice 0000:3b:00.1: Trying to use more Rx queues (8), than were allocated (1)! [   95.968093] ice 0000:3b:00.1: Failed to config TC for VSI index: 0 [   95.969621] general protection fault: 0000 [#1] SMP NOPTI [   95.969705] CPU: 1 PID: 58405 Comm: lldpad Kdump: loaded Tainted: G     U  W  O     --------- -t - 4.18.0 #1 [   95.969867] Hardware name: O.E.M/BC11SPSCB10, BIOS 8.23 12/30/2021 [   95.969992] RIP: 0010:devm_kmalloc+0xa/0x60 [   95.970052] Code: 5c ff ff ff 31 c0 5b 5d 41 5c c3 b8 f4 ff ff ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 89 d1 \u003c8b\u003e 97 60 02 00 00 48 8d 7e 18 48 39 f7 72 3f 55 89 ce 53 48 8b 4c [   95.970344] RSP: 0018:ffffc9003f553888 EFLAGS: 00010206 [   95.970425] RAX: dead000000000200 RBX: ffffea003c425b00 RCX: 00000000006080c0 [   95.970536] RDX: 00000000006080c0 RSI: 0000000000000200 RDI: dead000000000200 [   95.970648] RBP: dead000000000200 R08: 00000000000463c0 R09: ffff888ffa900000 [   95.970760] R10: 0000000000000000 R11: 0000000000000002 R12: ffff888ff6b40100 [   95.970870] R13: ffff888ff6a55018 R14: 0000000000000000 R15: ffff888ff6a55460 [   95.970981] FS:  00007f51b7d24700(0000) GS:ffff88903ee80000(0000) knlGS:0000000000000000 [   95.971108] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [   95.971197] CR2: 00007fac5410d710 CR3: 0000000f2c1de002 CR4: 00000000007606e0 [   95.971309] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [   95.971419] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [   95.971530] PKRU: 55555554 [   95.971573] Call Trace: [   95.971622]  ice_setup_rx_ring+0x39/0x110 [ice] [   95.971695]  ice_vsi_setup_rx_rings+0x54/0x90 [ice] [   95.971774]  ice_vsi_open+0x25/0x120 [ice] [   95.971843]  ice_open_internal+0xb8/0x1f0 [ice] [   95.971919]  ice_ena_vsi+0x4f/0xd0 [ice] [   95.971987]  ice_dcb_ena_dis_vsi.constprop.5+0x29/0x90 [ice] [   95.972082]  ice_pf_dcb_cfg+0x29a/0x380 [ice] [   95.972154]  ice_dcbnl_setets+0x174/0x1b0 [ice] [   95.972220]  dcbnl_ieee_set+0x89/0x230 [   95.972279]  ? dcbnl_ieee_del+0x150/0x150 [   95.972341]  dcb_doit+0x124/0x1b0 [   95.972392]  rtnetlink_rcv_msg+0x243/0x2f0 [   95.972457]  ? dcb_doit+0x14d/0x1b0 [   95.972510]  ? __kmalloc_node_track_caller+0x1d3/0x280 [   95.972591]  ? rtnl_calcit.isra.31+0x100/0x100 [   95.972661]  netlink_rcv_skb+0xcf/0xf0 [   95.972720]  netlink_unicast+0x16d/0x220 [   95.972781]  netlink_sendmsg+0x2ba/0x3a0 [   95.975891]  sock_sendmsg+0x4c/0x50 [   95.979032]  ___sys_sendmsg+0x2e4/0x300 [   95.982147]  ? kmem_cache_alloc+0x13e/0x190 [   95.985242]  ? __wake_up_common_lock+0x79/0x90 [   95.988338]  ? __check_object_size+0xac/0x1b0 [   95.991440]  ? _copy_to_user+0x22/0x30 [   95.994539]  ? move_addr_to_user+0xbb/0xd0 [   95.997619]  ? __sys_sendmsg+0x53/0x80 [   96.000664]  __sys_sendmsg+0x53/0x80 [   96.003747]  do_syscall_64+0x5b/0x1d0 [   96.006862]  entry_SYSCALL_64_after_hwframe+0x65/0xca  Only update num_txq/rxq when passed check, and restore tc_cfg if setup queue map failed.","status":"published","published":"2024-04-28T13:15:07.477Z","modified":"2026-11-03T06:03:11.214600546Z","updated_at":"2026-11-03T06:42:33.899035Z"},{"id":"SUSE-SU-2024:1644-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).\n- CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).\n- CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).\n- CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).\n- CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).\n- CVE-2024-27042: Fixed drm/amdgpu for potential out-of-bounds access in amdgpu_discovery_reg_base_init() (bsc#1223823).\n- CVE-2024-27041: Fixed drm/amd/display NULL checks for adev-\u003edm.dc in amdgpu_dm_fini() (bsc#1223714).\n- CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).\n- CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).\n- CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).\n- CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).\n- CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).\n- CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).\n- CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).\n- CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).\n- CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).\n- CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).\n- CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).\n- CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).\n- CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).\n- CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).\n- CVE-2024-26939: Fixed drm/i915/vma UAF on destroy against retire race (bsc#1223679).\n- CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).\n- CVE-2024-26915: Fixed drm/amdgpu reset IH OVERFLOW_CLEAR bit (bsc#1223207).\n- CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).\n- CVE-2024-26898: Fixed aoe potential use-after-free problem in aoecmd_cfg_pkts (bsc#1223016).\n- CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).\n- CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).\n- CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).\n- CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).\n- CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).\n- CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).\n- CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).\n- CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).\n- CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).\n- CVE-2024-26876: Fixed drm/bridge/adv7511 crash on irq during probe (bsc#1223119).\n- CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).\n- CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).\n- CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).\n- CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).\n- CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).\n- CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).\n- CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).\n- CVE-2024-26830: Fixed i40e to not allow untrusted VF to remove administratively set MAC (bsc#1223012).\n- CVE-2024-26817: Fixed amdkfd to use calloc instead of kzalloc to avoid integer overflow (bsc#1222812).\n- CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).\n- CVE-2024-26791: Fixed btrfs/dev-replace properly validate device names (bsc#1222793).\n- CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2024-26766: Fixed SDMA off-by-one error in _pad_sdma_tx_descs() (bsc#1222726).\n- CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26700: Fixed drm/amd/display MST Null pointer dereference  for RV (bsc#1222870).\n- CVE-2024-26687: Fixed xen/events close evtchn after mapping cleanup (bsc#1222435).\n- CVE-2024-26679: Fixed inet read sk-\u003esk_family once in inet_recv_error() (bsc#1222385).\n- CVE-2024-26675: Fixed ppp_async to limit MRU to 64K (bsc#1222379).\n- CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).\n- CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).\n- CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).\n- CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).\n- CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).\n- CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).\n- CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).\n- CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs (HugeTLB pages) functionality (bsc#1219264).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).\n- CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).\n- CVE-2023-52620: Fixed netfilter/nf_tables to disallow timeout for anonymous sets never used from userspace (bsc#1221825).\n- CVE-2023-52616: Fixed unexpected pointer access in crypto/lib/mpi in mpi_ec_init (bsc#1221612).\n- CVE-2023-52614: Fixed PM/devfreq buffer overflow in trans_stat_show (bsc#1221617).\n- CVE-2023-52593: Fixed wifi/wfx possible NULL pointer dereference in wfx_set_mfp_ap() (bsc#1221042).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).\n- CVE-2023-52589: Fixed media/rkisp1 IRQ disable race issue (bsc#1221084).\n- CVE-2023-52585: Fixed drm/amdgpu for possible NULL pointer dereference in amdgpu_ras_query_error_status_helper() (bsc#1221080).\n- CVE-2022-48662: Fixed a general protection fault (GPF) in i915_perf_open_ioctl (bsc#1223505).\n- CVE-2022-48659: Fixed mm/slub to return errno if kmalloc() fails (bsc#1223498).\n- CVE-2022-48658: Fixed mm/slub to avoid a problem in flush_cpu_slab()/__free_slab() task context (bsc#1223496).\n- CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-\u003emac_header (bsc#1223513).\n- CVE-2022-48642: Fixed netfilter/nf_tables percpu memory leak at nf_tables_addchain() (bsc#1223478).\n- CVE-2022-48640: Fixed bonding for possible NULL pointer dereference in bond_rr_gen_slave_id (bsc#1223499).\n- CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth \u003e 0 (bsc#1223475).\n- CVE-2021-47214: Fixed hugetlb/userfaultfd during restore reservation in hugetlb_mcopy_atomic_pte() (bsc#1222710).\n- CVE-2021-47211: Fixed a null pointer dereference on pointer cs_desc in usb-audio (bsc#1222869).\n- CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).\n- CVE-2021-47205: Unregistered clocks/resets when unbinding in sunxi-ng (bsc#1222888).\n- CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions (bsc#1222878)\n- CVE-2021-47200: Fixed drm/prime for possible use-after-free in mmap within drm_gem_ttm_mmap() and drm_gem_ttm_mmap() (bsc#1222838).\n- CVE-2021-47195: Fixed use-after-free inside SPI via add_lock mutex (bsc#1222832).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47184: Fixed NULL pointer dereference on VSI filter sync (bsc#1222666).\n\nThe following non-security bugs were fixed:\n\n- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).\n- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).\n- ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).\n- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).\n- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).\n- ALSA: scarlett2: Add correct product series name to messages (stable-fixes).\n- ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).\n- ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).\n- ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).\n- ASoC: meson: axg-card: make links nonatomic (git-fixes).\n- ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).\n- ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).\n- ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).\n- ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).\n- ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).\n- Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes).\n- Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).\n- Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).\n- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).\n- Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: add quirk for broken address properties (git-fixes).\n- Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).\n- Bluetooth: btintel: Fixe build regression (git-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).\n- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).\n- Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).\n- Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).\n- Documentation: Add missing documentation for EXPORT_OP flags (stable-fixes).\n- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev-\u003edevc (git-fixes).\n- HID: logitech-dj: allow mice to use all types of reports (git-fixes).\n- HID: uhid: Use READ_ONCE()/WRITE_ONCE() for -\u003erunning (stable-fixes).\n- Input: allocate keycode for Display refresh rate toggle (stable-fixes).\n- Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).\n- NFC: trf7970a: disable all regulators on removal (git-fixes).\n- PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).\n- RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes).\n- Reapply 'drm/qxl: simplify qxl_fence_wait' (stable-fixes).\n- Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).\n- Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).\n- Revert 'ice: Fix ice VF reset during iavf initialization (jsc#PED-376).' (bsc#1223275)\n- Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).\n- Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).\n- USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).\n- USB: core: Add hub_get() and hub_put() routines (git-fixes).\n- USB: core: Fix access violation during port device removal (git-fixes).\n- USB: core: Fix deadlock in port 'disable' sysfs attribute (git-fixes).\n- USB: serial: add device ID for VeriFone adapter (stable-fixes).\n- USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).