Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:03613-1 Final 1 1 2025-10-16T05:47:42Z current 2025-10-16T05:47:42Z 2025-10-16T05:47:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP3 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-49980: USB: gadget: fix use-after-free read in usb_udc_uevent() (bsc#1245110). - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968). - CVE-2022-50248: wifi: iwlwifi: mvm: fix double free on tx path (bsc#1249840). - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846). - CVE-2022-50258: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() (bsc#1249947). - CVE-2022-50381: md: fix a crash in mempool_free (bsc#1250257). - CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250301). - CVE-2022-50401: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (bsc#1250140). - CVE-2022-50408: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() (bsc#1250391). - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392). - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827). - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313). - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180). - CVE-2025-21969: kABI workaround for l2cap_conn changes (bsc#1240784). - CVE-2025-38184: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer (bsc#1245956). - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239). - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255). - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399). - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628). - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220). - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200). - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538). - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002). The following non-security bugs were fixed: - Limit patch filenames to 100 characters (bsc#1249604). - Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108). - hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (git-fixes). - kernel-binary: Another installation ordering fix (bsc#1241353). - kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522). - kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346) - kernel-syms.spec: Drop old rpm release number hack (bsc#1247172). - rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879) - rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337) - rpm: Configure KABI checkingness macro (bsc#1249186) - rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186) - rpm: Link arch-symbols script from scripts directory. - rpm: Link guards script from scripts directory. - use uniform permission checks for all mount propagation changes (git-fixes). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2025-3613,SUSE-SUSE-MicroOS-5.1-2025-3613,SUSE-SUSE-MicroOS-5.2-2025-3613 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ Link for SUSE-SU-2025:03613-1 https://lists.suse.com/pipermail/sle-security-updates/2025-October/022915.html E-Mail link for SUSE-SU-2025:03613-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1202700 SUSE Bug 1202700 https://bugzilla.suse.com/1203063 SUSE Bug 1203063 https://bugzilla.suse.com/1203332 SUSE Bug 1203332 https://bugzilla.suse.com/1204228 SUSE Bug 1204228 https://bugzilla.suse.com/1205128 SUSE Bug 1205128 https://bugzilla.suse.com/1206883 SUSE Bug 1206883 https://bugzilla.suse.com/1206884 SUSE Bug 1206884 https://bugzilla.suse.com/1209287 SUSE Bug 1209287 https://bugzilla.suse.com/1209291 SUSE Bug 1209291 https://bugzilla.suse.com/1210124 SUSE Bug 1210124 https://bugzilla.suse.com/1210584 SUSE Bug 1210584 https://bugzilla.suse.com/1213061 SUSE Bug 1213061 https://bugzilla.suse.com/1213666 SUSE Bug 1213666 https://bugzilla.suse.com/1215150 SUSE Bug 1215150 https://bugzilla.suse.com/1216976 SUSE Bug 1216976 https://bugzilla.suse.com/1220185 SUSE Bug 1220185 https://bugzilla.suse.com/1220186 SUSE Bug 1220186 https://bugzilla.suse.com/1240784 SUSE Bug 1240784 https://bugzilla.suse.com/1241353 SUSE Bug 1241353 https://bugzilla.suse.com/1243278 SUSE Bug 1243278 https://bugzilla.suse.com/1244337 SUSE Bug 1244337 https://bugzilla.suse.com/1245110 SUSE Bug 1245110 https://bugzilla.suse.com/1245956 SUSE Bug 1245956 https://bugzilla.suse.com/1246879 SUSE Bug 1246879 https://bugzilla.suse.com/1246968 SUSE Bug 1246968 https://bugzilla.suse.com/1247172 SUSE Bug 1247172 https://bugzilla.suse.com/1247239 SUSE Bug 1247239 https://bugzilla.suse.com/1248108 SUSE Bug 1248108 https://bugzilla.suse.com/1248255 SUSE Bug 1248255 https://bugzilla.suse.com/1248399 SUSE Bug 1248399 https://bugzilla.suse.com/1248628 SUSE Bug 1248628 https://bugzilla.suse.com/1248847 SUSE Bug 1248847 https://bugzilla.suse.com/1249186 SUSE Bug 1249186 https://bugzilla.suse.com/1249200 SUSE Bug 1249200 https://bugzilla.suse.com/1249220 SUSE Bug 1249220 https://bugzilla.suse.com/1249346 SUSE Bug 1249346 https://bugzilla.suse.com/1249538 SUSE Bug 1249538 https://bugzilla.suse.com/1249604 SUSE Bug 1249604 https://bugzilla.suse.com/1249664 SUSE Bug 1249664 https://bugzilla.suse.com/1249667 SUSE Bug 1249667 https://bugzilla.suse.com/1249700 SUSE Bug 1249700 https://bugzilla.suse.com/1249713 SUSE Bug 1249713 https://bugzilla.suse.com/1249716 SUSE Bug 1249716 https://bugzilla.suse.com/1249718 SUSE Bug 1249718 https://bugzilla.suse.com/1249734 SUSE Bug 1249734 https://bugzilla.suse.com/1249740 SUSE Bug 1249740 https://bugzilla.suse.com/1249743 SUSE Bug 1249743 https://bugzilla.suse.com/1249747 SUSE Bug 1249747 https://bugzilla.suse.com/1249808 SUSE Bug 1249808 https://bugzilla.suse.com/1249825 SUSE Bug 1249825 https://bugzilla.suse.com/1249827 SUSE Bug 1249827 https://bugzilla.suse.com/1249840 SUSE Bug 1249840 https://bugzilla.suse.com/1249846 SUSE Bug 1249846 https://bugzilla.suse.com/1249880 SUSE Bug 1249880 https://bugzilla.suse.com/1249885 SUSE Bug 1249885 https://bugzilla.suse.com/1249908 SUSE Bug 1249908 https://bugzilla.suse.com/1249918 SUSE Bug 1249918 https://bugzilla.suse.com/1249923 SUSE Bug 1249923 https://bugzilla.suse.com/1249930 SUSE Bug 1249930 https://bugzilla.suse.com/1249947 SUSE Bug 1249947 https://bugzilla.suse.com/1249949 SUSE Bug 1249949 https://bugzilla.suse.com/1250002 SUSE Bug 1250002 https://bugzilla.suse.com/1250009 SUSE Bug 1250009 https://bugzilla.suse.com/1250014 SUSE Bug 1250014 https://bugzilla.suse.com/1250041 SUSE Bug 1250041 https://bugzilla.suse.com/1250131 SUSE Bug 1250131 https://bugzilla.suse.com/1250132 SUSE Bug 1250132 https://bugzilla.suse.com/1250140 SUSE Bug 1250140 https://bugzilla.suse.com/1250180 SUSE Bug 1250180 https://bugzilla.suse.com/1250183 SUSE Bug 1250183 https://bugzilla.suse.com/1250187 SUSE Bug 1250187 https://bugzilla.suse.com/1250257 SUSE Bug 1250257 https://bugzilla.suse.com/1250269 SUSE Bug 1250269 https://bugzilla.suse.com/1250277 SUSE Bug 1250277 https://bugzilla.suse.com/1250301 SUSE Bug 1250301 https://bugzilla.suse.com/1250313 SUSE Bug 1250313 https://bugzilla.suse.com/1250391 SUSE Bug 1250391 https://bugzilla.suse.com/1250392 SUSE Bug 1250392 https://bugzilla.suse.com/1250394 SUSE Bug 1250394 https://bugzilla.suse.com/1250522 SUSE Bug 1250522 https://bugzilla.suse.com/1250764 SUSE Bug 1250764 https://bugzilla.suse.com/1250767 SUSE Bug 1250767 https://bugzilla.suse.com/1250774 SUSE Bug 1250774 https://bugzilla.suse.com/1250787 SUSE Bug 1250787 https://bugzilla.suse.com/1250790 SUSE Bug 1250790 https://bugzilla.suse.com/1250797 SUSE Bug 1250797 https://bugzilla.suse.com/1250799 SUSE Bug 1250799 https://bugzilla.suse.com/1250823 SUSE Bug 1250823 https://bugzilla.suse.com/1250847 SUSE Bug 1250847 https://bugzilla.suse.com/1250850 SUSE Bug 1250850 https://bugzilla.suse.com/1250853 SUSE Bug 1250853 https://bugzilla.suse.com/1250868 SUSE Bug 1250868 https://bugzilla.suse.com/1250890 SUSE Bug 1250890 https://bugzilla.suse.com/1250891 SUSE Bug 1250891 https://www.suse.com/security/cve/CVE-2021-4460/ SUSE CVE CVE-2021-4460 page https://www.suse.com/security/cve/CVE-2022-2602/ SUSE CVE CVE-2022-2602 page https://www.suse.com/security/cve/CVE-2022-2978/ SUSE CVE CVE-2022-2978 page https://www.suse.com/security/cve/CVE-2022-36280/ SUSE CVE CVE-2022-36280 page https://www.suse.com/security/cve/CVE-2022-43945/ SUSE CVE CVE-2022-43945 page https://www.suse.com/security/cve/CVE-2022-49980/ SUSE CVE CVE-2022-49980 page https://www.suse.com/security/cve/CVE-2022-50233/ SUSE CVE CVE-2022-50233 page https://www.suse.com/security/cve/CVE-2022-50234/ SUSE CVE CVE-2022-50234 page https://www.suse.com/security/cve/CVE-2022-50235/ SUSE CVE CVE-2022-50235 page https://www.suse.com/security/cve/CVE-2022-50248/ SUSE CVE CVE-2022-50248 page https://www.suse.com/security/cve/CVE-2022-50249/ SUSE CVE CVE-2022-50249 page https://www.suse.com/security/cve/CVE-2022-50252/ SUSE CVE CVE-2022-50252 page https://www.suse.com/security/cve/CVE-2022-50257/ SUSE CVE CVE-2022-50257 page https://www.suse.com/security/cve/CVE-2022-50258/ SUSE CVE CVE-2022-50258 page https://www.suse.com/security/cve/CVE-2022-50260/ SUSE CVE CVE-2022-50260 page https://www.suse.com/security/cve/CVE-2022-50271/ SUSE CVE CVE-2022-50271 page https://www.suse.com/security/cve/CVE-2022-50272/ SUSE CVE CVE-2022-50272 page https://www.suse.com/security/cve/CVE-2022-50299/ SUSE CVE CVE-2022-50299 page https://www.suse.com/security/cve/CVE-2022-50309/ SUSE CVE CVE-2022-50309 page https://www.suse.com/security/cve/CVE-2022-50312/ SUSE CVE CVE-2022-50312 page https://www.suse.com/security/cve/CVE-2022-50317/ SUSE CVE CVE-2022-50317 page https://www.suse.com/security/cve/CVE-2022-50330/ SUSE CVE CVE-2022-50330 page https://www.suse.com/security/cve/CVE-2022-50344/ SUSE CVE CVE-2022-50344 page https://www.suse.com/security/cve/CVE-2022-50355/ SUSE CVE CVE-2022-50355 page https://www.suse.com/security/cve/CVE-2022-50359/ SUSE CVE CVE-2022-50359 page https://www.suse.com/security/cve/CVE-2022-50367/ SUSE CVE CVE-2022-50367 page https://www.suse.com/security/cve/CVE-2022-50368/ SUSE CVE CVE-2022-50368 page https://www.suse.com/security/cve/CVE-2022-50375/ SUSE CVE CVE-2022-50375 page https://www.suse.com/security/cve/CVE-2022-50381/ SUSE CVE CVE-2022-50381 page https://www.suse.com/security/cve/CVE-2022-50385/ SUSE CVE CVE-2022-50385 page https://www.suse.com/security/cve/CVE-2022-50386/ SUSE CVE CVE-2022-50386 page https://www.suse.com/security/cve/CVE-2022-50401/ SUSE CVE CVE-2022-50401 page https://www.suse.com/security/cve/CVE-2022-50408/ SUSE CVE CVE-2022-50408 page https://www.suse.com/security/cve/CVE-2022-50409/ SUSE CVE CVE-2022-50409 page https://www.suse.com/security/cve/CVE-2022-50410/ SUSE CVE CVE-2022-50410 page https://www.suse.com/security/cve/CVE-2022-50414/ SUSE CVE CVE-2022-50414 page https://www.suse.com/security/cve/CVE-2022-50419/ SUSE CVE CVE-2022-50419 page https://www.suse.com/security/cve/CVE-2022-50422/ SUSE CVE CVE-2022-50422 page https://www.suse.com/security/cve/CVE-2022-50427/ SUSE CVE CVE-2022-50427 page https://www.suse.com/security/cve/CVE-2022-50431/ SUSE CVE CVE-2022-50431 page https://www.suse.com/security/cve/CVE-2022-50435/ SUSE CVE CVE-2022-50435 page https://www.suse.com/security/cve/CVE-2022-50437/ SUSE CVE CVE-2022-50437 page https://www.suse.com/security/cve/CVE-2022-50440/ SUSE CVE CVE-2022-50440 page https://www.suse.com/security/cve/CVE-2022-50444/ SUSE CVE CVE-2022-50444 page https://www.suse.com/security/cve/CVE-2022-50454/ SUSE CVE CVE-2022-50454 page https://www.suse.com/security/cve/CVE-2022-50458/ SUSE CVE CVE-2022-50458 page https://www.suse.com/security/cve/CVE-2022-50459/ SUSE CVE CVE-2022-50459 page https://www.suse.com/security/cve/CVE-2022-50467/ SUSE CVE CVE-2022-50467 page https://www.suse.com/security/cve/CVE-2023-1380/ SUSE CVE CVE-2023-1380 page https://www.suse.com/security/cve/CVE-2023-28328/ SUSE CVE CVE-2023-28328 page https://www.suse.com/security/cve/CVE-2023-31248/ SUSE CVE CVE-2023-31248 page https://www.suse.com/security/cve/CVE-2023-3772/ SUSE CVE CVE-2023-3772 page https://www.suse.com/security/cve/CVE-2023-39197/ SUSE CVE CVE-2023-39197 page https://www.suse.com/security/cve/CVE-2023-42753/ SUSE CVE CVE-2023-42753 page https://www.suse.com/security/cve/CVE-2023-53147/ SUSE CVE CVE-2023-53147 page https://www.suse.com/security/cve/CVE-2023-53178/ SUSE CVE CVE-2023-53178 page https://www.suse.com/security/cve/CVE-2023-53179/ SUSE CVE CVE-2023-53179 page https://www.suse.com/security/cve/CVE-2023-53213/ SUSE CVE CVE-2023-53213 page https://www.suse.com/security/cve/CVE-2023-53265/ SUSE CVE CVE-2023-53265 page https://www.suse.com/security/cve/CVE-2023-53273/ SUSE CVE CVE-2023-53273 page https://www.suse.com/security/cve/CVE-2023-53304/ SUSE CVE CVE-2023-53304 page https://www.suse.com/security/cve/CVE-2023-53321/ SUSE CVE CVE-2023-53321 page https://www.suse.com/security/cve/CVE-2023-53333/ SUSE CVE CVE-2023-53333 page https://www.suse.com/security/cve/CVE-2023-53438/ SUSE CVE CVE-2023-53438 page https://www.suse.com/security/cve/CVE-2023-53464/ SUSE CVE CVE-2023-53464 page https://www.suse.com/security/cve/CVE-2023-53492/ SUSE CVE CVE-2023-53492 page https://www.suse.com/security/cve/CVE-2024-26583/ SUSE CVE CVE-2024-26583 page https://www.suse.com/security/cve/CVE-2024-26584/ SUSE CVE CVE-2024-26584 page https://www.suse.com/security/cve/CVE-2024-58240/ SUSE CVE CVE-2024-58240 page https://www.suse.com/security/cve/CVE-2025-21969/ SUSE CVE CVE-2025-21969 page https://www.suse.com/security/cve/CVE-2025-38184/ SUSE CVE CVE-2025-38184 page https://www.suse.com/security/cve/CVE-2025-38488/ SUSE CVE CVE-2025-38488 page https://www.suse.com/security/cve/CVE-2025-38553/ SUSE CVE CVE-2025-38553 page https://www.suse.com/security/cve/CVE-2025-38572/ SUSE CVE CVE-2025-38572 page https://www.suse.com/security/cve/CVE-2025-38664/ SUSE CVE CVE-2025-38664 page https://www.suse.com/security/cve/CVE-2025-38685/ SUSE CVE CVE-2025-38685 page https://www.suse.com/security/cve/CVE-2025-38713/ SUSE CVE CVE-2025-38713 page https://www.suse.com/security/cve/CVE-2025-39751/ SUSE CVE CVE-2025-39751 page https://www.suse.com/security/cve/CVE-2025-39823/ SUSE CVE CVE-2025-39823 page SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 cluster-md-kmp-rt-5.3.18-150300.223.1 cluster-md-kmp-rt_debug-5.3.18-150300.223.1 dlm-kmp-rt-5.3.18-150300.223.1 dlm-kmp-rt_debug-5.3.18-150300.223.1 gfs2-kmp-rt-5.3.18-150300.223.1 gfs2-kmp-rt_debug-5.3.18-150300.223.1 kernel-devel-rt-5.3.18-150300.223.1 kernel-rt-5.3.18-150300.223.1 kernel-rt-devel-5.3.18-150300.223.1 kernel-rt-extra-5.3.18-150300.223.1 kernel-rt-livepatch-devel-5.3.18-150300.223.1 kernel-rt-optional-5.3.18-150300.223.1 kernel-rt_debug-5.3.18-150300.223.1 kernel-rt_debug-devel-5.3.18-150300.223.1 kernel-rt_debug-extra-5.3.18-150300.223.1 kernel-rt_debug-livepatch-devel-5.3.18-150300.223.1 kernel-rt_debug-optional-5.3.18-150300.223.1 kernel-source-rt-5.3.18-150300.223.1 kernel-syms-rt-5.3.18-150300.223.1 kselftests-kmp-rt-5.3.18-150300.223.1 kselftests-kmp-rt_debug-5.3.18-150300.223.1 ocfs2-kmp-rt-5.3.18-150300.223.1 ocfs2-kmp-rt_debug-5.3.18-150300.223.1 reiserfs-kmp-rt-5.3.18-150300.223.1 reiserfs-kmp-rt_debug-5.3.18-150300.223.1 kernel-rt-5.3.18-150300.223.1 as a component of SUSE Linux Enterprise Micro 5.1 kernel-source-rt-5.3.18-150300.223.1 as a component of SUSE Linux Enterprise Micro 5.1 kernel-rt-5.3.18-150300.223.1 as a component of SUSE Linux Enterprise Micro 5.2 kernel-source-rt-5.3.18-150300.223.1 as a component of SUSE Linux Enterprise Micro 5.2 In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix UBSAN shift-out-of-bounds warning If get_num_sdma_queues or get_num_xgmi_sdma_queues is 0, we end up doing a shift operation where the number of bits shifted equals number of bits in the operand. This behaviour is undefined. Set num_sdma_queues or num_xgmi_sdma_queues to ULLONG_MAX, if the count is >= number of bits in the operand. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1472 CVE-2021-4460 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2021-4460.html CVE-2021-4460 https://bugzilla.suse.com/1250764 SUSE Bug 1250764 io_uring UAF, Unix SCM garbage collection CVE-2022-2602 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-2602.html CVE-2022-2602 https://bugzilla.suse.com/1204228 SUSE Bug 1204228 https://bugzilla.suse.com/1205186 SUSE Bug 1205186 A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2022-2978 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-2978.html CVE-2022-2978 https://bugzilla.suse.com/1202700 SUSE Bug 1202700 https://bugzilla.suse.com/1204745 SUSE Bug 1204745 An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). CVE-2022-36280 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-36280.html CVE-2022-36280 https://bugzilla.suse.com/1203332 SUSE Bug 1203332 The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-43945 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-43945.html CVE-2022-43945 https://bugzilla.suse.com/1205128 SUSE Bug 1205128 https://bugzilla.suse.com/1205130 SUSE Bug 1205130 https://bugzilla.suse.com/1208030 SUSE Bug 1208030 https://bugzilla.suse.com/1208085 SUSE Bug 1208085 https://bugzilla.suse.com/1209225 SUSE Bug 1209225 https://bugzilla.suse.com/1210124 SUSE Bug 1210124 In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free Read in usb_udc_uevent() The syzbot fuzzer found a race between uevent callbacks and gadget driver unregistration that can cause a use-after-free bug: --------------------------------------------------------------- BUG: KASAN: use-after-free in usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 Read of size 8 at addr ffff888078ce2050 by task udevd/2968 CPU: 1 PID: 2968 Comm: udevd Not tainted 5.19.0-rc4-next-20220628-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 usb_udc_uevent+0x11f/0x130 drivers/usb/gadget/udc/core.c:1732 dev_uevent+0x290/0x770 drivers/base/core.c:2424 --------------------------------------------------------------- The bug occurs because usb_udc_uevent() dereferences udc->driver but does so without acquiring the udc_lock mutex, which protects this field. If the gadget driver is unbound from the udc concurrently with uevent processing, the driver structure may be accessed after it has been deallocated. To prevent the race, we make sure that the routine holds the mutex around the racing accesses. CVE-2022-49980 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-49980.html CVE-2022-49980 https://bugzilla.suse.com/1245110 SUSE Bug 1245110 https://bugzilla.suse.com/1245111 SUSE Bug 1245111 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} Both dev_name and short_name are not guaranteed to be NULL terminated so this instead use strnlen and then attempt to determine if the resulting string needs to be truncated or not. CVE-2022-50233 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50233.html CVE-2022-50233 https://bugzilla.suse.com/1246968 SUSE Bug 1246968 https://bugzilla.suse.com/1249242 SUSE Bug 1249242 In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: defer registered files gc to io_uring release Instead of putting io_uring's registered files in unix_gc() we want it to be done by io_uring itself. The trick here is to consider io_uring registered files for cycle detection but not actually putting them down. Because io_uring can't register other ring instances, this will remove all refs to the ring file triggering the ->release path and clean up with io_ring_ctx_free(). [axboe: add kerneldoc comment to skb, fold in skb leak fix] CVE-2022-50234 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50234.html CVE-2022-50234 https://bugzilla.suse.com/1249664 SUSE Bug 1249664 In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READDIR Restore the previous limit on the @count argument to prevent a buffer overflow attack. CVE-2022-50235 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50235.html CVE-2022-50235 https://bugzilla.suse.com/1249667 SUSE Bug 1249667 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000000 | tsf hi Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650 CPU: 4 PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5 iwlwifi 0000:06:00.0: 0x00000000 | time gp1 Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019 Call Trace: <TASK> dump_stack_lvl+0x55/0x6d print_report.cold.12+0xf2/0x684 iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2 ? __list_del_entry_valid+0x12/0x90 kasan_report+0x8b/0x180 iwlwifi 0000:06:00.0: 0x00000001 | uCode revision type ? __list_del_entry_valid+0x12/0x90 __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000048 | uCode version major tcp_update_skb_after_send+0x5d/0x170 __tcp_transmit_skb+0xb61/0x15c0 iwlwifi 0000:06:00.0: 0xDAA05125 | uCode version minor ? __tcp_select_window+0x490/0x490 iwlwifi 0000:06:00.0: 0x00000420 | hw version ? trace_kmalloc_node+0x29/0xd0 ? __kmalloc_node_track_caller+0x12a/0x260 ? memset+0x1f/0x40 ? __build_skb_around+0x125/0x150 ? __alloc_skb+0x1d4/0x220 ? skb_zerocopy_clone+0x55/0x230 iwlwifi 0000:06:00.0: 0x00489002 | board version ? kmalloc_reserve+0x80/0x80 ? rcu_read_lock_bh_held+0x60/0xb0 tcp_write_xmit+0x3f1/0x24d0 iwlwifi 0000:06:00.0: 0x034E001C | hcmd ? __check_object_size+0x180/0x350 iwlwifi 0000:06:00.0: 0x24020000 | isr0 tcp_sendmsg_locked+0x8a9/0x1520 iwlwifi 0000:06:00.0: 0x01400000 | isr1 ? tcp_sendpage+0x50/0x50 iwlwifi 0000:06:00.0: 0x48F0000A | isr2 ? lock_release+0xb9/0x400 ? tcp_sendmsg+0x14/0x40 iwlwifi 0000:06:00.0: 0x00C3080C | isr3 ? lock_downgrade+0x390/0x390 ? do_raw_spin_lock+0x114/0x1d0 iwlwifi 0000:06:00.0: 0x00200000 | isr4 ? rwlock_bug.part.2+0x50/0x50 iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id ? rwlock_bug.part.2+0x50/0x50 ? lockdep_hardirqs_on_prepare+0xe/0x200 iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event ? __local_bh_enable_ip+0x87/0xe0 ? inet_send_prepare+0x220/0x220 iwlwifi 0000:06:00.0: 0x000000C4 | l2p_control tcp_sendmsg+0x22/0x40 sock_sendmsg+0x5f/0x70 iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration __sys_sendto+0x19d/0x250 iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid ? __ia32_sys_getpeername+0x40/0x40 iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_sched_held+0x5a/0xd0 ? lock_release+0xb9/0x400 ? lock_downgrade+0x390/0x390 ? ktime_get+0x64/0x130 ? ktime_get+0x8d/0x130 ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_bh_held+0xb0/0xb0 __x64_sys_sendto+0x6f/0x80 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f1d126e4531 Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0 75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20 48 89 RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000000000000ffdc RCX: 00007f1d126e4531 RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014 RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R ---truncated--- CVE-2022-50248 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50248.html CVE-2022-50248 https://bugzilla.suse.com/1249840 SUSE Bug 1249840 In the Linux kernel, the following vulnerability has been resolved: memory: of: Fix refcount leak bug in of_get_ddr_timings() We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refcount. CVE-2022-50249 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50249.html CVE-2022-50249 https://bugzilla.suse.com/1249747 SUSE Bug 1249747 In the Linux kernel, the following vulnerability has been resolved: igb: Do not free q_vector unless new one was allocated Avoid potential use-after-free condition under memory pressure. If the kzalloc() fails, q_vector will be freed but left in the original adapter->q_vector[v_idx] array position. CVE-2022-50252 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50252.html CVE-2022-50252 https://bugzilla.suse.com/1249846 SUSE Bug 1249846 In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: Prevent leaking grants Prior to this commit, if a grant mapping operation failed partially, some of the entries in the map_ops array would be invalid, whereas all of the entries in the kmap_ops array would be valid. This in turn would cause the following logic in gntdev_map_grant_pages to become invalid: for (i = 0; i < map->count; i++) { if (map->map_ops[i].status == GNTST_okay) { map->unmap_ops[i].handle = map->map_ops[i].handle; if (!use_ptemod) alloced++; } if (use_ptemod) { if (map->kmap_ops[i].status == GNTST_okay) { if (map->map_ops[i].status == GNTST_okay) alloced++; map->kunmap_ops[i].handle = map->kmap_ops[i].handle; } } } ... atomic_add(alloced, &map->live_grants); Assume that use_ptemod is true (i.e., the domain mapping the granted pages is a paravirtualized domain). In the code excerpt above, note that the "alloced" variable is only incremented when both kmap_ops[i].status and map_ops[i].status are set to GNTST_okay (i.e., both mapping operations are successful). However, as also noted above, there are cases where a grant mapping operation fails partially, breaking the assumption of the code excerpt above. The aforementioned causes map->live_grants to be incorrectly set. In some cases, all of the map_ops mappings fail, but all of the kmap_ops mappings succeed, meaning that live_grants may remain zero. This in turn makes it impossible to unmap the successfully grant-mapped pages pointed to by kmap_ops, because unmap_grant_pages has the following snippet of code at its beginning: if (atomic_read(&map->live_grants) == 0) return; /* Nothing to do */ In other cases where only some of the map_ops mappings fail but all kmap_ops mappings succeed, live_grants is made positive, but when the user requests unmapping the grant-mapped pages, __unmap_grant_pages_done will then make map->live_grants negative, because the latter function does not check if all of the pages that were requested to be unmapped were actually unmapped, and the same function unconditionally subtracts "data->count" (i.e., a value that can be greater than map->live_grants) from map->live_grants. The side effects of a negative live_grants value have not been studied. The net effect of all of this is that grant references are leaked in one of the above conditions. In Qubes OS v4.1 (which uses Xen's grant mechanism extensively for X11 GUI isolation), this issue manifests itself with warning messages like the following to be printed out by the Linux kernel in the VM that had granted pages (that contain X11 GUI window data) to dom0: "g.e. 0x1234 still pending", especially after the user rapidly resizes GUI VM windows (causing some grant-mapping operations to partially or completely fail, due to the fact that the VM unshares some of the pages as part of the window resizing, making the pages impossible to grant-map from dom0). The fix for this issue involves counting all successful map_ops and kmap_ops mappings separately, and then adding the sum to live_grants. During unmapping, only the number of successfully unmapped grants is subtracted from live_grants. The code is also modified to check for negative live_grants values after the subtraction and warn the user. CVE-2022-50257 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50257.html CVE-2022-50257 https://bugzilla.suse.com/1249743 SUSE Bug 1249743 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in brcmf_fil_iovar_data_get(). The patch ensures buf is null-terminated. Found by a modified version of syzkaller. [ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 47.601565][ T1897] ================================================================== [ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0 [ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897 [ 47.604336][ T1897] [ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131 [ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event [ 47.607453][ T1897] Call Trace: [ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 [ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334 [ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609434][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609863][ T1897] kasan_report.cold+0x83/0xdf [ 47.610366][ T1897] ? strsep+0x1b2/0x1f0 [ 47.610882][ T1897] strsep+0x1b2/0x1f0 [ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0 [ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 [ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0 [ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 [ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260 [ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 47.616288][ T1897] brcmf_attach+0x246/0xd40 [ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 [ 47.617280][ T1897] ? kmemdup+0x43/0x50 [ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 [ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 [ 47.619429][ T1897] ? usb_probe_device+0x250/0x250 [ 47.619950][ T1897] really_probe+0x205/0xb70 [ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0 [ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.622209][ T1897] driver_probe_device+0x4e/0x150 [ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0 [ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0 [ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30 [ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160 [ 47.625437][ T1897] __device_attach+0x23f/0x3a0 [ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0 [ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0 [ 47.627057][ T1897] bus_probe_device+0x1da/0x290 [ 47.627557][ T1897] device_add+0xb7b/0x1eb0 [ 47.628027][ T1897] ? wait_for_completion+0x290/0x290 [ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 [ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0 [ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0 [ 47.630385][ T1897] usb_probe_device+0xbb/0x250 [ 47.630927][ T1897] ? usb_suspend+0x590/0x590 [ 47.631397][ T1897] really_probe+0x205/0xb70 [ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0 [ 47.633002][ ---truncated--- CVE-2022-50258 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50258.html CVE-2022-50258 https://bugzilla.suse.com/1249947 SUSE Bug 1249947 In the Linux kernel, the following vulnerability has been resolved: drm/msm: Make .remove and .shutdown HW shutdown consistent Drivers' .remove and .shutdown callbacks are executed on different code paths. The former is called when a device is removed from the bus, while the latter is called at system shutdown time to quiesce the device. This means that some overlap exists between the two, because both have to take care of properly shutting down the hardware. But currently the logic used in these two callbacks isn't consistent in msm drivers, which could lead to kernel panic. For example, on .remove the component is deleted and its .unbind callback leads to the hardware being shutdown but only if the DRM device has been marked as registered. That check doesn't exist in the .shutdown logic and this can lead to the driver calling drm_atomic_helper_shutdown() for a DRM device that hasn't been properly initialized. A situation like this can happen if drivers for expected sub-devices fail to probe, since the .bind callback will never be executed. If that is the case, drm_atomic_helper_shutdown() will attempt to take mutexes that are only initialized if drm_mode_config_init() is called during a device bind. This bug was attempted to be fixed in commit 623f279c7781 ("drm/msm: fix shutdown hook in case GPU components failed to bind"), but unfortunately it still happens in some cases as the one mentioned above, i.e: systemd-shutdown[1]: Powering off. kvm: exiting hardware virtualization platform wifi-firmware.0: Removing from iommu group 12 platform video-firmware.0: Removing from iommu group 10 ------------[ cut here ]------------ WARNING: CPU: 6 PID: 1 at drivers/gpu/drm/drm_modeset_lock.c:317 drm_modeset_lock_all_ctx+0x3c4/0x3d0 ... Hardware name: Google CoachZ (rev3+) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drm_modeset_lock_all_ctx+0x3c4/0x3d0 lr : drm_modeset_lock_all_ctx+0x48/0x3d0 sp : ffff80000805bb80 x29: ffff80000805bb80 x28: ffff327c00128000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000001 x24: ffffc95d820ec030 x23: ffff327c00bbd090 x22: ffffc95d8215eca0 x21: ffff327c039c5800 x20: ffff327c039c5988 x19: ffff80000805bbe8 x18: 0000000000000034 x17: 000000040044ffff x16: ffffc95d80cac920 x15: 0000000000000000 x14: 0000000000000315 x13: 0000000000000315 