{"id":"CVE-2022-48935","aliases":["DEBIAN-CVE-2022-48935","EUVD-2022-53814","GHSA-4qph-c4vr-m25p","OESA-2024-2078","OESA-2024-2080","SUSE-SU-2024:3227-1","SUSE-SU-2024:3408-1","SUSE-SU-2024:3569-1","SUSE-SU-2024:3587-1","SUSE-SU-2024:3592-1","UBUNTU-CVE-2022-48935"],"status":"published","title":"netfilter: nf_tables: unregister flowtable hooks on netns exit","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\n\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\n\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\n\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\n\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00212,"percentile":0.11539,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2024-08-22T03:31:29Z","modified":"2026-11-03T08:00:14Z","fixes":[{"ecosystem":"Linux","package":"Kernel","fixed_in":["5.10.198","5.15.26","5.16.12"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"linux","fixed_in":["5.16.12-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["5.16.12-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["5.16.12-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-iotg-5.15","fixed_in":["5.15.0-1008.11~20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Linux","package":"Kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.198"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.26"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"5.16.12"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.12-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.12-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.16.12-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-225.0.0.128.oe2203sp3"}]}],"bundled":32},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0-136.91.0.172.oe2203sp1"}]}],"bundled":54},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.91.3"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.91.3"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.91.3"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.15.91.3"}]}],"bundled":69},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2.150400.24.64.5"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2.150400.24.64.5"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP4","package":"kernel-livepatch-SLE15-SP4_Update_31","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150400.9.3.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2.150400.24.64.5"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2.150400.24.64.5"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2.150400.24.64.5"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2.150400.24.64.5"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2.150400.24.64.5"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2.150400.24.64.5"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.1"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150400.24.133.2"}]}],"bundled":73},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1.150500.6.37.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-64kb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1.150500.6.37.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"kernel-zfcpdump","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Legacy 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5_Update_20","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.3.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1"}]}],"bundled":130},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"kernel-default-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.55.83.1.150500.6.37.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.69.1"}]}],"bundled":132},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.69.1"}]}],"bundled":132},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.69.1"}]}],"bundled":132},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.69.1"}]}],"bundled":132},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.69.1"}]}],"bundled":132},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.33.69.1"}]}],"bundled":132},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 15 SP5","package":"kernel-livepatch-SLE15-SP5-RT_Update_21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-150500.11.3.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"SUSE:Real Time Module 15 SP5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-rt_debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-source-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"kernel-syms-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.14.21-150500.13.73.1"}]}],"bundled":130},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.0-28.30~16.04.1","4.8.0-30.32~16.04.1","4.8.0-32.34~16.04.1","4.8.0-34.36~16.04.1","4.10.0-14.16~16.04.1","4.10.0-19.21~16.04.1","4.10.0-20.22~16.04.1","4.10.0-21.23~16.04.1","4.10.0-22.24~16.04.1","4.10.0-24.28~16.04.1","4.10.0-26.30~16.04.1","4.11.0-13.19~16.04.1","4.11.0-14.20~16.04.1","4.13.0-16.19~16.04.3","4.13.0-17.20~16.04.1","4.13.0-19.22~16.04.1","4.13.0-21.24~16.04.1","4.13.0-25.29~16.04.2","4.15.0-13.14~16.04.1","4.15.0-15.16~16.04.1","4.15.0-20.21~16.04.1","4.15.0-22.24~16.04.1","4.15.0-23.25~16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1021.24~18.04.1","5.0.0-1022.25~18.04.1","5.0.0-1023.26~18.04.1","5.0.0-1024.27~18.04.1","5.0.0-1025.28","5.0.0-1027.30"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-aws-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1019.21~18.04.1","5.3.0-1023.25~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.2","5.3.0-1033.35","5.3.0-1034.36","5.3.0-1035.37"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.2","4.15.0-1003.3","4.15.0-1004.4","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1012.12","4.15.0-1013.13","4.15.0-1014.14","4.15.0-1018.18","4.15.0-1019.19","4.15.0-1021.21","4.15.0-1022.23","4.15.0-1023.24","4.15.0-1025.26","4.15.0-1028.29","4.15.0-1030.31","4.15.0-1031.32","4.15.0-1032.33","4.15.0-1035.36","4.15.0-1036.38","4.15.0-1037.39","4.18.0-1011.11~18.04.1","4.18.0-1013.13~18.04.1","4.18.0-1014.14~18.04.1","4.18.0-1018.18~18.04.1","4.18.0-1019.19~18.04.1","4.18.0-1020.20~18.04.1","4.18.0-1023.24~18.04.1","4.18.0-1024.25~18.04.1","4.18.0-1025.27~18.04.1","5.0.0-1014.14~18.04.1","5.0.0-1016.17~18.04.1","5.0.0-1018.19~18.04.1","5.0.0-1020.21~18.04.1","5.0.0-1022.23~18.04.1","5.0.0-1023.24~18.04.1","5.0.0-1025.27~18.04.1","5.0.0-1027.29~18.04.1","5.0.0-1028.30~18.04.1","5.0.0-1029.31~18.04.1","5.0.0-1031.33","5.0.0-1032.34","5.0.0-1035.37","5.0.0-1036.38"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8~18.04.1","5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1019.20~18.04.1","5.3.0-1020.21~18.04.1","5.3.0-1022.23~18.04.1","5.3.0-1028.29~18.04.1","5.3.0-1031.32~18.04.1","5.3.0-1032.33~18.04.1","5.3.0-1034.35~18.04.1","5.3.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-azure-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-1006.6~18.04.1","4.18.0-1007.7~18.04.1","4.18.0-1008.8~18.04.1","5.0.0-1012.12~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1001.1","4.15.0-1003.3","4.15.0-1005.5","4.15.0-1006.6","4.15.0-1008.8","4.15.0-1009.9","4.15.0-1010.10","4.15.0-1014.14","4.15.0-1015.15","4.15.0-1017.18","4.15.0-1018.19","4.15.0-1019.20","4.15.0-1021.22","4.15.0-1023.24","4.15.0-1024.25","4.15.0-1025.26","4.15.0-1026.27","4.15.0-1027.28","4.15.0-1028.29","4.15.0-1029.31","4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1042.45","4.15.0-1044.70","5.0.0-1020.20~18.04.1","5.0.0-1021.21~18.04.1","5.0.0-1025.26~18.04.1","5.0.0-1026.27~18.04.1","5.0.0-1028.29~18.04.1","5.0.0-1029.30~18.04.1","5.0.0-1031.32","5.0.0-1033.34","5.0.0-1034.35"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gcp-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1008.9~18.04.1","5.3.0-1009.10~18.04.1","5.3.0-1010.11~18.04.1","5.3.0-1012.13~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.17~18.04.1","5.3.0-1017.18~18.04.1","5.3.0-1018.19~18.04.1","5.3.0-1020.22~18.04.1","5.3.0-1026.28~18.04.1","5.3.0-1029.31~18.04.1","5.3.0-1030.32~18.04.1","5.3.0-1032.34~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-4.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1030.32","4.15.0-1032.34","4.15.0-1033.35","4.15.0-1034.36","4.15.0-1036.38","4.15.0-1037.39","4.15.0-1040.42","4.15.0-1041.43","4.15.0-1042.44","4.15.0-1044.46","4.15.0-1045.48","4.15.0-1046.49","4.15.0-1048.51","4.15.0-1049.52","4.15.0-1050.53","4.15.0-1052.55","4.15.0-1055.58","4.15.0-1057.60","4.15.0-1058.61","4.15.0-1059.62","4.15.0-1063.66","4.15.0-1064.67","4.15.0-1066.69","4.15.0-1067.70","4.15.0-1069.72","4.15.0-1070.73","4.15.0-1072.76","4.15.0-1073.78","4.15.0-1074.79","4.15.0-1076.81","4.15.0-1077.82","4.15.0-1078.83","4.15.0-1079.84"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gke-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1025.25~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.31~18.04.1","5.4.0-1030.32~18.04.1","5.4.0-1032.34~18.04.1","5.4.0-1033.35~18.04.1","5.4.0-1035.37~18.04.1","5.4.0-1036.38~18.04.1","5.4.0-1037.39~18.04.1","5.4.0-1039.41~18.04.1","5.4.0-1040.42~18.04.1","5.4.0-1042.44~18.04.1","5.4.0-1043.45~18.04.1","5.4.0-1044.46~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1","5.4.0-1052.55~18.04.1","5.4.0-1053.56~18.04.1","5.4.0-1054.57~18.04.1","5.4.0-1055.58~18.04.1","5.4.0-1056.59~18.04.1","5.4.0-1057.60~18.04.1","5.4.0-1059.62~18.04.1","5.4.0-1061.64~18.04.1","5.4.0-1062.65~18.04.1","5.4.0-1063.66~18.04.1","5.4.0-1065.68~18.04.1","5.4.0-1066.69~18.04.1","5.4.0-1067.70~18.04.1","5.4.0-1068.71~18.04.1","5.4.0-1071.76~18.04.3","5.4.0-1072.77~18.04.1","5.4.0-1074.79~18.04.1","5.4.0-1076.82~18.04.1","5.4.0-1078.84~18.04.1","5.4.0-1080.86~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-gkeop-5.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1001.1","5.4.0-1003.3","5.4.0-1004.5","5.4.0-1005.6","5.4.0-1007.8~18.04.1","5.4.0-1008.9~18.04.1","5.4.0-1009.10~18.04.1","5.4.0-1010.11~18.04.1","5.4.0-1011.12~18.04.2","5.4.0-1012.13~18.04.1","5.4.0-1013.14~18.04.1","5.4.0-1014.15~18.04.1","5.4.0-1015.16~18.04.1","5.4.0-1016.17~18.04.1","5.4.0-1018.19~18.04.1","5.4.0-1021.22~18.04.1","5.4.0-1022.23~18.04.1","5.4.0-1023.24~18.04.1","5.4.0-1024.25~18.04.1","5.4.0-1025.26~18.04.1","5.4.0-1026.27~18.04.1","5.4.0-1027.28~18.04.1","5.4.0-1029.30~18.04.2","5.4.0-1031.32~18.04.1","5.4.0-1032.33~18.04.1","5.4.0-1033.34~18.04.1","5.4.0-1034.35~18.04.1","5.4.0-1036.37~18.04.1","5.4.0-1037.38~18.04.1","5.4.0-1038.39~18.04.1","5.4.0-1039.40~18.04.1","5.4.0-1040.41~18.04.1","5.4.0-1043.44~18.04.1","5.4.0-1046.48~18.04.1","5.4.0-1048.51~18.04.1","5.4.0-1049.52~18.04.1","5.4.0-1051.54~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18.0-13.14~18.04.1","4.18.0-14.15~18.04.1","4.18.0-15.16~18.04.1","4.18.0-16.17~18.04.1","4.18.0-17.18~18.04.1","4.18.0-18.19~18.04.1","4.18.0-20.21~18.04.1","4.18.0-21.22~18.04.1","4.18.0-22.23~18.04.1","4.18.0-24.25~18.04.1","4.18.0-25.26~18.04.1","5.0.0-23.24~18.04.1","5.0.0-25.26~18.04.1","5.0.0-27.28~18.04.1","5.0.0-29.31~18.04.1","5.0.0-31.33~18.04.1","5.0.0-32.34~18.04.2","5.0.0-35.38~18.04.1","5.0.0-36.39~18.04.1","5.0.0-37.40~18.04.1","5.3.0-26.28~18.04.1","5.3.0-28.30~18.04.1","5.3.0-40.32~18.04.1","5.3.0-42.34~18.04.1","5.3.0-45.37~18.04.1","5.3.0-46.38~18.04.1","5.3.0-51.44~18.04.2","5.3.0-53.47~18.04.1","5.3.0-59.53~18.04.1","5.3.0-61.55~18.04.1","5.3.0-62.56~18.04.1","5.3.0-64.58~18.04.1","5.3.0-65.59","5.3.0-66.60","5.3.0-67.61","5.3.0-68.63","5.3.0-69.65","5.3.0-70.66","5.3.0-72.68","5.3.0-73.69","5.3.0-74.70","5.3.0-75.71","5.3.0-76.72"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-hwe-edge","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-15.16~18.04.1","5.0.0-16.17~18.04.1","5.0.0-17.18~18.04.1","5.0.0-19.20~18.04.1","5.0.0-20.21~18.04.1","5.3.0-19.20~18.04.2","5.3.0-22.24~18.04.1","5.3.0-23.25~18.04.1","5.3.0-23.25~18.04.2","5.3.0-24.26~18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oem","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.15.0-1002.3","4.15.0-1004.5","4.15.0-1006.9","4.15.0-1008.11","4.15.0-1009.12","4.15.0-1012.15","4.15.0-1013.16","4.15.0-1015.18","4.15.0-1017.20","4.15.0-1018.21","4.15.0-1021.24","4.15.0-1024.29","4.15.0-1026.31","4.15.0-1028.33","4.15.0-1030.35","4.15.0-1033.38","4.15.0-1034.39","4.15.0-1035.40","4.15.0-1036.41","4.15.0-1038.43","4.15.0-1039.44","4.15.0-1043.48","4.15.0-1045.50","4.15.0-1050.57","4.15.0-1056.65","4.15.0-1057.66","4.15.0-1059.68","4.15.0-1063.72","4.15.0-1064.73","4.15.0-1065.75","4.15.0-1066.76","4.15.0-1067.77","4.15.0-1069.79","4.15.0-1073.83","4.15.0-1076.86","4.15.0-1079.89","4.15.0-1080.90","4.15.0-1081.91","4.15.0-1087.97","4.15.0-1090.100","4.15.0-1091.101","4.15.0-1093.103","4.15.0-1094.104","4.15.0-1096.106","4.15.0-1097.107","4.15.0-1099.109","4.15.0-1100.110","4.15.0-1101.112","4.15.0-1102.113","4.15.0-1103.114"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.0.0-1007.12~18.04.1","5.0.0-1008.13~18.04.1","5.0.0-1009.14~18.04.1","5.0.0-1010.15~18.04.1","5.0.0-1011.16","5.0.0-1013.18","5.0.0-1014.19"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"linux-oracle-5.3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1011.12~18.04.1","5.3.0-1013.14~18.04.1","5.3.0-1014.15~18.04.1","5.3.0-1016.18~18.04.1","5.3.0-1018.20~18.04.1","5.3.0-1024.26~18.04.1","5.3.0-1027.29~18.04.1","5.3.0-1028.30~18.04.1","5.3.0-1030.32~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-iotg-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-1008.11~20.04.1"}]}],"versions":["5.15.0-1003.5~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.9~20.04.2","5.11.0-1014.15~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.2","5.11.0-1021.22~20.04.2","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.2","5.13.0-1011.12~20.04.1","5.13.0-1012.13~20.04.1","5.13.0-1014.15~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1019.21~20.04.1","5.13.0-1021.23~20.04.2","5.13.0-1022.24~20.04.1","5.13.0-1023.25~20.04.1","5.13.0-1025.27~20.04.1","5.13.0-1028.31~20.04.1","5.13.0-1029.32~20.04.1","5.13.0-1031.35~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-aws-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1041.43~20.04.1","5.8.0-1042.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1007.7~20.04.2","5.11.0-1012.13~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10~20.04.2","5.13.0-1012.14~20.04.1","5.13.0-1013.15~20.04.1","5.13.0-1014.16~20.04.1","5.13.0-1017.19~20.04.1","5.13.0-1021.24~20.04.1","5.13.0-1022.26~20.04.1","5.13.0-1023.27~20.04.1","5.13.0-1025.29~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1029.34~20.04.1","5.13.0-1031.37~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1033.35~20.04.1","5.8.0-1036.38~20.04.1","5.8.0-1039.42~20.04.1","5.8.0-1040.43~20.04.1","5.8.0-1041.44~20.04.1","5.8.0-1042.45~20.04.1","5.8.0-1043.46~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-azure-fde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1063.66+cvm2.2","5.4.0-1063.66+cvm3.2","5.4.0-1064.67+cvm1.1","5.4.0-1065.68+cvm2.1","5.4.0-1067.70+cvm1.1","5.4.0-1068.71+cvm1.1","5.4.0-1069.72+cvm1.1","5.4.0-1070.73+cvm1.1","5.4.0-1072.75+cvm1.1","5.4.0-1073.76+cvm1.1","5.4.0-1074.77+cvm1.1","5.4.0-1076.79+cvm1.1","5.4.0-1078.81+cvm1.1","5.4.0-1080.83+cvm1.1","5.4.0-1083.87+cvm1.1","5.4.0-1085.90+cvm1.1","5.4.0-1085.90+cvm2.1","5.4.0-1086.91+cvm1.1","5.4.0-1089.94+cvm1.2","5.4.0-1090.95+cvm1.1","5.4.0-1091.96+cvm1.1","5.4.0-1092.97+cvm1.1","5.4.0-1095.101+cvm1.1","5.4.0-1098.104+cvm1.1","5.4.0-1100.106+cvm1.1","5.4.0-1103.109+cvm1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1009.10~20.04.1","5.11.0-1014.16~20.04.1","5.11.0-1017.19~20.04.1","5.11.0-1018.20~20.04.2","5.11.0-1020.22~20.04.1","5.11.0-1021.23~20.04.1","5.11.0-1022.24~20.04.1","5.11.0-1023.25~20.04.1","5.11.0-1024.26~20.04.1","5.11.0-1026.29~20.04.1","5.11.0-1028.32~20.04.1","5.11.0-1029.33~20.04.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1008.9~20.04.3","5.13.0-1012.15~20.04.1","5.13.0-1013.16~20.04.1","5.13.0-1015.18~20.04.1","5.13.0-1019.23~20.04.1","5.13.0-1021.25~20.04.1","5.13.0-1023.28~20.04.1","5.13.0-1024.29~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1030.36~20.04.1","5.13.0-1031.37~20.04.1","5.13.0-1033.40~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gcp-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1032.34~20.04.1","5.8.0-1035.37~20.04.1","5.8.0-1038.40~20.04.1","5.8.0-1039.41"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-1033.35","5.4.0-1035.37","5.4.0-1036.38","5.4.0-1037.39","5.4.0-1039.41","5.4.0-1041.43","5.4.0-1042.44","5.4.0-1043.45","5.4.0-1044.46","5.4.0-1046.48","5.4.0-1049.52","5.4.0-1051.54","5.4.0-1052.55","5.4.0-1053.56","5.4.0-1054.57","5.4.0-1055.58","5.4.0-1056.59","5.4.0-1057.60","5.4.0-1059.62","5.4.0-1061.64","5.4.0-1062.65","5.4.0-1063.66","5.4.0-1065.68","5.4.0-1066.69","5.4.0-1067.70","5.4.0-1068.71","5.4.0-1071.76","5.4.0-1072.77","5.4.0-1074.79","5.4.0-1076.82","5.4.0-1078.84","5.4.0-1080.86","5.4.0-1081.87","5.4.0-1083.89","5.4.0-1084.90","5.4.0-1086.93","5.4.0-1087.94","5.4.0-1090.97","5.4.0-1091.98","5.4.0-1094.101","5.4.0-1095.102","5.4.0-1096.103","5.4.0-1097.104","5.4.0-1098.105","5.4.0-1099.106","5.4.0-1100.107","5.4.0-1101.108","5.4.0-1102.109","5.4.0-1103.110","5.4.0-1104.111","5.4.0-1105.112"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-gke-5.15","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1011.14~20.04.1","5.15.0-1014.17~20.04.1","5.15.0-1015.18~20.04.1","5.15.0-1016.19~20.04.1","5.15.0-1019.23~20.04.1","5.15.0-1020.25~20.04.1","5.15.0-1023.28~20.04.2","5.15.0-1027.32~20.04.1","5.15.0-1028.33~20.04.1","5.15.0-1029.34~20.04.1","5.15.0-1031.36~20.04.1","5.15.0-1032.37~20.04.1","5.15.0-1033.38~20.04.1","5.15.0-1034.39~20.04.1","5.15.0-1036.41~20.04.1","5.15.0-1037.42~20.04.1","5.15.0-1038.43~20.04.1","5.15.0-1039.44~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-22.23~20.04.1","5.11.0-25.27~20.04.1","5.11.0-27.29~20.04.1","5.11.0-34.36~20.04.1","5.11.0-36.40~20.04.1","5.11.0-37.41~20.04.2","5.11.0-38.42~20.04.1","5.11.0-40.44~20.04.2","5.11.0-41.45~20.04.1","5.11.0-43.47~20.04.2","5.11.0-44.48~20.04.2","5.11.0-46.51~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-21.21~20.04.1","5.13.0-22.22~20.04.1","5.13.0-23.23~20.04.2","5.13.0-25.26~20.04.1","5.13.0-27.29~20.04.1","5.13.0-28.31~20.04.1","5.13.0-30.33~20.04.1","5.13.0-35.40~20.04.1","5.13.0-37.42~20.04.1","5.13.0-39.44~20.04.1","5.13.0-40.45~20.04.1","5.13.0-41.46~20.04.1","5.13.0-44.49~20.04.1","5.13.0-48.54~20.04.1","5.13.0-51.58~20.04.1","5.13.0-52.59~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-hwe-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-23.24~20.04.1","5.8.0-25.26~20.04.1","5.8.0-28.30~20.04.1","5.8.0-29.31~20.04.1","5.8.0-31.33~20.04.1","5.8.0-33.36~20.04.1","5.8.0-34.37~20.04.2","5.8.0-36.40~20.04.1","5.8.0-38.43~20.04.1","5.8.0-40.45~20.04.1","5.8.0-41.46~20.04.1","5.8.0-43.49~20.04.1","5.8.0-44.50~20.04.1","5.8.0-45.51~20.04.1","5.8.0-48.54~20.04.1","5.8.0-49.55~20.04.1","5.8.0-50.56~20.04.1","5.8.0-53.60~20.04.1","5.8.0-55.62~20.04.1","5.8.0-59.66~20.04.1","5.8.0-63.71~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-intel-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1007.7","5.13.0-1008.8","5.13.0-1009.9","5.13.0-1010.10","5.13.0-1011.11","5.13.0-1014.15","5.13.0-1017.19"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.10","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.10.0-1008.9","5.10.0-1011.12","5.10.0-1013.14","5.10.0-1014.15","5.10.0-1016.17","5.10.0-1017.18","5.10.0-1019.20","5.10.0-1021.22","5.10.0-1022.23","5.10.0-1023.24","5.10.0-1025.26","5.10.0-1026.27","5.10.0-1029.30","5.10.0-1032.33","5.10.0-1033.34","5.10.0-1034.35","5.10.0-1038.40","5.10.0-1044.46","5.10.0-1045.47","5.10.0-1049.51","5.10.0-1050.52","5.10.0-1051.53","5.10.0-1052.54","5.10.0-1053.55","5.10.0-1055.58","5.10.0-1057.61"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1009.10","5.13.0-1010.11","5.13.0-1012.16","5.13.0-1014.18","5.13.0-1017.21","5.13.0-1019.23","5.13.0-1020.24","5.13.0-1021.25","5.13.0-1022.26","5.13.0-1026.32","5.13.0-1028.35","5.13.0-1029.36"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.14","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.14.0-1004.4","5.14.0-1005.5","5.14.0-1007.7","5.14.0-1008.8","5.14.0-1010.10","5.14.0-1011.11","5.14.0-1013.13","5.14.0-1018.19","5.14.0-1020.22","5.14.0-1022.24","5.14.0-1024.26","5.14.0-1027.30","5.14.0-1029.32","5.14.0-1031.34","5.14.0-1032.35","5.14.0-1033.36","5.14.0-1034.37","5.14.0-1036.40","5.14.0-1038.42","5.14.0-1042.47","5.14.0-1044.49","5.14.0-1045.51","5.14.0-1046.53","5.14.0-1047.54","5.14.0-1048.55","5.14.0-1049.56","5.14.0-1050.57","5.14.0-1051.58","5.14.0-1052.59","5.14.0-1054.61","5.14.0-1055.62","5.14.0-1056.63","5.14.0-1057.64","5.14.0-1058.66","5.14.0-1059.67"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oem-5.6","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.6.0-1007.7","5.6.0-1008.8","5.6.0-1010.10","5.6.0-1011.11","5.6.0-1013.13","5.6.0-1017.17","5.6.0-1018.18","5.6.0-1020.20","5.6.0-1021.21","5.6.0-1023.23","5.6.0-1026.26","5.6.0-1027.27","5.6.0-1028.28","5.6.0-1031.32","5.6.0-1032.33","5.6.0-1033.35","5.6.0-1034.36","5.6.0-1035.37","5.6.0-1036.39","5.6.0-1039.43","5.6.0-1042.46","5.6.0-1047.51","5.6.0-1048.52","5.6.0-1050.54","5.6.0-1052.56","5.6.0-1053.57","5.6.0-1054.58","5.6.0-1055.59","5.6.0-1056.60"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1008.8~20.04.1","5.11.0-1013.14~20.04.1","5.11.0-1016.17~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1019.20~20.04.1","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1025.27~20.04.1","5.11.0-1027.30~20.04.1","5.11.0-1028.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.13","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1011.13~20.04.2","5.13.0-1015.19~20.04.1","5.13.0-1016.20~20.04.1","5.13.0-1018.22~20.04.1","5.13.0-1021.26~20.04.1","5.13.0-1025.30~20.04.1","5.13.0-1027.32~20.04.1","5.13.0-1028.33~20.04.1","5.13.0-1030.35~20.04.1","5.13.0-1033.39~20.04.1","5.13.0-1034.40~20.04.1","5.13.0-1036.43~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-oracle-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-1031.32~20.04.2","5.8.0-1033.34~20.04.1","5.8.0-1034.35~20.04.2","5.8.0-1037.38~20.04.1","5.8.0-1038.39~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-raspi2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.3.0-1007.8","5.3.0-1014.16","5.3.0-1015.17","5.3.0-1017.19","5.4.0-1004.4","5.4.0-1006.6"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.4.0-24.28","5.4.0-26.30","5.4.0-27.31","5.4.0-28.32","5.4.0-30.34","5.4.0-31.35","5.4.0-33.37","5.4.0-34.38","5.4.0-36.41","5.4.0-37.42","5.4.0-39.44","5.4.0-40.45"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.11.0-1015.16~20.04.1","5.11.0-1017.18~20.04.1","5.11.0-1018.19~20.04.2","5.11.0-1020.21~20.04.1","5.11.0-1021.22~20.04.1","5.11.0-1022.23~20.04.1","5.11.0-1023.24~20.04.1","5.11.0-1024.25~20.04.1","5.11.0-1026.28~20.04.1","5.11.0-1028.31~20.04.1","5.11.0-1029.32~20.04.1","5.11.0-1030.34","5.11.0-1031.35"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"linux-riscv-5.8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.0-14.16~20.04.1","5.8.0-14.16~20.04.3","5.8.0-16.18~20.04.1","5.8.0-17.19~20.04.1","5.8.0-18.20~20.04.1","5.8.0-20.22~20.04.1","5.8.0-22.24~20.04.1","5.8.0-25.27~20.04.1","5.8.0-26.28~20.04.1","5.8.0-29.31~20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-allwinner-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1007.7~22.04.1","5.19.0-1009.9~22.04.1","5.19.0-1010.10~22.04.1","5.19.0-1011.11~22.04.1","5.19.0-1012.12~22.04.1","5.19.0-1013.13~22.04.1","5.19.0-1014.14~22.04.1","5.19.0-1015.15~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1019.20~22.04.1","5.19.0-1020.21~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1026.27~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1029.30~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-aws-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1008.8~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1012.12~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.2","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1022.22~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.21~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1025.28~22.04.1","5.19.0-1026.29~22.04.1","5.19.0-1027.30~22.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1005.5~22.04.1","6.2.0-1006.6~22.04.1","6.2.0-1007.7~22.04.1","6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.3","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1","6.2.0-1019.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.7~22.04.1","6.5.0-1009.9~22.04.1","6.5.0-1010.10~22.04.1","6.5.0-1011.11~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.19~22.04.2","6.5.0-1019.20~22.04.1","6.5.0-1021.22~22.04.1","6.5.0-1022.23~22.04.1","6.5.0-1023.24~22.04.1","6.5.0-1024.25~22.04.1","6.5.0-1025.26~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1025.28~22.04.1.1","5.19.0-1026.29~22.04.1.1","5.19.0-1027.30~22.04.2.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-azure-fde-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1.1","6.2.0-1009.9~22.04.3.1","6.2.0-1011.11~22.04.1.1","6.2.0-1012.12~22.04.1.1","6.2.0-1014.14~22.04.1.1","6.2.0-1015.15~22.04.1.1","6.2.0-1016.16~22.04.1.1","6.2.0-1017.17~22.04.1.1","6.2.0-1018.18~22.04.1.1","6.2.0-1019.19~22.04.1.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1020.22~22.04.2","5.19.0-1021.23~22.04.1","5.19.0-1022.24~22.04.1","5.19.0-1024.26~22.04.1","5.19.0-1025.27~22.04.1","5.19.0-1026.28~22.04.1","5.19.0-1027.29~22.04.1","5.19.0-1030.32~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1009.9~22.04.3","6.2.0-1010.10~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1011.11~22.04.3","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1016.18~22.04.1","6.2.0-1017.19~22.04.1","6.2.0-1018.20~22.04.1","6.2.0-1019.21~22.04.1","6.2.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-gcp-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1010.10~22.04.3","6.5.0-1011.11~22.04.1","6.5.0-1013.13~22.04.1","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1017.17~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1022.24~22.04.1","6.5.0-1023.25~22.04.1","6.5.0-1024.26~22.04.1","6.5.0-1025.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-28.29~22.04.1","5.19.0-32.33~22.04.1","5.19.0-35.36~22.04.1","5.19.0-38.39~22.04.1","5.19.0-40.41~22.04.1","5.19.0-41.42~22.04.1","5.19.0-42.43~22.04.1","5.19.0-43.44~22.04.1","5.19.0-45.46~22.04.1","5.19.0-46.47~22.04.1","5.19.0-50.50"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-25.25~22.04.2","6.2.0-26.26~22.04.1","6.2.0-31.31~22.04.1","6.2.0-32.32~22.04.1","6.2.0-33.33~22.04.1","6.2.0-34.34~22.04.1","6.2.0-35.35~22.04.1","6.2.0-36.37~22.04.1","6.2.0-37.38~22.04.1","6.2.0-39.40~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14~22.04.1","6.5.0-15.15~22.04.1","6.5.0-17.17~22.04.1","6.5.0-18.18~22.04.1","6.5.0-21.21~22.04.1","6.5.0-25.25~22.04.1","6.5.0-26.26~22.04.1","6.5.0-27.28~22.04.1","6.5.0-28.29~22.04.1","6.5.0-35.35~22.04.1","6.5.0-41.41~22.04.2","6.5.0-44.44~22.04.1","6.5.0-45.45~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-intel-iot-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1073.75"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1021.22~22.04.1","5.19.0-1022.23~22.04.1","5.19.0-1023.24~22.04.1","5.19.0-1024.25~22.04.1","5.19.0-1025.26~22.04.1","5.19.0-1027.28~22.04.1","5.19.0-1028.29~22.04.1","5.19.0-1030.30"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1008.8~22.04.1","6.2.0-1009.9~22.04.1","6.2.0-1011.11~22.04.1","6.2.0-1012.12~22.04.1","6.2.0-1013.13~22.04.1","6.2.0-1014.14~22.04.1","6.2.0-1015.15~22.04.1","6.2.0-1016.16~22.04.1","6.2.0-1017.17~22.04.1","6.2.0-1018.18~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-lowlatency-hwe-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-14.14.1~22.04.1","6.5.0-15.15.1.1~22.04.1","6.5.0-17.17.1.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-41.41.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-44.44.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-nvidia-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1003.3~22.04.1","6.2.0-1009.9","6.2.0-1010.10","6.2.0-1011.11","6.2.0-1012.12","6.2.0-1013.13","6.2.0-1015.15"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-5.17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.17.0-1003.3","5.17.0-1004.4","5.17.0-1006.6","5.17.0-1011.12","5.17.0-1012.13","5.17.0-1013.14","5.17.0-1014.15","5.17.0-1015.16","5.17.0-1016.17","5.17.0-1017.18","5.17.0-1018.19","5.17.0-1019.20","5.17.0-1020.21","5.17.0-1021.22","5.17.0-1024.25","5.17.0-1025.26","5.17.0-1026.27","5.17.0-1027.28","5.17.0-1028.29","5.17.0-1029.30","5.17.0-1030.31","5.17.0-1031.32","5.17.0-1032.33","5.17.0-1033.34","5.17.0-1034.35","5.17.0-1035.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.0.0-1006.6","6.0.0-1007.7","6.0.0-1008.8","6.0.0-1009.9","6.0.0-1010.10","6.0.0-1011.11","6.0.0-1012.12","6.0.0-1013.13","6.0.0-1014.14","6.0.0-1015.15","6.0.0-1016.16","6.0.0-1017.17","6.0.0-1018.18","6.0.0-1019.19","6.0.0-1020.20","6.0.0-1021.21"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.0-1004.4","6.1.0-1006.6","6.1.0-1007.7","6.1.0-1008.8","6.1.0-1009.9","6.1.0-1010.10","6.1.0-1012.12","6.1.0-1013.13","6.1.0-1014.14","6.1.0-1015.15","6.1.0-1016.16","6.1.0-1017.17","6.1.0-1019.19","6.1.0-1020.20","6.1.0-1021.21","6.1.0-1022.22","6.1.0-1023.23","6.1.0-1024.24","6.1.0-1025.25","6.1.0-1026.26","6.1.0-1027.27","6.1.0-1028.28","6.1.0-1029.29","6.1.0-1033.33","6.1.0-1034.34","6.1.0-1035.35","6.1.0-1036.36"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oem-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1003.3","6.5.0-1004.4","6.5.0-1006.6","6.5.0-1007.7","6.5.0-1008.8","6.5.0-1009.10","6.5.0-1011.12","6.5.0-1013.14","6.5.0-1014.15","6.5.0-1015.16","6.5.0-1016.17","6.5.0-1018.19","6.5.0-1019.20","6.5.0-1020.21","6.5.0-1022.23","6.5.0-1023.24","6.5.0-1024.25","6.5.0-1025.26","6.5.0-1027.28"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-oracle-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1013.13~22.04.4","6.5.0-1014.14~22.04.1","6.5.0-1015.15~22.04.1","6.5.0-1016.16~22.04.1","6.5.0-1018.18~22.04.1","6.5.0-1019.19~22.04.1","6.5.0-1020.20~22.04.1","6.5.0-1021.21~22.04.1","6.5.0-1023.23~22.04.1","6.5.0-1024.24~22.04.1","6.5.0-1025.25~22.04.1","6.5.0-1026.26~22.04.1","6.5.0-1027.27~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.15.0-1032.35"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.13.0-1004.4","5.13.0-1006.6+22.04.1","5.13.0-1007.7+22.04.1","5.13.0-1010.11+22.04.1","5.15.0-1004.4","5.15.0-1005.5","5.15.0-1006.6","5.15.0-1007.7","5.15.0-1008.8","5.15.0-1011.12","5.15.0-1012.13","5.15.0-1014.16","5.15.0-1015.17","5.15.0-1016.18","5.15.0-1017.19","5.15.0-1018.21","5.15.0-1019.22","5.15.0-1020.23","5.15.0-1022.26","5.15.0-1023.27","5.15.0-1026.30","5.15.0-1027.31","5.15.0-1028.32"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1012.13~22.04.1","5.19.0-1015.16~22.04.1","5.19.0-1016.17~22.04.1","5.19.0-1017.18~22.04.1","5.19.0-1018.19~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1","5.19.0-1021.23~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-riscv-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-17.17.1.1~22.04.1","6.5.0-21.21.1~22.04.1","6.5.0-25.25.1~22.04.1","6.5.0-26.26.1~22.04.1","6.5.0-27.28.1~22.04.1","6.5.0-28.29.1~22.04.1","6.5.0-35.35.1~22.04.1","6.5.0-40.40.1~22.04.1","6.5.0-42.42.1~22.04.1","6.5.0-45.45.1~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-5.19","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.19.0-1014.16~22.04.1","5.19.0-1015.17~22.04.1","5.19.0-1016.18~22.04.1","5.19.0-1017.19~22.04.1","5.19.0-1018.20~22.04.1","5.19.0-1019.21~22.04.1","5.19.0-1020.22~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.2.0-1006.7~22.04.1","6.2.0-1007.8~22.04.1","6.2.0-1009.10~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"linux-starfive-6.5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.5.0-1007.8~22.04.1","6.5.0-1008.9~22.04.1","6.5.0-1009.10~22.04.1","6.5.0-1010.11~22.04.1","6.5.0-1011.12~22.04.1","6.5.0-1012.13~22.04.1","6.5.0-1014.15~22.04.1","6.5.0-1015.16~22.04.1","6.5.0-1016.17~22.04.1","6.5.0-1017.18~22.04.1","6.5.0-1018.19~22.04.