\n- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).\n- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).\n- USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).\n- USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).\n- USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).\n- USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).\n- USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).\n- USB: serial: option: support Quectel EM060K sub-models (stable-fixes).\n- nfsd: Fixed mount kerberized nfs4 share issue (git-fixes bsc#1223858).\n- s390: Fixed kernel backtrack (bsc#1141539 git-fixes).\n- nfsd: Fixed mount issue with KOTD (bsc#1223380 bsc#1217408 bsc#1223640).\n- s390: Fixed LPM of lpar failure with error HSCLA2CF in 19th loops (jsc#PED-542 git-fixes bsc#1213573 ltc#203238).\n- ahci: asm1064: asm1166: do not limit reported ports (git-fixes).\n- ahci: asm1064: correct count of reported ports (stable-fixes).\n- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)\n- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)\n- arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)\n- arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).\n- ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).\n- batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).\n- clk: Get runtime PM before walking tree during disable_unused (git-fixes).\n- clk: Initialize struct clk_core kref earlier (stable-fixes).\n- clk: Mark 'all_lists' as const (stable-fixes).\n- clk: Print an info line before disabling unused clocks (stable-fixes).\n- clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).\n- clk: remove extra empty line (stable-fixes).\n- comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).\n- dma: xilinx_dpdma: Fix locking (git-fixes).\n- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).\n- dmaengine: owl: fix register access functions (git-fixes).\n- dmaengine: tegra186: Fix residual calculation (git-fixes).\n- docs: Document the FAN_FS_ERROR event (stable-fixes).\n- drm-print: add drm_dbg_driver to improve namespace symmetry (stable-fixes).\n- drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).\n- drm/amd/display: Fix nanosec stat overflow (stable-fixes).\n- drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).\n- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).\n- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).\n- drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).\n- drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).\n- drm/amdgpu: always force full reset for SOC21 (stable-fixes).\n- drm/amdgpu: fix incorrect active rb bitmap for gfx11 (stable-fixes).\n- drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).\n- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).\n- drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).\n- drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).\n- drm/ast: Fix soft lockup (git-fixes).\n- drm/client: Fully protect modes[] with dev-\u003emode_config.mutex (stable-fixes).\n- drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).\n- drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).\n- drm/i915: Disable port sync when bigjoiner is used (stable-fixes).\n- drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).\n- drm/nouveau/nvkm: add a replacement for nvkm_notify (bsc#1223834)\n- drm/panel: ili9341: Respect deferred probe (git-fixes).\n- drm/panel: ili9341: Use predefined error codes (git-fixes).\n- drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).\n- drm/vc4: do not check if plane-\u003estate-\u003efb == state-\u003efb (stable-fixes).\n- drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).\n- drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).\n- drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).\n- drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).\n- drm: nv04: Fix out of bounds access (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go (stable-fixes).\n- dump_stack: Do not get cpu_sync for panic CPU (bsc#1223574).\n- fbdev: fix incorrect address computation in deferred IO (git-fixes).\n- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).\n- fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).\n- fuse: do not unhash root (bsc#1223951).\n- fuse: fix root lookup with nonzero generation (bsc#1223950).\n- hwmon: (amc6821) add of_match table (stable-fixes).\n- i2c: pxa: hide unused icr_bits[] variable (git-fixes).\n- i2c: smbus: fix NULL function pointer dereference (git-fixes).\n- i40e: Fix VF MAC filter removal (git-fixes).\n- idma64: Do not try to serve interrupts when device is powered off (git-fixes).\n- iio: accel: mxc4005: Interrupt handling fixes (git-fixes).\n- iio:imu: adis16475: Fix sync mode setting (git-fixes).\n- init/main.c: Fix potential static_command_line memory overflow (git-fixes).\n- ipv6/addrconf: fix a potential refcount underflow for idev (git-fixes).\n- irqchip/gic-v3-its: Prevent double free on error (git-fixes).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- media: cec: core: remove length check of Timer Status (stable-fixes).\n- media: sta2x11: fix irq handler cast (stable-fixes).\n- mei: me: add arrow lake point H DID (stable-fixes).\n- mei: me: add arrow lake point S DID (stable-fixes).\n- mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).\n- mm/vmscan: make sure wakeup_kswapd with managed zone (bsc#1223473).\n- mmc: sdhci-msm: pervent access to suspended controller (git-fixes).\n- mtd: diskonchip: work around ubsan link failure (stable-fixes).\n- net: bridge: vlan: fix memory leak in __allowed_ingress (git-fixes).\n- net: fix a memleak when uncloning an skb dst and its metadata (git-fixes).\n- net: fix skb leak in __skb_tstamp_tx() (git-fixes).\n- net: ipv6: ensure we call ipv6_mc_down() at most once (git-fixes).\n- net: mld: fix reference count leak in mld_{query | report}_work() (git-fixes).\n- net: stream: purge sk_error_queue in sk_stream_kill_queues() (git-fixes).\n- net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: vlan: fix underflow for the real_dev refcnt (git-fixes).\n- net: vmxnet3: Fix NULL pointer dereference in vmxnet3_rq_rx_complete() (bsc#1223360).\n- netfilter: br_netfilter: Drop dst references before setting (git-fixes).\n- netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() (git-fixes).\n- netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).\n- nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nouveau: fix function cast warning (git-fixes).\n- nouveau: fix instmem race condition around ptr stores (git-fixes).\n- phy: tegra: xusb: Add API to retrieve the port number of phy (stable-fixes).\n- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).\n- platform/x86: intel-vbtn: Update tablet mode switch at end of probe (git-fixes).\n- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/rtas: define pr_fmt and convert printk call sites (bsc#1223369 ltc#205888).\n- powerpc/rtas: export rtas_error_rc() for reuse (bsc#1223369 ltc#205888).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n- printk: Add this_cpu_in_panic() (bsc#1223574).\n- printk: Adjust mapping for 32bit seq macros (bsc#1223574).\n- printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1223574).\n- printk: Disable passing console lock owner completely during panic() (bsc#1223574).\n- printk: Drop console_sem during panic (bsc#1223574).\n- printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1223574).\n- printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1223574).\n- printk: Wait for all reserved records with pr_flush() (bsc#1223574).\n- printk: nbcon: Relocate 32bit seq macros (bsc#1223574).\n- printk: ringbuffer: Clarify special lpos values (bsc#1223574).\n- printk: ringbuffer: Cleanup reader terminology (bsc#1223574).\n- printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1223574).\n- printk: ringbuffer: Improve prb_next_seq() performance (bsc#1223574).\n- printk: ringbuffer: Skip non-finalized records in panic (bsc#1223574).\n- pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).\n- ring-buffer: Only update pages_touched when a new page is touched (git-fixes).\n- ring-buffer: use READ_ONCE() to read cpu_buffer-\u003ecommit_page in concurrent environment (git-fixes).\n- s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223875).\n- s390/decompressor: fix misaligned symbol build error (git-fixes bsc#1223785).\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223877).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223878).\n- s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223879).\n- s390/scm: fix virtual vs physical address confusion (git-fixes bsc#1223784).\n- s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223876).\n- s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223598).\n- s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223595).\n- serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).\n- serial: core: Provide port lock wrappers (stable-fixes).\n- serial: core: fix kernel-doc for uart_port_unlock_irqrestore() (git-fixes).\n- serial: mxs-auart: add spinlock around changing cts state (git-fixes).\n- slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).\n- speakup: Avoid crash on very long word (git-fixes).\n- speakup: Fix 8bit characters from direct synth (git-fixes).\n- spi: hisi-kunpeng: Delete the dump interface of data registers in debugfs (git-fixes).\n- tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp (git-fixes).\n- thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).\n- thunderbolt: Fix wake configurations after device unplug (stable-fixes).\n- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).\n- tracing: Show size of requested perf buffer (git-fixes).\n- usb: Disable USB3 LPM at shutdown (stable-fixes).\n- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (git-fixes).\n- usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).\n- usb: dwc3: core: Prevent phy suspend during init (Git-fixes).\n- usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).\n- usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).\n- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).\n- usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic (git-fixes).\n- usb: ohci: Prevent missed ohci interrupts (git-fixes).\n- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).\n- usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).\n- usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).\n- usb: typec: tcpm: unregister existing source caps before re-registration (bsc#1220569).\n- usb: typec: ucsi: Ack unsupported commands (stable-fixes).\n- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).\n- usb: typec: ucsi: Fix connector check on init (git-fixes).\n- usb: udc: remove warning when queue disabled ep (stable-fixes).\n- virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223949).\n- wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).\n- wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).\n- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).\n- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).\n- wifi: nl80211: do not free NULL coalescing rule (git-fixes).\n- x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (git-fixes).\n- x86/bugs: Fix BHI documentation (git-fixes).\n- x86/bugs: Fix BHI handling of RRSBA (git-fixes).\n- x86/bugs: Fix BHI retpoline check (git-fixes).\n- x86/bugs: Fix return type of spectre_bhi_state() (git-fixes).\n- x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (git-fixes).\n- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).\n- x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (jsc#PED-7167 git-fixes).\n- x86/sev: Skip ROM range scans and validation for SEV-SNP guests (jsc#PED-7167 git-fixes).\n- xfrm6: fix inet6_dev refcount underflow problem (git-fixes).\n","status":"published","published":"2024-05-14T14:29:53Z","modified":"2025-05-02T04:32:07.49607Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1659-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-26760: Fixed scsi/target/pscsi bio_put() for error case (bsc#1222596).\n- CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).\n- CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).\n- CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).\n- CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).\n- CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).\n- CVE-2024-27041: Fixed drm/amd/display NULL checks for adev-\u003edm.dc in amdgpu_dm_fini() (bsc#1223714).\n- CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).\n- CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).