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff80000805bc28 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff327c00128000 x1 : 0000000000000000 x0 : ffff327c039c59b0 Call trace: drm_modeset_lock_all_ctx+0x3c4/0x3d0 drm_atomic_helper_shutdown+0x70/0x134 msm_drv_shutdown+0x30/0x40 platform_shutdown+0x28/0x40 device_shutdown+0x148/0x350 kernel_power_off+0x38/0x80 __do_sys_reboot+0x288/0x2c0 __arm64_sys_reboot+0x28/0x34 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0x44/0xec do_el0_svc+0x2c/0xc0 el0_svc+0x2c/0x84 el0t_64_sync_handler+0x11c/0x150 el0t_64_sync+0x18c/0x190 ---[ end trace 0000000000000000 ]--- Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000010eab1000 [0000000000000018] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP ... Hardware name: Google CoachZ (rev3+) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ww_mutex_lock+0x28/0x32c lr : drm_modeset_lock_all_ctx+0x1b0/0x3d0 sp : ffff80000805bb50 x29: ffff80000805bb50 x28: ffff327c00128000 x27: 0000000000000000 x26: 00000 ---truncated--- CVE-2022-50260 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50260.html CVE-2022-50260 https://bugzilla.suse.com/1249885 SUSE Bug 1249885 In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: Use kvmalloc/kvfree for larger packets. When copying a large file over sftp over vsock, data size is usually 32kB, and kmalloc seems to fail to try to allocate 32 32kB regions. vhost-5837: page allocation failure: order:4, mode:0x24040c0 Call Trace: [<ffffffffb6a0df64>] dump_stack+0x97/0xdb [<ffffffffb68d6aed>] warn_alloc_failed+0x10f/0x138 [<ffffffffb68d868a>] ? __alloc_pages_direct_compact+0x38/0xc8 [<ffffffffb664619f>] __alloc_pages_nodemask+0x84c/0x90d [<ffffffffb6646e56>] alloc_kmem_pages+0x17/0x19 [<ffffffffb6653a26>] kmalloc_order_trace+0x2b/0xdb [<ffffffffb66682f3>] __kmalloc+0x177/0x1f7 [<ffffffffb66e0d94>] ? copy_from_iter+0x8d/0x31d [<ffffffffc0689ab7>] vhost_vsock_handle_tx_kick+0x1fa/0x301 [vhost_vsock] [<ffffffffc06828d9>] vhost_worker+0xf7/0x157 [vhost] [<ffffffffb683ddce>] kthread+0xfd/0x105 [<ffffffffc06827e2>] ? vhost_dev_set_owner+0x22e/0x22e [vhost] [<ffffffffb683dcd1>] ? flush_kthread_worker+0xf3/0xf3 [<ffffffffb6eb332e>] ret_from_fork+0x4e/0x80 [<ffffffffb683dcd1>] ? flush_kthread_worker+0xf3/0xf3 Work around by doing kvmalloc instead. CVE-2022-50271 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50271.html CVE-2022-50271 https://bugzilla.suse.com/1249740 SUSE Bug 1249740 In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). CVE-2022-50272 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50272.html CVE-2022-50272 https://bugzilla.suse.com/1249808 SUSE Bug 1249808 In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf() returns the number of characters generated from the given input, which could cause the expression "200 - len" to wrap around to a large positive number. Fix this by using scnprintf() instead, which returns the actual number of characters written into the buffer. [ 1513.267938] ------------[ cut here ]------------ [ 1513.267943] WARNING: CPU: 15 PID: 37247 at <snip>/lib/vsprintf.c:2509 vsnprintf+0x2c8/0x510 [ 1513.267944] Modules linked in: <snip> [ 1513.267969] CPU: 15 PID: 37247 Comm: mdadm Not tainted 5.4.0-1085-azure #90~18.04.1-Ubuntu [ 1513.267969] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 1513.267971] RIP: 0010:vsnprintf+0x2c8/0x510 <-snip-> [ 1513.267982] Call Trace: [ 1513.267986] snprintf+0x45/0x70 [ 1513.267990] ? disk_name+0x71/0xa0 [ 1513.267993] dump_zones+0x114/0x240 [raid0] [ 1513.267996] ? _cond_resched+0x19/0x40 [ 1513.267998] raid0_run+0x19e/0x270 [raid0] [ 1513.268000] md_run+0x5e0/0xc50 [ 1513.268003] ? security_capable+0x3f/0x60 [ 1513.268005] do_md_run+0x19/0x110 [ 1513.268006] md_ioctl+0x195e/0x1f90 [ 1513.268007] blkdev_ioctl+0x91f/0x9f0 [ 1513.268010] block_ioctl+0x3d/0x50 [ 1513.268012] do_vfs_ioctl+0xa9/0x640 [ 1513.268014] ? __fput+0x162/0x260 [ 1513.268016] ksys_ioctl+0x75/0x80 [ 1513.268017] __x64_sys_ioctl+0x1a/0x20 [ 1513.268019] do_syscall_64+0x5e/0x200 [ 1513.268021] entry_SYSCALL_64_after_hwframe+0x44/0xa9 CVE-2022-50299 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50299.html CVE-2022-50299 https://bugzilla.suse.com/1249734 SUSE Bug 1249734 In the Linux kernel, the following vulnerability has been resolved: media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. CVE-2022-50309 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50309.html CVE-2022-50309 https://bugzilla.suse.com/1249718 SUSE Bug 1249718 In the Linux kernel, the following vulnerability has been resolved: drivers: serial: jsm: fix some leaks in probe This error path needs to unwind instead of just returning directly. CVE-2022-50312 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50312.html CVE-2022-50312 https://bugzilla.suse.com/1249716 SUSE Bug 1249716 In the Linux kernel, the following vulnerability has been resolved: drm/bridge: megachips: Fix a null pointer dereference bug When removing the module we will get the following warning: [ 31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered [ 31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130 [ 31.921825] Call Trace: [ 31.922533] stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw] [ 31.923139] i2c_device_remove+0x181/0x1f0 The two bridges (stdp2690, stdp4028) do not probe at the same time, so the driver does not call ge_b850v3_resgiter() when probing, causing the driver to try to remove the object that has not been initialized. Fix this by checking whether both the bridges are probed. CVE-2022-50317 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50317.html CVE-2022-50317 https://bugzilla.suse.com/1249713 SUSE Bug 1249713 In the Linux kernel, the following vulnerability has been resolved: crypto: cavium - prevent integer overflow loading firmware The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow. CVE-2022-50330 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50330.html CVE-2022-50330 https://bugzilla.suse.com/1249700 SUSE Bug 1249700 In the Linux kernel, the following vulnerability has been resolved: ext4: fix null-ptr-deref in ext4_write_info I caught a null-ptr-deref bug as follows: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339 RIP: 0010:ext4_write_info+0x53/0x1b0 [...] Call Trace: dquot_writeback_dquots+0x341/0x9a0 ext4_sync_fs+0x19e/0x800 __sync_filesystem+0x83/0x100 sync_filesystem+0x89/0xf0 generic_shutdown_super+0x79/0x3e0 kill_block_super+0xa1/0x110 deactivate_locked_super+0xac/0x130 deactivate_super+0xb6/0xd0 cleanup_mnt+0x289/0x400 __cleanup_mnt+0x16/0x20 task_work_run+0x11c/0x1c0 exit_to_user_mode_prepare+0x203/0x210 syscall_exit_to_user_mode+0x5b/0x3a0 do_syscall_64+0x59/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ================================================================== Above issue may happen as follows: ------------------------------------- exit_to_user_mode_prepare task_work_run __cleanup_mnt cleanup_mnt deactivate_super deactivate_locked_super kill_block_super generic_shutdown_super shrink_dcache_for_umount dentry = sb->s_root sb->s_root = NULL <--- Here set NULL sync_filesystem __sync_filesystem sb->s_op->sync_fs > ext4_sync_fs dquot_writeback_dquots sb->dq_op->write_info > ext4_write_info ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2) d_inode(sb->s_root) s_root->d_inode <--- Null pointer dereference To solve this problem, we use ext4_journal_start_sb directly to avoid s_root being used. CVE-2022-50344 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50344.html CVE-2022-50344 https://bugzilla.suse.com/1250014 SUSE Bug 1250014 In the Linux kernel, the following vulnerability has been resolved: staging: vt6655: fix some erroneous memory clean-up loops In some initialization functions of this driver, memory is allocated with 'i' acting as an index variable and increasing from 0. The commit in "Fixes" introduces some clean-up codes in case of allocation failure, which free memory in reverse order with 'i' decreasing to 0. However, there are some problems: - The