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"linux-raspi-realtime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.8.0-2019.20"]}],"products":[{"vendor":"linux","product":"linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"https://git.kernel.org/stable/c/e51f30826bc5384801df98d76109c94953d1df64","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/8ffb8ac3448845f65634889b051bd65e4dee484b","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/b4fcc081e527aa2ce12e956912fc47e251f6bd27","tags":["Patch","web","report"]},{"url":"https://git.kernel.org/stable/c/6069da443bf65f513bb507bb21e2f87cfb1ad0b6","tags":["Patch","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48935","tags":["advisory"]},{"url":"https://git.kernel.org/stable/c/88c795491bf45a8c08a0f94c9ca4f13722e51013","tags":["report"]},{"url":"https://git.kernel.org/stable/c/b05a24cc453e3cd51b0c79e3c583b5d495eba1d6","tags":["report"]},{"url":"https://github.com/advisories/GHSA-4qph-c4vr-m25p"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48935.json","tags":["advisory"]},{"url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-48935","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2078","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48920","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36946","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38613","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39490","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41002","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41015","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41059","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42120","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42122","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42265","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42271","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42280","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42281","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42284","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42285","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42288","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42297","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42302","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42305","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42308","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42318","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43819","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43828","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43831","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43853","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43860","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43861","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43866","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43879","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43882","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2024-2080","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47504","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-47556","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48634","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48639","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48642","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48643","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48644","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48648","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48663","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48671","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48672","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48675","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48686","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48691","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48873","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-48899","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52893","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52898","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52901","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52903","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22386","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243227-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1193629","tags":["report"]},{"url":"https://bugzilla.suse.com/1194111","tags":["report"]},{"url":"https://bugzilla.suse.com/1194765","tags":["report"]},{"url":"https://bugzilla.suse.com/1196261","tags":["report"]},{"url":"https://bugzilla.suse.com/1196516","tags":["report"]},{"url":"https://bugzilla.suse.com/1196894","tags":["report"]},{"url":"https://bugzilla.suse.com/1198017","tags":["report"]},{"url":"https://bugzilla.suse.com/1203360","tags":["report"]},{"url":"https://bugzilla.suse.com/1206006","tags":["report"]},{"url":"https://bugzilla.suse.com/1206258","tags":["report"]},{"url":"https://bugzilla.suse.com/1207158","tags":["report"]},{"url":"https://bugzilla.suse.com/1216834","tags":["report"]},{"url":"https://bugzilla.suse.com/1221326","tags":["report"]},{"url":"https://bugzilla.suse.com/1221645","tags":["report"]},{"url":"https://bugzilla.suse.com/1223191","tags":["report"]},{"url":"https://bugzilla.suse.com/1224105","tags":["report"]},{"url":"https://bugzilla.suse.com/1227832","tags":["report"]},{"url":"https://bugzilla.suse.com/1228020","tags":["report"]},{"url":"https://bugzilla.suse.com/1228466","tags":["report"]},{"url":"https://bugzilla.suse.com/1228516","tags":["report"]},{"url":"https://bugzilla.suse.com/1228576","tags":["report"]},{"url":"https://bugzilla.suse.com/1228718","tags":["report"]},{"url":"https://bugzilla.suse.com/1228801","tags":["report"]},{"url":"https://bugzilla.suse.com/1228959","tags":["report"]},{"url":"https://bugzilla.suse.com/1229042","tags":["report"]},{"url":"https://bugzilla.suse.com/1229292","tags":["report"]},{"url":"https://bugzilla.suse.com/1229400","tags":["report"]},{"url":"https://bugzilla.suse.com/1229454","tags":["report"]},{"url":"https://bugzilla.suse.com/1229500","tags":["report"]},{"url":"https://bugzilla.suse.com/1229503","tags":["report"]},{"url":"https://bugzilla.suse.com/1229506","tags":["report"]},{"url":"https://bugzilla.suse.com/1229507","tags":["report"]},{"url":"https://bugzilla.suse.com/1229508","tags":["report"]},{"url":"https://bugzilla.suse.com/1229509","tags":["report"]},{"url":"https://bugzilla.suse.com/1229510","tags":["report"]},{"url":"https://bugzilla.suse.com/1229512","tags":["report"]},{"url":"https://bugzilla.suse.com/1229516","tags":["report"]},{"url":"https://bugzilla.suse.com/1229522","tags":["report"]},{"url":"https://bugzilla.suse.com/1229526","tags":["report"]},{"url":"https://bugzilla.suse.com/1229528","tags":["report"]},{"url":"https://bugzilla.suse.com/1229531","tags":["report"]},{"url":"https://bugzilla.suse.com/1229533","tags":["report"]},{"url":"https://bugzilla.suse.com/1229535","tags":["report"]},{"url":"https://bugzilla.suse.com/1229536","tags":["report"]},{"url":"https://bugzilla.suse.com/1229537","tags":["report"]},{"url":"https://bugzilla.suse.com/1229540","tags":["report"]},{"url":"https://bugzilla.suse.com/1229544","tags":["report"]},{"url":"https://bugzilla.suse.com/1229554","tags":["report"]},{"url":"https://bugzilla.suse.com/1229557","tags":["report"]},{"url":"https://bugzilla.suse.com/1229565","tags":["report"]},{"url":"https://bugzilla.suse.com/1229566","tags":["report"]},{"url":"https://bugzilla.suse.com/1229568","tags":["report"]},{"url":"https://bugzilla.suse.com/1229581","tags":["report"]},{"url":"https://bugzilla.suse.com/1229598","tags":["report"]},{"url":"https://bugzilla.suse.com/1229603","tags":["report"]},{"url":"https://bugzilla.suse.com/1229604","tags":["report"]},{"url":"https://bugzilla.suse.com/1229608","tags":["report"]},{"url":"https://bugzilla.suse.com/1229611","tags":["report"]},{"url":"https://bugzilla.suse.com/1229612","tags":["report"]},{"url":"https://bugzilla.suse.com/1229613","tags":["report"]},{"url":"https://bugzilla.suse.com/1229614","tags":["report"]},{"url":"https://bugzilla.suse.com/1229617","tags":["report"]},{"url":"https://bugzilla.suse.com/1229619","tags":["report"]},{"url":"https://bugzilla.suse.com/1229620","tags":["report"]},{"url":"https://bugzilla.suse.com/1229622","tags":["report"]},{"url":"https://bugzilla.suse.com/1229623","tags":["report"]},{"url":"https://bugzilla.suse.com/1229624","tags":["report"]},{"url":"https://bugzilla.suse.com/1229625","tags":["report"]},{"url":"https://bugzilla.suse.com/1229626","tags":["report"]},{"url":"https://bugzilla.suse.com/1229628","tags":["report"]},{"url":"https://bugzilla.suse.com/1229629","tags":["report"]},{"url":"https://bugzilla.suse.com/1229630","tags":["report"]},{"url":"https://bugzilla.suse.com/1229631","tags":["report"]},{"url":"https://bugzilla.suse.com/1229635","tags":["report"]},{"url":"https://bugzilla.suse.com/1229636","tags":["report"]},{"url":"https://bugzilla.suse.com/1229637","tags":["report"]},{"url":"https://bugzilla.suse.com/1229638","tags":["report"]},{"url":"https://bugzilla.suse.com/1229639","tags":["report"]},{"url":"https://bugzilla.suse.com/1229641","tags":["report"]},{"url":"https://bugzilla.suse.com/1229642","tags":["report"]},{"url":"https://bugzilla.suse.com/1229643","tags":["report"]},{"url":"https://bugzilla.suse.com/1229645","tags":["report"]},{"url":"https://bugzilla.suse.com/1229657","tags":["report"]},{"url":"https://bugzilla.suse.com/1229664","tags":["report"]},{"url":"https://bugzilla.suse.com/1229707","tags":["report"]},{"url":"https://bugzilla.suse.com/1229792","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48868","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48869","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48878","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48899","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48909","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48915","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48917","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48924","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48925","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48926","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48927","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48930","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48932","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48934","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48937","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48941","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52896","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40910","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41062","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41087","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42077","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42232","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42271","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44938","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44947","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243408-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1194869","tags":["report"]},{"url":"https://bugzilla.suse.com/1228114","tags":["report"]},{"url":"https://bugzilla.suse.com/1228489","tags":["report"]},{"url":"https://bugzilla.suse.com/1230245","tags":["report"]},{"url":"https://bugzilla.suse.com/1230413","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4382","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42230","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45003","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243569-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1199769","tags":["report"]},{"url":"https://bugzilla.suse.com/1216223","tags":["report"]},{"url":"https://bugzilla.suse.com/1220382","tags":["report"]},{"url":"https://bugzilla.suse.com/1221610","tags":["report"]},{"url":"https://bugzilla.suse.com/1221650","tags":["report"]},{"url":"https://bugzilla.suse.com/1222629","tags":["report"]},{"url":"https://bugzilla.suse.com/1222973","tags":["report"]},{"url":"https://bugzilla.suse.com/1223600","tags":["report"]},{"url":"https://bugzilla.suse.com/1223848","tags":["report"]},{"url":"https://bugzilla.suse.com/1224085","tags":["report"]},{"url":"https://bugzilla.suse.com/1225903","tags":["report"]},{"url":"https://bugzilla.suse.com/1226003","tags":["report"]},{"url":"https://bugzilla.suse.com/1226606","tags":["report"]},{"url":"https://bugzilla.suse.com/1226662","tags":["report"]},{"url":"https://bugzilla.suse.com/1226666","tags":["report"]},{"url":"https://bugzilla.suse.com/1226846","tags":["report"]},{"url":"https://bugzilla.suse.com/1226860","tags":["report"]},{"url":"https://bugzilla.suse.com/1226875","tags":["report"]},{"url":"https://bugzilla.suse.com/1226915","tags":["report"]},{"url":"https://bugzilla.suse.com/1227487","tags":["report"]},{"url":"https://bugzilla.suse.com/1227726","tags":["report"]},{"url":"https://bugzilla.suse.com/1227819","tags":["report"]},{"url":"https://bugzilla.suse.com/1227890","tags":["report"]},{"url":"https://bugzilla.suse.com/1228507","tags":["report"]},{"url":"https://bugzilla.suse.com/1228620","tags":["report"]},{"url":"https://bugzilla.suse.com/1228771","tags":["report"]},{"url":"https://bugzilla.suse.com/1229031","tags":["report"]},{"url":"https://bugzilla.suse.com/1229034","tags":["report"]},{"url":"https://bugzilla.suse.com/1229086","tags":["report"]},{"url":"https://bugzilla.suse.com/1229156","tags":["report"]},{"url":"https://bugzilla.suse.com/1229289","tags":["report"]},{"url":"https://bugzilla.suse.com/1229334","tags":["report"]},{"url":"https://bugzilla.suse.com/1229362","tags":["report"]},{"url":"https://bugzilla.suse.com/1229363","tags":["report"]},{"url":"https://bugzilla.suse.com/1229364","tags":["report"]},{"url":"https://bugzilla.suse.com/1229394","tags":["report"]},{"url":"https://bugzilla.suse.com/1229429","tags":["report"]},{"url":"https://bugzilla.suse.com/1229453","tags":["report"]},{"url":"https://bugzilla.suse.com/1229572","tags":["report"]},{"url":"https://bugzilla.suse.com/1229573","tags":["report"]},{"url":"https://bugzilla.suse.com/1229585","tags":["report"]},{"url":"https://bugzilla.suse.com/1229607","tags":["report"]},{"url":"https://bugzilla.suse.com/1229633","tags":["report"]},{"url":"https://bugzilla.suse.com/1229662","tags":["report"]},{"url":"https://bugzilla.suse.com/1229753","tags":["report"]},{"url":"https://bugzilla.suse.com/1229764","tags":["report"]},{"url":"https://bugzilla.suse.com/1229790","tags":["report"]},{"url":"https://bugzilla.suse.com/1229810","tags":["report"]},{"url":"https://bugzilla.suse.com/1229830","tags":["report"]},{"url":"https://bugzilla.suse.com/1229899","tags":["report"]},{"url":"https://bugzilla.suse.com/1229928","tags":["report"]},{"url":"https://bugzilla.suse.com/1229947","tags":["report"]},{"url":"https://bugzilla.suse.com/1230015","tags":["report"]},{"url":"https://bugzilla.suse.com/1230129","tags":["report"]},{"url":"https://bugzilla.suse.com/1230130","tags":["report"]},{"url":"https://bugzilla.suse.com/1230170","tags":["report"]},{"url":"https://bugzilla.suse.com/1230171","tags":["report"]},{"url":"https://bugzilla.suse.com/1230174","tags":["report"]},{"url":"https://bugzilla.suse.com/1230175","tags":["report"]},{"url":"https://bugzilla.suse.com/1230176","tags":["report"]},{"url":"https://bugzilla.suse.com/1230178","tags":["report"]},{"url":"https://bugzilla.suse.com/1230180","tags":["report"]},{"url":"https://bugzilla.suse.com/1230185","tags":["report"]},{"url":"https://bugzilla.suse.com/1230192","tags":["report"]},{"url":"https://bugzilla.suse.com/1230193","tags":["report"]},{"url":"https://bugzilla.suse.com/1230194","tags":["report"]},{"url":"https://bugzilla.suse.com/1230200","tags":["report"]},{"url":"https://bugzilla.suse.com/1230204","tags":["report"]},{"url":"https://bugzilla.suse.com/1230209","tags":["report"]},{"url":"https://bugzilla.suse.com/1230211","tags":["report"]},{"url":"https://bugzilla.suse.com/1230212","tags":["report"]},{"url":"https://bugzilla.suse.com/1230217","tags":["report"]},{"url":"https://bugzilla.suse.com/1230224","tags":["report"]},{"url":"https://bugzilla.suse.com/1230230","tags":["report"]},{"url":"https://bugzilla.suse.com/1230233","tags":["report"]},{"url":"https://bugzilla.suse.com/1230244","tags":["report"]},{"url":"https://bugzilla.suse.com/1230247","tags":["report"]},{"url":"https://bugzilla.suse.com/1230248","tags":["report"]},{"url":"https://bugzilla.suse.com/1230269","tags":["report"]},{"url":"https://bugzilla.suse.com/1230339","tags":["report"]},{"url":"https://bugzilla.suse.com/1230340","tags":["report"]},{"url":"https://bugzilla.suse.com/1230392","tags":["report"]},{"url":"https://bugzilla.suse.com/1230398","tags":["report"]},{"url":"https://bugzilla.suse.com/1230431","tags":["report"]},{"url":"https://bugzilla.suse.com/1230433","tags":["report"]},{"url":"https://bugzilla.suse.com/1230434","tags":["report"]},{"url":"https://bugzilla.suse.com/1230440","tags":["report"]},{"url":"https://bugzilla.suse.com/1230442","tags":["report"]},{"url":"https://bugzilla.suse.com/1230444","tags":["report"]},{"url":"https://bugzilla.suse.com/1230450","tags":["report"]},{"url":"https://bugzilla.suse.com/1230451","tags":["report"]},{"url":"https://bugzilla.suse.com/1230454","tags":["report"]},{"url":"https://bugzilla.suse.com/1230506","tags":["report"]},{"url":"https://bugzilla.suse.com/1230507","tags":["report"]},{"url":"https://bugzilla.suse.com/1230511","tags":["report"]},{"url":"https://bugzilla.suse.com/1230515","tags":["report"]},{"url":"https://bugzilla.suse.com/1230517","tags":["report"]},{"url":"https://bugzilla.suse.com/1230524","tags":["report"]},{"url":"https://bugzilla.suse.com/1230533","tags":["report"]},{"url":"https://bugzilla.suse.com/1230535","tags":["report"]},{"url":"https://bugzilla.suse.com/1230549","tags":["report"]},{"url":"https://bugzilla.suse.com/1230556","tags":["report"]},{"url":"https://bugzilla.suse.com/1230582","tags":["report"]},{"url":"https://bugzilla.suse.com/1230589","tags":["report"]},{"url":"https://bugzilla.suse.com/1230591","tags":["report"]},{"url":"https://bugzilla.suse.com/1230592","tags":["report"]},{"url":"https://bugzilla.suse.com/1230699","tags":["report"]},{"url":"https://bugzilla.suse.com/1230700","tags":["report"]},{"url":"https://bugzilla.suse.com/1230701","tags":["report"]},{"url":"https://bugzilla.suse.com/1230702","tags":["report"]},{"url":"https://bugzilla.suse.com/1230703","tags":["report"]},{"url":"https://bugzilla.suse.com/1230705","tags":["report"]},{"url":"https://bugzilla.suse.com/1230706","tags":["report"]},{"url":"https://bugzilla.suse.com/1230707","tags":["report"]},{"url":"https://bugzilla.suse.com/1230709","tags":["report"]},{"url":"https://bugzilla.suse.com/1230710","tags":["report"]},{"url":"https://bugzilla.suse.com/1230711","tags":["report"]},{"url":"https://bugzilla.suse.com/1230712","tags":["report"]},{"url":"https://bugzilla.suse.com/1230719","tags":["report"]},{"url":"https://bugzilla.suse.com/1230724","tags":["report"]},{"url":"https://bugzilla.suse.com/1230725","tags":["report"]},{"url":"https://bugzilla.suse.com/1230730","tags":["report"]},{"url":"https://bugzilla.suse.com/1230731","tags":["report"]},{"url":"https://bugzilla.suse.com/1230732","tags":["report"]},{"url":"https://bugzilla.suse.com/1230733","tags":["report"]},{"url":"https://bugzilla.suse.com/1230747","tags":["report"]},{"url":"https://bugzilla.suse.com/1230748","tags":["report"]},{"url":"https://bugzilla.suse.com/1230751","tags":["report"]},{"url":"https://bugzilla.suse.com/1230752","tags":["report"]},{"url":"https://bugzilla.suse.com/1230756","tags":["report"]},{"url":"https://bugzilla.suse.com/1230761","tags":["report"]},{"url":"https://bugzilla.suse.com/1230766","tags":["report"]},{"url":"https://bugzilla.suse.com/1230767","tags":["report"]},{"url":"https://bugzilla.suse.com/1230768","tags":["report"]},{"url":"https://bugzilla.suse.com/1230771","tags":["report"]},{"url":"https://bugzilla.suse.com/1230772","tags":["report"]},{"url":"https://bugzilla.suse.com/1230776","tags":["report"]},{"url":"https://bugzilla.suse.com/1230783","tags":["report"]},{"url":"https://bugzilla.suse.com/1230786","tags":["report"]},{"url":"https://bugzilla.suse.com/1230791","tags":["report"]},{"url":"https://bugzilla.suse.com/1230794","tags":["report"]},{"url":"https://bugzilla.suse.com/1230796","tags":["report"]},{"url":"https://bugzilla.suse.com/1230802","tags":["report"]},{"url":"https://bugzilla.suse.com/1230806","tags":["report"]},{"url":"https://bugzilla.suse.com/1230808","tags":["report"]},{"url":"https://bugzilla.suse.com/1230810","tags":["report"]},{"url":"https://bugzilla.suse.com/1230812","tags":["report"]},{"url":"https://bugzilla.suse.com/1230813","tags":["report"]},{"url":"https://bugzilla.suse.com/1230814","tags":["report"]},{"url":"https://bugzilla.suse.com/1230815","tags":["report"]},{"url":"https://bugzilla.suse.com/1230821","tags":["report"]},{"url":"https://bugzilla.suse.com/1230825","tags":["report"]},{"url":"https://bugzilla.suse.com/1230830","tags":["report"]},{"url":"https://bugzilla.suse.com/1231013","tags":["report"]},{"url":"https://bugzilla.suse.com/1231017","tags":["report"]},{"url":"https://bugzilla.suse.com/1231116","tags":["report"]},{"url":"https://bugzilla.suse.com/1231120","tags":["report"]},{"url":"https://bugzilla.suse.com/1231146","tags":["report"]},{"url":"https://bugzilla.suse.com/1231180","tags":["report"]},{"url":"https://bugzilla.suse.com/1231181","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48911","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48923","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-48945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52610","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-52916","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26640","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26767","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26837","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38596","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-38632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40973","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-40983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41082","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42154","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42265","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42304","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42305","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-42306","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43835","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43912","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43914","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44944","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44946","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44950","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44952","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44967","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44969","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44970","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44971","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44972","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44977","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44982","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44986","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44987","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44988","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44989","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44990","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44999","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45000","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45001","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45007","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45008","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45011","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45013","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45018","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45021","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-45029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46685","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46686","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46694","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46707","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46714","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46720","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46724","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46725","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46726","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46737","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46738","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46739","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46743","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46744","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46747","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46753","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46759","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46771","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46772","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46773","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46774","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46778","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46780","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46781","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46784","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46787","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46798","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46830","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243587-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054914","tags":["report"]},{"url":"https://bugzilla.suse.com/1065729","tags":["report"]},{"url":"https://bugzilla.suse.com/1226631","tags":["report"]},{"url":"https://bugzilla.suse.com/1228747","tags":["report"]},{"url":"https://bugzilla.suse.com/1229891","tags":["report"]},{"url":"https://bugzilla.suse.com/1230055","tags":["report"]},{"url":"https://bugzilla.suse.com/1230289","tags":["report"]},{"url":"https://bugzilla.suse.com/1230550","tags":["report"]},{"url":"https://bugzilla.suse.com/1230763","tags":["report"]},{"url":"https://bugzilla.suse.com/1230774","tags":["report"]},{"url":"https://bugzilla.suse.com/1231084","tags":["report"]},{"url":"https://bugzilla.suse.com/1231085","tags":["report"]},{"url":"https://bugzilla.suse.com/1231087","tags":["report"]},{"url":"https://bugzilla.suse.com/1231115","tags":["report"]},{"url":"https://bugzilla.suse.com/1231277","tags":["report"]},{"url":"https://bugzilla.suse.com/1231327","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46770","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46775","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-46857","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243592-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-48935","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-48935","tags":["report"]},{"url":"https://git.kernel.org/linus/6069da443bf65f513bb507bb21e2f87cfb1ad0b6","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-48935","title":"netfilter: nf_tables: unregister flowtable hooks on netns exit","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\n\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\n\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\n\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\n\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.","status":"published","published":"2024-08-22T03:31:29.598Z","modified":"2026-08-05T08:53:00.192Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:34:33.913527Z"}],"euvd":[{"id":"EUVD-2022-53814","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\n\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\n\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\n\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\n\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.","status":"published","published":"2024-08-22T03:31:29Z","modified":"2026-08-05T08:53:00Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:21.005233Z"}],"ghsa":[{"id":"GHSA-4qph-c4vr-m25p","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables:...","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\n\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\n\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\n\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\n\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.","status":"published","published":"2024-08-22T06:30:29Z","modified":"2024-08-23T03:32:03Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:58:03.52689Z"}],"nvd":[{"id":"CVE-2022-48935","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\n\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\n\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\n\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\n\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.","status":"published","published":"2024-08-22T04:15:16.877Z","modified":"2026-08-04T10:17:27.187Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:40.977475Z"}],"osv":[{"id":"CVE-2022-48935","title":"netfilter: nf_tables: unregister flowtable hooks on netns exit","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\n\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\n\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\n\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\n\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.","status":"published","published":"2024-08-22T03:31:29.598Z","modified":"2026-10-28T02:30:54.998947021Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:28.090335Z"},{"id":"DEBIAN-CVE-2022-48935","description":"In the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_tables: unregister flowtable hooks on netns exit  Unregister flowtable hooks before they are releases via nf_tables_flowtable_destroy() otherwise hook core reports UAF.  BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666  CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace:  \u003cTASK\u003e  __dump_stack lib/dump_stack.c:88 [inline]  __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106  dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106  print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247  __kasan_report mm/kasan/report.c:433 [inline]  __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450  kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450  nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142  __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429  nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571  nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232  nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430  nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]  nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]  nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652  nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652  nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652  __nft_release_hook() calls nft_unregister_flowtable_net_hooks() which only unregisters the hooks, then after RCU grace period, it is guaranteed that no packets add new entries to the flowtable (no flow offload rules and flowtable hooks are reachable from packet path), so it is safe to call nf_flow_table_free() which cleans up the remaining entries from the flowtable (both software and hardware) and it unbinds the flow_block.","status":"published","published":"2024-08-22T04:15:16.877Z","modified":"2026-11-03T08:00:14.076849166Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:15.646766Z"},{"id":"OESA-2024-2078","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: get rid of warning on transaction commit when using flushoncommit\r\n\r\nWhen using the flushoncommit mount option, during almost every transaction\ncommit we trigger a warning from __writeback_inodes_sb_nr():\r\n\r\n  $ cat fs/fs-writeback.c:\n  (...)\n  static void __writeback_inodes_sb_nr(struct super_block *sb, ...\n  {\n        (...)\n        WARN_ON(!rwsem_is_locked(\u0026amp;sb-\u0026gt;s_umount));\n        (...)\n  }\n  (...)\r\n\r\nThe trace produced in dmesg looks like the following:\r\n\r\n  [947.473890] WARNING: CPU: 5 PID: 930 at fs/fs-writeback.c:2610 __writeback_inodes_sb_nr+0x7e/0xb3\n  [947.481623] Modules linked in: nfsd nls_cp437 cifs asn1_decoder cifs_arc4 fscache cifs_md4 ipmi_ssif\n  [947.489571] CPU: 5 PID: 930 Comm: btrfs-transacti Not tainted 95.16.3-srb-asrock-00001-g36437ad63879 #186\n  [947.497969] RIP: 0010:__writeback_inodes_sb_nr+0x7e/0xb3\n  [947.502097] Code: 24 10 4c 89 44 24 18 c6 (...)\n  [947.519760] RSP: 0018:ffffc90000777e10 EFLAGS: 00010246\n  [947.523818] RAX: 0000000000000000 RBX: 0000000000963300 RCX: 0000000000000000\n  [947.529765] RDX: 0000000000000000 RSI: 000000000000fa51 RDI: ffffc90000777e50\n  [947.535740] RBP: ffff888101628a90 R08: ffff888100955800 R09: ffff888100956000\n  [947.541701] R10: 0000000000000002 R11: 0000000000000001 R12: ffff888100963488\n  [947.547645] R13: ffff888100963000 R14: ffff888112fb7200 R15: ffff888100963460\n  [947.553621] FS:  0000000000000000(0000) GS:ffff88841fd40000(0000) knlGS:0000000000000000\n  [947.560537] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [947.565122] CR2: 0000000008be50c4 CR3: 000000000220c000 CR4: 00000000001006e0\n  [947.571072] Call Trace:\n  [947.572354]  \u0026lt;TASK\u0026gt;\n  [947.573266]  btrfs_commit_transaction+0x1f1/0x998\n  [947.576785]  ? start_transaction+0x3ab/0x44e\n  [947.579867]  ? schedule_timeout+0x8a/0xdd\n  [947.582716]  transaction_kthread+0xe9/0x156\n  [947.585721]  ? btrfs_cleanup_transaction.isra.0+0x407/0x407\n  [947.590104]  kthread+0x131/0x139\n  [947.592168]  ? set_kthread_struct+0x32/0x32\n  [947.595174]  ret_from_fork+0x22/0x30\n  [947.597561]  \u0026lt;/TASK\u0026gt;\n  [947.598553] ---[ end trace 644721052755541c ]---\r\n\r\nThis is because we started using writeback_inodes_sb() to flush delalloc\nwhen committing a transaction (when using -o flushoncommit), in order to\navoid deadlocks with filesystem freeze operations. This change was made\nby commit ce8ea7cc6eb313 (\u0026quot;btrfs: don\u0026apos;t call btrfs_start_delalloc_roots\nin flushoncommit\u0026quot;). After that change we started producing that warning,\nand every now and then a user reports this since the warning happens too\noften, it spams dmesg/syslog, and a user is unsure if this reflects any\nproblem that might compromise the filesystem\u0026apos;s reliability.