\n- CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).\n- CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).\n- CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).\n- CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).\n- CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).\n- CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).\n- CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).\n- CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).\n- CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).\n- CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).\n- CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).\n- CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).\n- CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).\n- CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).\n- CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).\n- CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).\n- CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).\n- CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).\n- CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).\n- CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).\n- CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).\n- CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).\n- CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).\n- CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).\n- CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).\n- CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).\n- CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).\n- CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).\n- CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26848: Fixed afs endless loop in directory parsing (bsc#1223030).\n- CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).\n- CVE-2024-26830: Fixed i40e to not allow untrusted VF to remove administratively set MAC (bsc#1223012).\n- CVE-2024-26817: Fixed amdkfd to use calloc instead of kzalloc to avoid integer overflow (bsc#1222812).\n- CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).\n- CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).\n- CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).\n- CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).\n- CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)\n- CVE-2024-26766: Fixed SDMA off-by-one error in _pad_sdma_tx_descs() (bsc#1222726).\n- CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).\n- CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt (bsc#1222720).\n- CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).\n- CVE-2024-26751: Fixed ARM/ep93xx terminator to gpiod_lookup_table (bsc#1222724).\n- CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).\n- CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677).\n- CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26727: Fixed assertion if a newly created btrfs subvolume already gets read (bsc#1222536).\n- CVE-2024-26718: Fixed dm-crypt/dm-verity disable tasklets (bsc#1222416).\n- CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2024-26696: Fixed nilfs2 hang in nilfs_lookup_dirty_data_buffers() (bsc#1222549).\n- CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).\n- CVE-2024-26687: Fixed xen/events close evtchn after mapping cleanup (bsc#1222435).\n- CVE-2024-26685: Fixed nilfs2 potential bug in end_buffer_async_write (bsc#1222437).\n- CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).\n- CVE-2024-26681: Fixed netdevsim to avoid potential loop in nsim_dev_trap_report_work() (bsc#1222431).\n- CVE-2024-26680: Fixed net/atlantic DMA mapping for PTP hwts ring (bsc#1222427).\n- CVE-2024-26675: Fixed ppp_async to limit MRU to 64K (bsc#1222379).\n- CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).\n- CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).\n- CVE-2024-26660: Fixed drm/amd/display bounds check for stream encoder creation (bsc#1222266).\n- CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).\n- CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).\n- CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).\n- CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).\n- CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs (HugeTLB pages) functionality (bsc#1219264).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).\n- CVE-2023-52636: Fixed libceph cursor init when preparing sparse read in msgr2 (bsc#1222247).\n- CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).\n- CVE-2023-52627: Fixed iio:adc:ad7091r exports into IIO_AD7091R namespace (bsc#1222051).\n- CVE-2023-52620: Fixed netfilter/nf_tables to disallow timeout for anonymous sets never used from userspace (bsc#1221825).\n- CVE-2023-52616: Fixed unexpected pointer access in crypto/lib/mpi in mpi_ec_init (bsc#1221612).\n- CVE-2023-52614: Fixed PM/devfreq buffer overflow in trans_stat_show (bsc#1221617).\n- CVE-2023-52593: Fixed wifi/wfx possible NULL pointer dereference in wfx_set_mfp_ap() (bsc#1221042).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).\n- CVE-2023-52589: Fixed media/rkisp1 IRQ disable race issue (bsc#1221084).\n- CVE-2023-52585: Fixed drm/amdgpu for possible NULL pointer dereference in amdgpu_ras_query_error_status_helper() (bsc#1221080).\n- CVE-2023-52561: Fixed arm64/dts/qcom/sdm845-db845c to mark cont splash memory region (bsc#1220935).\n- CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).\n- CVE-2023-52488: Fixed serial/sc16is7xx convert from _raw_ to _noinc_ regmap functions for FIFO (bsc#1221162).\n- CVE-2022-48662: Fixed a general protection fault (GPF) in i915_perf_open_ioctl (bsc#1223505).\n- CVE-2022-48659: Fixed mm/slub to return errno if kmalloc() fails (bsc#1223498).\n- CVE-2022-48658: Fixed mm/slub to avoid a problem in flush_cpu_slab()/__free_slab() task context (bsc#1223496).\n- CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-\u003emac_header (bsc#1223513).\n- CVE-2022-48642: Fixed netfilter/nf_tables percpu memory leak at nf_tables_addchain() (bsc#1223478).\n- CVE-2022-48640: Fixed bonding for possible NULL pointer dereference in bond_rr_gen_slave_id (bsc#1223499).\n- CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth \u003e 0 (bsc#1223475).\n- CVE-2021-47214: Fixed hugetlb/userfaultfd during restore reservation in hugetlb_mcopy_atomic_pte() (bsc#1222710).\n- CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions (bsc#1222878)\n- CVE-2021-47200: Fixed drm/prime for possible use-after-free in mmap within drm_gem_ttm_mmap() and drm_gem_ttm_mmap() (bsc#1222838).\n- CVE-2021-47195: Fixed use-after-free inside SPI via add_lock mutex (bsc#1222832).\n- CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).\n- CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).\n- CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()  (bsc#1222660).\n\nThe following non-security bugs were fixed:\n\n- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).\n- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).\n- ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).\n- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).\n- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).\n- ALSA: scarlett2: Add correct product series name to messages (stable-fixes).\n- ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).\n- ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).\n- ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).\n- ASoC: meson: axg-card: make links nonatomic (git-fixes).\n- ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).\n- ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).\n- ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).\n- ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).\n- ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).\n- Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes).\n- Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).\n- Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).\n- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).\n- Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: add quirk for broken address properties (git-fixes).\n- Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).\n- Bluetooth: btintel: Fixe build regression (git-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).\n- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).\n- Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).\n- Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).\n- Documentation: Add missing documentation for EXPORT_OP flags (stable-fixes).\n- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev-\u003edevc (git-fixes).\n- HID: logitech-dj: allow mice to use all types of reports (git-fixes).\n- HID: uhid: Use READ_ONCE()/WRITE_ONCE() for -\u003erunning (stable-fixes).\n- Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).\n- NFC: trf7970a: disable all regulators on removal (git-fixes).\n- NFS: avoid spurious warning of lost lock that is being unlocked (bsc#1221791).\n- PCI/AER: Block runtime suspend when handling errors (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports (git-fixes).\n- PCI/DPC: Quirk PIO log size for certain Intel Root Ports (git-fixes).\n- PCI/PM: Drain runtime-idle callbacks before driver removal (git-fixes).\n- PCI: Drop pci_device_remove() test of pci_dev-\u003edriver (git-fixes).\n- PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).\n- RAS: Avoid build errors when CONFIG_DEBUG_FS=n (jsc#PED-7619).\n- RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes).\n- RDMA/cm: add timeout to cm_destroy_id wait (git-fixes)\n- Reapply 'drm/qxl: simplify qxl_fence_wait' (stable-fixes).\n- Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).\n- Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).\n- Revert 'ice: Fix ice VF reset during iavf initialization (jsc#PED-376).' (bsc#1223275) \n- Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).\n- Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).\n- USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).\n- USB: serial: add device ID for VeriFone adapter (stable-fixes).\n- USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).\n- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).\n- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).\n- USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).\n- USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).\n- USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).\n- USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).\n- USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).\n- USB: serial: option: support Quectel EM060K sub-models (stable-fixes).\n- ahci: asm1064: asm1166: do not limit reported ports (git-fixes).\n- ahci: asm1064: correct count of reported ports (stable-fixes).\n- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)\n- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)\n- arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)\n- arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).\n- ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).\n- batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).\n- bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).\n- bcache: Remove dead references to cache_readaheads (git-fixes).\n- bcache: Remove unnecessary NULL point check in node allocations (git-fixes).\n- bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).\n- bcache: avoid NULL checking to c-\u003eroot in run_cache_set() (git-fixes).\n- bcache: avoid oversize memory allocation by small stripe_size (git-fixes).\n- bcache: bset: Fix comment typos (git-fixes).\n- bcache: check return value from btree_node_alloc_replacement() (git-fixes).\n- bcache: fix NULL pointer reference in cached_dev_detach_finish (git-fixes).\n- bcache: fix error info in register_bcache() (git-fixes).\n- bcache: fixup bcache_dev_sectors_dirty_add() multithreaded CPU false sharing (git-fixes).\n- bcache: fixup btree_cache_wait list damage (git-fixes).\n- bcache: fixup init dirty data errors (git-fixes).\n- bcache: fixup lock c-\u003eroot error (git-fixes).\n- bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race (git-fixes).\n- bcache: move calc_cached_dev_sectors to proper place on backing device detach (git-fixes).\n- bcache: move uapi header bcache.h to bcache code directory (git-fixes).\n- bcache: prevent potential division by zero error (git-fixes).\n- bcache: remove EXPERIMENTAL for Kconfig option 'Asynchronous device registration' (git-fixes).\n- bcache: remove redundant assignment to variable cur_idx (git-fixes).\n- bcache: remove the backing_dev_name field from struct cached_dev (git-fixes).