case i=0 is left out. Thus memory is leaked. - In case memory allocation fails right from the start, the memory freeing loops will start with i=-1 and invalid memory locations will be accessed. One of these loops has been fixed in commit c8ff91535880 ("staging: vt6655: fix potential memory leak"). Fix the remaining erroneous loops. CVE-2022-50355 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50355.html CVE-2022-50355 https://bugzilla.suse.com/1250041 SUSE Bug 1250041 In the Linux kernel, the following vulnerability has been resolved: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() When the driver calls cx88_risc_buffer() to prepare the buffer, the function call may fail, resulting in a empty buffer and null-ptr-deref later in buffer_queue(). The following log can reveal it: [ 41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 41.828027] RIP: 0010:buffer_queue+0xc2/0x500 [ 41.836311] Call Trace: [ 41.836945] __enqueue_in_driver+0x141/0x360 [ 41.837262] vb2_start_streaming+0x62/0x4a0 [ 41.838216] vb2_core_streamon+0x1da/0x2c0 [ 41.838516] __vb2_init_fileio+0x981/0xbc0 [ 41.839141] __vb2_perform_fileio+0xbf9/0x1120 [ 41.840072] vb2_fop_read+0x20e/0x400 [ 41.840346] v4l2_read+0x215/0x290 [ 41.840603] vfs_read+0x162/0x4c0 Fix this by checking the return value of cx88_risc_buffer() [hverkuil: fix coding style issues] CVE-2022-50359 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50359.html CVE-2022-50359 https://bugzilla.suse.com/1250269 SUSE Bug 1250269 In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes) CVE-2022-50367 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50367.html CVE-2022-50367 https://bugzilla.suse.com/1250277 SUSE Bug 1250277 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork: https://patchwork.freedesktop.org/patch/502668/ CVE-2022-50368 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50368.html CVE-2022-50368 https://bugzilla.suse.com/1250009 SUSE Bug 1250009 In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown lpuart_dma_shutdown tears down lpuart dma, but lpuart_flush_buffer can still occur which in turn tries to access dma apis if lpuart_dma_tx_use flag is true. At this point since dma is torn down, these dma apis can abort. Set lpuart_dma_tx_use and the corresponding rx flag lpuart_dma_rx_use to false in lpuart_dma_shutdown so that dmas are not accessed after they are relinquished. Otherwise, when try to kill btattach, kernel may panic. This patch may fix this issue. root@imx8ulpevk:~# btattach -B /dev/ttyLP2 -S 115200 ^C[ 90.182296] Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP [ 90.189806] Modules linked in: moal(O) mlan(O) [ 90.194258] CPU: 0 PID: 503 Comm: btattach Tainted: G O 5.15.32-06136-g34eecdf2f9e4 #37 [ 90.203554] Hardware name: NXP i.MX8ULP 9X9 EVK (DT) [ 90.208513] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 90.215470] pc : fsl_edma3_disable_request+0x8/0x60 [ 90.220358] lr : fsl_edma3_terminate_all+0x34/0x20c [ 90.225237] sp : ffff800013f0bac0 [ 90.228548] x29: ffff800013f0bac0 x28: 0000000000000001 x27: ffff000008404800 [ 90.235681] x26: ffff000008404960 x25: ffff000008404a08 x24: ffff000008404a00 [ 90.242813] x23: ffff000008404a60 x22: 0000000000000002 x21: 0000000000000000 [ 90.249946] x20: ffff800013f0baf8 x19: ffff00000559c800 x18: 0000000000000000 [ 90.257078] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 90.264211] x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000040 [ 90.271344] x11: ffff00000600c248 x10: ffff800013f0bb10 x9 : ffff000057bcb090 [ 90.278477] x8 : fffffc0000241a08 x7 : ffff00000534ee00 x6 : ffff000008404804 [ 90.285609] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff0000055b3480 [ 90.292742] x2 : ffff8000135c0000 x1 : ffff00000534ee00 x0 : ffff00000559c800 [ 90.299876] Call trace: [ 90.302321] fsl_edma3_disable_request+0x8/0x60 [ 90.306851] lpuart_flush_buffer+0x40/0x160 [ 90.311037] uart_flush_buffer+0x88/0x120 [ 90.315050] tty_driver_flush_buffer+0x20/0x30 [ 90.319496] hci_uart_flush+0x44/0x90 [ 90.323162] +0x34/0x12c [ 90.327253] tty_ldisc_close+0x38/0x70 [ 90.331005] tty_ldisc_release+0xa8/0x190 [ 90.335018] tty_release_struct+0x24/0x8c [ 90.339022] tty_release+0x3ec/0x4c0 [ 90.342593] __fput+0x70/0x234 [ 90.345652] ____fput+0x14/0x20 [ 90.348790] task_work_run+0x84/0x17c [ 90.352455] do_exit+0x310/0x96c [ 90.355688] do_group_exit+0x3c/0xa0 [ 90.359259] __arm64_sys_exit_group+0x1c/0x20 [ 90.363609] invoke_syscall+0x48/0x114 [ 90.367362] el0_svc_common.constprop.0+0xd4/0xfc [ 90.372068] do_el0_svc+0x2c/0x94 [ 90.375379] el0_svc+0x28/0x80 [ 90.378438] el0t_64_sync_handler+0xa8/0x130 [ 90.382711] el0t_64_sync+0x1a0/0x1a4 [ 90.386376] Code: 17ffffda d503201f d503233f f9409802 (b9400041) [ 90.392467] ---[ end trace 2f60524b4a43f1f6 ]--- [ 90.397073] note: btattach[503] exited with preempt_count 1 [ 90.402636] Fixing recursive fault but reboot is needed! CVE-2022-50375 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50375.html CVE-2022-50375 https://bugzilla.suse.com/1250132 SUSE Bug 1250132 In the Linux kernel, the following vulnerability has been resolved: md: fix a crash in mempool_free There's a crash in mempool_free when running the lvm test shell/lvchange-rebuild-raid.sh. The reason for the crash is this: * super_written calls atomic_dec_and_test(&mddev->pending_writes) and wake_up(&mddev->sb_wait). Then it calls rdev_dec_pending(rdev, mddev) and bio_put(bio). * so, the process that waited on sb_wait and that is woken up is racing with bio_put(bio). * if the process wins the race, it calls bioset_exit before bio_put(bio) is executed. * bio_put(bio) attempts to free a bio into a destroyed bio set - causing a crash in mempool_free. We fix this bug by moving bio_put before atomic_dec_and_test. We also move rdev_dec_pending before atomic_dec_and_test as suggested by Neil Brown. The function md_end_flush has a similar bug - we must call bio_put before we decrement the number of in-progress bios. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 11557f0067 P4D 11557f0067 PUD 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 73 Comm: kworker/0:1 Not tainted 6.1.0-rc3 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: kdelayd flush_expired_bios [dm_delay] RIP: 0010:mempool_free+0x47/0x80 Code: 48 89 ef 5b 5d ff e0 f3 c3 48 89 f7 e8 32 45 3f 00 48 63 53 08 48 89 c6 3b 53 04 7d 2d 48 8b 43 10 8d 4a 01 48 89 df 89 4b 08 <48> 89 2c d0 e8 b0 45 3f 00 48 8d 7b 30 5b 5d 31 c9 ba 01 00 00 00 RSP: 0018:ffff88910036bda8 EFLAGS: 00010093 RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000202 RDI: ffff8891037b65d8 RBP: ffff8891447ba240 R08: 0000000000012908 R09: 00000000003d0900 R10: 0000000000000000 R11: 0000000000173544 R12: ffff889101a14000 R13: ffff8891562ac300 R14: ffff889102b41440 R15: ffffe8ffffa00d05 FS: 0000000000000000(0000) GS:ffff88942fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000001102e99000 CR4: 00000000000006b0 Call Trace: <TASK> clone_endio+0xf4/0x1c0 [dm_mod] clone_endio+0xf4/0x1c0 [dm_mod] __submit_bio+0x76/0x120 submit_bio_noacct_nocheck+0xb6/0x2a0 flush_expired_bios+0x28/0x2f [dm_delay] process_one_work+0x1b4/0x300 worker_thread+0x45/0x3e0 ? rescuer_thread+0x380/0x380 kthread+0xc2/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: brd dm_delay dm_raid dm_mod af_packet uvesafb cfbfillrect cfbimgblt cn cfbcopyarea fb font fbdev tun autofs4 binfmt_misc configfs ipv6 virtio_rng virtio_balloon rng_core virtio_net pcspkr net_failover failover qemu_fw_cfg button mousedev raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t10_pi crc64_rocksoft crc64 virtio_scsi scsi_mod evdev psmouse bsg scsi_common [last unloaded: brd] CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- CVE-2022-50381 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50381.html CVE-2022-50381 https://bugzilla.suse.com/1250257 SUSE Bug 1250257 In the Linux kernel, the following vulnerability has been resolved: NFS: Fix an Oops in nfs_d_automount() When mounting from a NFSv4 referral, path->dentry can end up being a negative dentry, so derive the struct