\r\n\r\nWe can not just lock the sb-\u0026gt;s_umount semaphore before calling\nwriteback_inodes_sb(), because that would at least deadlock with\nfilesystem freezing, since at fs/super.c:freeze_super() sync_filesystem()\nis called while we are holding that semaphore in write mode, and that can\ntrigger a transaction commit, resulting in a deadlock. It would also\ntrigger the same type of deadlock in the unmount path. Possibly, it could\nalso introduce some other locking dependencies that lockdep would report.\r\n\r\nTo fix this call try_to_writeback_inodes_sb() instead of\nwriteback_inodes_sb(), because that will try to read lock sb-\u0026gt;s_umount\nand then will only call writeback_inodes_sb() if it was able to lock it.\nThis is fine because the cases where it can\u0026apos;t read lock sb-\u0026gt;s_umount\nare during a filesystem unmount or during a filesystem freeze - in those\ncases sb-\u0026gt;s_umount is write locked and sync_filesystem() is called, which\ncalls writeback_inodes_sb(). In other words, in all cases where we can\u0026apos;t\ntake a read lock on sb-\u0026gt;s_umount, writeback is already being triggered\nelsewhere.\r\n\r\nAn alternative would be to call btrfs_start_delalloc_roots() with a\nnumber of pages different from LONG_MAX, for example matching the number\nof delalloc bytes we currently have, in \n---truncated---(CVE-2022-48920)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\r\n\r\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\r\n\r\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\r\n\r\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\r\n\r\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.(CVE-2022-48935)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nphonet: fix rtm_phonet_notify() skb allocation\r\n\r\nfill_route() stores three components in the skb:\r\n\r\n- struct rtmsg\n- RTA_DST (u8)\n- RTA_OIF (u32)\r\n\r\nTherefore, rtm_phonet_notify() should use\r\n\r\nNLMSG_ALIGN(sizeof(struct rtmsg)) +\nnla_total_size(1) +\nnla_total_size(4)(CVE-2024-36946)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nm68k: Fix spinlock race in kernel thread creation\r\n\r\nContext switching does take care to retain the correct lock owner across\nthe switch from \u0026apos;prev\u0026apos; to \u0026apos;next\u0026apos; tasks.  This does rely on interrupts\nremaining disabled for the entire duration of the switch.\r\n\r\nThis condition is guaranteed for normal process creation and context\nswitching between already running processes, because both \u0026apos;prev\u0026apos; and\n\u0026apos;next\u0026apos; already have interrupts disabled in their saved copies of the\nstatus register.\r\n\r\nThe situation is different for newly created kernel threads.  The status\nregister is set to PS_S in copy_thread(), which does leave the IPL at 0.\nUpon restoring the \u0026apos;next\u0026apos; thread\u0026apos;s status register in switch_to() aka\nresume(), interrupts then become enabled prematurely.  resume() then\nreturns via ret_from_kernel_thread() and schedule_tail() where run queue\nlock is released (see finish_task_switch() and finish_lock_switch()).\r\n\r\nA timer interrupt calling scheduler_tick() before the lock is released\nin finish_task_switch() will find the lock already taken, with the\ncurrent task as lock owner.  This causes a spinlock recursion warning as\nreported by Guenter Roeck.\r\n\r\nAs far as I can ascertain, this race has been opened in commit\n533e6903bea0 (\u0026quot;m68k: split ret_from_fork(), simplify kernel_thread()\u0026quot;)\nbut I haven\u0026apos;t done a detailed study of kernel history so it may well\npredate that commit.\r\n\r\nInterrupts cannot be disabled in the saved status register copy for\nkernel threads (init will complain about interrupts disabled when\nfinally starting user space).  Disable interrupts temporarily when\nswitching the tasks\u0026apos; register sets in resume().\r\n\r\nNote that a simple oriw 0x700,%sr after restoring sr is not enough here\n- this leaves enough of a race for the \u0026apos;spinlock recursion\u0026apos; warning to\nstill be observed.\r\n\r\nTested on ARAnyM and qemu (Quadra 800 emulation).(CVE-2024-38613)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix missing sk_buff release in seg6_input_core\r\n\r\nThe seg6_input() function is responsible for adding the SRH into a\npacket, delegating the operation to the seg6_input_core(). This function\nuses the skb_cow_head() to ensure that there is sufficient headroom in\nthe sk_buff for accommodating the link-layer header.\nIn the event that the skb_cow_header() function fails, the\nseg6_input_core() catches the error but it does not release the sk_buff,\nwhich will result in a memory leak.\r\n\r\nThis issue was introduced in commit af3b5158b89d (\u0026quot;ipv6: sr: fix BUG due\nto headroom too small after SRH push\u0026quot;) and persists even after commit\n7a3f5b0de364 (\u0026quot;netfilter: add netfilter hooks to SRv6 data plane\u0026quot;),\nwhere the entire seg6_input() code was refactored to deal with netfilter\nhooks.\r\n\r\nThe proposed patch addresses the identified memory leak by requiring the\nseg6_input_core() function to release the sk_buff in the event that\nskb_cow_head() fails.(CVE-2024-39490)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: hisilicon/sec - Fix memory leak for sec resource release\r\n\r\nThe AIV is one of the SEC resources. When releasing resources,\nit need to release the AIV resources at the same time.\nOtherwise, memory leakage occurs.\r\n\r\nThe aiv resource release is added to the sec resource release\nfunction.(CVE-2024-41002)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nocfs2: add bounds checking to ocfs2_check_dir_entry()\r\n\r\nThis adds sanity checks for ocfs2_dir_entry to make sure all members of\nocfs2_dir_entry don\u0026apos;t stray beyond valid memory region.(CVE-2024-41015)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nhfsplus: fix uninit-value in copy_name\r\n\r\n[syzbot reported]\nBUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160\n sized_strscpy+0xc4/0x160\n copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411\n hfsplus_listxattr+0x11e9/0x1a50 fs/hfsplus/xattr.c:750\n vfs_listxattr fs/xattr.c:493 [inline]\n listxattr+0x1f3/0x6b0 fs/xattr.c:840\n path_listxattr fs/xattr.c:864 [inline]\n __do_sys_listxattr fs/xattr.c:876 [inline]\n __se_sys_listxattr fs/xattr.c:873 [inline]\n __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873\n x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\r\n\r\nUninit was created at:\n slab_post_alloc_hook mm/slub.c:3877 [inline]\n slab_alloc_node mm/slub.c:3918 [inline]\n kmalloc_trace+0x57b/0xbe0 mm/slub.c:4065\n kmalloc include/linux/slab.h:628 [inline]\n hfsplus_listxattr+0x4cc/0x1a50 fs/hfsplus/xattr.c:699\n vfs_listxattr fs/xattr.c:493 [inline]\n listxattr+0x1f3/0x6b0 fs/xattr.c:840\n path_listxattr fs/xattr.c:864 [inline]\n __do_sys_listxattr fs/xattr.c:876 [inline]\n __se_sys_listxattr fs/xattr.c:873 [inline]\n __x64_sys_listxattr+0x16b/0x2f0 fs/xattr.c:873\n x64_sys_call+0x2ba0/0x3b50 arch/x86/include/generated/asm/syscalls_64.h:195\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[Fix]\nWhen allocating memory to strbuf, initialize memory to 0.(CVE-2024-41059)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/sclp: Fix sclp_init() cleanup on failure\r\n\r\nIf sclp_init() fails it only partially cleans up: if there are multiple\nfailing calls to sclp_init() sclp_state_change_event will be added several\ntimes to sclp_reg_list, which results in the following warning:\r\n\r\n------------[ cut here ]------------\nlist_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10.\nWARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3\nKrnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8)\n           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3\n...\nCall Trace:\n [\u0026lt;000003ffe0d6076a\u0026gt;] __list_add_valid_or_report+0xe2/0xf8\n([\u0026lt;000003ffe0d60766\u0026gt;] __list_add_valid_or_report+0xde/0xf8)\n [\u0026lt;000003ffe0a8d37e\u0026gt;] sclp_init+0x40e/0x450\n [\u0026lt;000003ffe00009f2\u0026gt;] do_one_initcall+0x42/0x1e0\n [\u0026lt;000003ffe15b77a6\u0026gt;] do_initcalls+0x126/0x150\n [\u0026lt;000003ffe15b7a0a\u0026gt;] kernel_init_freeable+0x1ba/0x1f8\n [\u0026lt;000003ffe0d6650e\u0026gt;] kernel_init+0x2e/0x180\n [\u0026lt;000003ffe000301c\u0026gt;] __ret_from_fork+0x3c/0x60\n [\u0026lt;000003ffe0d759ca\u0026gt;] ret_from_fork+0xa/0x30\r\n\r\nFix this by removing sclp_state_change_event from sclp_reg_list when\nsclp_init() fails.(CVE-2024-41068)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Check pipe offset before setting vblank\r\n\r\npipe_ctx has a size of MAX_PIPES so checking its index before accessing\nthe array.\r\n\r\nThis fixes an OVERRUN issue reported by Coverity.(CVE-2024-42120)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Add NULL pointer check for kzalloc\r\n\r\n[Why \u0026amp; How]\nCheck return pointer of kzalloc before using it.(CVE-2024-42122)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nprotect the fetch of -\u0026gt;fd[fd] in do_dup2() from mispredictions\r\n\r\nboth callers have verified that fd is not greater than -\u0026gt;max_fds;\nhowever, misprediction might end up with\n        tofree = fdt-\u0026gt;fd[fd];\nbeing speculatively executed.  That\u0026apos;s wrong for the same reasons\nwhy it\u0026apos;s wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt-\u0026gt;max_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path.(CVE-2024-42265)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/iucv: fix use after free in iucv_sock_close()\r\n\r\niucv_sever_path() is called from process context and from bh context.\niucv-\u0026gt;path is used as indicator whether somebody else is taking care of\nsevering the path (or it is already removed / never existed).\nThis needs to be done with atomic compare and swap, otherwise there is a\nsmall window where iucv_sock_close() will try to work with a path that has\nalready been severed and freed by iucv_callback_connrej() called by\niucv_tasklet_fn().\r\n\r\nExample:\n[452744.123844] Call Trace:\n[452744.123845] ([\u0026lt;0000001e87f03880\u0026gt;] 0x1e87f03880)\n[452744.123966]  [\u0026lt;00000000d593001e\u0026gt;] iucv_path_sever+0x96/0x138\n[452744.124330]  [\u0026lt;000003ff801ddbca\u0026gt;] iucv_sever_path+0xc2/0xd0 [af_iucv]\n[452744.124336]  [\u0026lt;000003ff801e01b6\u0026gt;] iucv_sock_close+0xa6/0x310 [af_iucv]\n[452744.124341]  [\u0026lt;000003ff801e08cc\u0026gt;] iucv_sock_release+0x3c/0xd0 [af_iucv]\n[452744.124345]  [\u0026lt;00000000d574794e\u0026gt;] __sock_release+0x5e/0xe8\n[452744.124815]  [\u0026lt;00000000d5747a0c\u0026gt;] sock_close+0x34/0x48\n[452744.124820]  [\u0026lt;00000000d5421642\u0026gt;] __fput+0xba/0x268\n[452744.124826]  [\u0026lt;00000000d51b382c\u0026gt;] task_work_run+0xbc/0xf0\n[452744.124832]  [\u0026lt;00000000d5145710\u0026gt;] do_notify_resume+0x88/0x90\n[452744.124841]  [\u0026lt;00000000d5978096\u0026gt;] system_call+0xe2/0x2c8\n[452744.125319] Last Breaking-Event-Address:\n[452744.125321]  [\u0026lt;00000000d5930018\u0026gt;] iucv_path_sever+0x90/0x138\n[452744.125324]\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\r\n\r\nNote that bh_lock_sock() is not serializing the tasklet context against\nprocess context, because the check for sock_owned_by_user() and\ncorresponding handling is missing.\r\n\r\nIdeas for a future clean-up patch:\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\nRe-enqueue, if needed. This may require adding return values to the\ntasklet functions and thus changes to all users of iucv.\r\n\r\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv.(CVE-2024-42271)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmISDN: Fix a use after free in hfcmulti_tx()\r\n\r\nDon\u0026apos;t dereference *sp after calling dev_kfree_skb(*sp).(CVE-2024-42280)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Fix a segment issue when downgrading gso_size\r\n\r\nLinearize the skb when downgrading gso_size because it may trigger a\nBUG_ON() later when the skb is segmented as described in [1,2].(CVE-2024-42281)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: Return non-zero value from tipc_udp_addr2str() on error\r\n\r\ntipc_udp_addr2str() should return non-zero value if the UDP media\naddress is invalid. Otherwise, a buffer overflow access can occur in\ntipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP\nmedia address.(CVE-2024-42284)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/iwcm: Fix a use-after-free related to destroying CM IDs\r\n\r\niw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with\nan existing struct iw_cm_id (cm_id) as follows:\r\n\r\n        conn_id-\u0026gt;cm_id.iw = cm_id;\n        cm_id-\u0026gt;context = conn_id;\n        cm_id-\u0026gt;cm_handler = cma_iw_handler;\r\n\r\nrdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make\nsure that cm_work_handler() does not trigger a use-after-free by only\nfreeing of the struct rdma_id_private after all pending work has finished.(CVE-2024-42285)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nscsi: qla2xxx: Fix for possible memory corruption\r\n\r\nInit Control Block is dereferenced incorrectly.  Correctly dereference ICB(CVE-2024-42288)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nf2fs: fix to don\u0026apos;t dirty inode for readonly filesystem\r\n\r\nsyzbot reports f2fs bug as below:\r\n\r\nkernel BUG at fs/f2fs/inode.c:933!\nRIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933\nCall Trace:\n evict+0x2a4/0x620 fs/inode.c:664\n dispose_list fs/inode.c:697 [inline]\n evict_inodes+0x5f8/0x690 fs/inode.c:747\n generic_shutdown_super+0x9d/0x2c0 fs/super.c:675\n kill_block_super+0x44/0x90 fs/super.c:1667\n kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894\n deactivate_locked_super+0xc1/0x130 fs/super.c:484\n cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256\n task_work_run+0x24a/0x300 kernel/task_work.c:180\n ptrace_notify+0x2cd/0x380 kernel/signal.c:2399\n ptrace_report_syscall include/linux/ptrace.h:411 [inline]\n ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline]\n syscall_exit_work kernel/entry/common.c:251 [inline]\n syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]\n syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296\n do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nThe root cause is:\n- do_sys_open\n - f2fs_lookup\n  - __f2fs_find_entry\n   - f2fs_i_depth_write\n    - f2fs_mark_inode_dirty_sync\n     - f2fs_dirty_inode\n      - set_inode_flag(inode, FI_DIRTY_INODE)\r\n\r\n- umount\n - kill_f2fs_super\n  - kill_block_super\n   - generic_shutdown_super\n    - sync_filesystem\n    : sb is readonly, skip sync_filesystem()\n    - evict_inodes\n     - iput\n      - f2fs_evict_inode\n       - f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE))\n       : trigger kernel panic\r\n\r\nWhen we try to repair i_current_depth in readonly filesystem, let\u0026apos;s\nskip dirty inode to avoid panic in later f2fs_evict_inode().(CVE-2024-42297)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nPCI/DPC: Fix use-after-free on concurrent DPC and hot-removal\r\n\r\nKeith reports a use-after-free when a DPC event occurs concurrently to\nhot-removal of the same portion of the hierarchy:\r\n\r\nThe dpc_handler() awaits readiness of the secondary bus below the\nDownstream Port where the DPC event occurred.  To do so, it polls the\nconfig space of the first child device on the secondary bus.  If that\nchild device is concurrently removed, accesses to its struct pci_dev\ncause the kernel to oops.\r\n\r\nThat\u0026apos;s because pci_bridge_wait_for_secondary_bus() neglects to hold a\nreference on the child device.  Before v6.3, the function was only\ncalled on resume from system sleep or on runtime resume.  Holding a\nreference wasn\u0026apos;t necessary back then because the pciehp IRQ thread\ncould never run concurrently.  (On resume from system sleep, IRQs are\nnot enabled until after the resume_noirq phase.  And runtime resume is\nalways awaited before a PCI device is removed.)\r\n\r\nHowever starting with v6.3, pci_bridge_wait_for_secondary_bus() is also\ncalled on a DPC event.  Commit 53b54ad074de (\u0026quot;PCI/DPC: Await readiness\nof secondary bus after reset\u0026quot;), which introduced that, failed to\nappreciate that pci_bridge_wait_for_secondary_bus() now needs to hold a\nreference on the child device because dpc_handler() and pciehp may\nindeed run concurrently.  The commit was backported to v5.10+ stable\nkernels, so that\u0026apos;s the oldest one affected.\r\n\r\nAdd the missing reference acquisition.\r\n\r\nAbridged stack trace:\r\n\r\n  BUG: unable to handle page fault for address: 00000000091400c0\n  CPU: 15 PID: 2464 Comm: irq/53-pcie-dpc 6.9.0\n  RIP: pci_bus_read_config_dword+0x17/0x50\n  pci_dev_wait()\n  pci_bridge_wait_for_secondary_bus()\n  dpc_reset_link()\n  pcie_do_recovery()\n  dpc_handler()(CVE-2024-42302)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: check dot and dotdot of dx_root before making dir indexed\r\n\r\nSyzbot reports a issue as follows:\n============================================\nBUG: unable to handle page fault for address: ffffed11022e24fe\nPGD 23ffee067 P4D 23ffee067 PUD 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451\n ext4_rename fs/ext4/namei.c:3936 [inline]\n ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214\n[...]\n============================================\r\n\r\nThe immediate cause of this problem is that there is only one valid dentry\nfor the block to be split during do_split, so split==0 results in out of\nbounds accesses to the map triggering the issue.\r\n\r\n    do_split\n      unsigned split\n      dx_make_map\n       count = 1\n      split = count/2 = 0;\n      continued = hash2 == map[split - 1].hash;\n       ---\u0026gt; map[4294967295]\r\n\r\nThe maximum length of a filename is 255 and the minimum block size is 1024,\nso it is always guaranteed that the number of entries is greater than or\nequal to 2 when do_split() is called.\r\n\r\nBut syzbot\u0026apos;s crafted image has no dot and dotdot in dir, and the dentry\ndistribution in dirblock is as follows:\r\n\r\n  bus     dentry1          hole           dentry2           free\n|xx--|xx-------------|...............|xx-------------|...............|\n0   12 (8+248)=256  268     256     524 (8+256)=264 788     236     1024\r\n\r\nSo when renaming dentry1 increases its name_len length by 1, neither hole\nnor free is sufficient to hold the new dentry, and make_indexed_dir() is\ncalled.\r\n\r\nIn make_indexed_dir() it is assumed that the first two entries of the\ndirblock must be dot and dotdot, so bus and dentry1 are left in dx_root\nbecause they are treated as dot and dotdot, and only dentry2 is moved\nto the new leaf block. That\u0026apos;s why count is equal to 1.\r\n\r\nTherefore add the ext4_check_dx_root() helper function to add more sanity\nchecks to dot and dotdot before starting the conversion to avoid the above\nissue.(CVE-2024-42305)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Check for NULL pointer\r\n\r\n[why \u0026amp; how]\nNeed to make sure plane_state is initialized\nbefore accessing its members.\r\n\r\n(cherry picked from commit 295d91cbc700651782a60572f83c24861607b648)(CVE-2024-42308)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nlandlock: Don\u0026apos;t lose track of restrictions on cred_transfer\r\n\r\nWhen a process\u0026apos; cred struct is replaced, this _almost_ always invokes\nthe cred_prepare LSM hook; but in one special case (when\nKEYCTL_SESSION_TO_PARENT updates the parent\u0026apos;s credentials), the\ncred_transfer LSM hook is used instead.  Landlock only implements the\ncred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes\nall information on Landlock restrictions to be lost.\r\n\r\nThis basically means that a process with the ability to use the fork()\nand keyctl() syscalls can get rid of all Landlock restrictions on\nitself.\r\n\r\nFix it by adding a cred_transfer hook that does the same thing as the\nexisting cred_prepare hook. (Implemented by having hook_cred_prepare()\ncall hook_cred_transfer() so that the two functions are less likely to\naccidentally diverge in the future.)(CVE-2024-42318)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nkvm: s390: Reject memory region operations for ucontrol VMs\r\n\r\nThis change rejects the KVM_SET_USER_MEMORY_REGION and\nKVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM.\nThis is necessary since ucontrol VMs have kvm-\u0026gt;arch.gmap set to 0 and\nwould thus result in a null pointer dereference further in.\nMemory management needs to be performed in userspace and using the\nioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP.\r\n\r\nAlso improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION\nand KVM_SET_USER_MEMORY_REGION2.\r\n\r\n[frankja@linux.ibm.com: commit message spelling fix, subject prefix fix](CVE-2024-43819)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: fix infinite loop when replaying fast_commit\r\n\r\nWhen doing fast_commit replay an infinite loop may occur due to an\nuninitialized extent_status struct.  ext4_ext_determine_insert_hole() does\nnot detect the replay and calls ext4_es_find_extent_range(), which will\nreturn immediately without initializing the \u0026apos;es\u0026apos; variable.\r\n\r\nBecause \u0026apos;es\u0026apos; contains garbage, an integer overflow may happen causing an\ninfinite loop in this function, easily reproducible using fstest generic/039.\r\n\r\nThis commit fixes this issue by unconditionally initializing the structure\nin function ext4_es_find_extent_range().\r\n\r\nThanks to Zhang Yi, for figuring out the real problem!(CVE-2024-43828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: mediatek: vcodec: Handle invalid decoder vsi\r\n\r\nHandle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi\nis valid for future use.(CVE-2024-43831)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncgroup/cpuset: Prevent UAF in proc_cpuset_show()\r\n\r\nAn UAF can happen when /proc/cpuset is read as reported in [1].\r\n\r\nThis can be reproduced by the following methods:\n1.add an mdelay(1000) before acquiring the cgroup_lock In the\n cgroup_path_ns function.\n2.$cat /proc/\u0026lt;pid\u0026gt;/cpuset   repeatly.\n3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/\n$umount /sys/fs/cgroup/cpuset/   repeatly.\r\n\r\nThe race that cause this bug can be shown as below:\r\n\r\n(umount)\t\t|\t(cat /proc/\u0026lt;pid\u0026gt;/cpuset)\ncss_release\t\t|\tproc_cpuset_show\ncss_release_work_fn\t|\tcss = task_get_css(tsk, cpuset_cgrp_id);\ncss_free_rwork_fn\t|\tcgroup_path_ns(css-\u0026gt;cgroup, ...);\ncgroup_destroy_root\t|\tmutex_lock(\u0026amp;cgroup_mutex);\nrebind_subsystems\t|\ncgroup_free_root \t|\n\t\t\t|\t// cgrp was freed, UAF\n\t\t\t|\tcgroup_path_ns_locked(cgrp,..);\r\n\r\nWhen the cpuset is initialized, the root node top_cpuset.css.cgrp\nwill point to \u0026amp;cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will\nallocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated\n\u0026amp;cgroup_root.cgrp. When the umount operation is executed,\ntop_cpuset.css.cgrp will be rebound to \u0026amp;cgrp_dfl_root.cgrp.\r\n\r\nThe problem is that when rebinding to cgrp_dfl_root, there are cases\nwhere the cgroup_root allocated by setting up the root for cgroup v1\nis cached. This could lead to a Use-After-Free (UAF) if it is\nsubsequently freed. The descendant cgroups of cgroup v1 can only be\nfreed after the css is released. However, the css of the root will never\nbe released, yet the cgroup_root should be freed when it is unmounted.\nThis means that obtaining a reference to the css of the root does\nnot guarantee that css.cgrp-\u0026gt;root will not be freed.\r\n\r\nFix this problem by using rcu_read_lock in proc_cpuset_show().\nAs cgroup_root is kfree_rcu after commit d23b5c577715\n(\u0026quot;cgroup: Make operations on the cgroup root_list RCU safe\u0026quot;),\ncss-\u0026gt;cgroup won\u0026apos;t be freed during the critical section.\nTo call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to\nreplace task_get_css with task_css.\r\n\r\n[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd(CVE-2024-43853)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nremoteproc: imx_rproc: Skip over memory region when node value is NULL\r\n\r\nIn imx_rproc_addr_init() \u0026quot;nph = of_count_phandle_with_args()\u0026quot; just counts\nnumber of phandles. But phandles may be empty. So of_parse_phandle() in\nthe parsing loop (0 \u0026lt; a \u0026lt; nph) may return NULL which is later dereferenced.\nAdjust this issue by adding NULL-return check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\r\n\r\n[Fixed title to fit within the prescribed 70-75 charcters](CVE-2024-43860)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: usb: qmi_wwan: fix memory leak for not ip packets\r\n\r\nFree the unused skb when not ip packets arrive.(CVE-2024-43861)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/mlx5: Always drain health in shutdown callback\r\n\r\nThere is no point in recovery during device shutdown. if health\nwork started need to wait for it to avoid races and NULL pointer\naccess.\r\n\r\nHence, drain health WQ on shutdown callback.(CVE-2024-43866)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()\r\n\r\nCurrently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in\ncfg80211_calculate_bitrate_he(), leading to below warning:\r\n\r\nkernel: invalid HE MCS: bw:6, ru:6\nkernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211]\r\n\r\nFix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.(CVE-2024-43879)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nexec: Fix ToCToU between perm check and set-uid/gid usage\r\n\r\nWhen opening a file for exec via do_filp_open(), permission checking is\ndone against the file\u0026apos;s metadata at that moment, and on success, a file\npointer is passed back. Much later in the execve() code path, the file\nmetadata (specifically mode, uid, and gid) is used to determine if/how\nto set the uid and gid. However, those values may have changed since the\npermissions check, meaning the execution may gain unintended privileges.\r\n\r\nFor example, if a file could change permissions from executable and not\nset-id:\r\n\r\n---------x 1 root root 16048 Aug  7 13:16 target\r\n\r\nto set-id and non-executable:\r\n\r\n---S------ 1 root root 16048 Aug  7 13:16 target\r\n\r\nit is possible to gain root privileges when execution should have been\ndisallowed.\r\n\r\nWhile this race condition is rare in real-world scenarios, it has been\nobserved (and proven exploitable) when package managers are updating\nthe setuid bits of installed programs. Such files start with being\nworld-executable but then are adjusted to be group-exec with a set-uid\nbit. For example, \u0026quot;chmod o-x,u+s target\u0026quot; makes \u0026quot;target\u0026quot; executable only\nby uid \u0026quot;root\u0026quot; and gid \u0026quot;cdrom\u0026quot;, while also becoming setuid-root:\r\n\r\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\r\n\r\nbecomes:\r\n\r\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\r\n\r\nBut racing the chmod means users without group \u0026quot;cdrom\u0026quot; membership can\nget the permission to execute \u0026quot;target\u0026quot; just before the chmod, and when\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\nsetuid to root, violating the expressed authorization of \u0026quot;only cdrom\ngroup members can setuid to root\u0026quot;.\r\n\r\nRe-check that we still have execute permissions in case the metadata\nhas changed. It would be better to keep a copy from the perm-check time,\nbut until we can do that refactoring, the least-bad option is to do a\nfull inode_permission() call (under inode lock). It is understood that\nthis is safe against dead-locks, but hardly optimal.(CVE-2024-43882)","status":"published","published":"2024-08-30T11:07:33Z","modified":"2026-08-18T01:18:36.373625965Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"OESA-2024-2080","title":"kernel security update","description":"The Linux Kernel, the operating system core itself.\r\n\r\nSecurity Fix(es):\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nio_uring: fix memleak in io_init_wq_offload()\r\n\r\nI got memory leak report when doing fuzz test:\r\n\r\nBUG: memory leak\nunreferenced object 0xffff888107310a80 (size 96):\ncomm \u0026quot;syz-executor.6\u0026quot;, pid 4610, jiffies 4295140240 (age 20.135s)\nhex dump (first 32 bytes):\n01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................\n00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N..........\nbacktrace:\n[\u0026lt;000000001974933b\u0026gt;] kmalloc include/linux/slab.h:591 [inline]\n[\u0026lt;000000001974933b\u0026gt;] kzalloc include/linux/slab.h:721 [inline]\n[\u0026lt;000000001974933b\u0026gt;] io_init_wq_offload fs/io_uring.c:7920 [inline]\n[\u0026lt;000000001974933b\u0026gt;] io_uring_alloc_task_context+0x466/0x640 fs/io_uring.c:7955\n[\u0026lt;0000000039d0800d\u0026gt;] __io_uring_add_tctx_node+0x256/0x360 fs/io_uring.c:9016\n[\u0026lt;000000008482e78c\u0026gt;] io_uring_add_tctx_node fs/io_uring.c:9052 [inline]\n[\u0026lt;000000008482e78c\u0026gt;] __do_sys_io_uring_enter fs/io_uring.c:9354 [inline]\n[\u0026lt;000000008482e78c\u0026gt;] __se_sys_io_uring_enter fs/io_uring.c:9301 [inline]\n[\u0026lt;000000008482e78c\u0026gt;] __x64_sys_io_uring_enter+0xabc/0xc20 fs/io_uring.c:9301\n[\u0026lt;00000000b875f18f\u0026gt;] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n[\u0026lt;00000000b875f18f\u0026gt;] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80\n[\u0026lt;000000006b0a8484\u0026gt;] entry_SYSCALL_64_after_hwframe+0x44/0xae\r\n\r\nCPU0                          CPU1\nio_uring_enter                io_uring_enter\nio_uring_add_tctx_node        io_uring_add_tctx_node\n__io_uring_add_tctx_node      __io_uring_add_tctx_node\nio_uring_alloc_task_context   io_uring_alloc_task_context\nio_init_wq_offload            io_init_wq_offload\nhash = kzalloc                hash = kzalloc\nctx-\u0026gt;hash_map = hash          ctx-\u0026gt;hash_map = hash \u0026lt;- one of the hash is leaked\r\n\r\nWhen calling io_uring_enter() in parallel, the \u0026apos;hash_map\u0026apos; will be leaked,\nadd uring_lock to protect \u0026apos;hash_map\u0026apos;.(CVE-2021-47292)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nio_uring: ensure task_work gets run as part of cancelations\r\n\r\nIf we successfully cancel a work item but that work item needs to be\nprocessed through task_work, then we can be sleeping uninterruptibly\nin io_uring_cancel_generic() and never process it. Hence we don\u0026apos;t\nmake forward progress and we end up with an uninterruptible sleep\nwarning.\r\n\r\nWhile in there, correct a comment that should be IFF, not IIF.(CVE-2021-47504)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()\r\n\r\nethtool_set_coalesce() now uses both the .get_coalesce() and\n.set_coalesce() callbacks. But the check for their availability is\nbuggy, so changing the coalesce settings on a device where the driver\nprovides only _one_ of the callbacks results in a NULL pointer\ndereference instead of an -EOPNOTSUPP.\r\n\r\nFix the condition so that the availability of both callbacks is\nensured. This also matches the netlink code.\r\n\r\nNote that reproducing this requires some effort - it only affects the\nlegacy ioctl path, and needs a specific combination of driver options:\n- have .get_coalesce() and .coalesce_supported but no\n .set_coalesce(), or\n- have .set_coalesce() but no .get_coalesce(). Here eg. ethtool doesn\u0026apos;t\n  cause the crash as it first attempts to call ethtool_get_coalesce()\n  and bails out on error.(CVE-2021-47556)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/gma500: Fix BUG: sleeping function called from invalid context errors\r\n\r\ngma_crtc_page_flip() was holding the event_lock spinlock while calling\ncrtc_funcs-\u0026gt;mode_set_base() which takes ww_mutex.\r\n\r\nThe only reason to hold event_lock is to clear gma_crtc-\u0026gt;page_flip_event\non mode_set_base() errors.\r\n\r\nInstead unlock it after setting gma_crtc-\u0026gt;page_flip_event and on\nerrors re-take the lock and clear gma_crtc-\u0026gt;page_flip_event it\nit is still set.\r\n\r\nThis fixes the following WARN/stacktrace:\r\n\r\n[  512.122953] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:870\n[  512.123004] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1253, name: gnome-shell\n[  512.123031] preempt_count: 1, expected: 0\n[  512.123048] RCU nest depth: 0, expected: 0\n[  512.123066] INFO: lockdep is turned off.