\n- bcache: remove the cache_dev_name field from struct cache (git-fixes).\n- bcache: remove unnecessary flush_workqueue (git-fixes).\n- bcache: remove unused bch_mark_cache_readahead function def in stats.h (git-fixes).\n- bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).\n- bcache: replace snprintf in show functions with sysfs_emit (git-fixes).\n- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).\n- bcache: use bvec_kmap_local in bch_data_verify (git-fixes).\n- bcache: use bvec_kmap_local in bio_csum (git-fixes).\n- bcache: use default_groups in kobj_type (git-fixes).\n- bcache:: fix repeated words in comments (git-fixes).\n- ceph: stop copying to iter at EOF on sync reads (bsc#1223068).\n- ceph: switch to corrected encoding of max_xattr_size in mdsmap (bsc#1223067).\n- clk: Get runtime PM before walking tree during disable_unused (git-fixes).\n- clk: Initialize struct clk_core kref earlier (stable-fixes).\n- clk: Mark 'all_lists' as const (stable-fixes).\n- clk: Print an info line before disabling unused clocks (stable-fixes).\n- clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).\n- clk: remove extra empty line (stable-fixes).\n- comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).\n- dm cache policy smq: ensure IO does not prevent cleaner policy progress (git-fixes).\n- dm cache: add cond_resched() to various workqueue loops (git-fixes).\n- dm clone: call kmem_cache_destroy() in dm_clone_init() error path (git-fixes).\n- dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).\n- dm crypt: avoid accessing uninitialized tasklet (git-fixes).\n- dm flakey: do not corrupt the zero page (git-fixes).\n- dm flakey: fix a bug with 32-bit highmem systems (git-fixes).\n- dm flakey: fix a crash with invalid table line (git-fixes).\n- dm flakey: fix logic when corrupting a bio (git-fixes).\n- dm init: add dm-mod.waitfor to wait for asynchronously probed block devices (git-fixes).\n- dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (git-fixes).\n- dm integrity: fix out-of-range warning (git-fixes).\n- dm integrity: reduce vmalloc space footprint on 32-bit architectures (git-fixes).\n- dm raid: clean up four equivalent goto tags in raid_ctr() (git-fixes).\n- dm raid: fix false positive for requeue needed during reshape (git-fixes).\n- dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (git-fixes).\n- dm stats: check for and propagate alloc_percpu failure (git-fixes).\n- dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client (git-fixes).\n- dm thin metadata: check fail_io before using data_sm (git-fixes).\n- dm thin: add cond_resched() to various workqueue loops (git-fixes).\n- dm thin: fix deadlock when swapping to thin device (bsc#1177529).\n- dm verity: do not perform FEC for failed readahead IO (git-fixes).\n- dm verity: fix error handling for check_at_most_once on FEC (git-fixes).\n- dm zoned: free dmz-\u003eddev array in dmz_put_zoned_devices (git-fixes).\n- dm-delay: fix a race between delay_presuspend and delay_bio (git-fixes).\n- dm-integrity: do not modify bio's immutable bio_vec in integrity_metadata() (git-fixes).\n- dm-raid: fix lockdep waring in 'pers-\u003ehot_add_disk' (git-fixes).\n- dm-verity, dm-crypt: align 'struct bvec_iter' correctly (git-fixes).\n- dm-verity: align struct dm_verity_fec_io properly (git-fixes).\n- dm: add cond_resched() to dm_wq_work() (git-fixes).\n- dm: call the resume method on internal suspend (git-fixes).\n- dm: do not lock fs when the map is NULL during suspend or resume (git-fixes).\n- dm: do not lock fs when the map is NULL in process of resume (git-fixes).\n- dm: remove flush_scheduled_work() during local_exit() (git-fixes).\n- dm: send just one event on resize, not two (git-fixes).\n- dma: xilinx_dpdma: Fix locking (git-fixes).\n- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).\n- dmaengine: owl: fix register access functions (git-fixes).\n- dmaengine: tegra186: Fix residual calculation (git-fixes).\n- docs: Document the FAN_FS_ERROR event (stable-fixes).\n- drm-print: add drm_dbg_driver to improve namespace symmetry (stable-fixes).\n- drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).\n- drm/amd/display: Fix nanosec stat overflow (stable-fixes).\n- drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).\n- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).\n- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).\n- drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).\n- drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).\n- drm/amdgpu: always force full reset for SOC21 (stable-fixes).\n- drm/amdgpu: fix incorrect active rb bitmap for gfx11 (stable-fixes).\n- drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).\n- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).\n- drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).\n- drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).\n- drm/ast: Fix soft lockup (git-fixes).\n- drm/client: Fully protect modes[] with dev-\u003emode_config.mutex (stable-fixes).\n- drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).\n- drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).\n- drm/i915: Disable port sync when bigjoiner is used (stable-fixes).\n- drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).\n- drm/nouveau/nvkm: add a replacement for nvkm_notify (bsc#1223834)\n- drm/panel: ili9341: Respect deferred probe (git-fixes).\n- drm/panel: ili9341: Use predefined error codes (git-fixes).\n- drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).\n- drm/vc4: do not check if plane-\u003estate-\u003efb == state-\u003efb (stable-fixes).\n- drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).\n- drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).\n- drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).\n- drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).\n- drm: nv04: Fix out of bounds access (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go (stable-fixes).\n- dump_stack: Do not get cpu_sync for panic CPU (bsc#1223574).\n- fbdev: fix incorrect address computation in deferred IO (git-fixes).\n- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).\n- fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).\n- fix build warning\n- fuse: do not unhash root (bsc#1223951).\n- fuse: fix root lookup with nonzero generation (bsc#1223950).\n- hwmon: (amc6821) add of_match table (stable-fixes).\n- i2c: pxa: hide unused icr_bits[] variable (git-fixes).\n- i2c: smbus: fix NULL function pointer dereference (git-fixes).\n- i40e: Fix VF MAC filter removal (git-fixes).\n- idma64: Do not try to serve interrupts when device is powered off (git-fixes).\n- iio: accel: mxc4005: Interrupt handling fixes (git-fixes).\n- iio:imu: adis16475: Fix sync mode setting (git-fixes).\n- init/main.c: Fix potential static_command_line memory overflow (git-fixes).\n- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (git-fixes).\n- iommu/amd: Fix 'Guest Virtual APIC Table Root Pointer' configuration in IRTE (git-fixes).\n- iommu/amd: Fix domain flush size when syncing iotlb (git-fixes).\n- iommu/amd: Fix error handling for pdev_pri_ats_enable() (git-fixes).\n- iommu/arm-smmu-qcom: Limit the SMR groups to 128 (git-fixes).\n- iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any (git-fixes).\n- iommu/fsl: fix all kernel-doc warnings in fsl_pamu.c (git-fixes).\n- iommu/iova: Fix alloc iova overflows issue (git-fixes).\n- iommu/mediatek: Flush IOTLB completely only if domain has been attached (git-fixes).\n- iommu/rockchip: Fix unwind goto issue (git-fixes).\n- iommu/sprd: Release dma buffer to avoid memory leak (git-fixes).\n- iommu/vt-d: Allocate local memory for page request queue (git-fixes).\n- iommu/vt-d: Allow zero SAGAW if second-stage not supported (git-fixes).\n- iommu/vt-d: Fix error handling in sva enable/disable paths (git-fixes).\n- iommu: Fix error unwind in iommu_group_alloc() (git-fixes).\n- ipv6/addrconf: fix a potential refcount underflow for idev (git-fixes).\n- kABI: Adjust trace_iterator.wait_index (git-fixes).\n- kprobes: Fix double free of kretprobe_holder (bsc#1220901).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value (git-fixes).\n- libnvdimm/region: Allow setting align attribute on regions without mappings (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- md/raid1: fix choose next idle in read_balance() (git-fixes).\n- md: Do not clear MD_CLOSING when the raid is about to stop (git-fixes).\n- md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (git-fixes).\n- media: cec: core: remove length check of Timer Status (stable-fixes).\n- media: sta2x11: fix irq handler cast (stable-fixes).\n- mei: me: add arrow lake point H DID (stable-fixes).\n- mei: me: add arrow lake point S DID (stable-fixes).\n- mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).\n- mm/vmscan: make sure wakeup_kswapd with managed zone (bsc#1223473).\n- mmc: sdhci-msm: pervent access to suspended controller (git-fixes).\n- mtd: diskonchip: work around ubsan link failure (stable-fixes).\n- nd_btt: Make BTT lanes preemptible (git-fixes).\n- net: bridge: vlan: fix memory leak in __allowed_ingress (git-fixes).\n- net: fix a memleak when uncloning an skb dst and its metadata (git-fixes).\n- net: fix skb leak in __skb_tstamp_tx() (git-fixes).\n- net: ipv6: ensure we call ipv6_mc_down() at most once (git-fixes).\n- net: mld: fix reference count leak in mld_{query | report}_work() (git-fixes).\n- net: stream: purge sk_error_queue in sk_stream_kill_queues() (git-fixes).\n- net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).\n- net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: vlan: fix underflow for the real_dev refcnt (git-fixes).\n- netfilter: br_netfilter: Drop dst references before setting (git-fixes).\n- netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() (git-fixes).\n- netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).\n- nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nouveau: fix function cast warning (git-fixes).\n- nouveau: fix instmem race condition around ptr stores (git-fixes).\n- nvdimm/namespace: drop nested variable in create_namespace_pmem() (git-fixes).\n- nvdimm: Allow overwrite in the presence of disabled dimms (git-fixes).\n- nvdimm: Fix badblocks clear off-by-one error (git-fixes).\n- nvdimm: Fix dereference after free in register_nvdimm_pmu() (git-fixes).\n- nvdimm: Fix firmware activation deadlock scenarios (git-fixes).\n- nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() (git-fixes).\n- pci_iounmap(): Fix MMIO mapping leak (git-fixes).\n- phy: tegra: xusb: Add API to retrieve the port number of phy (stable-fixes).\n- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).\n- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/pseries/iommu: LPAR panics when rebooted with a frozen PE (bsc#1222011 ltc#205900).\n- powerpc/rtas: define pr_fmt and convert printk call sites (bsc#1223369 ltc#205888).\n- powerpc/rtas: export rtas_error_rc() for reuse (bsc#1223369 ltc#205888).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n- printk: Add this_cpu_in_panic() (bsc#1223574).\n- printk: Adjust mapping for 32bit seq macros (bsc#1223574).\n- printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1223574).\n- printk: Disable passing console lock owner completely during panic() (bsc#1223574).\n- printk: Drop console_sem during panic (bsc#1223574).\n- printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1223574).\n- printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1223574).\n- printk: Wait for all reserved records with pr_flush() (bsc#1223574).\n- printk: nbcon: Relocate 32bit seq macros (bsc#1223574).\n- printk: ringbuffer: Clarify special lpos values (bsc#1223574).\n- printk: ringbuffer: Cleanup reader terminology (bsc#1223574).\n- printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1223574).\n- printk: ringbuffer: Improve prb_next_seq() performance (bsc#1223574).\n- printk: ringbuffer: Skip non-finalized records in panic (bsc#1223574).\n- pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).\n- ring-buffer: Do not set shortest_full when full target is hit (git-fixes).\n- ring-buffer: Fix full_waiters_pending in poll (git-fixes).\n- ring-buffer: Fix resetting of shortest_full (git-fixes).\n- ring-buffer: Fix waking up ring buffer readers (git-fixes).\n- ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).\n- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).\n- ring-buffer: use READ_ONCE() to read cpu_buffer-\u003ecommit_page in concurrent environment (git-fixes).\n- s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223875).