\n[  512.123080] irq event stamp: 0\n[  512.123094] hardirqs last  enabled at (0): [\u0026lt;0000000000000000\u0026gt;] 0x0\n[  512.123134] hardirqs last disabled at (0): [\u0026lt;ffffffff8d0ec28c\u0026gt;] copy_process+0x9fc/0x1de0\n[  512.123176] softirqs last  enabled at (0): [\u0026lt;ffffffff8d0ec28c\u0026gt;] copy_process+0x9fc/0x1de0\n[  512.123207] softirqs last disabled at (0): [\u0026lt;0000000000000000\u0026gt;] 0x0\n[  512.123233] Preemption disabled at:\n[  512.123241] [\u0026lt;0000000000000000\u0026gt;] 0x0\n[  512.123275] CPU: 3 PID: 1253 Comm: gnome-shell Tainted: G        W         5.19.0+ #1\n[  512.123304] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013\n[  512.123323] Call Trace:\n[  512.123346]  \u0026lt;TASK\u0026gt;\n[  512.123370]  dump_stack_lvl+0x5b/0x77\n[  512.123412]  __might_resched.cold+0xff/0x13a\n[  512.123458]  ww_mutex_lock+0x1e/0xa0\n[  512.123495]  psb_gem_pin+0x2c/0x150 [gma500_gfx]\n[  512.123601]  gma_pipe_set_base+0x76/0x240 [gma500_gfx]\n[  512.123708]  gma_crtc_page_flip+0x95/0x130 [gma500_gfx]\n[  512.123808]  drm_mode_page_flip_ioctl+0x57d/0x5d0\n[  512.123897]  ? drm_mode_cursor2_ioctl+0x10/0x10\n[  512.123936]  drm_ioctl_kernel+0xa1/0x150\n[  512.123984]  drm_ioctl+0x21f/0x420\n[  512.124025]  ? drm_mode_cursor2_ioctl+0x10/0x10\n[  512.124070]  ? rcu_read_lock_bh_held+0xb/0x60\n[  512.124104]  ? lock_release+0x1ef/0x2d0\n[  512.124161]  __x64_sys_ioctl+0x8d/0xd0\n[  512.124203]  do_syscall_64+0x58/0x80\n[  512.124239]  ? do_syscall_64+0x67/0x80\n[  512.124267]  ? trace_hardirqs_on_prepare+0x55/0xe0\n[  512.124300]  ? do_syscall_64+0x67/0x80\n[  512.124340]  ? rcu_read_lock_sched_held+0x10/0x80\n[  512.124377]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  512.124411] RIP: 0033:0x7fcc4a70740f\n[  512.124442] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 \u0026lt;89\u0026gt; c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00\n[  512.124470] RSP: 002b:00007ffda73f5390 EFLAGS: 00000246 ORIG_RAX: 0000000000000010\n[  512.124503] RAX: ffffffffffffffda RBX: 000055cc9e474500 RCX: 00007fcc4a70740f\n[  512.124524] RDX: 00007ffda73f5420 RSI: 00000000c01864b0 RDI: 0000000000000009\n[  512.124544] RBP: 00007ffda73f5420 R08: 000055cc9c0b0cb0 R09: 0000000000000034\n[  512.124564] R10: 0000000000000000 R11: 0000000000000246 R12: 00000000c01864b0\n[  512.124584] R13: 0000000000000009 R14: 000055cc9df484d0 R15: 000055cc9af5d0c0\n[  512.124647]  \u0026lt;/TASK\u0026gt;(CVE-2022-48634)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: sched: fix possible refcount leak in tc_new_tfilter()\r\n\r\ntfilter_put need to be called to put the refount got by tp-\u0026gt;ops-\u0026gt;get to\navoid possible refcount leak when chain-\u0026gt;tmplt_ops != NULL and\nchain-\u0026gt;tmplt_ops != tp-\u0026gt;ops.(CVE-2022-48639)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: fix percpu memory leak at nf_tables_addchain()\r\n\r\nIt seems to me that percpu memory for chain stats started leaking since\ncommit 3bc158f8d0330f0a (\u0026quot;netfilter: nf_tables: map basechain priority to\nhardware priority\u0026quot;) when nft_chain_offload_priority() returned an error.(CVE-2022-48642)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: fix nft_counters_enabled underflow at nf_tables_addchain()\r\n\r\nsyzbot is reporting underflow of nft_counters_enabled counter at\nnf_tables_addchain() [1], for commit 43eb8949cfdffa76 (\u0026quot;netfilter:\nnf_tables: do not leave chain stats enabled on error\u0026quot;) missed that\nnf_tables_chain_destroy() after nft_basechain_init() in the error path of\nnf_tables_addchain() decrements the counter because nft_basechain_init()\nmakes nft_is_base_chain() return true by setting NFT_CHAIN_BASE flag.\r\n\r\nIncrement the counter immediately after returning from\nnft_basechain_init().(CVE-2022-48643)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/sched: taprio: avoid disabling offload when it was never enabled\r\n\r\nIn an incredibly strange API design decision, qdisc-\u0026gt;destroy() gets\ncalled even if qdisc-\u0026gt;init() never succeeded, not exclusively since\ncommit 87b60cfacf9f (\u0026quot;net_sched: fix error recovery at qdisc creation\u0026quot;),\nbut apparently also earlier (in the case of qdisc_create_dflt()).\r\n\r\nThe taprio qdisc does not fully acknowledge this when it attempts full\noffload, because it starts off with q-\u0026gt;flags = TAPRIO_FLAGS_INVALID in\ntaprio_init(), then it replaces q-\u0026gt;flags with TCA_TAPRIO_ATTR_FLAGS\nparsed from netlink (in taprio_change(), tail called from taprio_init()).\r\n\r\nBut in taprio_destroy(), we call taprio_disable_offload(), and this\ndetermines what to do based on FULL_OFFLOAD_IS_ENABLED(q-\u0026gt;flags).\r\n\r\nBut looking at the implementation of FULL_OFFLOAD_IS_ENABLED()\n(a bitwise check of bit 1 in q-\u0026gt;flags), it is invalid to call this macro\non q-\u0026gt;flags when it contains TAPRIO_FLAGS_INVALID, because that is set\nto U32_MAX, and therefore FULL_OFFLOAD_IS_ENABLED() will return true on\nan invalid set of flags.\r\n\r\nAs a result, it is possible to crash the kernel if user space forces an\nerror between setting q-\u0026gt;flags = TAPRIO_FLAGS_INVALID, and the calling\nof taprio_enable_offload(). This is because drivers do not expect the\noffload to be disabled when it was never enabled.\r\n\r\nThe error that we force here is to attach taprio as a non-root qdisc,\nbut instead as child of an mqprio root qdisc:\r\n\r\n$ tc qdisc add dev swp0 root handle 1: \\\n\tmqprio num_tc 8 map 0 1 2 3 4 5 6 7 \\\n\tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0\n$ tc qdisc replace dev swp0 parent 1:1 \\\n\ttaprio num_tc 8 map 0 1 2 3 4 5 6 7 \\\n\tqueues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 base-time 0 \\\n\tsched-entry S 0x7f 990000 sched-entry S 0x80 100000 \\\n\tflags 0x0 clockid CLOCK_TAI\nUnable to handle kernel paging request at virtual address fffffffffffffff8\n[fffffffffffffff8] pgd=0000000000000000, p4d=0000000000000000\nInternal error: Oops: 96000004 [#1] PREEMPT SMP\nCall trace:\n taprio_dump+0x27c/0x310\n vsc9959_port_setup_tc+0x1f4/0x460\n felix_port_setup_tc+0x24/0x3c\n dsa_slave_setup_tc+0x54/0x27c\n taprio_disable_offload.isra.0+0x58/0xe0\n taprio_destroy+0x80/0x104\n qdisc_create+0x240/0x470\n tc_modify_qdisc+0x1fc/0x6b0\n rtnetlink_rcv_msg+0x12c/0x390\n netlink_rcv_skb+0x5c/0x130\n rtnetlink_rcv+0x1c/0x2c\r\n\r\nFix this by keeping track of the operations we made, and undo the\noffload only if we actually did it.\r\n\r\nI\u0026apos;ve added \u0026quot;bool offloaded\u0026quot; inside a 4 byte hole between \u0026quot;int clockid\u0026quot;\nand \u0026quot;atomic64_t picos_per_byte\u0026quot;. Now the first cache line looks like\nbelow:\r\n\r\n$ pahole -C taprio_sched net/sched/sch_taprio.o\nstruct taprio_sched {\n        struct Qdisc * *           qdiscs;               /*     0     8 */\n        struct Qdisc *             root;                 /*     8     8 */\n        u32                        flags;                /*    16     4 */\n        enum tk_offsets            tk_offset;            /*    20     4 */\n        int                        clockid;              /*    24     4 */\n        bool                       offloaded;            /*    28     1 */\r\n\r\n        /* XXX 3 bytes hole, try to pack */\r\n\r\n        atomic64_t                 picos_per_byte;       /*    32     0 */\r\n\r\n        /* XXX 8 bytes hole, try to pack */\r\n\r\n        spinlock_t                 current_entry_lock;   /*    40     0 */\r\n\r\n        /* XXX 8 bytes hole, try to pack */\r\n\r\n        struct sched_entry *       current_entry;        /*    48     8 */\n        struct sched_gate_list *   oper_sched;           /*    56     8 */\n        /* --- cacheline 1 boundary (64 bytes) --- */(CVE-2022-48644)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsfc: fix TX channel offset when using legacy interrupts\r\n\r\nIn legacy interrupt mode the tx_channel_offset was hardcoded to 1, but\nthat\u0026apos;s not correct if efx_sepparate_tx_channels is false. In that case,\nthe offset is 0 because the tx queues are in the single existing channel\nat index 0, together with the rx queue.\r\n\r\nWithout this fix, as soon as you try to send any traffic, it tries to\nget the tx queues from an uninitialized channel getting these errors:\n  WARNING: CPU: 1 PID: 0 at drivers/net/ethernet/sfc/tx.c:540 efx_hard_start_xmit+0x12e/0x170 [sfc]\n  [...]\n  RIP: 0010:efx_hard_start_xmit+0x12e/0x170 [sfc]\n  [...]\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   dev_hard_start_xmit+0xd7/0x230\n   sch_direct_xmit+0x9f/0x360\n   __dev_queue_xmit+0x890/0xa40\n  [...]\n  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n  [...]\n  RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc]\n  [...]\n  Call Trace:\n   \u0026lt;IRQ\u0026gt;\n   dev_hard_start_xmit+0xd7/0x230\n   sch_direct_xmit+0x9f/0x360\n   __dev_queue_xmit+0x890/0xa40\n  [...](CVE-2022-48647)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nsfc: fix null pointer dereference in efx_hard_start_xmit\r\n\r\nTrying to get the channel from the tx_queue variable here is wrong\nbecause we can only be here if tx_queue is NULL, so we shouldn\u0026apos;t\ndereference it. As the above comment in the code says, this is very\nunlikely to happen, but it\u0026apos;s wrong anyway so let\u0026apos;s fix it.\r\n\r\nI hit this issue because of a different bug that caused tx_queue to be\nNULL. If that happens, this is the error message that we get here:\n  BUG: unable to handle kernel NULL pointer dereference at 0000000000000020\n  [...]\n  RIP: 0010:efx_hard_start_xmit+0x153/0x170 [sfc](CVE-2022-48648)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndmaengine: ti: k3-udma-private: Fix refcount leak bug in of_xudma_dev_get()\r\n\r\nWe should call of_node_put() for the reference returned by\nof_parse_phandle() in fail path or when it is not used anymore.\nHere we only need to move the of_node_put() before the check.(CVE-2022-48656)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngpio: mockup: fix NULL pointer dereference when removing debugfs\r\n\r\nWe now remove the device\u0026apos;s debugfs entries when unbinding the driver.\nThis now causes a NULL-pointer dereference on module exit because the\nplatform devices are unregistered *after* the global debugfs directory\nhas been recursively removed. Fix it by unregistering the devices first.(CVE-2022-48663)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()\r\n\r\nsyzbot is hitting percpu_rwsem_assert_held(\u0026amp;cpu_hotplug_lock) warning at\ncpuset_attach() [1], for commit 4f7e7236435ca0ab (\u0026quot;cgroup: Fix\nthreadgroup_rwsem \u0026lt;-\u0026gt; cpus_read_lock() deadlock\u0026quot;) missed that\ncpuset_attach() is also called from cgroup_attach_task_all().\nAdd cpus_read_lock() like what cgroup_procs_write_start() does.(CVE-2022-48671)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nof: fdt: fix off-by-one error in unflatten_dt_nodes()\r\n\r\nCommit 78c44d910d3e (\u0026quot;drivers/of: Fix depth when unflattening devicetree\u0026quot;)\nforgot to fix up the depth check in the loop body in unflatten_dt_nodes()\nwhich makes it possible to overflow the nps[] buffer...\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with the SVACE static\nanalysis tool.(CVE-2022-48672)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nIB/core: Fix a nested dead lock as part of ODP flow\r\n\r\nFix a nested dead lock as part of ODP flow by using mmput_async().\r\n\r\nFrom the below call trace [1] can see that calling mmput() once we have\nthe umem_odp-\u0026gt;umem_mutex locked as required by\nib_umem_odp_map_dma_and_lock() might trigger in the same task the\nexit_mmap()-\u0026gt;__mmu_notifier_release()-\u0026gt;mlx5_ib_invalidate_range() which\nmay dead lock when trying to lock the same mutex.\r\n\r\nMoving to use mmput_async() will solve the problem as the above\nexit_mmap() flow will be called in other task and will be executed once\nthe lock will be available.\r\n\r\n[1]\n[64843.077665] task:kworker/u133:2  state:D stack:    0 pid:80906 ppid:\n2 flags:0x00004000\n[64843.077672] Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib]\n[64843.077719] Call Trace:\n[64843.077722]  \u0026lt;TASK\u0026gt;\n[64843.077724]  __schedule+0x23d/0x590\n[64843.077729]  schedule+0x4e/0xb0\n[64843.077735]  schedule_preempt_disabled+0xe/0x10\n[64843.077740]  __mutex_lock.constprop.0+0x263/0x490\n[64843.077747]  __mutex_lock_slowpath+0x13/0x20\n[64843.077752]  mutex_lock+0x34/0x40\n[64843.077758]  mlx5_ib_invalidate_range+0x48/0x270 [mlx5_ib]\n[64843.077808]  __mmu_notifier_release+0x1a4/0x200\n[64843.077816]  exit_mmap+0x1bc/0x200\n[64843.077822]  ? walk_page_range+0x9c/0x120\n[64843.077828]  ? __cond_resched+0x1a/0x50\n[64843.077833]  ? mutex_lock+0x13/0x40\n[64843.077839]  ? uprobe_clear_state+0xac/0x120\n[64843.077860]  mmput+0x5f/0x140\n[64843.077867]  ib_umem_odp_map_dma_and_lock+0x21b/0x580 [ib_core]\n[64843.077931]  pagefault_real_mr+0x9a/0x140 [mlx5_ib]\n[64843.077962]  pagefault_mr+0xb4/0x550 [mlx5_ib]\n[64843.077992]  pagefault_single_data_segment.constprop.0+0x2ac/0x560\n[mlx5_ib]\n[64843.078022]  mlx5_ib_eqe_pf_action+0x528/0x780 [mlx5_ib]\n[64843.078051]  process_one_work+0x22b/0x3d0\n[64843.078059]  worker_thread+0x53/0x410\n[64843.078065]  ? process_one_work+0x3d0/0x3d0\n[64843.078073]  kthread+0x12a/0x150\n[64843.078079]  ? set_kthread_struct+0x50/0x50\n[64843.078085]  ret_from_fork+0x22/0x30\n[64843.078093]  \u0026lt;/TASK\u0026gt;(CVE-2022-48675)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnvme-tcp: fix UAF when detecting digest errors\r\n\r\nWe should also bail from the io_work loop when we set rd_enabled to true,\nso we don\u0026apos;t attempt to read data from the socket when the TCP stream is\nalready out-of-sync or corrupted.(CVE-2022-48686)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix out-of-bounds read when setting HMAC data.\r\n\r\nThe SRv6 layer allows defining HMAC data that can later be used to sign IPv6\nSegment Routing Headers. This configuration is realised via netlink through\nfour attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN and\nSEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actual\nlength of the SECRET attribute, it is possible to provide invalid combinations\n(e.g., secret = \u0026quot;\u0026quot;, secretlen = 64). This case is not checked in the code and\nwith an appropriately crafted netlink message, an out-of-bounds read of up\nto 64 bytes (max secret length) can occur past the skb end pointer and into\nskb_shared_info:\r\n\r\nBreakpoint 1, seg6_genl_sethmac (skb=\u0026lt;optimized out\u0026gt;, info=\u0026lt;optimized out\u0026gt;) at net/ipv6/seg6.c:208\n208\t\tmemcpy(hinfo-\u0026gt;secret, secret, slen);\n(gdb) bt\n #0  seg6_genl_sethmac (skb=\u0026lt;optimized out\u0026gt;, info=\u0026lt;optimized out\u0026gt;) at net/ipv6/seg6.c:208\n #1  0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=skb@entry=0xffff88800b1f9f00, nlh=nlh@entry=0xffff88800b1b7600,\n    extack=extack@entry=0xffffc90000ba7af0, ops=ops@entry=0xffffc90000ba7a80, hdrlen=4, net=0xffffffff84237580 \u0026lt;init_net\u0026gt;, family=\u0026lt;optimized out\u0026gt;,\n    family=\u0026lt;optimized out\u0026gt;) at net/netlink/genetlink.c:731\n #2  0xffffffff81e01435 in genl_family_rcv_msg (extack=0xffffc90000ba7af0, nlh=0xffff88800b1b7600, skb=0xffff88800b1f9f00,\n    family=0xffffffff82fef6c0 \u0026lt;seg6_genl_family\u0026gt;) at net/netlink/genetlink.c:775\n #3  genl_rcv_msg (skb=0xffff88800b1f9f00, nlh=0xffff88800b1b7600, extack=0xffffc90000ba7af0) at net/netlink/genetlink.c:792\n #4  0xffffffff81dfffc3 in netlink_rcv_skb (skb=skb@entry=0xffff88800b1f9f00, cb=cb@entry=0xffffffff81e01350 \u0026lt;genl_rcv_msg\u0026gt;)\n    at net/netlink/af_netlink.c:2501\n #5  0xffffffff81e00919 in genl_rcv (skb=0xffff88800b1f9f00) at net/netlink/genetlink.c:803\n #6  0xffffffff81dff6ae in netlink_unicast_kernel (ssk=0xffff888010eec800, skb=0xffff88800b1f9f00, sk=0xffff888004aed000)\n    at net/netlink/af_netlink.c:1319\n #7  netlink_unicast (ssk=ssk@entry=0xffff888010eec800, skb=skb@entry=0xffff88800b1f9f00, portid=portid@entry=0, nonblock=\u0026lt;optimized out\u0026gt;)\n    at net/netlink/af_netlink.c:1345\n #8  0xffffffff81dff9a4 in netlink_sendmsg (sock=\u0026lt;optimized out\u0026gt;, msg=0xffffc90000ba7e48, len=\u0026lt;optimized out\u0026gt;) at net/netlink/af_netlink.c:1921\n...\n(gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)-\u0026gt;head + ((struct sk_buff *)0xffff88800b1f9f00)-\u0026gt;end\n$1 = 0xffff88800b1b76c0\n(gdb) p/x secret\n$2 = 0xffff88800b1b76c0\n(gdb) p slen\n$3 = 64 \u0026apos;@\u0026apos;\r\n\r\nThe OOB data can then be read back from userspace by dumping HMAC state. This\ncommit fixes this by ensuring SECRETLEN cannot exceed the actual length of\nSECRET.(CVE-2022-48687)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: clean up hook list when offload flags check fails\r\n\r\nsplice back the hook list so nft_chain_release_hook() has a chance to\nrelease the hooks.\r\n\r\nBUG: memory leak\nunreferenced object 0xffff88810180b100 (size 96):\n  comm \u0026quot;syz-executor133\u0026quot;, pid 3619, jiffies 4294945714 (age 12.690s)\n  hex dump (first 32 bytes):\n    28 64 23 02 81 88 ff ff 28 64 23 02 81 88 ff ff  (d#.....(d#.....\n    90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff  ................\n  backtrace:\n    [\u0026lt;ffffffff83a8c59b\u0026gt;] kmalloc include/linux/slab.h:600 [inline]\n    [\u0026lt;ffffffff83a8c59b\u0026gt;] nft_netdev_hook_alloc+0x3b/0xc0 net/netfilter/nf_tables_api.c:1901\n    [\u0026lt;ffffffff83a9239a\u0026gt;] nft_chain_parse_netdev net/netfilter/nf_tables_api.c:1998 [inline]\n    [\u0026lt;ffffffff83a9239a\u0026gt;] nft_chain_parse_hook+0x33a/0x530 net/netfilter/nf_tables_api.c:2073\n    [\u0026lt;ffffffff83a9b14b\u0026gt;] nf_tables_addchain.constprop.0+0x10b/0x950 net/netfilter/nf_tables_api.c:2218\n    [\u0026lt;ffffffff83a9c41b\u0026gt;] nf_tables_newchain+0xa8b/0xc60 net/netfilter/nf_tables_api.c:2593\n    [\u0026lt;ffffffff83a3d6a6\u0026gt;] nfnetlink_rcv_batch+0xa46/0xd20 net/netfilter/nfnetlink.c:517\n    [\u0026lt;ffffffff83a3db79\u0026gt;] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:638 [inline]\n    [\u0026lt;ffffffff83a3db79\u0026gt;] nfnetlink_rcv+0x1f9/0x220 net/netfilter/nfnetlink.c:656\n    [\u0026lt;ffffffff83a13b17\u0026gt;] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n    [\u0026lt;ffffffff83a13b17\u0026gt;] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345\n    [\u0026lt;ffffffff83a13fd6\u0026gt;] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921\n    [\u0026lt;ffffffff83865ab6\u0026gt;] sock_sendmsg_nosec net/socket.c:714 [inline]\n    [\u0026lt;ffffffff83865ab6\u0026gt;] sock_sendmsg+0x56/0x80 net/socket.c:734\n    [\u0026lt;ffffffff8386601c\u0026gt;] ____sys_sendmsg+0x36c/0x390 net/socket.c:2482\n    [\u0026lt;ffffffff8386a918\u0026gt;] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536\n    [\u0026lt;ffffffff8386aaa8\u0026gt;] __sys_sendmsg+0x88/0x100 net/socket.c:2565\n    [\u0026lt;ffffffff845e5955\u0026gt;] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n    [\u0026lt;ffffffff845e5955\u0026gt;] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n    [\u0026lt;ffffffff84800087\u0026gt;] entry_SYSCALL_64_after_hwframe+0x63/0xcd(CVE-2022-48691)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmisc: fastrpc: Don\u0026apos;t remove map on creater_process and device_release\r\n\r\nDo not remove the map from the list on error path in\nfastrpc_init_create_process, instead call fastrpc_map_put, to avoid\nuse-after-free. Do not remove it on fastrpc_device_release either,\ncall fastrpc_map_put instead.\r\n\r\nThe fastrpc_free_map is the only proper place to remove the map.\nThis is called only after the reference count is 0.(CVE-2022-48873)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nixgbe: fix pci device refcount leak\r\n\r\nAs the comment of pci_get_domain_bus_and_slot() says, it\nreturns a PCI device with refcount incremented, when finish\nusing it, the caller must decrement the reference count by\ncalling pci_dev_put().\r\n\r\nIn ixgbe_get_first_secondary_devfn() and ixgbe_x550em_a_has_mii(),\npci_dev_put() is called to avoid leak.(CVE-2022-48896)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/msm/dp: do not complete dp_aux_cmd_fifo_tx() if irq is not for aux transfer\r\n\r\nThere are 3 possible interrupt sources are handled by DP controller,\nHPDstatus, Controller state changes and Aux read/write transaction.\nAt every irq, DP controller have to check isr status of every interrupt\nsources and service the interrupt if its isr status bits shows interrupts\nare pending. There is potential race condition may happen at current aux\nisr handler implementation since it is always complete dp_aux_cmd_fifo_tx()\neven irq is not for aux read or write transaction. This may cause aux read\ntransaction return premature if host aux data read is in the middle of\nwaiting for sink to complete transferring data to host while irq happen.\nThis will cause host\u0026apos;s receiving buffer contains unexpected data. This\npatch fixes this problem by checking aux isr and return immediately at\naux isr handler if there are no any isr status bits set.\r\n\r\nCurrent there is a bug report regrading eDP edid corruption happen during\nsystem booting up. After lengthy debugging to found that VIDEO_READY\ninterrupt was continuously firing during system booting up which cause\ndp_aux_isr() to complete dp_aux_cmd_fifo_tx() prematurely to retrieve data\nfrom aux hardware buffer which is not yet contains complete data transfer\nfrom sink. This cause edid corruption.\r\n\r\nFollows are the signature at kernel logs when problem happen,\nEDID has corrupt header\npanel-simple-dp-aux aux-aea0000.edp: Couldn\u0026apos;t identify panel via EDID\r\n\r\nChanges in v2:\n-- do complete if (ret == IRQ_HANDLED) ay dp-aux_isr()\n-- add more commit text\r\n\r\nChanges in v3:\n-- add Stephen suggested\n-- dp_aux_isr() return IRQ_XXX back to caller\n-- dp_ctrl_isr() return IRQ_XXX back to caller\r\n\r\nChanges in v4:\n-- split into two patches\r\n\r\nChanges in v5:\n-- delete empty line between tags\r\n\r\nChanges in v6:\n-- remove extra \u0026quot;that\u0026quot; and fixed line more than 75 char at commit text\r\n\r\nPatchwork: https://patchwork.freedesktop.org/patch/516121/(CVE-2022-48898)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/virtio: Fix GEM handle creation UAF\r\n\r\nUserspace can guess the handle value and try to race GEM object creation\nwith handle close, resulting in a use-after-free if we dereference the\nobject after dropping the handle\u0026apos;s reference.  For that reason, dropping\nthe handle\u0026apos;s reference must be done *after* we are done dereferencing\nthe object.(CVE-2022-48899)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbtrfs: get rid of warning on transaction commit when using flushoncommit\r\n\r\nWhen using the flushoncommit mount option, during almost every transaction\ncommit we trigger a warning from __writeback_inodes_sb_nr():\r\n\r\n  $ cat fs/fs-writeback.c:\n  (...)\n  static void __writeback_inodes_sb_nr(struct super_block *sb, ...\n  {\n        (...)\n        WARN_ON(!rwsem_is_locked(\u0026amp;sb-\u0026gt;s_umount));\n        (...)\n  }\n  (...)\r\n\r\nThe trace produced in dmesg looks like the following:\r\n\r\n  [947.473890] WARNING: CPU: 5 PID: 930 at fs/fs-writeback.c:2610 __writeback_inodes_sb_nr+0x7e/0xb3\n  [947.481623] Modules linked in: nfsd nls_cp437 cifs asn1_decoder cifs_arc4 fscache cifs_md4 ipmi_ssif\n  [947.489571] CPU: 5 PID: 930 Comm: btrfs-transacti Not tainted 95.16.3-srb-asrock-00001-g36437ad63879 #186\n  [947.497969] RIP: 0010:__writeback_inodes_sb_nr+0x7e/0xb3\n  [947.502097] Code: 24 10 4c 89 44 24 18 c6 (...)\n  [947.519760] RSP: 0018:ffffc90000777e10 EFLAGS: 00010246\n  [947.523818] RAX: 0000000000000000 RBX: 0000000000963300 RCX: 0000000000000000\n  [947.529765] RDX: 0000000000000000 RSI: 000000000000fa51 RDI: ffffc90000777e50\n  [947.535740] RBP: ffff888101628a90 R08: ffff888100955800 R09: ffff888100956000\n  [947.541701] R10: 0000000000000002 R11: 0000000000000001 R12: ffff888100963488\n  [947.547645] R13: ffff888100963000 R14: ffff888112fb7200 R15: ffff888100963460\n  [947.553621] FS:  0000000000000000(0000) GS:ffff88841fd40000(0000) knlGS:0000000000000000\n  [947.560537] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  [947.565122] CR2: 0000000008be50c4 CR3: 000000000220c000 CR4: 00000000001006e0\n  [947.571072] Call Trace:\n  [947.572354]  \u0026lt;TASK\u0026gt;\n  [947.573266]  btrfs_commit_transaction+0x1f1/0x998\n  [947.576785]  ? start_transaction+0x3ab/0x44e\n  [947.579867]  ? schedule_timeout+0x8a/0xdd\n  [947.582716]  transaction_kthread+0xe9/0x156\n  [947.585721]  ? btrfs_cleanup_transaction.isra.0+0x407/0x407\n  [947.590104]  kthread+0x131/0x139\n  [947.592168]  ? set_kthread_struct+0x32/0x32\n  [947.595174]  ret_from_fork+0x22/0x30\n  [947.597561]  \u0026lt;/TASK\u0026gt;\n  [947.598553] ---[ end trace 644721052755541c ]---\r\n\r\nThis is because we started using writeback_inodes_sb() to flush delalloc\nwhen committing a transaction (when using -o flushoncommit), in order to\navoid deadlocks with filesystem freeze operations. This change was made\nby commit ce8ea7cc6eb313 (\u0026quot;btrfs: don\u0026apos;t call btrfs_start_delalloc_roots\nin flushoncommit\u0026quot;). After that change we started producing that warning,\nand every now and then a user reports this since the warning happens too\noften, it spams dmesg/syslog, and a user is unsure if this reflects any\nproblem that might compromise the filesystem\u0026apos;s reliability.\r\n\r\nWe can not just lock the sb-\u0026gt;s_umount semaphore before calling\nwriteback_inodes_sb(), because that would at least deadlock with\nfilesystem freezing, since at fs/super.c:freeze_super() sync_filesystem()\nis called while we are holding that semaphore in write mode, and that can\ntrigger a transaction commit, resulting in a deadlock. It would also\ntrigger the same type of deadlock in the unmount path. Possibly, it could\nalso introduce some other locking dependencies that lockdep would report.\r\n\r\nTo fix this call try_to_writeback_inodes_sb() instead of\nwriteback_inodes_sb(), because that will try to read lock sb-\u0026gt;s_umount\nand then will only call writeback_inodes_sb() if it was able to lock it.\nThis is fine because the cases where it can\u0026apos;t read lock sb-\u0026gt;s_umount\nare during a filesystem unmount or during a filesystem freeze - in those\ncases sb-\u0026gt;s_umount is write locked and sync_filesystem() is called, which\ncalls writeback_inodes_sb(). In other words, in all cases where we can\u0026apos;t\ntake a read lock on sb-\u0026gt;s_umount, writeback is already being triggered\nelsewhere.\r\n\r\nAn alternative would be to call btrfs_start_delalloc_roots() with a\nnumber of pages different from LONG_MAX, for example matching the number\nof delalloc bytes we currently have, in \n---truncated---(CVE-2022-48920)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnetfilter: nf_tables: unregister flowtable hooks on netns exit\r\n\r\nUnregister flowtable hooks before they are releases via\nnf_tables_flowtable_destroy() otherwise hook core reports UAF.\r\n\r\nBUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\nRead of size 4 at addr ffff8880736f7438 by task syz-executor579/3666\r\n\r\nCPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nCall Trace:\n \u0026lt;TASK\u0026gt;\n __dump_stack lib/dump_stack.c:88 [inline]\n __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106\n dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106\n print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247\n __kasan_report mm/kasan/report.c:433 [inline]\n __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450\n kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450\n nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142\n __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429\n nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571\n nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232\n nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]\n nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652\n nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652\r\n\r\n__nft_release_hook() calls nft_unregister_flowtable_net_hooks() which\nonly unregisters the hooks, then after RCU grace period, it is\nguaranteed that no packets add new entries to the flowtable (no flow\noffload rules and flowtable hooks are reachable from packet path), so it\nis safe to call nf_flow_table_free() which cleans up the remaining\nentries from the flowtable (both software and hardware) and it unbinds\nthe flow_block.(CVE-2022-48935)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ngsmi: fix null-deref in gsmi_get_variable\r\n\r\nWe can get EFI variables without fetching the attribute, so we must\nallow for that in gsmi.\r\n\r\ncommit 859748255b43 (\u0026quot;efi: pstore: Omit efivars caching EFI varstore\naccess layer\u0026quot;) added a new get_variable call with attr=NULL, which\ntriggers panic in gsmi.(CVE-2023-52893)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nxhci: Fix null pointer dereference when host dies\r\n\r\nMake sure xhci_free_dev() and xhci_kill_endpoint_urbs() do not race\nand cause null pointer dereference when host suddenly dies.\r\n\r\nUsb core may call xhci_free_dev() which frees the xhci-\u0026gt;devs[slot_id]\nvirt device at the same time that xhci_kill_endpoint_urbs() tries to\nloop through all the device\u0026apos;s endpoints, checking if there are any\ncancelled urbs left to give back.\r\n\r\nhold the xhci spinlock while freeing the virt device(CVE-2023-52898)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nusb: xhci: Check endpoint is valid before dereferencing it\r\n\r\nWhen the host controller is not responding, all URBs queued to all\nendpoints need to be killed. This can cause a kernel panic if we\ndereference an invalid endpoint.\r\n\r\nFix this by using xhci_get_virt_ep() helper to find the endpoint and\nchecking if the endpoint is valid before dereferencing it.\r\n\r\n[233311.853271] xhci-hcd xhci-hcd.1.auto: xHCI host controller not responding, assume dead\n[233311.853393] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000e8\r\n\r\n[233311.853964] pc : xhci_hc_died+0x10c/0x270\n[233311.853971] lr : xhci_hc_died+0x1ac/0x270\r\n\r\n[233311.854077] Call trace:\n[233311.854085]  xhci_hc_died+0x10c/0x270\n[233311.854093]  xhci_stop_endpoint_command_watchdog+0x100/0x1a4\n[233311.854105]  call_timer_fn+0x50/0x2d4\n[233311.854112]  expire_timers+0xac/0x2e4\n[233311.854118]  run_timer_softirq+0x300/0xabc\n[233311.854127]  __do_softirq+0x148/0x528\n[233311.854135]  irq_exit+0x194/0x1a8\n[233311.854143]  __handle_domain_irq+0x164/0x1d0\n[233311.854149]  gic_handle_irq.22273+0x10c/0x188\n[233311.854156]  el1_irq+0xfc/0x1a8\n[233311.854175]  lpm_cpuidle_enter+0x25c/0x418 [msm_pm]\n[233311.854185]  cpuidle_enter_state+0x1f0/0x764\n[233311.854194]  do_idle+0x594/0x6ac\n[233311.854201]  cpu_startup_entry+0x7c/0x80\n[233311.854209]  secondary_start_kernel+0x170/0x198(CVE-2023-52901)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nio_uring: lock overflowing for IOPOLL\r\n\r\nsyzbot reports an issue with overflow filling for IOPOLL:\r\n\r\nWARNING: CPU: 0 PID: 28 at io_uring/io_uring.c:734 io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734\nCPU: 0 PID: 28 Comm: kworker/u4:1 Not tainted 6.2.0-rc3-syzkaller-16369-g358a161a6a9e #0\nWorkqueue: events_unbound io_ring_exit_work\nCall trace:\n io_cqring_event_overflow+0x1c0/0x230 io_uring/io_uring.c:734\n io_req_cqe_overflow+0x5c/0x70 io_uring/io_uring.c:773\n io_fill_cqe_req io_uring/io_uring.h:168 [inline]\n io_do_iopoll+0x474/0x62c io_uring/rw.c:1065\n io_iopoll_try_reap_events+0x6c/0x108 io_uring/io_uring.c:1513\n io_uring_try_cancel_requests+0x13c/0x258 io_uring/io_uring.c:3056\n io_ring_exit_work+0xec/0x390 io_uring/io_uring.c:2869\n process_one_work+0x2d8/0x504 kernel/workqueue.c:2289\n worker_thread+0x340/0x610 kernel/workqueue.c:2436\n kthread+0x12c/0x158 kernel/kthread.c:376\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:863\r\n\r\nThere is no real problem for normal IOPOLL as flush is also called with\nuring_lock taken, but it\u0026apos;s getting more complicated for IOPOLL|SQPOLL,\nfor which __io_cqring_overflow_flush() happens from the CQ waiting path.(CVE-2023-52903)\r\n\r\nA race condition was found in the Linux kernel\u0026apos;s drm/exynos device driver in exynos_drm_crtc_atomic_disable() function. This can result in a null pointer dereference issue, possibly leading to a kernel panic or denial of service issue.\r\n\r\n\n(CVE-2024-22386)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nphonet: fix rtm_phonet_notify() skb allocation\r\n\r\nfill_route() stores three components in the skb:\r\n\r\n- struct rtmsg\n- RTA_DST (u8)\n- RTA_OIF (u32)\r\n\r\nTherefore, rtm_phonet_notify() should use\r\n\r\nNLMSG_ALIGN(sizeof(struct rtmsg)) +\nnla_total_size(1) +\nnla_total_size(4)(CVE-2024-36946)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nm68k: Fix spinlock race in kernel thread creation\r\n\r\nContext switching does take care to retain the correct lock owner across\nthe switch from \u0026apos;prev\u0026apos; to \u0026apos;next\u0026apos; tasks.  This does rely on interrupts\nremaining disabled for the entire duration of the switch.\r\n\r\nThis condition is guaranteed for normal process creation and context\nswitching between already running processes, because both \u0026apos;prev\u0026apos; and\n\u0026apos;next\u0026apos; already have interrupts disabled in their saved copies of the\nstatus register.\r\n\r\nThe situation is different for newly created kernel threads.  The status\nregister is set to PS_S in copy_thread(), which does leave the IPL at 0.\nUpon restoring the \u0026apos;next\u0026apos; thread\u0026apos;s status register in switch_to() aka\nresume(), interrupts then become enabled prematurely.  resume() then\nreturns via ret_from_kernel_thread() and schedule_tail() where run queue\nlock is released (see finish_task_switch() and finish_lock_switch()).\r\n\r\nA timer interrupt calling scheduler_tick() before the lock is released\nin finish_task_switch() will find the lock already taken, with the\ncurrent task as lock owner.  This causes a spinlock recursion warning as\nreported by Guenter Roeck.\r\n\r\nAs far as I can ascertain, this race has been opened in commit\n533e6903bea0 (\u0026quot;m68k: split ret_from_fork(), simplify kernel_thread()\u0026quot;)\nbut I haven\u0026apos;t done a detailed study of kernel history so it may well\npredate that commit.\r\n\r\nInterrupts cannot be disabled in the saved status register copy for\nkernel threads (init will complain about interrupts disabled when\nfinally starting user space).  Disable interrupts temporarily when\nswitching the tasks\u0026apos; register sets in resume().\r\n\r\nNote that a simple oriw 0x700,%sr after restoring sr is not enough here\n- this leaves enough of a race for the \u0026apos;spinlock recursion\u0026apos; warning to\nstill be observed.\r\n\r\nTested on ARAnyM and qemu (Quadra 800 emulation).(CVE-2024-38613)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nipv6: sr: fix missing sk_buff release in seg6_input_core\r\n\r\nThe seg6_input() function is responsible for adding the SRH into a\npacket, delegating the operation to the seg6_input_core(). This function\nuses the skb_cow_head() to ensure that there is sufficient headroom in\nthe sk_buff for accommodating the link-layer header.\nIn the event that the skb_cow_header() function fails, the\nseg6_input_core() catches the error but it does not release the sk_buff,\nwhich will result in a memory leak.\r\n\r\nThis issue was introduced in commit af3b5158b89d (\u0026quot;ipv6: sr: fix BUG due\nto headroom too small after SRH push\u0026quot;) and persists even after commit\n7a3f5b0de364 (\u0026quot;netfilter: add netfilter hooks to SRv6 data plane\u0026quot;),\nwhere the entire seg6_input() code was refactored to deal with netfilter\nhooks.\r\n\r\nThe proposed patch addresses the identified memory leak by requiring the\nseg6_input_core() function to release the sk_buff in the event that\nskb_cow_head() fails.(CVE-2024-39490)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncrypto: hisilicon/sec - Fix memory leak for sec resource release\r\n\r\nThe AIV is one of the SEC resources. When releasing resources,\nit need to release the AIV resources at the same time.\nOtherwise, memory leakage occurs.\r\n\r\nThe aiv resource release is added to the sec resource release\nfunction.(CVE-2024-41002)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ns390/sclp: Fix sclp_init() cleanup on failure\r\n\r\nIf sclp_init() fails it only partially cleans up: if there are multiple\nfailing calls to sclp_init() sclp_state_change_event will be added several\ntimes to sclp_reg_list, which results in the following warning:\r\n\r\n------------[ cut here ]------------\nlist_add double add: new=000003ffe1598c10, prev=000003ffe1598bf0, next=000003ffe1598c10.\nWARNING: CPU: 0 PID: 1 at lib/list_debug.c:35 __list_add_valid_or_report+0xde/0xf8\nCPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.10.0-rc3\nKrnl PSW : 0404c00180000000 000003ffe0d6076a (__list_add_valid_or_report+0xe2/0xf8)\n           R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:0 PM:0 RI:0 EA:3\n...\nCall Trace:\n [\u0026lt;000003ffe0d6076a\u0026gt;] __list_add_valid_or_report+0xe2/0xf8\n([\u0026lt;000003ffe0d60766\u0026gt;] __list_add_valid_or_report+0xde/0xf8)\n [\u0026lt;000003ffe0a8d37e\u0026gt;] sclp_init+0x40e/0x450\n [\u0026lt;000003ffe00009f2\u0026gt;] do_one_initcall+0x42/0x1e0\n [\u0026lt;000003ffe15b77a6\u0026gt;] do_initcalls+0x126/0x150\n [\u0026lt;000003ffe15b7a0a\u0026gt;] kernel_init_freeable+0x1ba/0x1f8\n [\u0026lt;000003ffe0d6650e\u0026gt;] kernel_init+0x2e/0x180\n [\u0026lt;000003ffe000301c\u0026gt;] __ret_from_fork+0x3c/0x60\n [\u0026lt;000003ffe0d759ca\u0026gt;] ret_from_fork+0xa/0x30\r\n\r\nFix this by removing sclp_state_change_event from sclp_reg_list when\nsclp_init() fails.(CVE-2024-41068)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Check pipe offset before setting vblank\r\n\r\npipe_ctx has a size of MAX_PIPES so checking its index before accessing\nthe array.\r\n\r\nThis fixes an OVERRUN issue reported by Coverity.(CVE-2024-42120)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Add NULL pointer check for kzalloc\r\n\r\n[Why \u0026amp; How]\nCheck return pointer of kzalloc before using it.(CVE-2024-42122)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nprotect the fetch of -\u0026gt;fd[fd] in do_dup2() from mispredictions\r\n\r\nboth callers have verified that fd is not greater than -\u0026gt;max_fds;\nhowever, misprediction might end up with\n        tofree = fdt-\u0026gt;fd[fd];\nbeing speculatively executed.  That\u0026apos;s wrong for the same reasons\nwhy it\u0026apos;s wrong in close_fd()/file_close_fd_locked(); the same\nsolution applies - array_index_nospec(fd, fdt-\u0026gt;max_fds) could differ\nfrom fd only in case of speculative execution on mispredicted path.(CVE-2024-42265)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/iucv: fix use after free in iucv_sock_close()\r\n\r\niucv_sever_path() is called from process context and from bh context.\niucv-\u0026gt;path is used as indicator whether somebody else is taking care of\nsevering the path (or it is already removed / never existed).\nThis needs to be done with atomic compare and swap, otherwise there is a\nsmall window where iucv_sock_close() will try to work with a path that has\nalready been severed and freed by iucv_callback_connrej() called by\niucv_tasklet_fn().\r\n\r\nExample:\n[452744.123844] Call Trace:\n[452744.123845] ([\u0026lt;0000001e87f03880\u0026gt;] 0x1e87f03880)\n[452744.123966]  [\u0026lt;00000000d593001e\u0026gt;] iucv_path_sever+0x96/0x138\n[452744.124330]  [\u0026lt;000003ff801ddbca\u0026gt;] iucv_sever_path+0xc2/0xd0 [af_iucv]\n[452744.124336]  [\u0026lt;000003ff801e01b6\u0026gt;] iucv_sock_close+0xa6/0x310 [af_iucv]\n[452744.124341]  [\u0026lt;000003ff801e08cc\u0026gt;] iucv_sock_release+0x3c/0xd0 [af_iucv]\n[452744.124345]  [\u0026lt;00000000d574794e\u0026gt;] __sock_release+0x5e/0xe8\n[452744.124815]  [\u0026lt;00000000d5747a0c\u0026gt;] sock_close+0x34/0x48\n[452744.124820]  [\u0026lt;00000000d5421642\u0026gt;] __fput+0xba/0x268\n[452744.124826]  [\u0026lt;00000000d51b382c\u0026gt;] task_work_run+0xbc/0xf0\n[452744.124832]  [\u0026lt;00000000d5145710\u0026gt;] do_notify_resume+0x88/0x90\n[452744.124841]  [\u0026lt;00000000d5978096\u0026gt;] system_call+0xe2/0x2c8\n[452744.125319] Last Breaking-Event-Address:\n[452744.125321]  [\u0026lt;00000000d5930018\u0026gt;] iucv_path_sever+0x90/0x138\n[452744.125324]\n[452744.125325] Kernel panic - not syncing: Fatal exception in interrupt\r\n\r\nNote that bh_lock_sock() is not serializing the tasklet context against\nprocess context, because the check for sock_owned_by_user() and\ncorresponding handling is missing.\r\n\r\nIdeas for a future clean-up patch:\nA) Correct usage of bh_lock_sock() in tasklet context, as described in\nRe-enqueue, if needed. This may require adding return values to the\ntasklet functions and thus changes to all users of iucv.\r\n\r\nB) Change iucv tasklet into worker and use only lock_sock() in af_iucv.(CVE-2024-42271)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmISDN: Fix a use after free in hfcmulti_tx()\r\n\r\nDon\u0026apos;t dereference *sp after calling dev_kfree_skb(*sp).(CVE-2024-42280)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nbpf: Fix a segment issue when downgrading gso_size\r\n\r\nLinearize the skb when downgrading gso_size because it may trigger a\nBUG_ON() later when the skb is segmented as described in [1,2].(CVE-2024-42281)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ntipc: Return non-zero value from tipc_udp_addr2str() on error\r\n\r\ntipc_udp_addr2str() should return non-zero value if the UDP media\naddress is invalid. Otherwise, a buffer overflow access can occur in\ntipc_media_addr_printf(). Fix this by returning 1 on an invalid UDP\nmedia address.(CVE-2024-42284)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nRDMA/iwcm: Fix a use-after-free related to destroying CM IDs\r\n\r\niw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with\nan existing struct iw_cm_id (cm_id) as follows:\r\n\r\n        conn_id-\u0026gt;cm_id.iw = cm_id;\n        cm_id-\u0026gt;context = conn_id;\n        cm_id-\u0026gt;cm_handler = cma_iw_handler;\r\n\r\nrdma_destroy_id() frees both the cm_id and the struct rdma_id_private. Make\nsure that cm_work_handler() does not trigger a use-after-free by only\nfreeing of the struct rdma_id_private after all pending work has finished.(CVE-2024-42285)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nf2fs: fix to don\u0026apos;t dirty inode for readonly filesystem\r\n\r\nsyzbot reports f2fs bug as below:\r\n\r\nkernel BUG at fs/f2fs/inode.c:933!\nRIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933\nCall Trace:\n evict+0x2a4/0x620 fs/inode.c:664\n dispose_list fs/inode.c:697 [inline]\n evict_inodes+0x5f8/0x690 fs/inode.c:747\n generic_shutdown_super+0x9d/0x2c0 fs/super.c:675\n kill_block_super+0x44/0x90 fs/super.c:1667\n kill_f2fs_super+0x303/0x3b0 fs/f2fs/super.c:4894\n deactivate_locked_super+0xc1/0x130 fs/super.c:484\n cleanup_mnt+0x426/0x4c0 fs/namespace.c:1256\n task_work_run+0x24a/0x300 kernel/task_work.c:180\n ptrace_notify+0x2cd/0x380 kernel/signal.c:2399\n ptrace_report_syscall include/linux/ptrace.h:411 [inline]\n ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline]\n syscall_exit_work kernel/entry/common.c:251 [inline]\n syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]\n syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296\n do_syscall_64+0x50/0x110 arch/x86/entry/common.c:88\n entry_SYSCALL_64_after_hwframe+0x63/0x6b\r\n\r\nThe root cause is:\n- do_sys_open\n - f2fs_lookup\n  - __f2fs_find_entry\n   - f2fs_i_depth_write\n    - f2fs_mark_inode_dirty_sync\n     - f2fs_dirty_inode\n      - set_inode_flag(inode, FI_DIRTY_INODE)\r\n\r\n- umount\n - kill_f2fs_super\n  - kill_block_super\n   - generic_shutdown_super\n    - sync_filesystem\n    : sb is readonly, skip sync_filesystem()\n    - evict_inodes\n     - iput\n      - f2fs_evict_inode\n       - f2fs_bug_on(sbi, is_inode_flag_set(inode, FI_DIRTY_INODE))\n       : trigger kernel panic\r\n\r\nWhen we try to repair i_current_depth in readonly filesystem, let\u0026apos;s\nskip dirty inode to avoid panic in later f2fs_evict_inode().(CVE-2024-42297)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: check dot and dotdot of dx_root before making dir indexed\r\n\r\nSyzbot reports a issue as follows:\n============================================\nBUG: unable to handle page fault for address: ffffed11022e24fe\nPGD 23ffee067 P4D 23ffee067 PUD 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 0 PID: 5079 Comm: syz-executor306 Not tainted 6.10.0-rc5-g55027e689933 #0\nCall Trace:\n \u0026lt;TASK\u0026gt;\n make_indexed_dir+0xdaf/0x13c0 fs/ext4/namei.c:2341\n ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2451\n ext4_rename fs/ext4/namei.c:3936 [inline]\n ext4_rename2+0x26e5/0x4370 fs/ext4/namei.c:4214\n[...]\n============================================\r\n\r\nThe immediate cause of this problem is that there is only one valid dentry\nfor the block to be split during do_split, so split==0 results in out of\nbounds accesses to the map triggering the issue.\r\n\r\n    do_split\n      unsigned split\n      dx_make_map\n       count = 1\n      split = count/2 = 0;\n      continued = hash2 == map[split - 1].hash;\n       ---\u0026gt; map[4294967295]\r\n\r\nThe maximum length of a filename is 255 and the minimum block size is 1024,\nso it is always guaranteed that the number of entries is greater than or\nequal to 2 when do_split() is called.\r\n\r\nBut syzbot\u0026apos;s crafted image has no dot and dotdot in dir, and the dentry\ndistribution in dirblock is as follows:\r\n\r\n  bus     dentry1          hole           dentry2           free\n|xx--|xx-------------|...............|xx-------------|...............|\n0   12 (8+248)=256  268     256     524 (8+256)=264 788     236     1024\r\n\r\nSo when renaming dentry1 increases its name_len length by 1, neither hole\nnor free is sufficient to hold the new dentry, and make_indexed_dir() is\ncalled.\r\n\r\nIn make_indexed_dir() it is assumed that the first two entries of the\ndirblock must be dot and dotdot, so bus and dentry1 are left in dx_root\nbecause they are treated as dot and dotdot, and only dentry2 is moved\nto the new leaf block. That\u0026apos;s why count is equal to 1.\r\n\r\nTherefore add the ext4_check_dx_root() helper function to add more sanity\nchecks to dot and dotdot before starting the conversion to avoid the above\nissue.(CVE-2024-42305)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ndrm/amd/display: Check for NULL pointer\r\n\r\n[why \u0026amp; how]\nNeed to make sure plane_state is initialized\nbefore accessing its members.\r\n\r\n(cherry picked from commit 295d91cbc700651782a60572f83c24861607b648)(CVE-2024-42308)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nkvm: s390: Reject memory region operations for ucontrol VMs\r\n\r\nThis change rejects the KVM_SET_USER_MEMORY_REGION and\nKVM_SET_USER_MEMORY_REGION2 ioctls when called on a ucontrol VM.\nThis is necessary since ucontrol VMs have kvm-\u0026gt;arch.gmap set to 0 and\nwould thus result in a null pointer dereference further in.\nMemory management needs to be performed in userspace and using the\nioctls KVM_S390_UCAS_MAP and KVM_S390_UCAS_UNMAP.\r\n\r\nAlso improve s390 specific documentation for KVM_SET_USER_MEMORY_REGION\nand KVM_SET_USER_MEMORY_REGION2.\r\n\r\n[frankja@linux.ibm.com: commit message spelling fix, subject prefix fix](CVE-2024-43819)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\next4: fix infinite loop when replaying fast_commit\r\n\r\nWhen doing fast_commit replay an infinite loop may occur due to an\nuninitialized extent_status struct.  ext4_ext_determine_insert_hole() does\nnot detect the replay and calls ext4_es_find_extent_range(), which will\nreturn immediately without initializing the \u0026apos;es\u0026apos; variable.\r\n\r\nBecause \u0026apos;es\u0026apos; contains garbage, an integer overflow may happen causing an\ninfinite loop in this function, easily reproducible using fstest generic/039.\r\n\r\nThis commit fixes this issue by unconditionally initializing the structure\nin function ext4_es_find_extent_range().\r\n\r\nThanks to Zhang Yi, for figuring out the real problem!(CVE-2024-43828)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nmedia: mediatek: vcodec: Handle invalid decoder vsi\r\n\r\nHandle an invalid decoder vsi in vpu_dec_init to ensure the decoder vsi\nis valid for future use.(CVE-2024-43831)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\ncgroup/cpuset: Prevent UAF in proc_cpuset_show()\r\n\r\nAn UAF can happen when /proc/cpuset is read as reported in [1].\r\n\r\nThis can be reproduced by the following methods:\n1.add an mdelay(1000) before acquiring the cgroup_lock In the\n cgroup_path_ns function.\n2.$cat /proc/\u0026lt;pid\u0026gt;/cpuset   repeatly.\n3.$mount -t cgroup -o cpuset cpuset /sys/fs/cgroup/cpuset/\n$umount /sys/fs/cgroup/cpuset/   repeatly.\r\n\r\nThe race that cause this bug can be shown as below:\r\n\r\n(umount)\t\t|\t(cat /proc/\u0026lt;pid\u0026gt;/cpuset)\ncss_release\t\t|\tproc_cpuset_show\ncss_release_work_fn\t|\tcss = task_get_css(tsk, cpuset_cgrp_id);\ncss_free_rwork_fn\t|\tcgroup_path_ns(css-\u0026gt;cgroup, ...);\ncgroup_destroy_root\t|\tmutex_lock(\u0026amp;cgroup_mutex);\nrebind_subsystems\t|\ncgroup_free_root \t|\n\t\t\t|\t// cgrp was freed, UAF\n\t\t\t|\tcgroup_path_ns_locked(cgrp,..);\r\n\r\nWhen the cpuset is initialized, the root node top_cpuset.css.cgrp\nwill point to \u0026amp;cgrp_dfl_root.cgrp. In cgroup v1, the mount operation will\nallocate cgroup_root, and top_cpuset.css.cgrp will point to the allocated\n\u0026amp;cgroup_root.cgrp. When the umount operation is executed,\ntop_cpuset.css.cgrp will be rebound to \u0026amp;cgrp_dfl_root.cgrp.\r\n\r\nThe problem is that when rebinding to cgrp_dfl_root, there are cases\nwhere the cgroup_root allocated by setting up the root for cgroup v1\nis cached. This could lead to a Use-After-Free (UAF) if it is\nsubsequently freed. The descendant cgroups of cgroup v1 can only be\nfreed after the css is released. However, the css of the root will never\nbe released, yet the cgroup_root should be freed when it is unmounted.\nThis means that obtaining a reference to the css of the root does\nnot guarantee that css.cgrp-\u0026gt;root will not be freed.\r\n\r\nFix this problem by using rcu_read_lock in proc_cpuset_show().\nAs cgroup_root is kfree_rcu after commit d23b5c577715\n(\u0026quot;cgroup: Make operations on the cgroup root_list RCU safe\u0026quot;),\ncss-\u0026gt;cgroup won\u0026apos;t be freed during the critical section.\nTo call cgroup_path_ns_locked, css_set_lock is needed, so it is safe to\nreplace task_get_css with task_css.\r\n\r\n[1] https://syzkaller.appspot.com/bug?extid=9b1ff7be974a403aa4cd(CVE-2024-43853)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nremoteproc: imx_rproc: Skip over memory region when node value is NULL\r\n\r\nIn imx_rproc_addr_init() \u0026quot;nph = of_count_phandle_with_args()\u0026quot; just counts\nnumber of phandles. But phandles may be empty. So of_parse_phandle() in\nthe parsing loop (0 \u0026lt; a \u0026lt; nph) may return NULL which is later dereferenced.\nAdjust this issue by adding NULL-return check.\r\n\r\nFound by Linux Verification Center (linuxtesting.org) with SVACE.\r\n\r\n[Fixed title to fit within the prescribed 70-75 charcters](CVE-2024-43860)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet: usb: qmi_wwan: fix memory leak for not ip packets\r\n\r\nFree the unused skb when not ip packets arrive.(CVE-2024-43861)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nnet/mlx5: Always drain health in shutdown callback\r\n\r\nThere is no point in recovery during device shutdown. if health\nwork started need to wait for it to avoid races and NULL pointer\naccess.\r\n\r\nHence, drain health WQ on shutdown callback.(CVE-2024-43866)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nwifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()\r\n\r\nCurrently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in\ncfg80211_calculate_bitrate_he(), leading to below warning:\r\n\r\nkernel: invalid HE MCS: bw:6, ru:6\nkernel: WARNING: CPU: 0 PID: 2312 at net/wireless/util.c:1501 cfg80211_calculate_bitrate_he+0x22b/0x270 [cfg80211]\r\n\r\nFix it by handling 2x996 RU allocation in the same way as 160 MHz bandwidth.(CVE-2024-43879)\r\n\r\nIn the Linux kernel, the following vulnerability has been resolved:\r\n\r\nexec: Fix ToCToU between perm check and set-uid/gid usage\r\n\r\nWhen opening a file for exec via do_filp_open(), permission checking is\ndone against the file\u0026apos;s metadata at that moment, and on success, a file\npointer is passed back. Much later in the execve() code path, the file\nmetadata (specifically mode, uid, and gid) is used to determine if/how\nto set the uid and gid. However, those values may have changed since the\npermissions check, meaning the execution may gain unintended privileges.\r\n\r\nFor example, if a file could change permissions from executable and not\nset-id:\r\n\r\n---------x 1 root root 16048 Aug  7 13:16 target\r\n\r\nto set-id and non-executable:\r\n\r\n---S------ 1 root root 16048 Aug  7 13:16 target\r\n\r\nit is possible to gain root privileges when execution should have been\ndisallowed.\r\n\r\nWhile this race condition is rare in real-world scenarios, it has been\nobserved (and proven exploitable) when package managers are updating\nthe setuid bits of installed programs. Such files start with being\nworld-executable but then are adjusted to be group-exec with a set-uid\nbit. For example, \u0026quot;chmod o-x,u+s target\u0026quot; makes \u0026quot;target\u0026quot; executable only\nby uid \u0026quot;root\u0026quot; and gid \u0026quot;cdrom\u0026quot;, while also becoming setuid-root:\r\n\r\n-rwxr-xr-x 1 root cdrom 16048 Aug  7 13:16 target\r\n\r\nbecomes:\r\n\r\n-rwsr-xr-- 1 root cdrom 16048 Aug  7 13:16 target\r\n\r\nBut racing the chmod means users without group \u0026quot;cdrom\u0026quot; membership can\nget the permission to execute \u0026quot;target\u0026quot; just before the chmod, and when\nthe chmod finishes, the exec reaches brpm_fill_uid(), and performs the\nsetuid to root, violating the expressed authorization of \u0026quot;only cdrom\ngroup members can setuid to root\u0026quot;.\r\n\r\nRe-check that we still have execute permissions in case the metadata\nhas changed. It would be better to keep a copy from the perm-check time,\nbut until we can do that refactoring, the least-bad option is to do a\nfull inode_permission() call (under inode lock). It is understood that\nthis is safe against dead-locks, but hardly optimal.(CVE-2024-43882)","status":"published","published":"2024-08-30T11:07:33Z","modified":"2026-08-18T01:18:36.00471486Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.595342Z"},{"id":"UBUNTU-CVE-2022-48935","description":"In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unregister flowtable hooks on netns exit Unregister flowtable hooks before they are releases via nf_tables_flowtable_destroy() otherwise hook core reports UAF. BUG: KASAN: use-after-free in nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142 Read of size 4 at addr ffff8880736f7438 by task syz-executor579/3666 CPU: 0 PID: 3666 Comm: syz-executor579 Not tainted 5.16.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace:  \u003cTASK\u003e  __dump_stack lib/dump_stack.c:88 [inline]  __dump_stack lib/dump_stack.c:88 [inline] lib/dump_stack.c:106  dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106 lib/dump_stack.c:106  print_address_description+0x65/0x380 mm/kasan/report.c:247 mm/kasan/report.c:247  __kasan_report mm/kasan/report.c:433 [inline]  __kasan_report mm/kasan/report.c:433 [inline] mm/kasan/report.c:450  kasan_report+0x19a/0x1f0 mm/kasan/report.c:450 mm/kasan/report.c:450  nf_hook_entries_grow+0x5a7/0x700 net/netfilter/core.c:142 net/netfilter/core.c:142  __nf_register_net_hook+0x27e/0x8d0 net/netfilter/core.c:429 net/netfilter/core.c:429  nf_register_net_hook+0xaa/0x180 net/netfilter/core.c:571 net/netfilter/core.c:571  nft_register_flowtable_net_hooks+0x3c5/0x730 net/netfilter/nf_tables_api.c:7232 net/netfilter/nf_tables_api.c:7232  nf_tables_newflowtable+0x2022/0x2cf0 net/netfilter/nf_tables_api.c:7430 net/netfilter/nf_tables_api.c:7430  nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline]  nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline]  nfnetlink_rcv_batch net/netfilter/nfnetlink.c:513 [inline] net/netfilter/nfnetlink.c:652  nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:634 [inline] net/netfilter/nfnetlink.c:652  nfnetlink_rcv+0x10e6/0x2550 net/netfilter/nfnetlink.c:652 net/netfilter/nfnetlink.c:652 __nft_release_hook() calls nft_unregister_flowtable_net_hooks() which only unregisters the hooks, then after RCU grace period, it is guaranteed that no packets add new entries to the flowtable (no flow offload rules and flowtable hooks are reachable from packet path), so it is safe to call nf_flow_table_free() which cleans up the remaining entries from the flowtable (both software and hardware) and it unbinds the flow_block.","status":"published","published":"2024-08-22T04:15:00Z","modified":"2026-08-06T03:07:38.678538192Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:58.967204Z"},{"id":"SUSE-SU-2024:3227-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP4 RT kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-41062: bluetooth/l2cap: sync sock recv cb and release (bsc#1228576).\n- CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).\n- CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).\n- CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).\n- CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section-\u003eusage (bsc#1221326).\n- CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).\n- CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).\n- CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)\n- CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)\n- CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)\n- CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)\n- CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)\n- CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).\n- CVE-2024-41009: bpf: Fix overrunning reservations in ringbuf (bsc#1228020).\n\nThe following non-security bugs were fixed:\n\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- nvme_core: scan namespaces asynchronously (bsc#1224105).\n","status":"published","published":"2024-09-12T13:26:12Z","modified":"2026-02-04T04:36:29.705159Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3408-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).\n- CVE-2024-44947: Initialize beyond-EOF page contents before setting uptodate (bsc#1229454).\n- CVE-2024-43883: Do not drop references before new references are gained (bsc#1229707).\n- CVE-2024-43861: Fix memory leak for not ip packets (bsc#1229500).\n- CVE-2023-52489: Fix race in accessing memory_section-\u003eusage (bsc#1221326).\n- CVE-2024-44938: Fix shift-out-of-bounds in dbDiscardAG (bsc#1229792).\n- CVE-2024-41087: Fix double free on error (CVE-2024-41087,bsc#1228466).\n- CVE-2024-43882: Fixed ToCToU between perm check and set-uid/gid usage. (bsc#1229503)\n- CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)\n- CVE-2022-48912: Fix use-after-free in __nf_register_net_hook() (bsc#1229641)\n- CVE-2024-42271: Fixed a use after free in iucv_sock_close(). (bsc#1229400)\n- CVE-2024-42232: Fixed a race between delayed_work() and ceph_monc_stop(). (bsc#1228959)\n- CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).\n- CVE-2024-41009: Fix overrunning reservations in ringbuf (bsc#1228020).\n- CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).\n\nThe following non-security bugs were fixed:\n\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- mm, kmsan: fix infinite recursion due to RCU critical section (git-fixes).\n- mm: prevent derefencing NULL ptr in pfn_section_valid() (git-fixes).\n- Revert 'mm: prevent derefencing NULL ptr in pfn_section_valid()' (bsc#1230413).\n- Revert 'mm, kmsan: fix infinite recursion due to RCU critical section' (bsc#1230413).\n- Revert 'mm/sparsemem: fix race in accessing memory_section-\u003eusage' (bsc#1230413).\n- nvme_core: scan namespaces asynchronously (bsc#1224105).\n","status":"published","published":"2024-09-24T06:39:39Z","modified":"2026-02-04T04:23:08.399081Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3569-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-48901: btrfs: do not start relocation until in progress drops are done  (bsc#1229607).\n- CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance.  (bsc#1229633).\n- CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)\n- CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)\n- CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).\n- CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).\n- CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).\n- CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).\n- CVE-2024-26767: drm/amd/display: fixed integer types and null check locations  (bsc#1230339).\n- CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).\n- CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).\n- CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).\n- CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).\n- CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).\n- CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).\n- CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).\n- CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).\n- CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).\n- CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command  (bsc#1228620 CVE-2024-41082).\n- CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).\n- CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)\n- CVE-2024-42265: protect the fetch of -\u003efd[fd] in do_dup2() from mispredictions (bsc#1229334).\n- CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).\n- CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).\n- CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).\n- CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).\n- CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).\n- CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).\n- CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)\n- CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).\n- CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).\n- CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).\n- CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).\n- CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).\n- CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race  (bsc#1230178).\n- CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).\n- CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).\n- CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)\n- CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).\n- CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).\n- CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).\n- CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).\n- CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).\n- CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit() (bsc#1230233).\n- CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).\n- CVE-2024-45007: char: xillybus: Refine workqueue handling (bsc#1230175).\n- CVE-2024-45008: Input: MT - limit max slots (bsc#1230248).\n- CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).\n- CVE-2024-45015: drm/msm/dpu: move dpu_encoder's connector assignment to (bsc#1230444)\n- CVE-2024-45018: netfilter: flowtable: initialise extack before use (bsc#1230431).\n- CVE-2024-45021: memcg_write_event_control(): fix a user-triggerable oops (bsc#1230434).\n- CVE-2024-45029: i2c: tegra: Do not mark ACPI devices as irq safe (bsc#1230451).\n- CVE-2024-46673: scsi: aacraid: Fix double-free on probe failure (bsc#1230506).\n- CVE-2024-46674: usb: dwc3: st: fix probed platform device ref count on probe  error path (bsc#1230507).\n- CVE-2024-46677: gtp: fix a potential NULL pointer dereference (bsc#1230549).\n- CVE-2024-46679: ethtool: check device is present when getting link settings (bsc#1230556).\n- CVE-2024-46685: pinctrl: single: fix potential NULL dereference in pcs_get_function() (bsc#1230515)\n- CVE-2024-46686: smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() (bsc#1230517).\n- CVE-2024-46689: soc: qcom: cmd-db: Map shared memory as WC, not WB (bsc#1230524)\n- CVE-2024-46702: thunderbolt: Mark XDomain as unplugged when router is removed (bsc#1230589)\n- CVE-2024-46707: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3  (bsc#1230582).\n- CVE-2024-46715: driver: iio: add missing checks on iio_info's callback access  (bsc#1230700).\n- CVE-2024-46717: net/mlx5e: SHAMPO, Fix incorrect page release (bsc#1230719).\n- CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)\n- CVE-2024-46728: drm/amd/display: Check index for aux_rd_interval before using (bsc#1230703)\n- CVE-2024-46730: drm/amd/display: Ensure array index tg_inst won't be -1 (bsc#1230701)\n- CVE-2024-46743: of/irq: Prevent device address out-of-bounds read in interrupt map walk (bsc#1230756).\n- CVE-2024-46751: btrfs: do not BUG_ON() when 0 reference count at btrfs_lookup_extent_info() (bsc#1230786).\n- CVE-2024-46752: btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() (bsc#1230794).\n- CVE-2024-46753: btrfs: handle errors from btrfs_dec_ref() properly (bsc#1230796).\n- CVE-2024-46772: drm/amd/display: Check denominator crb_pipes before used (bsc#1230772).\n- CVE-2024-46783: tcp_bpf: fix return value of tcp_bpf_sendmsg() (bsc#1230810).\n- CVE-2024-46787: userfaultfd: fix checks for huge PMDs (bsc#1230815).\n- CVE-2024-46794: x86/tdx: Fix data leak in mmio_read() (bsc#1230825).\n- CVE-2024-46822: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120).\n- CVE-2024-46830: KVM: x86: Acquire kvm-\u003esrcu when handling KVM_SET_VCPU_EVENTS  (bsc#1231116).\n\nThe following non-security bugs were fixed:\n\n- ACPI: battery: create alarm sysfs attribute atomically (git-fixes).\n- ACPI: CPPC: Fix MASK_VAL() usage (git-fixes).\n- ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() (git-fixes).