\n- s390/decompressor: fix misaligned symbol build error (git-fixes bsc#1223785).\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223877).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223878).\n- s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223879).\n- s390/scm: fix virtual vs physical address confusion (git-fixes bsc#1223784).\n- s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223876).\n- s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223598).\n- s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223595).\n- serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).\n- serial: core: Provide port lock wrappers (stable-fixes).\n- serial: core: fix kernel-doc for uart_port_unlock_irqrestore() (git-fixes).\n- serial: mxs-auart: add spinlock around changing cts state (git-fixes).\n- slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).\n- speakup: Avoid crash on very long word (git-fixes).\n- speakup: Fix 8bit characters from direct synth (git-fixes).\n- tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp (git-fixes).\n- thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).\n- thunderbolt: Fix wake configurations after device unplug (stable-fixes).\n- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).\n- tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).\n- tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).\n- tracing: Remove precision vsnprintf() check from print event (git-fixes).\n- tracing: Show size of requested perf buffer (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- usb: Disable USB3 LPM at shutdown (stable-fixes).\n- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (git-fixes).\n- usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).\n- usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).\n- usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).\n- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).\n- usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic (git-fixes).\n- usb: ohci: Prevent missed ohci interrupts (git-fixes).\n- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).\n- usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).\n- usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).\n- usb: typec: tcpm: unregister existing source caps before re-registration (bsc#1220569).\n- usb: typec: ucsi: Ack unsupported commands (stable-fixes).\n- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).\n- usb: typec: ucsi: Fix connector check on init (git-fixes).\n- usb: udc: remove warning when queue disabled ep (stable-fixes).\n- vdpa/mlx5: Allow CVQ size changes (git-fixes).\n- virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223949).\n- wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).\n- wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).\n- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).\n- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).\n- wifi: nl80211: do not free NULL coalescing rule (git-fixes).\n- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).\n- x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (jsc#PED-7167 git-fixes).\n- x86/sev: Skip ROM range scans and validation for SEV-SNP guests (jsc#PED-7167 git-fixes).\n- x86/xen: Add some null pointer checking to smp.c (git-fixes).\n- x86/xen: add CPU dependencies for 32-bit build (git-fixes).\n- x86/xen: fix percpu vcpu_info allocation (git-fixes).\n- xen-netback: properly sync TX responses (git-fixes).\n- xen-netfront: Add missing skb_mark_for_recycle (git-fixes).\n- xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import (git-fixes).\n- xen/xenbus: document will_handle argument for xenbus_watch_path() (git-fixes).\n- xfrm6: fix inet6_dev refcount underflow problem (git-fixes).\n","status":"published","published":"2024-05-15T09:29:37Z","modified":"2025-05-02T04:32:07.647787Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1663-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 Real Time kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-27389: Fixed pstore inode handling with d_invalidate() (bsc#1223705).\n- CVE-2024-27062: Fixed nouveau lock inside client object tree (bsc#1223834).\n- CVE-2024-27056: Fixed wifi/iwlwifi/mvm to ensure offloading TID queue exists (bsc#1223822).\n- CVE-2024-27046: Fixed nfp/flower handling acti_netdevs allocation failure (bsc#1223827).\n- CVE-2024-27043: Fixed a use-after-free in edia/dvbdev in different places (bsc#1223824).\n- CVE-2024-27041: Fixed drm/amd/display NULL checks for adev-\u003edm.dc in amdgpu_dm_fini() (bsc#1223714).\n- CVE-2024-27039: Fixed clk/hisilicon/hi3559a an erroneous devm_kfree() (bsc#1223821).\n- CVE-2024-27038: Fixed clk_core_get NULL pointer dereference (bsc#1223816).\n- CVE-2024-27030: Fixed octeontx2-af to use separate handlers for interrupts (bsc#1223790).\n- CVE-2024-27014: Fixed net/mlx5e to prevent deadlock while disabling aRFS (bsc#1223735).\n- CVE-2024-27013: Fixed tun limit printing rate when illegal packet received by tun device (bsc#1223745).\n- CVE-2024-26993: Fixed fs/sysfs reference leak in sysfs_break_active_protection() (bsc#1223693).\n- CVE-2024-26982: Fixed Squashfs inode number check not to be an invalid value of zero (bsc#1223634).\n- CVE-2024-26970: Fixed clk/qcom/gcc-ipq6018 termination of frequency table arrays (bsc#1223644).\n- CVE-2024-26969: Fixed clk/qcom/gcc-ipq8074 termination of frequency table arrays (bsc#1223645).\n- CVE-2024-26966: Fixed clk/qcom/mmcc-apq8084 termination of frequency table arrays (bsc#1223646).\n- CVE-2024-26965: Fixed clk/qcom/mmcc-msm8974 termination of frequency table arrays (bsc#1223648).\n- CVE-2024-26960: Fixed mm/swap race between free_swap_and_cache() and swapoff() (bsc#1223655).\n- CVE-2024-26951: Fixed wireguard/netlink check for dangling peer via is_dead instead of empty list (bsc#1223660).\n- CVE-2024-26950: Fixed wireguard/netlink to access device through ctx instead of peer (bsc#1223661).\n- CVE-2024-26948: Fixed drm/amd/display by adding dc_state NULL check in dc_state_release (bsc#1223664).\n- CVE-2024-26927: Fixed ASoC/SOF bounds checking to firmware data Smatch (bsc#1223525).\n- CVE-2024-26901: Fixed do_sys_name_to_handle() to use kzalloc() to prevent kernel-infoleak (bsc#1223198).\n- CVE-2024-26896: Fixed wifi/wfx memory leak when starting AP (bsc#1223042).\n- CVE-2024-26893: Fixed firmware/arm_scmi for possible double free in SMC transport cleanup path (bsc#1223196).\n- CVE-2024-26885: Fixed bpf DEVMAP_HASH overflow check on 32-bit arches (bsc#1223190).\n- CVE-2024-26884: Fixed bpf hashtab overflow check on 32-bit arches (bsc#1223189).\n- CVE-2024-26883: Fixed bpf stackmap overflow check on 32-bit arches (bsc#1223035).\n- CVE-2024-26882: Fixed net/ip_tunnel to make sure to pull inner header in ip_tunnel_rcv() (bsc#1223034).\n- CVE-2024-26881: Fixed net/hns3 kernel crash when 1588 is received on HIP08 devices (bsc#1223041).\n- CVE-2024-26879: Fixed clk/meson by adding missing clocks to axg_clk_regmaps (bsc#1223066).\n- CVE-2024-26878: Fixed quota for potential NULL pointer dereference (bsc#1223060).\n- CVE-2024-26866: Fixed spi/spi-fsl-lpspi by removing redundant spi_controller_put call (bsc#1223024).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-26861: Fixed wireguard/receive annotate data-race around receiving_counter.counter (bsc#1223076).\n- CVE-2024-26857: Fixed geneve to make sure to pull inner header in geneve_rx() (bsc#1223058).\n- CVE-2024-26856: Fixed use-after-free inside sparx5_del_mact_entry (bsc#1223052).\n- CVE-2024-26855: Fixed net/ice potential NULL pointer dereference in ice_bridge_setlink() (bsc#1223051).\n- CVE-2024-26853: Fixed igc returning frame twice in XDP_REDIRECT (bsc#1223061).\n- CVE-2024-26852: Fixed net/ipv6 to avoid possible UAF in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26848: Fixed afs endless loop in directory parsing (bsc#1223030).\n- CVE-2024-26836: Fixed platform/x86/think-lmi password opcode ordering for workstations (bsc#1222968).\n- CVE-2024-26830: Fixed i40e to not allow untrusted VF to remove administratively set MAC (bsc#1223012).\n- CVE-2024-26817: Fixed amdkfd to use calloc instead of kzalloc to avoid integer overflow (bsc#1222812).\n- CVE-2024-26816: Fixed relocations in .notes section when building with CONFIG_XEN_PV=y by ignoring them (bsc#1222624).\n- CVE-2024-26807: Fixed spi/cadence-qspi NULL pointer reference in runtime PM hooks (bsc#1222801).\n- CVE-2024-26805: Fixed a kernel-infoleak-after-free in __skb_datagram_iter in netlink  (bsc#1222630).\n- CVE-2024-26793: Fixed an use-after-free and null-ptr-deref in gtp_newlink() in gtp  (bsc#1222428).\n- CVE-2024-26783: Fixed mm/vmscan bug when calling wakeup_kswapd() with a wrong zone index (bsc#1222615).\n- CVE-2024-26779: Fixed a race condition on enabling fast-xmit in mac80211 (bsc#1222772).\n- CVE-2024-26773: Fixed ext4 block allocation from corrupted group in ext4_mb_try_best_found() (bsc#1222618).\n- CVE-2024-26772: Fixed ext4 to avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (bsc#1222613).\n- CVE-2024-26771: Fixed a null pointer dereference on edma_probe in dmaengine ti edma  (bsc#1222610)\n- CVE-2024-26766: Fixed SDMA off-by-one error in _pad_sdma_tx_descs() (bsc#1222726).\n- CVE-2024-26764: Fixed IOCB_AIO_RW check in fs/aio before the struct aio_kiocb conversion (bsc#1222721).\n- CVE-2024-26763: Fixed user corruption via by writing data with O_DIRECT on device in dm-crypt (bsc#1222720).\n- CVE-2024-26760: Fixed scsi/target/pscsi bio_put() for error case (bsc#1222596).\n- CVE-2024-267600: Fixed scsi/target/pscsi error case in bio_put() (bsc#1222596).\n- CVE-2024-26754: Fixed an use-after-free and null-ptr-deref in gtp_genl_dump_pdp() in gtp  (bsc#1222632).\n- CVE-2024-26751: Fixed ARM/ep93xx terminator to gpiod_lookup_table (bsc#1222724).\n- CVE-2024-26747: Fixed a NULL pointer issue with USB parent module's reference (bsc#1222609).\n- CVE-2024-26744: Fixed null pointer dereference in srpt_service_guid parameter in rdma/srpt (bsc#1222449).\n- CVE-2024-26743: Fixed memory leak in qedr_create_user_qp error flow in rdma/qedr (bsc#1222677).\n- CVE-2024-26737: Fixed selftests/bpf racing between bpf_timer_cancel_and_free and bpf_timer_cancel (bsc#1222557).\n- CVE-2024-26733: Fixed an overflow in arp_req_get() in arp (bsc#1222585).\n- CVE-2024-26727: Fixed assertion if a newly created btrfs subvolume already gets read (bsc#1222536).\n- CVE-2024-26718: Fixed dm-crypt/dm-verity disable tasklets (bsc#1222416).\n- CVE-2024-26704: Fixed a double-free of blocks due to wrong extents moved_len in ext4 (bsc#1222422).\n- CVE-2024-26696: Fixed nilfs2 hang in nilfs_lookup_dirty_data_buffers() (bsc#1222549).\n- CVE-2024-26689: Fixed a use-after-free in encode_cap_msg() (bsc#1222503).\n- CVE-2024-26687: Fixed xen/events close evtchn after mapping cleanup (bsc#1222435).\n- CVE-2024-26685: Fixed nilfs2 potential bug in end_buffer_async_write (bsc#1222437).\n- CVE-2024-26684: Fixed net/stmmac/xgmac handling of DPP safety error for DMA channels (bsc#1222445).\n- CVE-2024-26681: Fixed netdevsim to avoid potential loop in nsim_dev_trap_report_work() (bsc#1222431).\n- CVE-2024-26680: Fixed net/atlantic DMA mapping for PTP hwts ring (bsc#1222427).\n- CVE-2024-26675: Fixed ppp_async to limit MRU to 64K (bsc#1222379).\n- CVE-2024-26673: Fixed netfilter/nft_ct layer 3 and 4 protocol sanitization (bsc#1222368).\n- CVE-2024-26671: Fixed blk-mq IO hang from sbitmap wakeup race (bsc#1222357).\n- CVE-2024-26660: Fixed drm/amd/display bounds check for stream encoder creation (bsc#1222266).\n- CVE-2024-26656: Fixed drm/amdgpu use-after-free bug (bsc#1222307).\n- CVE-2024-26610: Fixed memory corruption in wifi/iwlwifi (bsc#1221299).\n- CVE-2024-26601: Fixed ext4 buddy bitmap corruption via fast commit replay (bsc#1220342).\n- CVE-2024-23850: Fixed double free of anonymous device after snapshot  creation failure (bsc#1219126).\n- CVE-2024-23848: Fixed media/cec for possible use-after-free in cec_queue_msg_fh (bsc#1219104).\n- CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169).\n- CVE-2024-22099: Fixed a null-pointer-dereference in rfcomm_check_security (bsc#1219170).\n- CVE-2024-0841: Fixed a null pointer dereference in the hugetlbfs_fill_super function in hugetlbfs (HugeTLB pages) functionality (bsc#1219264).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2023-6270: Fixed a use-after-free issue in aoecmd_cfg_pkts (bsc#1218562).\n- CVE-2023-52652: Fixed NTB for possible name leak in ntb_register_device() (bsc#1223686).\n- CVE-2023-52645: Fixed pmdomain/mediatek race conditions with genpd (bsc#1223033).\n- CVE-2023-52636: Fixed libceph cursor init when preparing sparse read in msgr2 (bsc#1222247).