\n- ACPI: processor: Fix memory leaks in error paths of processor_add() (stable-fixes).\n- ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() (stable-fixes).\n- ACPI: SBS: manage alarm sysfs attribute through psy core (git-fixes).\n- ACPI: sysfs: validate return type of _STR method (git-fixes).\n- af_unix: annotate lockless accesses to sk-\u003esk_err (bsc#1226846).\n- af_unix: Fix data races around sk-\u003esk_shutdown (bsc#1226846).\n- af_unix: Fix data-races around sk-\u003esk_shutdown (git-fixes).\n- ALSA: hda: Add input value sanity checks to HDMI channel map controls (stable-fixes).\n- ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices (stable-fixes).\n- ALSA: hda/conexant: Mute speakers at suspend / shutdown (stable-fixes).\n- ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown (stable-fixes).\n- ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx (stable-fixes).\n- apparmor: fix possible NULL pointer dereference (stable-fixes).\n- arm64: acpi: Move get_cpu_for_acpi_id() to a header (git-fixes).\n- arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity (git-fixes).\n- arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E (git-fixes).\n- arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency (git-fixes).\n- arm64/mm: Modify range-based tlbi to decrement scale (bsc#1229585)\n- arm64/mm: Update tlb invalidation routines for FEAT_LPA2 (bsc#1229585)\n- arm64: tlb: Allow range operation for MAX_TLBI_RANGE_PAGES (bsc#1229585)\n- arm64: tlb: Fix TLBI RANGE operand (bsc#1229585)\n- arm64: tlb: Improve __TLBI_VADDR_RANGE() (bsc#1229585)\n- ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object (git-fixes).\n- ASoC: meson: axg-card: fix 'use-after-free' (git-fixes).\n- ASoc: SOF: topology: Clear SOF link platform name upon unload (git-fixes).\n- ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode (git-fixes).\n- ASoC: tegra: Fix CBB error during probe() (git-fixes).\n- ASoC: topology: Properly initialize soc_enum values (stable-fixes).\n- ata: libata: Fix memory leak for error path in ata_host_alloc() (git-fixes).\n- ata: pata_macio: Use WARN instead of BUG (stable-fixes).\n- blk-mq: add helper for checking if one CPU is mapped to specified hctx (bsc#1223600).\n- blk-mq: add number of queue calc helper (bsc#1229034).\n- blk-mq: Build default queue map via group_cpus_evenly() (bsc#1229031).\n- blk-mq: do not schedule block kworker on isolated CPUs (bsc#1223600).\n- blk-mq: introduce blk_mq_dev_map_queues (bsc#1229034).\n- blk-mq: issue warning when offlining hctx with online isolcpus (bsc#1229034).\n- blk-mq: use hk cpus only when isolcpus=io_queue is enabled (bsc#1229034).\n- Bluetooth: btusb: Fix not handling ZPL/short-transfer (git-fixes).\n- Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED (git-fixes).\n- Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL (git-fixes).\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- Bluetooth: MGMT: Ignore keys being loaded with invalid type (git-fixes).\n- cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181).\n- cachefiles: Fix non-taking of sb_writers around set/removexattr (bsc#1231013).\n- can: bcm: Clear bo-\u003ebcm_proc_read after remove_proc_entry() (git-fixes).\n- can: bcm: Remove proc entry when dev is unregistered (git-fixes).\n- can: j1939: use correct function name in comment (git-fixes).\n- can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open (git-fixes).\n- cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller (git-fixes).\n- ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180).\n- char: xillybus: Check USB endpoints when probing device (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix the pll post div mask (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled (git-fixes).\n- cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately (git-fixes).\n- crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure (git-fixes).\n- crypto: virtio - Handle dataq logic with tasklet (git-fixes).\n- crypto: virtio - Wait for tasklet to complete on device remove (git-fixes).\n- crypto: xor - fix template benchmarking (git-fixes).\n- devres: Initialize an uninitialized struct member (stable-fixes).\n- driver core: Add debug logs when fwnode links are added/deleted (git-fixes).\n- driver core: Add missing parameter description to __fwnode_link_add() (git-fixes).\n- driver core: Create __fwnode_link_del() helper function (git-fixes).\n- driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle (git-fixes).\n- driver core: fw_devlink: Consolidate device link flag computation (git-fixes).\n- driver core: Set deferred probe reason when deferred by driver core (git-fixes).\n- drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind() (git-fixes).\n- Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic (git-fixes).\n- Drivers: hv: vmbus: Fix the misplaced function description (git-fixes).\n- drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes).\n- drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes).\n- drm/amd/amdgpu: Check tbo resource pointer (stable-fixes).\n- drm/amd/amdgpu: Properly tune the size of struct (git-fixes).\n- drm/amd/display: Add array index check for hdcp ddc access (stable-fixes).\n- drm/amd/display: added NULL check at start of dc_validate_stream (stable-fixes).\n- drm/amd/display: Assign linear_pitch_alignment even for VM (stable-fixes).\n- drm/amd/display: Check denominator pbn_div before used (stable-fixes).\n- drm/amd/display: Check gpio_id before used as array index (stable-fixes).\n- drm/amd/display: Check HDCP returned status (stable-fixes).\n- drm/amd/display: Check msg_id before processing transcation (stable-fixes).\n- drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] (stable-fixes).\n- drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX (stable-fixes).\n- drm/amd/display: Ensure index calculation will not overflow (stable-fixes).\n- drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create (stable-fixes).\n- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration (stable-fixes).\n- drm/amd/display: Skip wbscl_set_scaler_filter if filter is null (stable-fixes).\n- drm/amd/display: Spinlock before reading event (stable-fixes).\n- drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (stable-fixes).\n- drm/amdgpu/atomfirmware: Silence UBSAN warning (stable-fixes).\n- drm/amdgpu: avoid reading vf2pf info size from FB (stable-fixes).\n- drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6 (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts (stable-fixes).\n- drm/amdgpu: fix a possible null pointer dereference (git-fixes).\n- drm/amdgpu: fix dereference after null check (stable-fixes).\n- drm/amdgpu: fix mc_data out-of-bounds read warning (stable-fixes).\n- drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (stable-fixes).\n- drm/amdgpu: Fix out-of-bounds write warning (stable-fixes).\n- drm/amdgpu: fix overflowed array index read warning (stable-fixes).\n- drm/amdgpu: Fix smatch static checker warning (stable-fixes).\n- drm/amdgpu: fix the waring dereferencing hive (stable-fixes).\n- drm/amdgpu: fix ucode out-of-bounds read warning (stable-fixes).\n- drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr (stable-fixes).\n- drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs (stable-fixes).\n- drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc (stable-fixes).\n- drm/amdgpu/pm: Fix uninitialized variable agc_btc_response (stable-fixes).\n- drm/amdgpu/pm: Fix uninitialized variable warning for smu10 (stable-fixes).\n- drm/amdgpu: Set no_hw_access when VF request full GPU fails (stable-fixes).\n- drm/amdgpu: the warning dereferencing obj for nbio_v7_4 (stable-fixes).\n- drm/amdgpu: update type of buf size to u32 for eeprom functions (stable-fixes).\n- drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device (stable-fixes).\n- drm/amd/pm: check negtive return for table entries (stable-fixes).\n- drm/amd/pm: check specific index for aldebaran (stable-fixes).\n- drm/amd/pm: Fix negative array index read (stable-fixes).\n- drm/amd/pm: fix the Out-of-bounds read warning (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warning (stable-fixes).\n- drm/amd/pm: fix warning using uninitialized value of max_vid_step (stable-fixes).\n- drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid() (git-fixes).\n- drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ (stable-fixes).\n- drm/i915/fence: Mark debug_fence_free() with __maybe_unused (git-fixes).\n- drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused (git-fixes).\n- drm/i915/guc: prevent a possible int overflow in wq offsets (git-fixes).\n- drm/meson: plane: Add error handling (stable-fixes).\n- drm/msm/a5xx: disable preemption in submits by default (git-fixes).\n- drm/msm/a5xx: fix races in preemption evaluation stage (git-fixes).\n- drm/msm/a5xx: properly clear preemption records on resume (git-fixes).\n- drm/msm/a5xx: workaround early ring-buffer emptiness check (git-fixes).\n- drm/msm/adreno: Fix error return if missing firmware-name (stable-fixes).\n- drm/msm/disp/dpu: use atomic enable/disable callbacks for encoder (bsc#1230444)\n- drm/msm: Fix incorrect file name output in adreno_request_fw() (git-fixes).\n- drm/msm: fix %s null argument error (git-fixes).\n- drm: omapdrm: Add missing check for alloc_ordered_workqueue (git-fixes).\n- drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets (git-fixes).\n- drm/radeon: fix null pointer dereference in radeon_add_common_modes (git-fixes).\n- drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode (git-fixes).\n- drm/rockchip: vop: Allow 4096px width scaling (git-fixes).\n- drm/stm: ltdc: check memory returned by devm_kzalloc() (git-fixes).\n- exfat: fix memory leak in exfat_load_bitmap() (git-fixes).\n- fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() (git-fixes).\n- filemap: remove use of wait bookmarks (bsc#1224085).\n- firmware_loader: Block path traversal (git-fixes).\n- fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF (bsc#1230592).\n- fuse: update stats for pages in dropped aux writeback list (bsc#1230130).\n- fuse: use unsigned type for getxattr/listxattr size truncation (bsc#1230129).\n- genirq/affinity: Do not pass irq_affinity_desc array to irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Move group_cpus_evenly() into lib/ (bsc#1229031).\n- genirq/affinity: Only build SMP-only helper functions on SMP kernels (bsc#1229031).\n- genirq/affinity: Pass affinity managed mask array to irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Remove the 'firstvec' parameter from irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Rename irq_build_affinity_masks as group_cpus_evenly (bsc#1229031).\n- genirq/affinity: Replace cpumask_weight() with cpumask_empty() where appropriate (bsc#1229031).\n- gfs2: setattr_chown: Add missing initialization (git-fixes).\n- HID: amd_sfh: free driver_data after destroying hid device (stable-fixes).\n- HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup (stable-fixes).\n- hwmon: (adc128d818) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwmon: (lm95234) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwmon: (max16065) Fix overflows seen when writing limits (git-fixes).\n- hwmon: (ntc_thermistor) fix module autoloading (git-fixes).\n- hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init (git-fixes).\n- hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume (git-fixes).\n- hwrng: mtk - Use devm_pm_runtime_enable (git-fixes).\n- i2c: aspeed: Update the stop sw state when the bus recovery occurs (git-fixes).\n- i2c: Fix conditional for substituting empty ACPI functions (stable-fixes).\n- i2c: isch: Add missed 'else' (git-fixes).\n- i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() (git-fixes).\n- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (git-fixes).\n- i2c: xiic: Wait for TX empty to avoid missed TX NAKs (git-fixes).\n- i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup (stable-fixes).\n- IB/core: Fix ib_cache_setup_one error flow cleanup (git-fixes)\n- IB/hfi1: Fix potential deadlock on \u0026irq_src_lock and \u0026dd-\u003euctxt_lock (git-fixes)\n- iio: adc: ad7124: fix chip ID mismatch (git-fixes).\n- iio: adc: ad7124: fix config comparison (git-fixes).\n- iio: adc: ad7606: fix oversampling gpio array (git-fixes).\n- iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes).\n- iio: buffer-dmaengine: fix releasing dma channel on error (git-fixes).\n- iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes).\n- iio: fix scale application in iio_convert_raw_to_processed_unlocked (git-fixes).\n- iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes).\n- Input: ilitek_ts_i2c - add report id message validation (git-fixes).\n- Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes).\n- Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes).\n- Input: uinput - reject requests with unreasonable number of slots (stable-fixes).\n- ipmi: docs: do not advertise deprecated sysfs entries (git-fixes).\n- ipmi:ssif: Improve detecting during probing (bsc#1228771)\n- ipmi:ssif: Improve detecting during probing (bsc#1228771) \n- jfs: fix out-of-bounds in dbNextAG() and diAlloc() (git-fixes).\n- kabi: add __nf_queue_get_refs() for kabi compliance.\n- kABI, crypto: virtio - Handle dataq logic with tasklet (git-fixes).\n- kthread: Fix task state in kthread worker if being frozen (bsc#1231146).\n- lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly (bsc#1229031).\n- lib/group_cpus.c: honor housekeeping config when grouping CPUs (bsc#1229034).\n- lib/group_cpus: Export group_cpus_evenly() (bsc#1229031).\n- lirc: rc_dev_get_from_fd(): fix file leak (git-fixes).\n- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).\n- mailbox: rockchip: fix a typo in module autoloading (git-fixes).\n- media: aspeed: Fix no complete irq for non-64-aligned width (bsc#1230269)\n- media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse (stable-fixes).\n- media: qcom: camss: Fix ordering of pm_runtime_enable (git-fixes).\n- media: Revert 'media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()' (git-fixes).\n- media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes).\n- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes).\n- media: uvcvideo: Enforce alignment of frame and interval (stable-fixes).\n- media: venus: fix use after free bug in venus_remove due to race condition (git-fixes).\n- media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes).\n- media: vivid: do not set HDMI TX controls if there are no HDMI outputs (stable-fixes).\n- media: vivid: fix wrong sizeimage value for mplane (stable-fixes).\n- mmc: cqhci: Fix checking of CQHCI_HALT state (git-fixes).\n- mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K (git-fixes).\n- mmc: sdhci-of-aspeed: fix module autoloading (git-fixes).\n- mtd: powernv: Add check devm_kasprintf() returned value (git-fixes).\n- mtd: slram: insert break after errors in parsing the map (git-fixes).\n- net: drop bad gso csum_start and offset in virtio_net_hdr (git-fixes).\n- net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (git-fixes).\n- net: missing check virtio (git-fixes).\n- net: tighten bad gso csum offset check in virtio_net_hdr (git-fixes).\n- nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769).\n- NFSD: Fix frame size warning in svc_export_parse() (git-fixes).\n- NFS: Do not re-read the entire page cache to find the next cookie (bsc#1226662).\n- NFSD: Rewrite synopsis of nfsd_percpu_counters_init() (git-fixes).\n- NFS: never reuse a NFSv4.0 lock-owner (bsc#1227726).\n- NFS: Reduce use of uncached readdir (bsc#1226662).\n- NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations (git-fixes).\n- nilfs2: Constify struct kobj_type (git-fixes).\n- nilfs2: determine empty node blocks as corrupted (git-fixes).\n- nilfs2: fix missing cleanup on rollforward recovery error (git-fixes).\n- nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() (git-fixes).\n- nilfs2: fix potential oob read in nilfs_btree_check_delete() (git-fixes).\n- nilfs2: fix state management in error path of log writing function (git-fixes).\n- nilfs2: protect references to superblock parameters exposed in sysfs (git-fixes).\n- nilfs2: replace snprintf in show functions with sysfs_emit (git-fixes).\n- nilfs2: use default_groups in kobj_type (git-fixes).\n- nvme: move stopping keep-alive into nvme_uninit_ctrl() (git-fixes).\n- nvme/pci: Add APST quirk for Lenovo N60z laptop (git-fixes).\n- nvme-pci: Add sleep quirk for Samsung 990 Evo (git-fixes).\n- nvme-pci: use block layer helpers to calculate num of queues (bsc#1229034).\n- nvme: replace blk_mq_pci_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- nvmet: Identify-Active Namespace ID List command should reject invalid nsid (git-fixes).\n- nvmet-rdma: fix possible bad dereference when freeing rsps (git-fixes).\n- nvmet-tcp: do not continue for invalid icreq (git-fixes).\n- nvmet-tcp: fix kernel crash if commands allocation fails (git-fixes).\n- nvmet-trace: avoid dereferencing pointer too early (git-fixes).\n- ocfs2: cancel dqi_sync_work before freeing oinfo (git-fixes).\n- ocfs2: fix null-ptr-deref when journal load failed (git-fixes).\n- ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate (git-fixes).\n- ocfs2: remove unreasonable unlock in ocfs2_read_blocks (git-fixes).\n- PCI: Add missing bridge lock to pci_bus_lock() (stable-fixes).\n- PCI: al: Check IORESOURCE_BUS existence during probe (git-fixes).\n- PCI/ASPM: Move pci_function_0() upward (bsc#1226915)\n- PCI/ASPM: Remove struct aspm_latency (bsc#1226915)\n- PCI/ASPM: Stop caching device L0s, L1 acceptable exit latencies (bsc#1226915)\n- PCI/ASPM: Stop caching link L0s, L1 exit latencies (bsc#1226915)\n- PCI: dra7xx: Fix error handling when IRQ request fails in probe (git-fixes).\n- PCI: dwc: Expose dw_pcie_ep_exit() to module (git-fixes).\n- PCI: dwc: Restore MSI Receiver mask during resume (git-fixes).\n- pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv (stable-fixes).\n- PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) (stable-fixes).\n- PCI: keystone: Fix if-statement expression in ks_pcie_quirk() (git-fixes).\n- PCI: Support BAR sizes up to 8TB (bsc#1231017)\n- PCI: Wait for Link before restoring Downstream Buses (git-fixes).\n- PCI: xilinx-nwl: Clean up clock on probe failure/removal (git-fixes).\n- PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes).\n- PCI: xilinx-nwl: Fix register misspelling (git-fixes).\n- pcmcia: Use resource_size function on resource object (stable-fixes).\n- pinctrl: single: fix missing error code in pcs_probe() (git-fixes).\n- pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes).\n- PKCS#7: Check codeSigning EKU of certificates in PKCS#7 (bsc#1226666).\n- platform/x86: dell-smbios: Fix error path in dell_smbios_init() (git-fixes).\n- platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array (git-fixes).\n- platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses (git-fixes).\n- power: supply: axp20x_battery: Remove design from min and max voltage (git-fixes).\n- power: supply: Drop use_cnt check from power_supply_property_is_writeable() (git-fixes).\n- power: supply: hwmon: Fix missing temp1_max_alarm attribute (git-fixes).\n- power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense (git-fixes).\n- RDMA/core: Remove unused declaration rdma_resolve_ip_route() (git-fixes)\n- RDMA/cxgb4: Added NULL check for lookup_atid (git-fixes)\n- RDMA/efa: Properly handle unexpected AQ completions (git-fixes)\n- RDMA/hns: Do not modify rq next block addr in HIP09 QPC (git-fixes)\n- RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled (git-fixes)\n- RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() (git-fixes)\n- RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler (git-fixes)\n- RDMA/hns: Optimize hem allocation performance (git-fixes)\n- RDMA/irdma: fix error message in irdma_modify_qp_roce() (git-fixes)\n- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (git-fixes)\n- RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds (git-fixes)\n- RDMA/rtrs: Fix the problem of variable not initialized fully (git-fixes)\n- RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer (git-fixes)\n- Restore dropped fields for bluetooth MGMT/SMP structs (git-fixes).\n- Revert 'Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE' (git-fixes).\n- Revert 'media: tuners: fix error return code of hybrid_tuner_request_state()' (git-fixes).\n- Revert 'media: tuners: fix error return code of hybrid_tuner_request_state()' (stable-fixes).\n- rtc: at91sam9: fix OF node leak in probe() error path (git-fixes).\n- scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223).\n- scsi: lpfc: Change diagnostic log flag during receipt of unknown ELS cmds (bsc#1229429).\n- scsi: lpfc: Copyright updates for 14.4.0.4 patches (bsc#1229429).\n- scsi: lpfc: Fix overflow build issue (bsc#1229429).\n- scsi: lpfc: Fix unintentional double clearing of vmid_flag (bsc#1229429).\n- scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (bsc#1229429).\n- scsi: lpfc: Remove redundant vport assignment when building an abort request (bsc#1229429).\n- scsi: lpfc: Update lpfc version to 14.4.0.4 (bsc#1229429).\n- scsi: lpfc: Update PRLO handling in direct attached topology (bsc#1229429).\n- scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (bsc#1229429).\n- scsi: pm8001: do not overwrite PCI queue mapping (bsc#1229034).\n- scsi: replace blk_mq_pci_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848).\n- scsi: use block layer helpers to calculate num of queues (bsc#1229034).\n- spi: nxp-fspi: fix the KASAN report out-of-bounds bug (git-fixes).\n- Squashfs: sanity check symbolic link size (git-fixes).\n- staging: iio: frequency: ad9834: Validate frequency parameter value (git-fixes).\n- thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes).\n- tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes).\n- tools/virtio: fix build (git-fixes).\n- tpm: Clean up TPM space after command failure (git-fixes).\n- tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes).\n- tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes).\n- udp: fix receiving fraglist GSO packets (git-fixes).\n- uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind (git-fixes).\n- usb: cdnsp: Fix incorrect usb_request status (git-fixes).\n- USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes).\n- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).\n- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).\n- usb: dwc3: core: Prevent USB core invalid event buffer address access (git-fixes).\n- usb: dwc3: core: Skip setting event buffers for host only controllers (git-fixes).\n- usb: dwc3: core: update LC timer as per USB Spec V3.2 (git-fixes).\n- usb: dwc3: core: update LC timer as per USB Spec V3.2 (stable-fixes).\n- usb: dwc3: omap: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: fix probed platform device ref count on probe error path (git-fixes).\n- usbip: Do not submit special requests twice (stable-fixes).\n- usbnet: fix cyclical race on disconnect with work queue (git-fixes).\n- usbnet: ipheth: race between ipheth_close and error handling (git-fixes).\n- usbnet: modern method to get random MAC (git-fixes).\n- USB: serial: kobil_sct: restore initial terminal settings (git-fixes).\n- USB: serial: option: add MeiG Smart SRM825L (git-fixes).\n- usb: typec: ucsi: Fix null pointer dereference in trace (stable-fixes).\n- usb: uas: set host status byte on data completion error (git-fixes).\n- usb: uas: set host status byte on data completion error (stable-fixes).\n- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).\n- usb: xhci: fix loss of data on Cadence xHC (git-fixes).\n- vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).\n- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler (git-fixes).\n- virito: add APIs for retrieving vq affinity (bsc#1229034).\n- virtio-blk: Ensure no requests in virtqueues before deleting vqs (git-fixes).\n- virtio: blk/scsi: use block layer helpers to calculate num of queues (bsc#1229034).\n- virtio: blk/scs: replace blk_mq_virtio_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- virtiofs: forbid newlines in tags (bsc#1230591).\n- virtio_net: checksum offloading handling fix (git-fixes).\n- virtio_net: Fix ''%d' directive writing between 1 and 11 bytes into a region of size 10' warnings (git-fixes).\n- virtio_net: use u64_stats_t infra to avoid data-races (git-fixes).\n- virtio: reenable config if freezing device failed (git-fixes).\n- virtio/vsock: fix logic which reduces credit update messages (git-fixes).\n- VMCI: Fix use-after-free when removing resource in vmci_resource_remove() (git-fixes).\n- vsock/virtio: add support for device suspend/resume (git-fixes).\n- vsock/virtio: factor our the code to initialize and delete VQs (git-fixes).\n- vsock/virtio: initialize the_virtio_vsock before using VQs (git-fixes).\n- vsock/virtio: remove socket from connected/bound list on shutdown (git-fixes).\n- watchdog: imx_sc_wdt: Do not disable WDT in suspend (git-fixes).\n- wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 (stable-fixes).\n- wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors (git-fixes).\n- wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() (git-fixes).\n- wifi: iwlwifi: mvm: increase the time between ranging measurements (git-fixes).\n- wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (git-fixes).\n- wifi: mt76: mt7615: check devm_kasprintf() returned value (git-fixes).\n- wifi: mt76: mt7915: fix rx filter setting for bfee functionality (git-fixes).\n- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (stable-fixes).\n- wifi: rtw88: 8822c: Fix reported RX band width (git-fixes).\n- wifi: rtw88: always wait for both firmware loading attempts (git-fixes).\n- wifi: rtw88: remove CPT execution branch never used (git-fixes).\n- wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param (git-fixes).\n- x86/hyperv: fix kexec crash due to VP assist page corruption (git-fixes).\n- x86/kexec: Add EFI config table identity mapping for kexec kernel (bsc#1220382).\n- x86/mm/ident_map: Use gbpages only where full GB page should be mapped (bsc#1220382).\n- x86/xen: Convert comma to semicolon (git-fixes).\n- xen: add capability to remap non-RAM pages to different PFNs (bsc#1226003).\n- xen: allow mapping ACPI data using a different physical address (bsc#1226003).\n- xen: introduce generic helper checking for memory map conflicts (bsc#1226003).\n- xen: move checks for e820 conflicts further up (bsc#1226003).\n- xen: move max_pfn in xen_memory_setup() out of function scope (bsc#1226003).\n- xen/swiotlb: add alignment check for dma buffers (bsc#1229928).\n- xen/swiotlb: fix allocated size (git-fixes).\n- xen: tolerate ACPI NVS memory overlapping with Xen allocated memory (bsc#1226003).\n- xen: use correct end address of kernel for conflict checking (bsc#1226003).\n- xfs: do not include bnobt blocks when reserving free block pool (git-fixes).\n- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes).\n- xz: cleanup CRC32 edits from 2018 (git-fixes).\n","status":"published","published":"2024-10-09T11:52:12Z","modified":"2026-02-04T02:15:16.708757Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3587-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 Azure kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-48901: btrfs: do not start relocation until in progress drops are done  (bsc#1229607).\n- CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance.  (bsc#1229633).\n- CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)\n- CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)\n- CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).\n- CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).\n- CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).\n- CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).\n- CVE-2024-26767: drm/amd/display: fixed integer types and null check locations  (bsc#1230339).\n- CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).\n- CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).\n- CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).\n- CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).\n- CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).\n- CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).\n- CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).\n- CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).\n- CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).\n- CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command  (bsc#1228620 CVE-2024-41082).\n- CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).\n- CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)\n- CVE-2024-42265: protect the fetch of -\u003efd[fd] in do_dup2() from mispredictions (bsc#1229334).\n- CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).\n- CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).\n- CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).\n- CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).\n- CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).\n- CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).\n- CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)\n- CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).\n- CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).\n- CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).\n- CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).\n- CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).\n- CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race  (bsc#1230178).\n- CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).\n- CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).\n- CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)\n- CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).\n- CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).\n- CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).\n- CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).\n- CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).\n- CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit() (bsc#1230233).\n- CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).\n- CVE-2024-45007: char: xillybus: Refine workqueue handling (bsc#1230175).\n- CVE-2024-45008: Input: MT - limit max slots (bsc#1230248).\n- CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).\n- CVE-2024-45015: drm/msm/dpu: move dpu_encoder's connector assignment to (bsc#1230444)\n- CVE-2024-45018: netfilter: flowtable: initialise extack before use (bsc#1230431).\n- CVE-2024-45021: memcg_write_event_control(): fix a user-triggerable oops (bsc#1230434).\n- CVE-2024-45029: i2c: tegra: Do not mark ACPI devices as irq safe (bsc#1230451).\n- CVE-2024-46673: scsi: aacraid: Fix double-free on probe failure (bsc#1230506).\n- CVE-2024-46674: usb: dwc3: st: fix probed platform device ref count on probe  error path (bsc#1230507).\n- CVE-2024-46677: gtp: fix a potential NULL pointer dereference (bsc#1230549).\n- CVE-2024-46678: bonding: change ipsec_lock from spin lock to mutex (bsc#1230550).\n- CVE-2024-46679: ethtool: check device is present when getting link settings (bsc#1230556).\n- CVE-2024-46685: pinctrl: single: fix potential NULL dereference in pcs_get_function() (bsc#1230515)\n- CVE-2024-46686: smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() (bsc#1230517).\n- CVE-2024-46689: soc: qcom: cmd-db: Map shared memory as WC, not WB (bsc#1230524)\n- CVE-2024-46702: thunderbolt: Mark XDomain as unplugged when router is removed (bsc#1230589)\n- CVE-2024-46707: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3  (bsc#1230582).\n- CVE-2024-46715: driver: iio: add missing checks on iio_info's callback access  (bsc#1230700).\n- CVE-2024-46717: net/mlx5e: SHAMPO, Fix incorrect page release (bsc#1230719).\n- CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)\n- CVE-2024-46728: drm/amd/display: Check index for aux_rd_interval before using (bsc#1230703)\n- CVE-2024-46730: drm/amd/display: Ensure array index tg_inst won't be -1 (bsc#1230701)\n- CVE-2024-46743: of/irq: Prevent device address out-of-bounds read in interrupt map walk (bsc#1230756).\n- CVE-2024-46751: btrfs: do not BUG_ON() when 0 reference count at btrfs_lookup_extent_info() (bsc#1230786).\n- CVE-2024-46752: btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() (bsc#1230794).\n- CVE-2024-46753: btrfs: handle errors from btrfs_dec_ref() properly (bsc#1230796).\n- CVE-2024-46770: ice: Add netif_device_attach/detach into PF reset flow (bsc#1230763).\n- CVE-2024-46775: drm/amd/display: Validate function returns (bsc#1230774).\n- CVE-2024-46783: tcp_bpf: fix return value of tcp_bpf_sendmsg() (bsc#1230810).\n- CVE-2024-46787: userfaultfd: fix checks for huge PMDs (bsc#1230815).\n- CVE-2024-46794: x86/tdx: Fix data leak in mmio_read() (bsc#1230825).\n- CVE-2024-46822: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120).\n- CVE-2024-46826: ELF: fix kernel.randomize_va_space double read (bsc#1231115).\n- CVE-2024-46830: KVM: x86: Acquire kvm-\u003esrcu when handling KVM_SET_VCPU_EVENTS  (bsc#1231116).\n- CVE-2024-46854: net: dpaa: Pad packets to ETH_ZLEN (bsc#1231084).\n- CVE-2024-46855: netfilter: nft_socket: fix sk refcount leaks (bsc#1231085).\n- CVE-2024-46857: net/mlx5: Fix bridge mode operations when there are no VFs (bsc#1231087).\n\nThe following non-security bugs were fixed:\n\n- ACPI: CPPC: Fix MASK_VAL() usage (git-fixes).\n- ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() (git-fixes).\n- ACPI: SBS: manage alarm sysfs attribute through psy core (git-fixes).\n- ACPI: battery: create alarm sysfs attribute atomically (git-fixes).\n- ACPI: processor: Fix memory leaks in error paths of processor_add() (stable-fixes).\n- ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() (stable-fixes).\n- ACPI: sysfs: validate return type of _STR method (git-fixes).\n- ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices (stable-fixes).\n- ALSA: hda/conexant: Mute speakers at suspend / shutdown (stable-fixes).\n- ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown (stable-fixes).\n- ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx (stable-fixes).\n- ALSA: hda/realtek: add patch for internal mic in Lenovo V145 (stable-fixes).\n- ALSA: hda: Add input value sanity checks to HDMI channel map controls (stable-fixes).\n- ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object (git-fixes).\n- ASoC: meson: axg-card: fix 'use-after-free' (git-fixes).\n- ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode (git-fixes).\n- ASoC: tegra: Fix CBB error during probe() (git-fixes).\n- ASoC: topology: Properly initialize soc_enum values (stable-fixes).\n- ASoc: SOF: topology: Clear SOF link platform name upon unload (git-fixes).\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- Bluetooth: MGMT: Ignore keys being loaded with invalid type (git-fixes).\n- Bluetooth: btusb: Fix not handling ZPL/short-transfer (git-fixes).\n- Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED (git-fixes).\n- Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL (git-fixes).\n- Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic (git-fixes).\n- Drivers: hv: vmbus: Fix the misplaced function description (git-fixes).\n- HID: amd_sfh: free driver_data after destroying hid device (stable-fixes).\n- HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup (stable-fixes).\n- IB/core: Fix ib_cache_setup_one error flow cleanup (git-fixes)\n- IB/hfi1: Fix potential deadlock on \u0026irq_src_lock and \u0026dd-\u003euctxt_lock (git-fixes)\n- Input: ilitek_ts_i2c - add report id message validation (git-fixes).\n- Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes).\n- Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes).\n- Input: uinput - reject requests with unreasonable number of slots (stable-fixes).\n- KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (git-fixes bsc#1231277).\n- NFS: Do not re-read the entire page cache to find the next cookie (bsc#1226662).\n- NFS: Reduce use of uncached readdir (bsc#1226662).\n- NFS: never reuse a NFSv4.0 lock-owner (bsc#1227726).\n- NFSD: Fix frame size warning in svc_export_parse() (git-fixes).\n- NFSD: Rewrite synopsis of nfsd_percpu_counters_init() (git-fixes).\n- NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations (git-fixes).\n- PCI/ASPM: Move pci_function_0() upward (bsc#1226915)\n- PCI/ASPM: Remove struct aspm_latency (bsc#1226915)\n- PCI/ASPM: Stop caching device L0s, L1 acceptable exit latencies (bsc#1226915)\n- PCI/ASPM: Stop caching link L0s, L1 exit latencies (bsc#1226915)\n- PCI: Add missing bridge lock to pci_bus_lock() (stable-fixes).\n- PCI: Support BAR sizes up to 8TB (bsc#1231017)\n- PCI: Wait for Link before restoring Downstream Buses (git-fixes).\n- PCI: al: Check IORESOURCE_BUS existence during probe (git-fixes).\n- PCI: dra7xx: Fix error handling when IRQ request fails in probe (git-fixes).\n- PCI: dwc: Expose dw_pcie_ep_exit() to module (git-fixes).\n- PCI: dwc: Restore MSI Receiver mask during resume (git-fixes).\n- PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) (stable-fixes).\n- PCI: keystone: Fix if-statement expression in ks_pcie_quirk() (git-fixes).\n- PCI: xilinx-nwl: Clean up clock on probe failure/removal (git-fixes).\n- PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes).\n- PCI: xilinx-nwl: Fix register misspelling (git-fixes).\n- PKCS#7: Check codeSigning EKU of certificates in PKCS#7 (bsc#1226666).\n- RDMA/core: Remove unused declaration rdma_resolve_ip_route() (git-fixes)\n- RDMA/cxgb4: Added NULL check for lookup_atid (git-fixes)\n- RDMA/efa: Properly handle unexpected AQ completions (git-fixes)\n- RDMA/hns: Do not modify rq next block addr in HIP09 QPC (git-fixes)\n- RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler (git-fixes)\n- RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled (git-fixes)\n- RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() (git-fixes)\n- RDMA/hns: Optimize hem allocation performance (git-fixes)\n- RDMA/irdma: fix error message in irdma_modify_qp_roce() (git-fixes)\n- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (git-fixes)\n- RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds (git-fixes)\n- RDMA/rtrs: Fix the problem of variable not initialized fully (git-fixes)\n- RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer (git-fixes)\n- Restore dropped fields for bluetooth MGMT/SMP structs (git-fixes).\n- Revert 'Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE' (git-fixes).\n- Revert 'media: tuners: fix error return code of hybrid_tuner_request_state()' (git-fixes).\n- Revert 'media: tuners: fix error return code of hybrid_tuner_request_state()' (stable-fixes).\n- Revert 'mm, kmsan: fix infinite recursion due to RCU critical section'.\n- Revert 'mm/sparsemem: fix race in accessing memory_section-\u003eusage'.\n- Revert 'mm: prevent derefencing NULL ptr in pfn_section_valid()'.\n- Squashfs: sanity check symbolic link size (git-fixes).\n- USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes).\n- USB: serial: kobil_sct: restore initial terminal settings (git-fixes).\n- USB: serial: option: add MeiG Smart SRM825L (git-fixes).\n- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).\n- VMCI: Fix use-after-free when removing resource in vmci_resource_remove() (git-fixes).\n- af_unix: Fix data races around sk-\u003esk_shutdown (bsc#1226846).\n- af_unix: Fix data-races around sk-\u003esk_shutdown (git-fixes).\n- af_unix: annotate lockless accesses to sk-\u003esk_err (bsc#1226846).\n- apparmor: fix possible NULL pointer dereference (stable-fixes).\n- arm64/mm: Modify range-based tlbi to decrement scale (bsc#1229585)\n- arm64/mm: Update tlb invalidation routines for FEAT_LPA2 (bsc#1229585)\n- arm64: acpi: Move get_cpu_for_acpi_id() to a header (git-fixes).\n- arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity (git-fixes).\n- arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency (git-fixes).\n- arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E (git-fixes).\n- arm64: tlb: Allow range operation for MAX_TLBI_RANGE_PAGES (bsc#1229585)\n- arm64: tlb: Fix TLBI RANGE operand (bsc#1229585)\n- arm64: tlb: Improve __TLBI_VADDR_RANGE() (bsc#1229585)\n- ata: libata: Fix memory leak for error path in ata_host_alloc() (git-fixes).\n- ata: pata_macio: Use WARN instead of BUG (stable-fixes).\n- blk-mq: Build default queue map via group_cpus_evenly() (bsc#1229031).\n- blk-mq: add helper for checking if one CPU is mapped to specified hctx (bsc#1223600).\n- blk-mq: add number of queue calc helper (bsc#1229034).\n- blk-mq: do not schedule block kworker on isolated CPUs (bsc#1223600).\n- blk-mq: introduce blk_mq_dev_map_queues (bsc#1229034).\n- blk-mq: issue warning when offlining hctx with online isolcpus (bsc#1229034).\n- blk-mq: use hk cpus only when isolcpus=io_queue is enabled (bsc#1229034).\n- cachefiles: Fix non-taking of sb_writers around set/removexattr (bsc#1231013).\n- cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181).\n- can: bcm: Clear bo-\u003ebcm_proc_read after remove_proc_entry() (git-fixes).\n- can: bcm: Remove proc entry when dev is unregistered (git-fixes).\n- can: j1939: use correct function name in comment (git-fixes).\n- can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open (git-fixes).\n- cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller (git-fixes).\n- ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180).\n- char: tpm: Fix possible memory leak in tpm_bios_measurements_open() (git-fixes).\n- char: xillybus: Check USB endpoints when probing device (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix the pll post div mask (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled (git-fixes).\n- cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately (git-fixes).\n- crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure (git-fixes).\n- crypto: virtio - Handle dataq logic with tasklet (git-fixes).\n- crypto: virtio - Wait for tasklet to complete on device remove (git-fixes).\n- crypto: xor - fix template benchmarking (git-fixes).\n- devres: Initialize an uninitialized struct member (stable-fixes).\n- driver core: Add debug logs when fwnode links are added/deleted (git-fixes).\n- driver core: Add missing parameter description to __fwnode_link_add() (git-fixes).\n- driver core: Create __fwnode_link_del() helper function (git-fixes).\n- driver core: Set deferred probe reason when deferred by driver core (git-fixes).\n- driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle (git-fixes).\n- driver core: fw_devlink: Consolidate device link flag computation (git-fixes).\n- drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes).\n- drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes).\n- drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind() (git-fixes).\n- drm/amd/amdgpu: Check tbo resource pointer (stable-fixes).\n- drm/amd/amdgpu: Properly tune the size of struct (git-fixes).\n- drm/amd/display: Add array index check for hdcp ddc access (stable-fixes).\n- drm/amd/display: Assign linear_pitch_alignment even for VM (stable-fixes).\n- drm/amd/display: Check HDCP returned status (stable-fixes).\n- drm/amd/display: Check denominator pbn_div before used (stable-fixes).\n- drm/amd/display: Check gpio_id before used as array index (stable-fixes).\n- drm/amd/display: Check msg_id before processing transcation (stable-fixes).\n- drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] (stable-fixes).\n- drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX (stable-fixes).\n- drm/amd/display: Ensure index calculation will not overflow (stable-fixes).\n- drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create (stable-fixes).\n- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration (stable-fixes).\n- drm/amd/display: Skip wbscl_set_scaler_filter if filter is null (stable-fixes).\n- drm/amd/display: Spinlock before reading event (stable-fixes).\n- drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (stable-fixes).\n- drm/amd/display: added NULL check at start of dc_validate_stream (stable-fixes).\n- drm/amd/pm: Fix negative array index read (stable-fixes).\n- drm/amd/pm: check negtive return for table entries (stable-fixes).\n- drm/amd/pm: check specific index for aldebaran (stable-fixes).\n- drm/amd/pm: fix the Out-of-bounds read warning (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warning (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr (stable-fixes).\n- drm/amd/pm: fix warning using uninitialized value of max_vid_step (stable-fixes).\n- drm/amdgpu/atomfirmware: Silence UBSAN warning (stable-fixes).\n- drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs (stable-fixes).\n- drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc (stable-fixes).\n- drm/amdgpu/pm: Fix uninitialized variable agc_btc_response (stable-fixes).\n- drm/amdgpu/pm: Fix uninitialized variable warning for smu10 (stable-fixes).\n- drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (stable-fixes).\n- drm/amdgpu: Fix out-of-bounds write warning (stable-fixes).\n- drm/amdgpu: Fix smatch static checker warning (stable-fixes).\n- drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr (stable-fixes).\n- drm/amdgpu: Set no_hw_access when VF request full GPU fails (stable-fixes).\n- drm/amdgpu: avoid reading vf2pf info size from FB (stable-fixes).\n- drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6 (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts (stable-fixes).\n- drm/amdgpu: fix a possible null pointer dereference (git-fixes).\n- drm/amdgpu: fix dereference after null check (stable-fixes).\n- drm/amdgpu: fix mc_data out-of-bounds read warning (stable-fixes).\n- drm/amdgpu: fix overflowed array index read warning (stable-fixes).\n- drm/amdgpu: fix the waring dereferencing hive (stable-fixes).\n- drm/amdgpu: fix ucode out-of-bounds read warning (stable-fixes).\n- drm/amdgpu: the warning dereferencing obj for nbio_v7_4 (stable-fixes).\n- drm/amdgpu: update type of buf size to u32 for eeprom functions (stable-fixes).\n- drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device (stable-fixes).\n- drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid() (git-fixes).\n- drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ (stable-fixes).\n- drm/i915/fence: Mark debug_fence_free() with __maybe_unused (git-fixes).\n- drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused (git-fixes).\n- drm/i915/guc: prevent a possible int overflow in wq offsets (git-fixes).\n- drm/meson: plane: Add error handling (stable-fixes).\n- drm/msm/a5xx: disable preemption in submits by default (git-fixes).\n- drm/msm/a5xx: fix races in preemption evaluation stage (git-fixes).\n- drm/msm/a5xx: properly clear preemption records on resume (git-fixes).\n- drm/msm/a5xx: workaround early ring-buffer emptiness check (git-fixes).\n- drm/msm/adreno: Fix error return if missing firmware-name (stable-fixes).\n- drm/msm/disp/dpu: use atomic enable/disable callbacks for encoder (bsc#1230444)\n- drm/msm: Fix incorrect file name output in adreno_request_fw() (git-fixes).\n- drm/msm: fix %s null argument error (git-fixes).\n- drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets (git-fixes).\n- drm/radeon: fix null pointer dereference in radeon_add_common_modes (git-fixes).\n- drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode (git-fixes).\n- drm/rockchip: vop: Allow 4096px width scaling (git-fixes).\n- drm/stm: ltdc: check memory returned by devm_kzalloc() (git-fixes).\n- drm: omapdrm: Add missing check for alloc_ordered_workqueue (git-fixes).\n- exfat: fix memory leak in exfat_load_bitmap() (git-fixes).\n- fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() (git-fixes).\n- filemap: remove use of wait bookmarks (bsc#1224085).\n- firmware_loader: Block path traversal (git-fixes).\n- fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF (bsc#1230592).\n- fuse: update stats for pages in dropped aux writeback list (bsc#1230130).\n- fuse: use unsigned type for getxattr/listxattr size truncation (bsc#1230129).\n- genirq/affinity: Do not pass irq_affinity_desc array to irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Move group_cpus_evenly() into lib/ (bsc#1229031).\n- genirq/affinity: Only build SMP-only helper functions on SMP kernels (bsc#1229031).\n- genirq/affinity: Pass affinity managed mask array to irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Remove the 'firstvec' parameter from irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Rename irq_build_affinity_masks as group_cpus_evenly (bsc#1229031).\n- genirq/affinity: Replace cpumask_weight() with cpumask_empty() where appropriate (bsc#1229031).\n- gfs2: setattr_chown: Add missing initialization (git-fixes).\n- hwmon: (adc128d818) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwmon: (lm95234) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwmon: (max16065) Fix overflows seen when writing limits (git-fixes).\n- hwmon: (ntc_thermistor) fix module autoloading (git-fixes).\n- hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init (git-fixes).\n- hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume (git-fixes).\n- hwrng: mtk - Use devm_pm_runtime_enable (git-fixes).\n- i2c: Fix conditional for substituting empty ACPI functions (stable-fixes).\n- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (git-fixes).\n- i2c: aspeed: Update the stop sw state when the bus recovery occurs (git-fixes).\n- i2c: isch: Add missed 'else' (git-fixes).\n- i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() (git-fixes).\n- i2c: xiic: Wait for TX empty to avoid missed TX NAKs (git-fixes).\n- i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup (stable-fixes).\n- iio: adc: ad7124: fix chip ID mismatch (git-fixes).\n- iio: adc: ad7124: fix config comparison (git-fixes).\n- iio: adc: ad7606: fix oversampling gpio array (git-fixes).\n- iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes).\n- iio: buffer-dmaengine: fix releasing dma channel on error (git-fixes).\n- iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes).\n- iio: fix scale application in iio_convert_raw_to_processed_unlocked (git-fixes).\n- iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes).\n- ipmi: docs: do not advertise deprecated sysfs entries (git-fixes).\n- ipmi:ssif: Improve detecting during probing (bsc#1228771)\n- ipmi:ssif: Improve detecting during probing (bsc#1228771)\n- jfs: fix out-of-bounds in dbNextAG() and diAlloc() (git-fixes).\n- kABI, crypto: virtio - Handle dataq logic with tasklet (git-fixes).\n- kabi: add __nf_queue_get_refs() for kabi compliance.\n- kthread: Fix task state in kthread worker if being frozen (bsc#1231146).\n- lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly (bsc#1229031).\n- lib/group_cpus.c: honor housekeeping config when grouping CPUs (bsc#1229034).\n- lib/group_cpus: Export group_cpus_evenly() (bsc#1229031).\n- lirc: rc_dev_get_from_fd(): fix file leak (git-fixes).\n- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).\n- mailbox: rockchip: fix a typo in module autoloading (git-fixes).\n- media: Revert 'media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()' (git-fixes).\n- media: aspeed: Fix no complete irq for non-64-aligned width (bsc#1230269)\n- media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse (stable-fixes).\n- media: qcom: camss: Fix ordering of pm_runtime_enable (git-fixes).\n- media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes).\n- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes).\n- media: uvcvideo: Enforce alignment of frame and interval (stable-fixes).\n- media: venus: fix use after free bug in venus_remove due to race condition (git-fixes).\n- media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes).\n- media: vivid: do not set HDMI TX controls if there are no HDMI outputs (stable-fixes).\n- media: vivid: fix wrong sizeimage value for mplane (stable-fixes).\n- mmc: cqhci: Fix checking of CQHCI_HALT state (git-fixes).\n- mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K (git-fixes).\n- mmc: sdhci-of-aspeed: fix module autoloading (git-fixes).\n- mtd: powernv: Add check devm_kasprintf() returned value (git-fixes).\n- mtd: slram: insert break after errors in parsing the map (git-fixes).\n- net: drop bad gso csum_start and offset in virtio_net_hdr (git-fixes).\n- net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (git-fixes).\n- net: mana: Implement get_ringparam/set_ringparam for mana (bsc#1229891).\n- net: mana: Improve mana_set_channels() in low mem conditions (bsc#1230289).\n- net: missing check virtio (git-fixes).\n- net: tighten bad gso csum offset check in virtio_net_hdr (git-fixes).\n- nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769).\n- nilfs2: Constify struct kobj_type (git-fixes).\n- nilfs2: determine empty node blocks as corrupted (git-fixes).\n- nilfs2: fix missing cleanup on rollforward recovery error (git-fixes).\n- nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() (git-fixes).\n- nilfs2: fix potential oob read in nilfs_btree_check_delete() (git-fixes).\n- nilfs2: fix state management in error path of log writing function (git-fixes).\n- nilfs2: protect references to superblock parameters exposed in sysfs (git-fixes).\n- nilfs2: replace snprintf in show functions with sysfs_emit (git-fixes).\n- nilfs2: use default_groups in kobj_type (git-fixes).\n- nvme-pci: Add sleep quirk for Samsung 990 Evo (git-fixes).\n- nvme-pci: use block layer helpers to calculate num of queues (bsc#1229034).\n- nvme/pci: Add APST quirk for Lenovo N60z laptop (git-fixes).\n- nvme: move stopping keep-alive into nvme_uninit_ctrl() (git-fixes).\n- nvme: replace blk_mq_pci_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- nvmet-rdma: fix possible bad dereference when freeing rsps (git-fixes).\n- nvmet-tcp: do not continue for invalid icreq (git-fixes).\n- nvmet-tcp: fix kernel crash if commands allocation fails (git-fixes).\n- nvmet-trace: avoid dereferencing pointer too early (git-fixes).\n- nvmet: Identify-Active Namespace ID List command should reject invalid nsid (git-fixes).\n- ocfs2: cancel dqi_sync_work before freeing oinfo (git-fixes).\n- ocfs2: fix null-ptr-deref when journal load failed (git-fixes).\n- ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate (git-fixes).\n- ocfs2: remove unreasonable unlock in ocfs2_read_blocks (git-fixes).\n- pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv (stable-fixes).\n- pcmcia: Use resource_size function on resource object (stable-fixes).\n- pinctrl: single: fix missing error code in pcs_probe() (git-fixes).\n- pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes).\n- platform/x86: dell-smbios: Fix error path in dell_smbios_init() (git-fixes).\n- platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array (git-fixes).\n- platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses (git-fixes).\n- power: supply: Drop use_cnt check from power_supply_property_is_writeable() (git-fixes).\n- power: supply: axp20x_battery: Remove design from min and max voltage (git-fixes).\n- power: supply: hwmon: Fix missing temp1_max_alarm attribute (git-fixes).\n- power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense (git-fixes).\n- powerpc/64: Convert patch_instruction() to patch_u32() (bsc#1194869).\n- powerpc/boot: Handle allocation failure in simple_realloc() (bsc#1194869).\n- powerpc/boot: Only free if realloc() succeeds (bsc#1194869).\n- powerpc/code-patching: Add generic memory patching (bsc#1194869).\n- powerpc/code-patching: Consolidate and cache per-cpu patching context (bsc#1194869).\n- powerpc/code-patching: Do not call is_vmalloc_or_module_addr() without CONFIG_MODULES (bsc#1194869).\n- powerpc/code-patching: Fix error handling in do_patch_instruction() (bsc#1194869).\n- powerpc/code-patching: Fix oops with DEBUG_VM enabled (bsc#1194869).\n- powerpc/code-patching: Fix unmap_patch_area() error handling (bsc#1194869).\n- powerpc/code-patching: Perform hwsync in __patch_instruction() in case of failure (bsc#1194869).\n- powerpc/code-patching: Pre-map patch area (bsc#1194869).\n- powerpc/code-patching: Remove #ifdef CONFIG_STRICT_KERNEL_RWX (bsc#1194869).\n- powerpc/code-patching: Remove pr_debug()/pr_devel() messages and fix check() (bsc#1194869).\n- powerpc/code-patching: Reorganise do_patch_instruction() to ease error handling (bsc#1194869).\n- powerpc/code-patching: Speed up page mapping/unmapping (bsc#1194869).\n- powerpc/code-patching: Use WARN_ON and fix check in poking_init (bsc#1194869).\n- powerpc/code-patching: Use jump_label to check if poking_init() is done (bsc#1194869).\n- powerpc/code-patching: Use temporary mm for Radix MMU (bsc#1194869).\n- powerpc/code-patching: introduce patch_instructions() (bsc#1194869).\n- powerpc/ftrace: Use patch_instruction() return directly (bsc#1194869).\n- powerpc/imc-pmu: Fix use of mutex in IRQs disabled section (bsc#1054914 git-fixes).\n- powerpc/imc-pmu: Use the correct spinlock initializer (bsc#1054914 git-fixes).\n- powerpc/inst: Refactor ___get_user_instr() (bsc#1194869).\n- powerpc/lib: Add __init attribute to eligible functions (bsc#1194869).\n- powerpc/tlb: Add local flush for page given mm_struct and psize (bsc#1194869).\n- powerpc/vdso: Fix VDSO data access when running in a non-root time namespace (bsc#1194869).\n- powerpc/vdso: Merge vdso64 and vdso32 into a single directory (bsc#1194869).\n- powerpc/vdso: Rework VDSO32 makefile to add a prefix to object files (bsc#1194869).\n- powerpc/vdso: augment VDSO32 functions to support 64 bits build (bsc#1194869).\n- powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu (bsc#1194869).\n- powerpc/xmon: Fix disassembly CPU feature checks (bsc#1065729).\n- powerpc: Allow clearing and restoring registers independent of saved breakpoint state (bsc#1194869).\n- rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow (bsc#1226631).\n- rcu: Add rcutree.nohz_full_patience_delay to reduce nohz_full (bsc#1231327)\n- rtc: at91sam9: fix OF node leak in probe() error path (git-fixes).\n- s390/mm: Add cond_resched() to cmm_alloc/free_pages() (bsc#1228747).\n- sched/isolation: Prevent boot crash when the boot CPU is (bsc#1231327)\n- scsi: fnic: Move flush_work initialization out of if block (bsc#1230055).\n- scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223).\n- scsi: lpfc: Change diagnostic log flag during receipt of unknown ELS cmds (bsc#1229429).\n- scsi: lpfc: Fix overflow build issue (bsc#1229429).\n- scsi: lpfc: Fix unintentional double clearing of vmid_flag (bsc#1229429).\n- scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (bsc#1229429).\n- scsi: lpfc: Remove redundant vport assignment when building an abort request (bsc#1229429).\n- scsi: lpfc: Update PRLO handling in direct attached topology (bsc#1229429).\n- scsi: lpfc: Update lpfc version to 14.4.0.4 (bsc#1229429).\n- scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (bsc#1229429).\n- scsi: pm8001: do not overwrite PCI queue mapping (bsc#1229034).\n- scsi: replace blk_mq_pci_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848).\n- scsi: use block layer helpers to calculate num of queues (bsc#1229034).\n- spi: nxp-fspi: fix the KASAN report out-of-bounds bug (git-fixes).\n- staging: iio: frequency: ad9834: Validate frequency parameter value (git-fixes).\n- thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes).\n- tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes).\n- tools/virtio: fix build (git-fixes).\n- tpm: Clean up TPM space after command failure (git-fixes).\n- tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes).\n- tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes).\n- udp: fix receiving fraglist GSO packets (git-fixes).\n- uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind (git-fixes).\n- usb: cdnsp: Fix incorrect usb_request status (git-fixes).\n- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).\n- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).\n- usb: dwc3: core: Prevent USB core invalid event buffer address access (git-fixes).\n- usb: dwc3: core: Skip setting event buffers for host only controllers (git-fixes).\n- usb: dwc3: core: update LC timer as per USB Spec V3.2 (git-fixes).\n- usb: dwc3: core: update LC timer as per USB Spec V3.2 (stable-fixes).\n- usb: dwc3: omap: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: fix probed platform device ref count on probe error path (git-fixes).\n- usb: typec: ucsi: Fix null pointer dereference in trace (stable-fixes).\n- usb: uas: set host status byte on data completion error (git-fixes).\n- usb: uas: set host status byte on data completion error (stable-fixes).\n- usb: xhci: fix loss of data on Cadence xHC (git-fixes).\n- usbip: Do not submit special requests twice (stable-fixes).\n- usbnet: fix cyclical race on disconnect with work queue (git-fixes).\n- usbnet: ipheth: race between ipheth_close and error handling (git-fixes).\n- usbnet: modern method to get random MAC (git-fixes).\n- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler (git-fixes).\n- vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).\n- virito: add APIs for retrieving vq affinity (bsc#1229034).\n- virtio-blk: Ensure no requests in virtqueues before deleting vqs (git-fixes).\n- virtio/vsock: fix logic which reduces credit update messages (git-fixes).\n- virtio: blk/scs: replace blk_mq_virtio_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- virtio: blk/scsi: use block layer helpers to calculate num of queues (bsc#1229034).\n- virtio: reenable config if freezing device failed (git-fixes).\n- virtio_net: Fix ''%d' directive writing between 1 and 11 bytes into a region of size 10' warnings (git-fixes).\n- virtio_net: checksum offloading handling fix (git-fixes).\n- virtio_net: use u64_stats_t infra to avoid data-races (git-fixes).\n- virtiofs: forbid newlines in tags (bsc#1230591).\n- vsock/virtio: add support for device suspend/resume (git-fixes).\n- vsock/virtio: factor our the code to initialize and delete VQs (git-fixes).\n- vsock/virtio: initialize the_virtio_vsock before using VQs (git-fixes).\n- vsock/virtio: remove socket from connected/bound list on shutdown (git-fixes).\n- watchdog: imx_sc_wdt: Do not disable WDT in suspend (git-fixes).\n- wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 (stable-fixes).\n- wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() (git-fixes).\n- wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors (git-fixes).\n- wifi: iwlwifi: mvm: increase the time between ranging measurements (git-fixes).\n- wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (git-fixes).\n- wifi: mt76: mt7615: check devm_kasprintf() returned value (git-fixes).\n- wifi: mt76: mt7915: fix rx filter setting for bfee functionality (git-fixes).\n- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (stable-fixes).\n- wifi: rtw88: 8822c: Fix reported RX band width (git-fixes).\n- wifi: rtw88: always wait for both firmware loading attempts (git-fixes).\n- wifi: rtw88: remove CPT execution branch never used (git-fixes).\n- wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param (git-fixes).\n- workqueue: Avoid using isolated cpus' timers on (bsc#1231327)\n- workqueue: mark power efficient workqueue as unbounded if (bsc#1231327)\n- x86/hyperv: fix kexec crash due to VP assist page corruption (git-fixes).\n- x86/kexec: Add EFI config table identity mapping for kexec kernel (bsc#1220382).\n- x86/mm/ident_map: Use gbpages only where full GB page should be mapped (bsc#1220382).\n- x86/xen: Convert comma to semicolon (git-fixes).\n- xen/swiotlb: add alignment check for dma buffers (bsc#1229928).\n- xen/swiotlb: fix allocated size (git-fixes).\n- xen: add capability to remap non-RAM pages to different PFNs (bsc#1226003).\n- xen: allow mapping ACPI data using a different physical address (bsc#1226003).\n- xen: introduce generic helper checking for memory map conflicts (bsc#1226003).\n- xen: move checks for e820 conflicts further up (bsc#1226003).\n- xen: move max_pfn in xen_memory_setup() out of function scope (bsc#1226003).\n- xen: tolerate ACPI NVS memory overlapping with Xen allocated memory (bsc#1226003).\n- xen: use correct end address of kernel for conflict checking (bsc#1226003).\n- xfs: do not include bnobt blocks when reserving free block pool (git-fixes).\n- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes).\n- xz: cleanup CRC32 edits from 2018 (git-fixes).\n","status":"published","published":"2024-10-10T13:29:54Z","modified":"2026-02-04T02:54:15.69694Z","updated_at":"2026-11-02T15:53:55.639015Z"},{"id":"SUSE-SU-2024:3592-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes.\n\n\nThe following security bugs were fixed:\n\n- CVE-2022-48901: btrfs: do not start relocation until in progress drops are done  (bsc#1229607).\n- CVE-2022-48911: kabi: add __nf_queue_get_refs() for kabi compliance.  (bsc#1229633).\n- CVE-2022-48923: btrfs: prevent copying too big compressed lzo segment (bsc#1229662)\n- CVE-2022-48935: Fixed an unregister flowtable hooks on netns exit (bsc#1229619)\n- CVE-2023-52610: net/sched: act_ct: fix skb leak and crash on ooo frags (bsc#1221610).\n- CVE-2023-52916: media: aspeed: Fix memory overwrite if timing is 1600x900 (bsc#1230269).\n- CVE-2024-26640: tcp: add sanity checks to rx zerocopy (bsc#1221650).\n- CVE-2024-26759: mm/swap: fix race when skipping swapcache (bsc#1230340).\n- CVE-2024-26767: drm/amd/display: fixed integer types and null check locations  (bsc#1230339).\n- CVE-2024-26804: net: ip_tunnel: prevent perpetual headroom growth (bsc#1222629).\n- CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).\n- CVE-2024-37353: virtio: fixed a double free in vp_del_vqs() (bsc#1226875).\n- CVE-2024-38538: net: bridge: xmit: make sure we have at least eth header len bytes (bsc#1226606).\n- CVE-2024-38596: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (bsc#1226846).\n- CVE-2024-40910: Fix refcount imbalance on inbound connections (bsc#1227832).\n- CVE-2024-40973: media: mtk-vcodec: potential null pointer deference in SCP (bsc#1227890).\n- CVE-2024-40983: tipc: force a dst refcount before doing decryption (bsc#1227819).\n- CVE-2024-41062: Sync sock recv cb and release (bsc#1228576).\n- CVE-2024-41082: nvme-fabrics: use reserved tag for reg read/write command  (bsc#1228620 CVE-2024-41082).\n- CVE-2024-42154: tcp_metrics: validate source addr length (bsc#1228507).\n- CVE-2024-42259: Fix Virtual Memory mapping boundaries calculation (bsc#1229156)\n- CVE-2024-42265: protect the fetch of -\u003efd[fd] in do_dup2() from mispredictions (bsc#1229334).\n- CVE-2024-42304: ext4: make sure the first directory block is not a hole (bsc#1229364).\n- CVE-2024-42305: ext4: check dot and dotdot of dx_root before making dir indexed (bsc#1229363).\n- CVE-2024-42306: udf: Avoid using corrupted block bitmap buffer (bsc#1229362).