\n- CVE-2023-52635: Fixed PM/devfreq to synchronize devfreq_monitor_[start/stop] (bsc#1222294).\n- CVE-2023-52627: Fixed iio:adc:ad7091r exports into IIO_AD7091R namespace (bsc#1222051).\n- CVE-2023-52620: Fixed netfilter/nf_tables to disallow timeout for anonymous sets never used from userspace (bsc#1221825).\n- CVE-2023-52616: Fixed unexpected pointer access in crypto/lib/mpi in mpi_ec_init (bsc#1221612).\n- CVE-2023-52614: Fixed PM/devfreq buffer overflow in trans_stat_show (bsc#1221617).\n- CVE-2023-52593: Fixed wifi/wfx possible NULL pointer dereference in wfx_set_mfp_ap() (bsc#1221042).\n- CVE-2023-52591: Fixed a possible reiserfs filesystem corruption via directory renaming (bsc#1221044).\n- CVE-2023-52590: Fixed a possible ocfs2 filesystem corruption via directory renaming (bsc#1221088).\n- CVE-2023-52589: Fixed media/rkisp1 IRQ disable race issue (bsc#1221084).\n- CVE-2023-52585: Fixed drm/amdgpu for possible NULL pointer dereference in amdgpu_ras_query_error_status_helper() (bsc#1221080).\n- CVE-2023-52561: Fixed arm64/dts/qcom/sdm845-db845c to mark cont splash memory region (bsc#1220935).\n- CVE-2023-52503: Fixed tee/amdtee use-after-free vulnerability in amdtee_close_session (bsc#1220915).\n- CVE-2023-52488: Fixed serial/sc16is7xx convert from _raw_ to _noinc_ regmap functions for FIFO (bsc#1221162).\n- CVE-2022-48701: Fixed an out-of-bounds bug in __snd_usb_parse_audio_interface() (bsc#1223921).\n- CVE-2022-48662: Fixed a general protection fault (GPF) in i915_perf_open_ioctl (bsc#1223505).\n- CVE-2022-48659: Fixed mm/slub to return errno if kmalloc() fails (bsc#1223498).\n- CVE-2022-48658: Fixed mm/slub to avoid a problem in flush_cpu_slab()/__free_slab() task context (bsc#1223496).\n- CVE-2022-48651: Fixed an out-of-bound bug in ipvlan caused by unset skb-\u003emac_header (bsc#1223513).\n- CVE-2022-48642: Fixed netfilter/nf_tables percpu memory leak at nf_tables_addchain() (bsc#1223478).\n- CVE-2022-48640: Fixed bonding for possible NULL pointer dereference in bond_rr_gen_slave_id (bsc#1223499).\n- CVE-2022-48631: Fixed a bug in ext4, when parsing extents where eh_entries == 0 and eh_depth \u003e 0 (bsc#1223475).\n- CVE-2021-47214: Fixed hugetlb/userfaultfd during restore reservation in hugetlb_mcopy_atomic_pte() (bsc#1222710).\n- CVE-2021-47211: Fixed a null pointer dereference on pointer cs_desc in usb-audio (bsc#1222869).\n- CVE-2021-47207: Fixed a null pointer dereference on pointer block in gus (bsc#1222790).\n- CVE-2021-47205: Unregistered clocks/resets when unbinding in sunxi-ng (bsc#1222888).\n- CVE-2021-47202: Fixed NULL pointer dereferences in of_thermal_ functions (bsc#1222878)\n- CVE-2021-47200: Fixed drm/prime for possible use-after-free in mmap within drm_gem_ttm_mmap() and drm_gem_ttm_mmap() (bsc#1222838).\n- CVE-2021-47195: Fixed use-after-free inside SPI via add_lock mutex (bsc#1222832).\n- CVE-2021-47189: Fixed denial of service due to memory ordering issues between normal and ordered work functions in btrfs (bsc#1222706).\n- CVE-2021-47185: Fixed a softlockup issue in flush_to_ldisc in tty tty_buffer (bsc#1222669).\n- CVE-2021-47184: Fixed NULL pointer dereference on VSI filter sync (bsc#1222666).\n- CVE-2021-47183: Fixed a null pointer dereference during link down processing in scsi lpfc (bsc#1192145, bsc#1222664).\n- CVE-2021-47182: Fixed scsi_mode_sense() buffer length handling (bsc#1222662).\n- CVE-2021-47181: Fixed a null pointer dereference caused by calling platform_get_resource()  (bsc#1222660).\n\nThe following non-security bugs were fixed:\n\n- ALSA: firewire-lib: handle quirk to calculate payload quadlets as data block counter (stable-fixes).\n- ALSA: hda/realtek - Enable audio jacks of Haier Boyue G42 with ALC269VC (stable-fixes).\n- ALSA: hda/realtek - Fix inactive headset mic jack (stable-fixes).\n- ALSA: hda/realtek: Add quirk for HP SnowWhite laptops (stable-fixes).\n- ALSA: hda/realtek: Fix mute led of HP Laptop 15-da3001TU (stable-fixes).\n- ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() (git-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett 2Pre and 4Pre USB support (stable-fixes).\n- ALSA: scarlett2: Add Focusrite Clarett+ 2Pre and 4Pre support (stable-fixes).\n- ALSA: scarlett2: Add correct product series name to messages (stable-fixes).\n- ALSA: scarlett2: Add support for Clarett 8Pre USB (stable-fixes).\n- ALSA: scarlett2: Default mixer driver to enabled (stable-fixes).\n- ALSA: scarlett2: Move USB IDs out from device_info struct (stable-fixes).\n- ASoC: meson: axg-card: make links nonatomic (git-fixes).\n- ASoC: meson: axg-tdm-interface: manage formatters in trigger (git-fixes).\n- ASoC: meson: cards: select SND_DYNAMIC_MINORS (git-fixes).\n- ASoC: soc-core.c: Skip dummy codec when adding platforms (stable-fixes).\n- ASoC: tegra: Fix DSPK 16-bit playback (git-fixes).\n- ASoC: ti: davinci-mcasp: Fix race condition during probe (git-fixes).\n- Bluetooth: Add new quirk for broken read key length on ATS2851 (git-fixes).\n- Bluetooth: Fix TOCTOU in HCI debugfs implementation (git-fixes).\n- Bluetooth: Fix memory leak in hci_req_sync_complete() (git-fixes).\n- Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() (stable-fixes).\n- Bluetooth: L2CAP: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: RFCOMM: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: SCO: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: add quirk for broken address properties (git-fixes).\n- Bluetooth: btintel: Fix null ptr deref in btintel_read_version (stable-fixes).\n- Bluetooth: btintel: Fixe build regression (git-fixes).\n- Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 (stable-fixes).\n- Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE (git-fixes).\n- Bluetooth: hci_event: set the conn encrypted before conn establishes (stable-fixes).\n- Bluetooth: hci_sock: Fix not validating setsockopt user input (git-fixes).\n- Bluetooth: qca: fix NULL-deref on non-serdev suspend (git-fixes).\n- Documentation: Add missing documentation for EXPORT_OP flags (stable-fixes).\n- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev-\u003edevc (git-fixes).\n- HID: logitech-dj: allow mice to use all types of reports (git-fixes).\n- HID: uhid: Use READ_ONCE()/WRITE_ONCE() for -\u003erunning (stable-fixes).\n- Input: allocate keycode for Display refresh rate toggle (stable-fixes).\n- Input: synaptics-rmi4 - fail probing if memory allocation for 'phys' fails (stable-fixes).\n- NFC: trf7970a: disable all regulators on removal (git-fixes).\n- NFS: avoid spurious warning of lost lock that is being unlocked (bsc#1221791).\n- PCI/AER: Block runtime suspend when handling errors (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Ice Lake Root Ports (git-fixes).\n- PCI/DPC: Quirk PIO log size for Intel Raptor Lake Root Ports (git-fixes).\n- PCI/DPC: Quirk PIO log size for certain Intel Root Ports (git-fixes).\n- PCI/PM: Drain runtime-idle callbacks before driver removal (git-fixes).\n- PCI: Drop pci_device_remove() test of pci_dev-\u003edriver (git-fixes).\n- PCI: rpaphp: Error out on busy status from get-sensor-state (bsc#1223369 ltc#205888).\n- RAS: Avoid build errors when CONFIG_DEBUG_FS=n (jsc#PED-7619).\n- RDMA/cm: Print the old state when cm_destroy_id gets timeout (git-fixes).\n- RDMA/cm: add timeout to cm_destroy_id wait (git-fixes)\n- README.BRANCH: Correct email address for Petr Tesarik\n- README.BRANCH: Remove copy of branch name\n- Reapply 'drm/qxl: simplify qxl_fence_wait' (stable-fixes).\n- Revert 'ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default' (stable-fixes).\n- Revert 'drm/qxl: simplify qxl_fence_wait' (git-fixes).\n- Revert 'ice: Fix ice VF reset during iavf initialization (jsc#PED-376).' (bsc#1223275)\n- Revert 'usb: cdc-wdm: close race between read and workqueue' (git-fixes).\n- Revert 'usb: phy: generic: Get the vbus supply' (git-fixes).\n- USB: UAS: return ENODEV when submit urbs fail with device not attached (stable-fixes).\n- USB: serial: add device ID for VeriFone adapter (stable-fixes).\n- USB: serial: cp210x: add ID for MGP Instruments PDS100 (stable-fixes).\n- USB: serial: cp210x: add pid/vid for TDK NC0110013M and MM0110113M (stable-fixes).\n- USB: serial: ftdi_sio: add support for GMC Z216C Adapter IR-USB (stable-fixes).\n- USB: serial: option: add Fibocom FM135-GL variants (stable-fixes).\n- USB: serial: option: add Lonsung U8300/U9300 product (stable-fixes).\n- USB: serial: option: add MeiG Smart SLM320 product (stable-fixes).\n- USB: serial: option: add Rolling RW101-GL and RW135-GL support (stable-fixes).\n- USB: serial: option: add Telit FN920C04 rmnet compositions (stable-fixes).\n- USB: serial: option: add support for Fibocom FM650/FG650 (stable-fixes).\n- USB: serial: option: support Quectel EM060K sub-models (stable-fixes).\n- ahci: asm1064: asm1166: do not limit reported ports (git-fixes).\n- ahci: asm1064: correct count of reported ports (stable-fixes).\n- arm64: dts: imx8-ss-conn: fix usdhc wrong lpcg clock order (git-fixes)\n- arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for (git-fixes)\n- arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 (git-fixes)\n- arm64: dts: rockchip: fix rk3328 hdmi ports node (git-fixes)\n- arm64: dts: rockchip: fix rk3399 hdmi ports node (git-fixes)\n- arm64: hibernate: Fix level3 translation fault in swsusp_save() (git-fixes).\n- ax25: fix use-after-free bugs caused by ax25_ds_del_timer (git-fixes).\n- batman-adv: Avoid infinite loop trying to resize local TT (git-fixes).\n- bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (git-fixes).\n- bcache: Remove dead references to cache_readaheads (git-fixes).\n- bcache: Remove unnecessary NULL point check in node allocations (git-fixes).\n- bcache: add code comments for bch_btree_node_get() and __bch_btree_node_alloc() (git-fixes).\n- bcache: avoid NULL checking to c-\u003eroot in run_cache_set() (git-fixes).\n- bcache: avoid oversize memory allocation by small stripe_size (git-fixes).\n- bcache: bset: Fix comment typos (git-fixes).\n- bcache: check return value from btree_node_alloc_replacement() (git-fixes).\n- bcache: fix NULL pointer reference in cached_dev_detach_finish (git-fixes).\n- bcache: fix error info in register_bcache() (git-fixes).\n- bcache: fixup bcache_dev_sectors_dirty_add() multithreaded CPU false sharing (git-fixes).\n- bcache: fixup btree_cache_wait list damage (git-fixes).\n- bcache: fixup init dirty data errors (git-fixes).\n- bcache: fixup lock c-\u003eroot error (git-fixes).\n- bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up race (git-fixes).\n- bcache: move calc_cached_dev_sectors to proper place on backing device detach (git-fixes).\n- bcache: move uapi header bcache.h to bcache code directory (git-fixes).\n- bcache: prevent potential division by zero error (git-fixes).\n- bcache: remove EXPERIMENTAL for Kconfig option 'Asynchronous device registration' (git-fixes).\n- bcache: remove redundant assignment to variable cur_idx (git-fixes).\n- bcache: remove the backing_dev_name field from struct cached_dev (git-fixes).\n- bcache: remove the cache_dev_name field from struct cache (git-fixes).\n- bcache: remove unnecessary flush_workqueue (git-fixes).\n- bcache: remove unused bch_mark_cache_readahead function def in stats.h (git-fixes).\n- bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in btree_gc_coalesce() (git-fixes).\n- bcache: replace snprintf in show functions with sysfs_emit (git-fixes).\n- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).\n- bcache: use bvec_kmap_local in bch_data_verify (git-fixes).\n- bcache: use bvec_kmap_local in bio_csum (git-fixes).\n- bcache: use default_groups in kobj_type (git-fixes).\n- bcache:: fix repeated words in comments (git-fixes).\n- ceph: stop copying to iter at EOF on sync reads (bsc#1223068).\n- ceph: switch to corrected encoding of max_xattr_size in mdsmap (bsc#1223067).\n- clk: Get runtime PM before walking tree during disable_unused (git-fixes).\n- clk: Initialize struct clk_core kref earlier (stable-fixes).\n- clk: Mark 'all_lists' as const (stable-fixes).\n- clk: Print an info line before disabling unused clocks (stable-fixes).\n- clk: Remove prepare_lock hold assertion in __clk_release() (git-fixes).\n- clk: remove extra empty line (stable-fixes).\n- comedi: vmk80xx: fix incomplete endpoint checking (git-fixes).\n- dm cache policy smq: ensure IO does not prevent cleaner policy progress (git-fixes).\n- dm cache: add cond_resched() to various workqueue loops (git-fixes).\n- dm clone: call kmem_cache_destroy() in dm_clone_init() error path (git-fixes).\n- dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).