\n- CVE-2024-43828: ext4: fix infinite loop when replaying fast_commit (bsc#1229394).\n- CVE-2024-43890: tracing: Fix overflow in get_free_elt() (bsc#1229764).\n- CVE-2024-43898: ext4: sanity check for NULL pointer after ext4_force_shutdown (bsc#1229753).\n- CVE-2024-43912: wifi: nl80211: disallow setting special AP channel widths (bsc#1229830)\n- CVE-2024-43914: md/raid5: avoid BUG_ON() while continue reshape after reassembling (bsc#1229790).\n- CVE-2024-44935: sctp: Fix null-ptr-deref in reuseport_add_sock() (bsc#1229810).\n- CVE-2024-44944: netfilter: ctnetlink: use helper function to calculate expect ID (bsc#1229899).\n- CVE-2024-44946: kcm: Serialise kcm_sendmsg() for the same socket (bsc#1230015).\n- CVE-2024-44950: serial: sc16is7xx: fix invalid FIFO access with special register set (bsc#1230180).\n- CVE-2024-44952: driver core: Fix uevent_show() vs driver detach race  (bsc#1230178).\n- CVE-2024-44954: ALSA: line6: Fix racy access to midibuf (bsc#1230176).\n- CVE-2024-44970: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (bsc#1230209).\n- CVE-2024-44971: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() (bsc#1230211).\n- CVE-2024-44986: ipv6: fix possible UAF in ip6_finish_output2() (bsc#1230230)\n- CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185).\n- CVE-2024-44988: net: dsa: mv88e6xxx: Fix out-of-bound access (bsc#1230192).\n- CVE-2024-44989: bonding: fix xfrm real_dev null pointer dereference (bsc#1230193).\n- CVE-2024-44990: bonding: fix null pointer deref in bond_ipsec_offload_ok (bsc#1230194).\n- CVE-2024-44998: atm: idt77252: prevent use after free in dequeue_rx() (bsc#1230171).\n- CVE-2024-44999: gtp: pull network headers in gtp_dev_xmit() (bsc#1230233).\n- CVE-2024-45003: Don't evict inode under the inode lru traversing context (bsc#1230245).\n- CVE-2024-45007: char: xillybus: Refine workqueue handling (bsc#1230175).\n- CVE-2024-45008: Input: MT - limit max slots (bsc#1230248).\n- CVE-2024-45013: nvme: move stopping keep-alive into nvme_uninit_ctrl() (bsc#1230442).\n- CVE-2024-45015: drm/msm/dpu: move dpu_encoder's connector assignment to (bsc#1230444)\n- CVE-2024-45018: netfilter: flowtable: initialise extack before use (bsc#1230431).\n- CVE-2024-45021: memcg_write_event_control(): fix a user-triggerable oops (bsc#1230434).\n- CVE-2024-45029: i2c: tegra: Do not mark ACPI devices as irq safe (bsc#1230451).\n- CVE-2024-46673: scsi: aacraid: Fix double-free on probe failure (bsc#1230506).\n- CVE-2024-46674: usb: dwc3: st: fix probed platform device ref count on probe  error path (bsc#1230507).\n- CVE-2024-46677: gtp: fix a potential NULL pointer dereference (bsc#1230549).\n- CVE-2024-46679: ethtool: check device is present when getting link settings (bsc#1230556).\n- CVE-2024-46685: pinctrl: single: fix potential NULL dereference in pcs_get_function() (bsc#1230515)\n- CVE-2024-46686: smb/client: avoid dereferencing rdata=NULL in smb2_new_read_req() (bsc#1230517).\n- CVE-2024-46689: soc: qcom: cmd-db: Map shared memory as WC, not WB (bsc#1230524)\n- CVE-2024-46702: thunderbolt: Mark XDomain as unplugged when router is removed (bsc#1230589)\n- CVE-2024-46707: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3  (bsc#1230582).\n- CVE-2024-46715: driver: iio: add missing checks on iio_info's callback access  (bsc#1230700).\n- CVE-2024-46717: net/mlx5e: SHAMPO, Fix incorrect page release (bsc#1230719).\n- CVE-2024-46721: pparmor: fix possible NULL pointer dereference (bsc#1230710)\n- CVE-2024-46728: drm/amd/display: Check index for aux_rd_interval before using (bsc#1230703)\n- CVE-2024-46730: drm/amd/display: Ensure array index tg_inst won't be -1 (bsc#1230701)\n- CVE-2024-46743: of/irq: Prevent device address out-of-bounds read in interrupt map walk (bsc#1230756).\n- CVE-2024-46750: PCI: Add missing bridge lock to pci_bus_lock() (bsc#1230783).\n- CVE-2024-46751: btrfs: do not BUG_ON() when 0 reference count at btrfs_lookup_extent_info() (bsc#1230786).\n- CVE-2024-46752: btrfs: reduce nesting for extent processing at btrfs_lookup_extent_info() (bsc#1230794).\n- CVE-2024-46753: btrfs: handle errors from btrfs_dec_ref() properly (bsc#1230796).\n- CVE-2024-46772: drm/amd/display: Check denominator crb_pipes before used (bsc#1230772).\n- CVE-2024-46783: tcp_bpf: fix return value of tcp_bpf_sendmsg() (bsc#1230810).\n- CVE-2024-46787: userfaultfd: fix checks for huge PMDs (bsc#1230815).\n- CVE-2024-46794: x86/tdx: Fix data leak in mmio_read() (bsc#1230825).\n- CVE-2024-46822: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (bsc#1231120).\n- CVE-2024-46830: KVM: x86: Acquire kvm-\u003esrcu when handling KVM_SET_VCPU_EVENTS  (bsc#1231116).\n\nThe following non-security bugs were fixed:\n\n- ACPI: battery: create alarm sysfs attribute atomically (git-fixes).\n- ACPI: CPPC: Fix MASK_VAL() usage (git-fixes).\n- ACPI: PMIC: Remove unneeded check in tps68470_pmic_opregion_probe() (git-fixes).\n- ACPI: processor: Fix memory leaks in error paths of processor_add() (stable-fixes).\n- ACPI: processor: Return an error if acpi_processor_get_info() fails in processor_add() (stable-fixes).\n- ACPI: SBS: manage alarm sysfs attribute through psy core (git-fixes).\n- ACPI: sysfs: validate return type of _STR method (git-fixes).\n- af_unix: annotate lockless accesses to sk-\u003esk_err (bsc#1226846).\n- af_unix: Fix data races around sk-\u003esk_shutdown (bsc#1226846).\n- af_unix: Fix data-races around sk-\u003esk_shutdown (git-fixes).\n- ALSA: hda: Add input value sanity checks to HDMI channel map controls (stable-fixes).\n- ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius devices (stable-fixes).\n- ALSA: hda/conexant: Mute speakers at suspend / shutdown (stable-fixes).\n- ALSA: hda/generic: Add a helper to mute speakers at suspend/shutdown (stable-fixes).\n- ALSA: hda/realtek: Support mute LED on HP Laptop 14-dq2xxx (stable-fixes).\n- apparmor: fix possible NULL pointer dereference (stable-fixes).\n- arm64: acpi: Move get_cpu_for_acpi_id() to a header (git-fixes).\n- arm64: dts: rockchip: Correct the Pinebook Pro battery design capacity (git-fixes).\n- arm64: dts: rockchip: fix PMIC interrupt pin in pinctrl for ROCK Pi E (git-fixes).\n- arm64: dts: rockchip: Raise Pinebook Pro's panel backlight PWM frequency (git-fixes).\n- arm64/mm: Modify range-based tlbi to decrement scale (bsc#1229585)\n- arm64/mm: Update tlb invalidation routines for FEAT_LPA2 (bsc#1229585)\n- arm64: tlb: Allow range operation for MAX_TLBI_RANGE_PAGES (bsc#1229585)\n- arm64: tlb: Fix TLBI RANGE operand (bsc#1229585)\n- arm64: tlb: Improve __TLBI_VADDR_RANGE() (bsc#1229585)\n- ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object (git-fixes).\n- ASoC: meson: axg-card: fix 'use-after-free' (git-fixes).\n- ASoc: SOF: topology: Clear SOF link platform name upon unload (git-fixes).\n- ASoC: sunxi: sun4i-i2s: fix LRCLK polarity in i2s mode (git-fixes).\n- ASoC: tegra: Fix CBB error during probe() (git-fixes).\n- ASoC: topology: Properly initialize soc_enum values (stable-fixes).\n- ata: libata: Fix memory leak for error path in ata_host_alloc() (git-fixes).\n- ata: pata_macio: Use WARN instead of BUG (stable-fixes).\n- blk-mq: add helper for checking if one CPU is mapped to specified hctx (bsc#1223600).\n- blk-mq: add number of queue calc helper (bsc#1229034).\n- blk-mq: Build default queue map via group_cpus_evenly() (bsc#1229031).\n- blk-mq: do not schedule block kworker on isolated CPUs (bsc#1223600).\n- blk-mq: introduce blk_mq_dev_map_queues (bsc#1229034).\n- blk-mq: issue warning when offlining hctx with online isolcpus (bsc#1229034).\n- blk-mq: use hk cpus only when isolcpus=io_queue is enabled (bsc#1229034).\n- Bluetooth: btusb: Fix not handling ZPL/short-transfer (git-fixes).\n- Bluetooth: hci_core: Fix sending MGMT_EV_CONNECT_FAILED (git-fixes).\n- Bluetooth: hci_sync: Ignore errors from HCI_OP_REMOTE_NAME_REQ_CANCEL (git-fixes).\n- Bluetooth: L2CAP: Fix deadlock (git-fixes).\n- Bluetooth: MGMT: Ignore keys being loaded with invalid type (git-fixes).\n- cachefiles: fix dentry leak in cachefiles_open_file() (bsc#1231181).\n- cachefiles: Fix non-taking of sb_writers around set/removexattr (bsc#1231013).\n- can: bcm: Clear bo-\u003ebcm_proc_read after remove_proc_entry() (git-fixes).\n- can: bcm: Remove proc entry when dev is unregistered (git-fixes).\n- can: j1939: use correct function name in comment (git-fixes).\n- can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open (git-fixes).\n- cdc-acm: Add DISABLE_ECHO quirk for GE HealthCare UI Controller (git-fixes).\n- ceph: remove the incorrect Fw reference check when dirtying pages (bsc#1231180).\n- char: xillybus: Check USB endpoints when probing device (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix the pll post div mask (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API (git-fixes).\n- clk: qcom: clk-alpha-pll: Fix zonda set_rate failure when PLL is disabled (git-fixes).\n- cpufreq: ti-cpufreq: Introduce quirks to handle syscon fails appropriately (git-fixes).\n- crypto: ccp - Properly unregister /dev/sev on sev PLATFORM_STATUS failure (git-fixes).\n- crypto: virtio - Handle dataq logic with tasklet (git-fixes).\n- crypto: virtio - Wait for tasklet to complete on device remove (git-fixes).\n- crypto: xor - fix template benchmarking (git-fixes).\n- devres: Initialize an uninitialized struct member (stable-fixes).\n- driver core: Add debug logs when fwnode links are added/deleted (git-fixes).\n- driver core: Add missing parameter description to __fwnode_link_add() (git-fixes).\n- driver core: Create __fwnode_link_del() helper function (git-fixes).\n- driver core: fw_devlink: Allow marking a fwnode link as being part of a cycle (git-fixes).\n- driver core: fw_devlink: Consolidate device link flag computation (git-fixes).\n- driver core: Set deferred probe reason when deferred by driver core (git-fixes).\n- drivers:drm:exynos_drm_gsc:Fix wrong assignment in gsc_bind() (git-fixes).\n- Drivers: hv: vmbus: Fix rescind handling in uio_hv_generic (git-fixes).\n- Drivers: hv: vmbus: Fix the misplaced function description (git-fixes).\n- drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error (git-fixes).\n- drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error (git-fixes).\n- drm/amd/amdgpu: Check tbo resource pointer (stable-fixes).\n- drm/amd/amdgpu: Properly tune the size of struct (git-fixes).\n- drm/amd/display: Add array index check for hdcp ddc access (stable-fixes).\n- drm/amd/display: added NULL check at start of dc_validate_stream (stable-fixes).\n- drm/amd/display: Assign linear_pitch_alignment even for VM (stable-fixes).\n- drm/amd/display: Check denominator pbn_div before used (stable-fixes).\n- drm/amd/display: Check gpio_id before used as array index (stable-fixes).\n- drm/amd/display: Check HDCP returned status (stable-fixes).\n- drm/amd/display: Check msg_id before processing transcation (stable-fixes).\n- drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] (stable-fixes).\n- drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX (stable-fixes).\n- drm/amd/display: Ensure index calculation will not overflow (stable-fixes).\n- drm/amd/display: Fix Coverity INTEGER_OVERFLOW within dal_gpio_service_create (stable-fixes).\n- drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration (stable-fixes).\n- drm/amd/display: Skip wbscl_set_scaler_filter if filter is null (stable-fixes).\n- drm/amd/display: Spinlock before reading event (stable-fixes).\n- drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 (stable-fixes).\n- drm/amdgpu/atomfirmware: Silence UBSAN warning (stable-fixes).\n- drm/amdgpu: avoid reading vf2pf info size from FB (stable-fixes).\n- drm/amdgpu: check for LINEAR_ALIGNED correctly in check_tiling_flags_gfx6 (stable-fixes).\n- drm/amdgpu: clear RB_OVERFLOW bit when enabling interrupts (stable-fixes).\n- drm/amdgpu: fix a possible null pointer dereference (git-fixes).\n- drm/amdgpu: fix dereference after null check (stable-fixes).\n- drm/amdgpu: fix mc_data out-of-bounds read warning (stable-fixes).\n- drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (stable-fixes).\n- drm/amdgpu: Fix out-of-bounds write warning (stable-fixes).\n- drm/amdgpu: fix overflowed array index read warning (stable-fixes).\n- drm/amdgpu: Fix smatch static checker warning (stable-fixes).\n- drm/amdgpu: fix the waring dereferencing hive (stable-fixes).\n- drm/amdgpu: fix ucode out-of-bounds read warning (stable-fixes).\n- drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr (stable-fixes).\n- drm/amdgpu/pm: Check input value for CUSTOM profile mode setting on legacy SOCs (stable-fixes).\n- drm/amdgpu/pm: Check the return value of smum_send_msg_to_smc (stable-fixes).\n- drm/amdgpu/pm: Fix uninitialized variable agc_btc_response (stable-fixes).\n- drm/amdgpu/pm: Fix uninitialized variable warning for smu10 (stable-fixes).\n- drm/amdgpu: Set no_hw_access when VF request full GPU fails (stable-fixes).\n- drm/amdgpu: the warning dereferencing obj for nbio_v7_4 (stable-fixes).\n- drm/amdgpu: update type of buf size to u32 for eeprom functions (stable-fixes).\n- drm/amdkfd: Reconcile the definition and use of oem_id in struct kfd_topology_device (stable-fixes).\n- drm/amd/pm: check negtive return for table entries (stable-fixes).\n- drm/amd/pm: check specific index for aldebaran (stable-fixes).\n- drm/amd/pm: Fix negative array index read (stable-fixes).\n- drm/amd/pm: fix the Out-of-bounds read warning (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warning for smu8_hwmgr (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warnings for vangogh_ppt (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warnings for vega10_hwmgr (stable-fixes).\n- drm/amd/pm: fix uninitialized variable warning (stable-fixes).\n- drm/amd/pm: fix warning using uninitialized value of max_vid_step (stable-fixes).\n- drm/bridge: lontium-lt8912b: Validate mode in drm_bridge_funcs::mode_valid() (git-fixes).\n- drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ (stable-fixes).\n- drm/i915/fence: Mark debug_fence_free() with __maybe_unused (git-fixes).\n- drm/i915/fence: Mark debug_fence_init_onstack() with __maybe_unused (git-fixes).\n- drm/i915/guc: prevent a possible int overflow in wq offsets (git-fixes).\n- drm/meson: plane: Add error handling (stable-fixes).\n- drm/msm/a5xx: disable preemption in submits by default (git-fixes).\n- drm/msm/a5xx: fix races in preemption evaluation stage (git-fixes).\n- drm/msm/a5xx: properly clear preemption records on resume (git-fixes).\n- drm/msm/a5xx: workaround early ring-buffer emptiness check (git-fixes).\n- drm/msm/adreno: Fix error return if missing firmware-name (stable-fixes).\n- drm/msm/disp/dpu: use atomic enable/disable callbacks for encoder (bsc#1230444)\n- drm/msm: Fix incorrect file name output in adreno_request_fw() (git-fixes).\n- drm/msm: fix %s null argument error (git-fixes).\n- drm: omapdrm: Add missing check for alloc_ordered_workqueue (git-fixes).\n- drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets (git-fixes).\n- drm/radeon: fix null pointer dereference in radeon_add_common_modes (git-fixes).\n- drm/rockchip: dw_hdmi: Fix reading EDID when using a forced mode (git-fixes).\n- drm/rockchip: vop: Allow 4096px width scaling (git-fixes).\n- drm/stm: ltdc: check memory returned by devm_kzalloc() (git-fixes).\n- exfat: fix memory leak in exfat_load_bitmap() (git-fixes).\n- fbdev: hpfb: Fix an error handling path in hpfb_dio_probe() (git-fixes).\n- filemap: remove use of wait bookmarks (bsc#1224085).\n- firmware_loader: Block path traversal (git-fixes).\n- fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF (bsc#1230592).\n- fuse: update stats for pages in dropped aux writeback list (bsc#1230130).\n- fuse: use unsigned type for getxattr/listxattr size truncation (bsc#1230129).\n- genirq/affinity: Do not pass irq_affinity_desc array to irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Move group_cpus_evenly() into lib/ (bsc#1229031).\n- genirq/affinity: Only build SMP-only helper functions on SMP kernels (bsc#1229031).\n- genirq/affinity: Pass affinity managed mask array to irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Remove the 'firstvec' parameter from irq_build_affinity_masks (bsc#1229031).\n- genirq/affinity: Rename irq_build_affinity_masks as group_cpus_evenly (bsc#1229031).\n- genirq/affinity: Replace cpumask_weight() with cpumask_empty() where appropriate (bsc#1229031).\n- gfs2: setattr_chown: Add missing initialization (git-fixes).\n- HID: amd_sfh: free driver_data after destroying hid device (stable-fixes).\n- HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup (stable-fixes).\n- hwmon: (adc128d818) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwmon: (lm95234) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwmon: (max16065) Fix overflows seen when writing limits (git-fixes).\n- hwmon: (ntc_thermistor) fix module autoloading (git-fixes).\n- hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (stable-fixes).\n- hwrng: bcm2835 - Add missing clk_disable_unprepare in bcm2835_rng_init (git-fixes).\n- hwrng: cctrng - Add missing clk_disable_unprepare in cctrng_resume (git-fixes).\n- hwrng: mtk - Use devm_pm_runtime_enable (git-fixes).\n- i2c: aspeed: Update the stop sw state when the bus recovery occurs (git-fixes).\n- i2c: Fix conditional for substituting empty ACPI functions (stable-fixes).\n- i2c: isch: Add missed 'else' (git-fixes).\n- i2c: qcom-geni: Use IRQF_NO_AUTOEN flag in request_irq() (git-fixes).\n- i2c: Use IS_REACHABLE() for substituting empty ACPI functions (git-fixes).\n- i2c: xiic: Wait for TX empty to avoid missed TX NAKs (git-fixes).\n- i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup (stable-fixes).\n- IB/core: Fix ib_cache_setup_one error flow cleanup (git-fixes)\n- IB/hfi1: Fix potential deadlock on \u0026irq_src_lock and \u0026dd-\u003euctxt_lock (git-fixes)\n- iio: adc: ad7124: fix chip ID mismatch (git-fixes).\n- iio: adc: ad7124: fix config comparison (git-fixes).\n- iio: adc: ad7606: fix oversampling gpio array (git-fixes).\n- iio: adc: ad7606: fix standby gpio state to match the documentation (git-fixes).\n- iio: buffer-dmaengine: fix releasing dma channel on error (git-fixes).\n- iio: chemical: bme680: Fix read/write ops to device by adding mutexes (git-fixes).\n- iio: fix scale application in iio_convert_raw_to_processed_unlocked (git-fixes).\n- iio: magnetometer: ak8975: Fix reading for ak099xx sensors (git-fixes).\n- Input: ilitek_ts_i2c - add report id message validation (git-fixes).\n- Input: ilitek_ts_i2c - avoid wrong input subsystem sync (git-fixes).\n- Input: ps2-gpio - use IRQF_NO_AUTOEN flag in request_irq() (git-fixes).\n- Input: uinput - reject requests with unreasonable number of slots (stable-fixes).\n- ipmi: docs: do not advertise deprecated sysfs entries (git-fixes).\n- ipmi:ssif: Improve detecting during probing (bsc#1228771)\n- ipmi:ssif: Improve detecting during probing (bsc#1228771) \n- jfs: fix out-of-bounds in dbNextAG() and diAlloc() (git-fixes).\n- kabi: add __nf_queue_get_refs() for kabi compliance.\n- kABI, crypto: virtio - Handle dataq logic with tasklet (git-fixes).\n- kthread: Fix task state in kthread worker if being frozen (bsc#1231146).\n- lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly (bsc#1229031).\n- lib/group_cpus.c: honor housekeeping config when grouping CPUs (bsc#1229034).\n- lib/group_cpus: Export group_cpus_evenly() (bsc#1229031).\n- lirc: rc_dev_get_from_fd(): fix file leak (git-fixes).\n- mailbox: bcm2835: Fix timeout during suspend mode (git-fixes).\n- mailbox: rockchip: fix a typo in module autoloading (git-fixes).\n- media: aspeed: Fix no complete irq for non-64-aligned width (bsc#1230269)\n- media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse (stable-fixes).\n- media: qcom: camss: Fix ordering of pm_runtime_enable (git-fixes).\n- media: Revert 'media: dvb-usb: Fix unexpected infinite loop in dvb_usb_read_remote_control()' (git-fixes).\n- media: sun4i_csi: Implement link validate for sun4i_csi subdev (git-fixes).\n- media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags (git-fixes).\n- media: uvcvideo: Enforce alignment of frame and interval (stable-fixes).\n- media: venus: fix use after free bug in venus_remove due to race condition (git-fixes).\n- media: vicodec: allow en/decoder cmd w/o CAPTURE (git-fixes).\n- media: vivid: do not set HDMI TX controls if there are no HDMI outputs (stable-fixes).\n- media: vivid: fix wrong sizeimage value for mplane (stable-fixes).\n- mmc: cqhci: Fix checking of CQHCI_HALT state (git-fixes).\n- mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K (git-fixes).\n- mmc: sdhci-of-aspeed: fix module autoloading (git-fixes).\n- mtd: powernv: Add check devm_kasprintf() returned value (git-fixes).\n- mtd: slram: insert break after errors in parsing the map (git-fixes).\n- net: drop bad gso csum_start and offset in virtio_net_hdr (git-fixes).\n- net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (git-fixes).\n- net: missing check virtio (git-fixes).\n- net: tighten bad gso csum offset check in virtio_net_hdr (git-fixes).\n- nf_conntrack_proto_udp: do not accept packets with IPS_NAT_CLASH (bsc#1199769).\n- NFSD: Fix frame size warning in svc_export_parse() (git-fixes).\n- NFS: Do not re-read the entire page cache to find the next cookie (bsc#1226662).\n- NFSD: Rewrite synopsis of nfsd_percpu_counters_init() (git-fixes).\n- NFS: never reuse a NFSv4.0 lock-owner (bsc#1227726).\n- NFS: Reduce use of uncached readdir (bsc#1226662).\n- NFSv4: Add missing rescheduling points in nfs_client_return_marked_delegations (git-fixes).\n- nilfs2: Constify struct kobj_type (git-fixes).\n- nilfs2: determine empty node blocks as corrupted (git-fixes).\n- nilfs2: fix missing cleanup on rollforward recovery error (git-fixes).\n- nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() (git-fixes).\n- nilfs2: fix potential oob read in nilfs_btree_check_delete() (git-fixes).\n- nilfs2: fix state management in error path of log writing function (git-fixes).\n- nilfs2: protect references to superblock parameters exposed in sysfs (git-fixes).\n- nilfs2: replace snprintf in show functions with sysfs_emit (git-fixes).\n- nilfs2: use default_groups in kobj_type (git-fixes).\n- nvme: move stopping keep-alive into nvme_uninit_ctrl() (git-fixes).\n- nvme/pci: Add APST quirk for Lenovo N60z laptop (git-fixes).\n- nvme-pci: Add sleep quirk for Samsung 990 Evo (git-fixes).\n- nvme-pci: use block layer helpers to calculate num of queues (bsc#1229034).\n- nvme: replace blk_mq_pci_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- nvmet: Identify-Active Namespace ID List command should reject invalid nsid (git-fixes).\n- nvmet-rdma: fix possible bad dereference when freeing rsps (git-fixes).\n- nvmet-tcp: do not continue for invalid icreq (git-fixes).\n- nvmet-tcp: fix kernel crash if commands allocation fails (git-fixes).\n- nvmet-trace: avoid dereferencing pointer too early (git-fixes).\n- ocfs2: cancel dqi_sync_work before freeing oinfo (git-fixes).\n- ocfs2: fix null-ptr-deref when journal load failed (git-fixes).\n- ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate (git-fixes).\n- ocfs2: remove unreasonable unlock in ocfs2_read_blocks (git-fixes).\n- PCI: Add missing bridge lock to pci_bus_lock() (stable-fixes).\n- PCI: al: Check IORESOURCE_BUS existence during probe (git-fixes).\n- PCI/ASPM: Move pci_function_0() upward (bsc#1226915)\n- PCI/ASPM: Remove struct aspm_latency (bsc#1226915)\n- PCI/ASPM: Stop caching device L0s, L1 acceptable exit latencies (bsc#1226915)\n- PCI/ASPM: Stop caching link L0s, L1 exit latencies (bsc#1226915)\n- PCI: dra7xx: Fix error handling when IRQ request fails in probe (git-fixes).\n- PCI: dwc: Expose dw_pcie_ep_exit() to module (git-fixes).\n- PCI: dwc: Restore MSI Receiver mask during resume (git-fixes).\n- pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv (stable-fixes).\n- PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) (stable-fixes).\n- PCI: keystone: Fix if-statement expression in ks_pcie_quirk() (git-fixes).\n- PCI: Support BAR sizes up to 8TB (bsc#1231017)\n- PCI: Wait for Link before restoring Downstream Buses (git-fixes).\n- PCI: xilinx-nwl: Clean up clock on probe failure/removal (git-fixes).\n- PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler (git-fixes).\n- PCI: xilinx-nwl: Fix register misspelling (git-fixes).\n- pcmcia: Use resource_size function on resource object (stable-fixes).\n- pinctrl: single: fix missing error code in pcs_probe() (git-fixes).\n- pinctrl: single: fix potential NULL dereference in pcs_get_function() (git-fixes).\n- PKCS#7: Check codeSigning EKU of certificates in PKCS#7 (bsc#1226666).\n- platform/x86: dell-smbios: Fix error path in dell_smbios_init() (git-fixes).\n- platform/x86: panasonic-laptop: Allocate 1 entry extra in the sinf array (git-fixes).\n- platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses (git-fixes).\n- power: supply: axp20x_battery: Remove design from min and max voltage (git-fixes).\n- power: supply: Drop use_cnt check from power_supply_property_is_writeable() (git-fixes).\n- power: supply: hwmon: Fix missing temp1_max_alarm attribute (git-fixes).\n- power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense (git-fixes).\n- RDMA/core: Remove unused declaration rdma_resolve_ip_route() (git-fixes)\n- RDMA/cxgb4: Added NULL check for lookup_atid (git-fixes)\n- RDMA/efa: Properly handle unexpected AQ completions (git-fixes)\n- RDMA/hns: Do not modify rq next block addr in HIP09 QPC (git-fixes)\n- RDMA/hns: Fix spin_unlock_irqrestore() called with IRQs enabled (git-fixes)\n- RDMA/hns: Fix the overflow risk of hem_list_calc_ba_range() (git-fixes)\n- RDMA/hns: Fix VF triggering PF reset in abnormal interrupt handler (git-fixes)\n- RDMA/hns: Optimize hem allocation performance (git-fixes)\n- RDMA/irdma: fix error message in irdma_modify_qp_roce() (git-fixes)\n- RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (git-fixes)\n- RDMA/rtrs-clt: Reset cid to con_num - 1 to stay in bounds (git-fixes)\n- RDMA/rtrs: Fix the problem of variable not initialized fully (git-fixes)\n- RDMA/rtrs: Reset hb_missed_cnt after receiving other traffic from peer (git-fixes)\n- Restore dropped fields for bluetooth MGMT/SMP structs (git-fixes).\n- Revert 'Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE' (git-fixes).\n- Revert 'media: tuners: fix error return code of hybrid_tuner_request_state()' (git-fixes).\n- Revert 'media: tuners: fix error return code of hybrid_tuner_request_state()' (stable-fixes).\n- rtc: at91sam9: fix OF node leak in probe() error path (git-fixes).\n- scsi: ibmvfc: Add max_sectors module parameter (bsc#1216223).\n- scsi: lpfc: Change diagnostic log flag during receipt of unknown ELS cmds (bsc#1229429).\n- scsi: lpfc: Copyright updates for 14.4.0.4 patches (bsc#1229429).\n- scsi: lpfc: Fix overflow build issue (bsc#1229429).\n- scsi: lpfc: Fix unintentional double clearing of vmid_flag (bsc#1229429).\n- scsi: lpfc: Fix unsolicited FLOGI kref imbalance when in direct attached topology (bsc#1229429).\n- scsi: lpfc: Remove redundant vport assignment when building an abort request (bsc#1229429).\n- scsi: lpfc: Update lpfc version to 14.4.0.4 (bsc#1229429).\n- scsi: lpfc: Update PRLO handling in direct attached topology (bsc#1229429).\n- scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (bsc#1229429).\n- scsi: pm8001: do not overwrite PCI queue mapping (bsc#1229034).\n- scsi: replace blk_mq_pci_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- scsi: sd: Fix off-by-one error in sd_read_block_characteristics() (bsc#1223848).\n- scsi: use block layer helpers to calculate num of queues (bsc#1229034).\n- spi: nxp-fspi: fix the KASAN report out-of-bounds bug (git-fixes).\n- Squashfs: sanity check symbolic link size (git-fixes).\n- staging: iio: frequency: ad9834: Validate frequency parameter value (git-fixes).\n- thunderbolt: Mark XDomain as unplugged when router is removed (stable-fixes).\n- tomoyo: fallback to realpath if symlink's pathname does not exist (git-fixes).\n- tools/virtio: fix build (git-fixes).\n- tpm: Clean up TPM space after command failure (git-fixes).\n- tracing: Avoid possible softlockup in tracing_iter_reset() (git-fixes).\n- tty: rp2: Fix reset with non forgiving PCIe host bridges (git-fixes).\n- udp: fix receiving fraglist GSO packets (git-fixes).\n- uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind (git-fixes).\n- usb: cdnsp: Fix incorrect usb_request status (git-fixes).\n- USB: class: CDC-ACM: fix race between get_serial and set_serial (git-fixes).\n- usb: dwc2: drd: fix clock gating on USB role switch (git-fixes).\n- usb: dwc2: Skip clock gating on Broadcom SoCs (git-fixes).\n- usb: dwc3: core: Prevent USB core invalid event buffer address access (git-fixes).\n- usb: dwc3: core: Skip setting event buffers for host only controllers (git-fixes).\n- usb: dwc3: core: update LC timer as per USB Spec V3.2 (git-fixes).\n- usb: dwc3: omap: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: add missing depopulate in probe error path (git-fixes).\n- usb: dwc3: st: fix probed platform device ref count on probe error path (git-fixes).\n- usbip: Do not submit special requests twice (stable-fixes).\n- usbnet: fix cyclical race on disconnect with work queue (git-fixes).\n- usbnet: ipheth: race between ipheth_close and error handling (git-fixes).\n- usbnet: modern method to get random MAC (git-fixes).\n- USB: serial: kobil_sct: restore initial terminal settings (git-fixes).\n- USB: serial: option: add MeiG Smart SRM825L (git-fixes).\n- usb: typec: ucsi: Fix null pointer dereference in trace (stable-fixes).\n- usb: uas: set host status byte on data completion error (git-fixes).\n- usb: uas: set host status byte on data completion error (stable-fixes).\n- USB: usbtmc: prevent kernel-usb-infoleak (git-fixes).\n- usb: xhci: fix loss of data on Cadence xHC (git-fixes).\n- vhost: Add smp_rmb() in vhost_vq_avail_empty() (git-fixes).\n- vhost-vdpa: switch to use vmf_insert_pfn() in the fault handler (git-fixes).\n- virito: add APIs for retrieving vq affinity (bsc#1229034).\n- virtio-blk: Ensure no requests in virtqueues before deleting vqs (git-fixes).\n- virtio: blk/scsi: use block layer helpers to calculate num of queues (bsc#1229034).\n- virtio: blk/scs: replace blk_mq_virtio_map_queues with blk_mq_dev_map_queues (bsc#1229034).\n- virtiofs: forbid newlines in tags (bsc#1230591).\n- virtio_net: checksum offloading handling fix (git-fixes).\n- virtio_net: Fix ''%d' directive writing between 1 and 11 bytes into a region of size 10' warnings (git-fixes).\n- virtio_net: use u64_stats_t infra to avoid data-races (git-fixes).\n- virtio: reenable config if freezing device failed (git-fixes).\n- virtio/vsock: fix logic which reduces credit update messages (git-fixes).\n- VMCI: Fix use-after-free when removing resource in vmci_resource_remove() (git-fixes).\n- vsock/virtio: add support for device suspend/resume (git-fixes).\n- vsock/virtio: factor our the code to initialize and delete VQs (git-fixes).\n- vsock/virtio: initialize the_virtio_vsock before using VQs (git-fixes).\n- vsock/virtio: remove socket from connected/bound list on shutdown (git-fixes).\n- watchdog: imx_sc_wdt: Do not disable WDT in suspend (git-fixes).\n- wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3 (stable-fixes).\n- wifi: cfg80211: fix two more possible UBSAN-detected off-by-one errors (git-fixes).\n- wifi: cfg80211: fix UBSAN noise in cfg80211_wext_siwscan() (git-fixes).\n- wifi: iwlwifi: mvm: increase the time between ranging measurements (git-fixes).\n- wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (git-fixes).\n- wifi: mt76: mt7615: check devm_kasprintf() returned value (git-fixes).\n- wifi: mt76: mt7915: fix rx filter setting for bfee functionality (git-fixes).\n- wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() (stable-fixes).\n- wifi: rtw88: 8822c: Fix reported RX band width (git-fixes).\n- wifi: rtw88: always wait for both firmware loading attempts (git-fixes).\n- wifi: rtw88: remove CPT execution branch never used (git-fixes).\n- wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param (git-fixes).\n- x86/hyperv: fix kexec crash due to VP assist page corruption (git-fixes).\n- x86/kexec: Add EFI config table identity mapping for kexec kernel (bsc#1220382).\n- x86/mm/ident_map: Use gbpages only where full GB page should be mapped (bsc#1220382).\n- x86/xen: Convert comma to semicolon (git-fixes).\n- xen: add capability to remap non-RAM pages to different PFNs (bsc#1226003).\n- xen: allow mapping ACPI data using a different physical address (bsc#1226003).\n- xen: introduce generic helper checking for memory map conflicts (bsc#1226003).\n- xen: move checks for e820 conflicts further up (bsc#1226003).\n- xen: move max_pfn in xen_memory_setup() out of function scope (bsc#1226003).\n- xen/swiotlb: add alignment check for dma buffers (bsc#1229928).\n- xen/swiotlb: fix allocated size (git-fixes).\n- xen: tolerate ACPI NVS memory overlapping with Xen allocated memory (bsc#1226003).\n- xen: use correct end address of kernel for conflict checking (bsc#1226003).\n- xfs: do not include bnobt blocks when reserving free block pool (git-fixes).\n- xhci: Set quirky xHC PCI hosts to D3 _after_ stopping and freeing them (git-fixes).\n- xz: cleanup CRC32 edits from 2018 (git-fixes).\n","status":"published","published":"2024-10-10T16:03:49Z","modified":"2026-02-04T03:02:41.70324Z","updated_at":"2026-11-02T15:53:55.639015Z"}]}}