\n- dm crypt: avoid accessing uninitialized tasklet (git-fixes).\n- dm flakey: do not corrupt the zero page (git-fixes).\n- dm flakey: fix a bug with 32-bit highmem systems (git-fixes).\n- dm flakey: fix a crash with invalid table line (git-fixes).\n- dm flakey: fix logic when corrupting a bio (git-fixes).\n- dm init: add dm-mod.waitfor to wait for asynchronously probed block devices (git-fixes).\n- dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path (git-fixes).\n- dm integrity: fix out-of-range warning (git-fixes).\n- dm integrity: reduce vmalloc space footprint on 32-bit architectures (git-fixes).\n- dm raid: clean up four equivalent goto tags in raid_ctr() (git-fixes).\n- dm raid: fix false positive for requeue needed during reshape (git-fixes).\n- dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (git-fixes).\n- dm stats: check for and propagate alloc_percpu failure (git-fixes).\n- dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client (git-fixes).\n- dm thin metadata: check fail_io before using data_sm (git-fixes).\n- dm thin: add cond_resched() to various workqueue loops (git-fixes).\n- dm thin: fix deadlock when swapping to thin device (bsc#1177529).\n- dm verity: do not perform FEC for failed readahead IO (git-fixes).\n- dm verity: fix error handling for check_at_most_once on FEC (git-fixes).\n- dm zoned: free dmz-\u003eddev array in dmz_put_zoned_devices (git-fixes).\n- dm-delay: fix a race between delay_presuspend and delay_bio (git-fixes).\n- dm-integrity: do not modify bio's immutable bio_vec in integrity_metadata() (git-fixes).\n- dm-raid: fix lockdep waring in 'pers-\u003ehot_add_disk' (git-fixes).\n- dm-verity, dm-crypt: align 'struct bvec_iter' correctly (git-fixes).\n- dm-verity: align struct dm_verity_fec_io properly (git-fixes).\n- dm: add cond_resched() to dm_wq_work() (git-fixes).\n- dm: call the resume method on internal suspend (git-fixes).\n- dm: do not lock fs when the map is NULL during suspend or resume (git-fixes).\n- dm: do not lock fs when the map is NULL in process of resume (git-fixes).\n- dm: remove flush_scheduled_work() during local_exit() (git-fixes).\n- dm: send just one event on resize, not two (git-fixes).\n- dma: xilinx_dpdma: Fix locking (git-fixes).\n- dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (git-fixes).\n- dmaengine: owl: fix register access functions (git-fixes).\n- dmaengine: tegra186: Fix residual calculation (git-fixes).\n- docs: Document the FAN_FS_ERROR event (stable-fixes).\n- drm-print: add drm_dbg_driver to improve namespace symmetry (stable-fixes).\n- drm/amd/display: Do not recursively call manual trigger programming (stable-fixes).\n- drm/amd/display: Fix nanosec stat overflow (stable-fixes).\n- drm/amd/display: fix disable otg wa logic in DCN316 (stable-fixes).\n- drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11 (stable-fixes).\n- drm/amdgpu/sdma5.2: use legacy HDP flush for SDMA2/3 (stable-fixes).\n- drm/amdgpu: Fix leak when GPU memory allocation fails (stable-fixes).\n- drm/amdgpu: Reset dGPU if suspend got aborted (stable-fixes).\n- drm/amdgpu: always force full reset for SOC21 (stable-fixes).\n- drm/amdgpu: fix incorrect active rb bitmap for gfx11 (stable-fixes).\n- drm/amdgpu: fix incorrect number of active RBs for gfx11 (stable-fixes).\n- drm/amdgpu: once more fix the call oder in amdgpu_ttm_move() v2 (git-fixes).\n- drm/amdgpu: validate the parameters of bo mapping operations more clearly (git-fixes).\n- drm/amdkfd: Reset GPU on queue preemption failure (stable-fixes).\n- drm/ast: Fix soft lockup (git-fixes).\n- drm/client: Fully protect modes[] with dev-\u003emode_config.mutex (stable-fixes).\n- drm/i915/cdclk: Fix CDCLK programming order when pipes are active (git-fixes).\n- drm/i915/vrr: Disable VRR when using bigjoiner (stable-fixes).\n- drm/i915: Disable port sync when bigjoiner is used (stable-fixes).\n- drm/msm/dp: fix typo in dp_display_handle_port_status_changed() (git-fixes).\n- drm/nouveau/nvkm: add a replacement for nvkm_notify (bsc#1223834)\n- drm/panel: ili9341: Respect deferred probe (git-fixes).\n- drm/panel: ili9341: Use predefined error codes (git-fixes).\n- drm/panel: visionox-rm69299: do not unregister DSI device (git-fixes).\n- drm/vc4: do not check if plane-\u003estate-\u003efb == state-\u003efb (stable-fixes).\n- drm/vmwgfx: Enable DMA mappings with SEV (git-fixes).\n- drm/vmwgfx: Fix crtc's atomic check conditional (git-fixes).\n- drm/vmwgfx: Fix invalid reads in fence signaled events (git-fixes).\n- drm/vmwgfx: Sort primary plane formats by order of preference (git-fixes).\n- drm: nv04: Fix out of bounds access (git-fixes).\n- drm: panel-orientation-quirks: Add quirk for GPD Win Mini (stable-fixes).\n- drm: panel-orientation-quirks: Add quirk for Lenovo Legion Go (stable-fixes).\n- dump_stack: Do not get cpu_sync for panic CPU (bsc#1223574).\n- fbdev: fix incorrect address computation in deferred IO (git-fixes).\n- fbdev: viafb: fix typo in hw_bitblt_1 and hw_bitblt_2 (stable-fixes).\n- fbmon: prevent division by zero in fb_videomode_from_videomode() (stable-fixes).\n- fix build warning\n- fuse: do not unhash root (bsc#1223951).\n- fuse: fix root lookup with nonzero generation (bsc#1223950).\n- hwmon: (amc6821) add of_match table (stable-fixes).\n- i2c: pxa: hide unused icr_bits[] variable (git-fixes).\n- i2c: smbus: fix NULL function pointer dereference (git-fixes).\n- i40e: Fix VF MAC filter removal (git-fixes).\n- idma64: Do not try to serve interrupts when device is powered off (git-fixes).\n- iio: accel: mxc4005: Interrupt handling fixes (git-fixes).\n- iio:imu: adis16475: Fix sync mode setting (git-fixes).\n- init/main.c: Fix potential static_command_line memory overflow (git-fixes).\n- iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter (git-fixes).\n- iommu/amd: Do not block updates to GATag if guest mode is on (git-fixes).\n- iommu/amd: Fix 'Guest Virtual APIC Table Root Pointer' configuration in IRTE (git-fixes).\n- iommu/amd: Fix domain flush size when syncing iotlb (git-fixes).\n- iommu/amd: Fix error handling for pdev_pri_ats_enable() (git-fixes).\n- iommu/arm-smmu-qcom: Limit the SMR groups to 128 (git-fixes).\n- iommu/arm-smmu-v3: Acknowledge pri/event queue overflow if any (git-fixes).\n- iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982 (git-fixes).\n- iommu/fsl: fix all kernel-doc warnings in fsl_pamu.c (git-fixes).\n- iommu/iova: Fix alloc iova overflows issue (git-fixes).\n- iommu/mediatek: Flush IOTLB completely only if domain has been attached (git-fixes).\n- iommu/rockchip: Fix unwind goto issue (git-fixes).\n- iommu/sprd: Release dma buffer to avoid memory leak (git-fixes).\n- iommu/vt-d: Allocate local memory for page request queue (git-fixes).\n- iommu/vt-d: Allow zero SAGAW if second-stage not supported (git-fixes).\n- iommu/vt-d: Fix error handling in sva enable/disable paths (git-fixes).\n- iommu: Fix error unwind in iommu_group_alloc() (git-fixes).\n- ipv6/addrconf: fix a potential refcount underflow for idev (git-fixes).\n- kABI: Adjust trace_iterator.wait_index (git-fixes).\n- kprobes: Fix double free of kretprobe_holder (bsc#1220901).\n- kprobes: Fix possible use-after-free issue on kprobe registration (git-fixes).\n- libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and check its return value (git-fixes).\n- libnvdimm/region: Allow setting align attribute on regions without mappings (git-fixes).\n- livepatch: Fix missing newline character in klp_resolve_symbols() (bsc#1223539).\n- md/raid1: fix choose next idle in read_balance() (git-fixes).\n- md: Do not clear MD_CLOSING when the raid is about to stop (git-fixes).\n- md: do not clear MD_RECOVERY_FROZEN for new dm-raid until resume (git-fixes).\n- media: cec: core: remove length check of Timer Status (stable-fixes).\n- media: sta2x11: fix irq handler cast (stable-fixes).\n- mei: me: add arrow lake point H DID (stable-fixes).\n- mei: me: add arrow lake point S DID (stable-fixes).\n- mei: me: disable RPL-S on SPS and IGN firmwares (git-fixes).\n- mm/vmscan: make sure wakeup_kswapd with managed zone (bsc#1223473).\n- mmc: sdhci-msm: pervent access to suspended controller (git-fixes).\n- mtd: diskonchip: work around ubsan link failure (stable-fixes).\n- nd_btt: Make BTT lanes preemptible (git-fixes).\n- net: bridge: vlan: fix memory leak in __allowed_ingress (git-fixes).\n- net: fix a memleak when uncloning an skb dst and its metadata (git-fixes).\n- net: fix skb leak in __skb_tstamp_tx() (git-fixes).\n- net: ipv6: ensure we call ipv6_mc_down() at most once (git-fixes).\n- net: mld: fix reference count leak in mld_{query | report}_work() (git-fixes).\n- net: stream: purge sk_error_queue in sk_stream_kill_queues() (git-fixes).\n- net: usb: ax88179_178a: avoid the interface always configured as random address (git-fixes).\n- net: usb: ax88179_178a: avoid writing the mac address before first reading (git-fixes).\n- net: usb: ax88179_178a: stop lying about skb-\u003etruesize (git-fixes).\n- net: vlan: fix underflow for the real_dev refcnt (git-fixes).\n- netfilter: br_netfilter: Drop dst references before setting (git-fixes).\n- netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() (git-fixes).\n- netfilter: nft_ct: fix l3num expectations with inet pseudo family (git-fixes).\n- nfsd: Fixed mount issue with KOTD (bsc#1223380 bsc#1217408 bsc#1223640).\n- nfsd: use __fput_sync() to avoid delayed closing of files (bsc#1223380 bsc#1217408).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nilfs2: fix OOB in nilfs_set_de_type (git-fixes).\n- nouveau: fix function cast warning (git-fixes).\n- nouveau: fix instmem race condition around ptr stores (git-fixes).\n- nvdimm/namespace: drop nested variable in create_namespace_pmem() (git-fixes).\n- nvdimm: Allow overwrite in the presence of disabled dimms (git-fixes).\n- nvdimm: Fix badblocks clear off-by-one error (git-fixes).\n- nvdimm: Fix dereference after free in register_nvdimm_pmu() (git-fixes).\n- nvdimm: Fix firmware activation deadlock scenarios (git-fixes).\n- nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() (git-fixes).\n- pci_iounmap(): Fix MMIO mapping leak (git-fixes).\n- phy: tegra: xusb: Add API to retrieve the port number of phy (stable-fixes).\n- pinctrl: renesas: checker: Limit cfg reg enum checks to provided IDs (stable-fixes).\n- platform/x86: intel-vbtn: Update tablet mode switch at end of probe (git-fixes).\n- platform/x86: touchscreen_dmi: Add an extra entry for a variant of the Chuwi Vi8 tablet (stable-fixes).\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/pseries/iommu: LPAR panics when rebooted with a frozen PE (bsc#1222011 ltc#205900).\n- powerpc/rtas: define pr_fmt and convert printk call sites (bsc#1223369 ltc#205888).\n- powerpc/rtas: export rtas_error_rc() for reuse (bsc#1223369 ltc#205888).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n- printk: Add this_cpu_in_panic() (bsc#1223574).\n- printk: Adjust mapping for 32bit seq macros (bsc#1223574).\n- printk: Avoid non-panic CPUs writing to ringbuffer (bsc#1223574).\n- printk: Disable passing console lock owner completely during panic() (bsc#1223574).\n- printk: Drop console_sem during panic (bsc#1223574).\n- printk: Rename abandon_console_lock_in_panic() to other_cpu_in_panic() (bsc#1223574).\n- printk: Use prb_first_seq() as base for 32bit seq macros (bsc#1223574).\n- printk: Wait for all reserved records with pr_flush() (bsc#1223574).\n- printk: nbcon: Relocate 32bit seq macros (bsc#1223574).\n- printk: ringbuffer: Clarify special lpos values (bsc#1223574).\n- printk: ringbuffer: Cleanup reader terminology (bsc#1223574).\n- printk: ringbuffer: Do not skip non-finalized records with prb_next_seq() (bsc#1223574).\n- printk: ringbuffer: Improve prb_next_seq() performance (bsc#1223574).\n- printk: ringbuffer: Skip non-finalized records in panic (bsc#1223574).\n- pstore/zone: Add a null pointer check to the psz_kmsg_read (stable-fixes).\n- ring-buffer: Do not set shortest_full when full target is hit (git-fixes).\n- ring-buffer: Fix full_waiters_pending in poll (git-fixes).\n- ring-buffer: Fix resetting of shortest_full (git-fixes).\n- ring-buffer: Fix waking up ring buffer readers (git-fixes).\n- ring-buffer: Make wake once of ring_buffer_wait() more robust (git-fixes).\n- ring-buffer: Use wait_event_interruptible() in ring_buffer_wait() (git-fixes).\n- ring-buffer: use READ_ONCE() to read cpu_buffer-\u003ecommit_page in concurrent environment (git-fixes).\n- s390/cio: Ensure the copied buf is NUL terminated (git-fixes bsc#1223875).\n- s390/decompressor: fix misaligned symbol build error (git-fixes bsc#1223785).\n- s390/mm: Fix clearing storage keys for huge pages (git-fixes bsc#1223877).\n- s390/mm: Fix storage key clearing for guest huge pages (git-fixes bsc#1223878).\n- s390/qeth: Fix kernel panic after setting hsuid (git-fixes bsc#1223879).\n- s390/scm: fix virtual vs physical address confusion (git-fixes bsc#1223784).\n- s390/vdso: Add CFI for RA register to asm macro vdso_func (git-fixes bsc#1223876).\n- s390/vdso: drop '-fPIC' from LDFLAGS (git-fixes bsc#1223598).\n- s390/zcrypt: fix reference counting on zcrypt card objects (git-fixes bsc#1223595).\n- s390: Fixed LPM of lpar failure with error HSCLA2CF in 19th loops (jsc#PED-542 git-fixes bsc#1213573 ltc#203238).\n- s390: Fixed kernel backtrack (bsc#1141539 git-fixes).\n- serial/pmac_zilog: Remove flawed mitigation for rx irq flood (git-fixes).\n- serial: core: Provide port lock wrappers (stable-fixes).\n- serial: core: fix kernel-doc for uart_port_unlock_irqrestore() (git-fixes).\n- serial: mxs-auart: add spinlock around changing cts state (git-fixes).\n- slimbus: qcom-ngd-ctrl: Add timeout for wait operation (git-fixes).\n- speakup: Avoid crash on very long word (git-fixes).\n- speakup: Fix 8bit characters from direct synth (git-fixes).\n- tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp (git-fixes).\n- thunderbolt: Avoid notify PM core about runtime PM resume (stable-fixes).\n- thunderbolt: Fix wake configurations after device unplug (stable-fixes).\n- tracing/net_sched: Fix tracepoints that save qdisc_dev() as a string (git-fixes).\n- tracing/ring-buffer: Fix wait_on_pipe() race (git-fixes).\n- tracing: Have saved_cmdlines arrays all in one allocation (git-fixes).\n- tracing: Remove precision vsnprintf() check from print event (git-fixes).\n- tracing: Show size of requested perf buffer (git-fixes).\n- tracing: Use .flush() call to wake up readers (git-fixes).\n- usb: Disable USB3 LPM at shutdown (stable-fixes).\n- usb: Fix regression caused by invalid ep0 maxpacket in virtual SuperSpeed device (git-fixes).\n- usb: dwc2: host: Fix dereference issue in DDMA completion flow (git-fixes).\n- usb: gadget: composite: fix OS descriptors w_value logic (git-fixes).\n- usb: gadget: f_fs: Fix a race condition when processing setup packets (git-fixes).\n- usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error (stable-fixes).\n- usb: gadget: tegra-xudc: Fix USB3 PHY retrieval logic (git-fixes).\n- usb: ohci: Prevent missed ohci interrupts (git-fixes).\n- usb: sl811-hcd: only defined function checkdone if QUIRK2 is defined (stable-fixes).\n- usb: typec: tcpci: add generic tcpci fallback compatible (stable-fixes).\n- usb: typec: tcpm: Check for port partner validity before consuming it (git-fixes).\n- usb: typec: tcpm: unregister existing source caps before re-registration (bsc#1220569).\n- usb: typec: ucsi: Ack unsupported commands (stable-fixes).\n- usb: typec: ucsi: Clear UCSI_CCI_RESET_COMPLETE before reset (stable-fixes).\n- usb: typec: ucsi: Fix connector check on init (git-fixes).\n- usb: udc: remove warning when queue disabled ep (stable-fixes).\n- vdpa/mlx5: Allow CVQ size changes (git-fixes).\n- virtio: treat alloc_dax() -EOPNOTSUPP failure as non-fatal (bsc#1223949).\n- wifi: ath9k: fix LNA selection in ath_ant_try_scan() (stable-fixes).\n- wifi: iwlwifi: mvm: remove old PASN station when adding a new one (git-fixes).\n- wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd (git-fixes).\n- wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (stable-fixes).\n- wifi: nl80211: do not free NULL coalescing rule (git-fixes).\n- x86/cpufeatures: Fix dependencies for GFNI, VAES, and VPCLMULQDQ (git-fixes).\n- x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type (jsc#PED-7167 git-fixes).\n- x86/sev: Skip ROM range scans and validation for SEV-SNP guests (jsc#PED-7167 git-fixes).\n- x86/xen: Add some null pointer checking to smp.c (git-fixes).\n- x86/xen: add CPU dependencies for 32-bit build (git-fixes).\n- x86/xen: fix percpu vcpu_info allocation (git-fixes).\n- xen-netback: properly sync TX responses (git-fixes).\n- xen-netfront: Add missing skb_mark_for_recycle (git-fixes).\n- xen/gntdev: Fix the abuse of underlying struct page in DMA-buf import (git-fixes).\n- xen/xenbus: document will_handle argument for xenbus_watch_path() (git-fixes).\n- xfrm6: fix inet6_dev refcount underflow problem (git-fixes).\n","status":"published","published":"2024-05-15T19:08:39Z","modified":"2026-02-04T04:20:21.705752Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2011-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2024-26828: Fixed underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).\n- CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).\n- CVE-2024-26928: Fixed potential UAF in cifs_debug_files_proc_show() (bsc#1223532).\n- CVE-2024-26929: Fixed double free of fcport (bsc#1223715).\n- CVE-2024-26930: Fixed double free of the ha-\u003evp_map pointer (bsc#1223626).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2024-27413: Fixed incorrect allocation size (bsc#1224438).\n- CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).\n- CVE-2024-35863: Fixed potential UAF in is_valid_oplock_break() (bsc#1224763).\n- CVE-2024-35867: Fixed potential UAF in cifs_stats_proc_show() (bsc#1224664).\n- CVE-2024-35868: Fixed potential UAF in cifs_stats_proc_write() (bsc#1224678).\n- CVE-2024-35904: Fixed dereference of garbage after mount failure (bsc#1224494).\n- CVE-2024-35905: Fixed int overflow for stack access size  (bsc#1224488).\n- CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).\n\nThe following non-security bugs were fixed:\n\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- filemap: remove use of wait bookmarks (bsc#1224085).\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).\n- powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).\n- powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n- supported.conf: support tcp_dctcp module (jsc#PED-8111)\n","status":"published","published":"2024-06-12T16:39:51Z","modified":"2026-02-04T02:22:35.130887Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2189-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-35905: Fixed int overflow for stack access size (bsc#1224488).\n- CVE-2024-26828: Fix underflow in parse_server_interfaces() (bsc#1223084).\n- CVE-2024-35863: Fix potential UAF in is_valid_oplock_break() (bsc#1224763).\n- CVE-2024-35867: Fix potential UAF in cifs_stats_proc_show() (bsc#1224664).\n- CVE-2024-35868: Fix potential UAF in cifs_stats_proc_write() (bsc#1224678).\n- CVE-2024-26928: Fix potential UAF in cifs_debug_files_proc_show() (bsc#1223532).\n- CVE-2024-36926: Fixed LPAR panics during boot up with a frozen PE (bsc#1222011).\n- CVE-2024-26925: Release mutex after nft_gc_seq_end from abort path (bsc#1223390).\n- CVE-2024-27413: Fix incorrect allocation size (bsc#1224438).\n- CVE-2024-35817: Set gtt bound flag in amdgpu_ttm_gart_bind (bsc#1224736).\n- CVE-2024-35904: Avoid dereference of garbage after mount failure (bsc#1224494).\n- CVE-2024-26929: Fixed double free of fcport (bsc#1223715).\n- CVE-2024-27398: Fixed use-after-free bugs caused by sco_sock_timeout (bsc#1224174).\n- CVE-2024-26930: Fixed double free of the ha-\u003evp_map pointer (bsc#1223626).\n- CVE-2024-26840: Fixed a memory leak in cachefiles_add_cache() (bsc#1222976).\n- CVE-2024-26862: Fixed packet annotate data-races around ignore_outgoing (bsc#1223111).\n- CVE-2024-0639: Fixed a denial-of-service vulnerability due to a deadlock found in sctp_auto_asconf_init in net/sctp/socket.c (bsc#1218917).\n- CVE-2024-26921: Preserve kabi for sk_buff (bsc#1223138).\n- CVE-2024-26852: Fixed use-after-free in ip6_route_mpath_notify() (bsc#1223057).\n- CVE-2023-1829: Fixed a use-after-free vulnerability in the control index filter (tcindex) (bsc#1210335).\n\nThe following non-security bugs were fixed:\n\n- af_unix: Do not use atomic ops for unix_sk(sk)-\u003einflight (bsc#1223384).\n- af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).\n- af_unix: annote lockless accesses to unix_tot_inflight \u0026 gc_in_progress (bsc#1223384).\n- filemap: remove use of wait bookmarks (bsc#1224085).\n- idpf: extend tx watchdog timeout (bsc#1224137).\n- ipvs: Fix checksumming on GSO of SCTP packets (bsc#1221958)\n- powerpc/kasan: Do not instrument non-maskable or raw interrupts (bsc#1223191).\n- powerpc/powernv: Add a null pointer check in opal_event_init() (bsc#1065729).\n- powerpc/powernv: Add a null pointer check to scom_debug_init_one() (bsc#1194869).\n- powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV (bsc#1220492 ltc#205270).\n- powerpc/pseries/vio: Do not return ENODEV if node or compatible missing (bsc#1220783).\n- powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt (bsc#1221645 ltc#205739 bsc#1223191).\n- powerpc: Refactor verification of MSR_RI (bsc#1223191).\n","status":"published","published":"2024-06-25T06:34:56Z","modified":"2026-02-04T03:48:02.097364Z","updated_at":"2026-11-02T15:53:55.136363Z"},{"id":"SUSE-SU-2025:0231-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2024-53095: smb: client: Fix use-after-free of network namespace (bsc#1233642).\n- CVE-2024-53146: NFSD: Prevent a potential integer overflow (bsc#1234853).\n- CVE-2024-53156: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (bsc#1234846).\n- CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234891).\n- CVE-2024-53179: smb: client: fix use-after-free of signing key (bsc#1234921).\n- CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235004).\n- CVE-2024-53239: ALSA: 6fire: Release resources at card release (bsc#1235054).\n- CVE-2024-53240: xen/netfront: fix crash when removing device (bsc#1234281).\n- CVE-2024-53241: x86/xen: use new hypercall functions instead of hypercall page (XSA-466 bsc#1234282).\n- CVE-2024-56539: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() (bsc#1234963).\n- CVE-2024-56548: hfsplus: do not query the device logical block size multiple times (bsc#1235073).\n- CVE-2024-56570: ovl: Filter invalid inodes with missing lookup function (bsc#1235035).\n- CVE-2024-56598: jfs: array-index-out-of-bounds fix in dtReadFirst (bsc#1235220).\n- CVE-2024-56604: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (bsc#1235056).\n- CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235061).\n- CVE-2024-56619: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() (bsc#1235224).\n- CVE-2024-8805: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE (bsc#1230697).\n\nThe following non-security bugs were fixed:\n\n- KVM: x86: fix sending PV IPI (git-fixes).\n- idpf: add support for SW triggered interrupts (bsc#1235507).\n- idpf: enable WB_ON_ITR (bsc#1235507).\n- idpf: trigger SW interrupt when exiting wb_on_itr mode (bsc#1235507).\n- kernel-binary: do not BuildIgnore m4. It is actually needed for regenerating zconf when it is not up-to-date due to merge.\n- kernel/fork: beware of __put_task_struct() calling context (bsc#1189998 (PREEMPT_RT prerequisite backports)).\n- net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (bsc#1235246).\n- rpm/kernel-binary.spec.in: Fix build regression The previous fix forgot to take over grep -c option that broke the conditional expression\n- scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (git-fixes).\n- smb: client: fix TCP timers deadlock after rmmod (git-fixes) [hcarvalho: this fixes issue discussed in bsc#1233642].\n- usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode() (git-fixes).\n- usb: typec: tps6598x: Fix return value check in tps6598x_probe() (git-fixes).\n- x86/bug: Merge annotate_reachable() into _BUG_FLAGS() asm (git-fixes).\n- x86/fpu/xsave: Handle compacted offsets correctly with supervisor states (git-fixes).\n- x86/fpu/xstate: Fix the ARCH_REQ_XCOMP_PERM implementation (git-fixes).\n- x86/fpu: Remove unused supervisor only offsets (git-fixes).\n- x86/kvm: Do not use pv tlb/ipi/sched_yield if on 1 vCPU (git-fixes).\n- x86/mce/inject: Avoid out-of-bounds write when setting flags (git-fixes).\n- x86/mce: Allow instrumentation during task work queueing (git-fixes).\n- x86/mce: Mark mce_end() noinstr (git-fixes).\n- x86/mce: Mark mce_panic() noinstr (git-fixes).\n- x86/mce: Mark mce_read_aux() noinstr (git-fixes).\n- x86/mm: Flush global TLB when switching to trampoline page-table (git-fixes).\n- x86/sgx: Free backing memory after faulting the enclave page (git-fixes).\n- x86/sgx: Silence softlockup detection when releasing large enclaves (git-fixes).\n- x86/uaccess: Move variable into switch case statement (git-fixes).\n- x86: Annotate call_on_stack() (git-fixes).\n","status":"published","published":"2025-01-24T10:10:55Z","modified":"2026-02-04T02:33:41.949689Z","updated_at":"2026-11-02T15:53:56.647031Z"}]}}