nfs_server from the dentry itself instead. CVE-2022-50385 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50385.html CVE-2022-50385 https://bugzilla.suse.com/1250131 SUSE Bug 1250131 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389 CVE-2022-50386 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50386.html CVE-2022-50386 https://bugzilla.suse.com/1250301 SUSE Bug 1250301 In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd] [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000 [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff [ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000 [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] <TASK> [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ? dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600] worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [ 72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] </TASK> [ 72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut here ]------------ CVE-2022-50401 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50401.html CVE-2022-50401 https://bugzilla.suse.com/1250140 SUSE Bug 1250140 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.tx_bytes += skb->len; [ 46.912801] ================================================================== [ 46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328 [ 46.935991] [ 46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G O 5.4.199-[REDACTED] #1 [ 46.947255] Hardware name: [REDACTED] [ 46.954568] Call trace: [ 46.957037] dump_backtrace+0x0/0x2b8 [ 46.960719] show_stack+0x24/0x30 [ 46.964052] dump_stack+0x128/0x194 [ 46.967557] print_address_description.isra.0+0x64/0x380 [ 46.972877] __kasan_report+0x1d4/0x240 [ 46.976723] kasan_report+0xc/0x18 [ 46.980138] __asan_report_load4_noabort+0x18/0x20 [ 46.985027] brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.990613] dev_hard_start_xmit+0x1bc/0xda0 [ 46.994894] sch_direct_xmit+0x198/0xd08 [ 46.998827] __qdisc_run+0x37c/0x1dc0 [ 47.002500] __dev_queue_xmit+0x1528/0x21f8 [ 47.006692] dev_queue_xmit+0x24/0x30 [ 47.010366] neigh_resolve_output+0x37c/0x678 [ 47.014734] ip_finish_output2+0x598/0x2458 [ 47.018927] __ip_finish_output+0x300/0x730 [ 47.023118] ip_output+0x2e0/0x430 [ 47.026530] ip_local_out+0x90/0x140 [ 47.030117] igmpv3_sendpack+0x14c/0x228 [ 47.034049] igmpv3_send_cr+0x384/0x6b8 [ 47.037895] igmp_ifc_timer_expire+0x4c/0x118 [ 47.042262] call_timer_fn+0x1cc/0xbe8 [ 47.046021] __run_timers+0x4d8/0xb28 [ 47.049693] run_timer_softirq+0x24/0x40 [ 47.053626] __do_softirq+0x2c0/0x117c [ 47.057387] irq_exit+0x2dc/0x388 [ 47.060715] __handle_domain_irq+0xb4/0x158 [ 47.064908] gic_handle_irq+0x58/0xb0 [ 47.068581] el0_irq_naked+0x50/0x5c [ 47.072162] [ 47.073665] Allocated by task 328: [ 47.077083] save_stack+0x24/0xb0 [ 47.080410] __kasan_kmalloc.isra.0+0xc0/0xe0 [ 47.084776] kasan_slab_alloc+0x14/0x20 [ 47.088622] kmem_cache_alloc+0x15c/0x468 [ 47.092643] __alloc_skb+0xa4/0x498 [ 47.096142] igmpv3_newpack+0x158/0xd78 [ 47.099987] add_grhead+0x210/0x288 [ 47.103485] add_grec+0x6b0/0xb70 [ 47.106811] igmpv3_send_cr+0x2e0/0x6b8 [ 47.110657] igmp_ifc_timer_expire+0x4c/0x118 [ 47.115027] call_timer_fn+0x1cc/0xbe8 [ 47.118785] __run_timers+0x4d8/0xb28 [ 47.122457] run_timer_softirq+0x24/0x40 [ 47.126389] __do_softirq+0x2c0/0x117c [ 47.130142] [ 47.131643] Freed by task 180: [ 47.134712] save_stack+0x24/0xb0 [ 47.138041] __kasan_slab_free+0x108/0x180 [ 47.142146] kasan_slab_free+0x10/0x18 [ 47.145904] slab_free_freelist_hook+0xa4/0x1b0 [ 47.150444] kmem_cache_free+0x8c/0x528 [ 47.154292] kfree_skbmem+0x94/0x108 [ 47.157880] consume_skb+0x10c/0x5a8 [ 47.161466] __dev_kfree_skb_any+0x88/0xa0 [ 47.165598] brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil] [ 47.171023] brcmf_txfinalize+0xec/0x190 [brcmfmac] [ 47.176016] brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac] [ 47.182056] brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac] [ 47.187568] brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac] [ 47.192529] brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac] [ 47.197859] process_one_work+0x7fc/0x1a80 [ 47.201965] worker_thread+0x31c/0xc40 [ 47.205726] kthread+0x2d8/0x370 [ 47.208967] ret_from_fork+0x10/0x18 [ 47.212546] [ 47.214051] The buggy address belongs to the object at ffffff803f588280 [ 47.214051] which belongs to the cache skbuff_head_cache of size 208 [ 47.227086] The buggy address is located 104 bytes inside of [ 47.227086] 208-byte region [ffffff803f588280, ffffff803f588350) [ 47.238814] The buggy address belongs to the page: [ 47.243618] page:ffffffff00dd6200 refcount:1 mapcou ---truncated--- CVE-2022-50408 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50408.html CVE-2022-50408 https://bugzilla.suse.com/1250391 SUSE Bug 1250391 In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] The test scenario has the following flow: thread1 thread2 ----------- --------------- tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk); __tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk); remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1. We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue. CVE-2022-50409 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50409.html CVE-2022-50409 https://bugzilla.suse.com/1250392 SUSE Bug 1250392 In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case. CVE-2022-50410 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50410.html CVE-2022-50410 https://bugzilla.suse.com/1250187 SUSE Bug 1250187 In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport), but when fcoe_if_init() fails, &fcoe_sw_transport is not detached and leaves freed &fcoe_sw_transport on fcoe_transports list. This causes panic when reinserting module. BUG: unable to handle page fault for address: fffffbfff82e2213 RIP: 0010:fcoe_transport_attach+0xe1/0x230 [libfcoe] Call Trace: <TASK> do_one_initcall+0xd0/0x4e0 load_module+0x5eee/0x7210 ... CVE-2022-50414 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50414.html CVE-2022-50414 https://bugzilla.suse.com/1250183 SUSE Bug 1250183 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_add shall not be called multiple times as stated in its documentation: 'Do not call this routine or device_register() more than once for any device structure' Syzkaller reports a bug as follows [1]: ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:33! invalid opcode: 0000 [#1] PREEMPT SMP KASAN [...] Call Trace: <TASK> __list_add include/linux/list.h:69 [inline] list_add_tail include/linux/list.h:102 [inline] kobj_kset_join lib/kobject.c:164 [inline] kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214 kobject_add_varg lib/kobject.c:358 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:410 device_add+0x368/0x1e90 drivers/base/core.c:3452 hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53 hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799 hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110 hci_event_func net/bluetooth/hci_event.c:7440 [inline] hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495 hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> CVE-2022-50419 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50419.html CVE-2022-50419 https://bugzilla.suse.com/1250394 SUSE Bug 1250394 In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete "slow_task->timer". However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below: (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the "task->slow_task" is deallocated. CVE-2022-50422 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50422.html CVE-2022-50422 https://bugzilla.suse.com/1250774 SUSE Bug 1250774 In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() If device_register() fails in snd_ac97_dev_register(), it should call put_device() to give up reference, or the name allocated in dev_set_name() is leaked. CVE-2022-50427 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50427.html CVE-2022-50427 https://bugzilla.suse.com/1250787 SUSE Bug 1250787 In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() dev_set_name() in soundbus_add_one() allocates memory for name, it need be freed when of_device_register() fails, call soundbus_dev_put() to give up the reference that hold in device_initialize(), so that it can be freed in kobject_cleanup() when the refcount hit to 0. And other resources are also freed in i2sbus_release_dev(), so it can return 0 directly. CVE-2022-50431 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50431.html CVE-2022-50431 https://bugzilla.suse.com/1250790 SUSE Bug 1250790 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid crash when inline data creation follows DIO write When inode is created and written to using direct IO, there is nothing to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when inode gets truncated later to say 1 byte and written using normal write, we will try to store the data as inline data. This confuses the code later because the inode now has both normal block and inline data allocated and the confusion manifests for example as: kernel BUG at fs/ext4/inode.c:2721! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 359 Comm: repro Not tainted 5.19.0-rc8-00001-g31ba1e3b8305-dirty #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 RIP: 0010:ext4_writepages+0x363d/0x3660 RSP: 0018:ffffc90000ccf260 EFLAGS: 00010293 RAX: ffffffff81e1abcd RBX: 0000008000000000 RCX: ffff88810842a180 RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 RBP: ffffc90000ccf650 R08: ffffffff81e17d58 R09: ffffed10222c680b R10: dfffe910222c680c R11: 1ffff110222c680a R12: ffff888111634128 R13: ffffc90000ccf880 R14: 0000008410000000 R15: 0000000000000001 FS: 00007f72635d2640(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565243379180 CR3: 000000010aa74000 CR4: 0000000000150eb0 Call Trace: <TASK> do_writepages+0x397/0x640 filemap_fdatawrite_wbc+0x151/0x1b0 file_write_and_wait_range+0x1c9/0x2b0 ext4_sync_file+0x19e/0xa00 vfs_fsync_range+0x17b/0x190 ext4_buffered_write_iter+0x488/0x530 ext4_file_write_iter+0x449/0x1b90 vfs_write+0xbcd/0xf40 ksys_write+0x198/0x2c0 __x64_sys_write+0x7b/0x90 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Fix the problem by clearing EXT4_STATE_MAY_INLINE_DATA when we are doing direct IO write to a file. CVE-2022-50435 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50435.html CVE-2022-50435 https://bugzilla.suse.com/1250799 SUSE Bug 1250799 In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork: https://patchwork.freedesktop.org/patch/502670/ CVE-2022-50437 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50437.html CVE-2022-50437 https://bugzilla.suse.com/1250797 SUSE Bug 1250797 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor. CVE-2022-50440 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50440.html CVE-2022-50440 https://bugzilla.suse.com/1250853 SUSE Bug 1250853 In the Linux kernel, the following vulnerability has been resolved: clk: tegra20: Fix refcount leak in tegra20_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. CVE-2022-50444 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50444.html CVE-2022-50444 https://bugzilla.suse.com/1250767 SUSE Bug 1250767 In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and free the memory.Thus, when nouveau_bo_init() returns an error, the gem object has already been released. Then the call to nouveau_bo_ref() will use the freed "nvbo->bo" and lead to a use-after-free bug. We should delete the call to nouveau_bo_ref() to avoid the use-after-free. CVE-2022-50454 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50454.html CVE-2022-50454 https://bugzilla.suse.com/1250890 SUSE Bug 1250890 In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra210_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. CVE-2022-50458 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50458.html CVE-2022-50458 https://bugzilla.suse.com/1250891 SUSE Bug 1250891 In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() Fix a NULL pointer crash that occurs when we are freeing the socket at the same time we access it via sysfs. The problem is that: 1. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() take the frwd_lock and do sock_hold() then drop the frwd_lock. sock_hold() does a get on the "struct sock". 2. iscsi_sw_tcp_release_conn() does sockfd_put() which does the last put on the "struct socket" and that does __sock_release() which sets the sock->ops to NULL. 3. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() then call kernel_getpeername() which accesses the NULL sock->ops. Above we do a get on the "struct sock", but we needed a get on the "struct socket". Originally, we just held the frwd_lock the entire time but in commit bcf3a2953d36 ("scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling getpeername()") we switched to refcount based because the network layer changed and started taking a mutex in that path, so we could no longer hold the frwd_lock. Instead of trying to maintain multiple refcounts, this just has us use a mutex for accessing the socket in the interface code paths. CVE-2022-50459 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50459.html CVE-2022-50459 https://bugzilla.suse.com/1250850 SUSE Bug 1250850 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID An error case exit from lpfc_cmpl_ct_cmd_gft_id() results in a call to lpfc_nlp_put() with a null pointer to a nodelist structure. Changed lpfc_cmpl_ct_cmd_gft_id() to initialize nodelist pointer upon entry. CVE-2022-50467 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2022-50467.html CVE-2022-50467 https://bugzilla.suse.com/1250847 SUSE Bug 1250847 A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. CVE-2023-1380 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-1380.html CVE-2023-1380 https://bugzilla.suse.com/1209287 SUSE Bug 1209287 A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. CVE-2023-28328 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-28328.html CVE-2023-28328 https://bugzilla.suse.com/1209291 SUSE Bug 1209291 https://bugzilla.suse.com/1222212 SUSE Bug 1222212 Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace CVE-2023-31248 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-31248.html CVE-2023-31248 https://bugzilla.suse.com/1213061 SUSE Bug 1213061 https://bugzilla.suse.com/1213064 SUSE Bug 1213064 A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. CVE-2023-3772 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-3772.html CVE-2023-3772 https://bugzilla.suse.com/1213666 SUSE Bug 1213666 An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. CVE-2023-39197 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-39197.html CVE-2023-39197 https://bugzilla.suse.com/1216976 SUSE Bug 1216976 https://bugzilla.suse.com/1220015 SUSE Bug 1220015 An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. CVE-2023-42753 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-42753.html CVE-2023-42753 https://bugzilla.suse.com/1215150 SUSE Bug 1215150 https://bugzilla.suse.com/1218613 SUSE Bug 1218613 In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrm_update_ae_params Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700 This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD. CVE-2023-53147 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53147.html CVE-2023-53147 https://bugzilla.suse.com/1249880 SUSE Bug 1249880 In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different page. The race unfolds like this: 1. a page with data A and swap offset X is stored in zswap 2. page A is removed off the LRU by zpool driver for writeback in zswap-shrink work, data for A is mapped by zpool driver 3. user space program faults and invalidates page entry A, offset X is considered free 4. kswapd stores page B at offset X in zswap (zswap could also be full, if so, page B would then be IOed to X, then skip step 5.) 5. entry A is replaced by B in tree->rbroot, this doesn't affect the local reference held by zswap-shrink work 6. zswap-shrink work writes back A at X, and frees zswap entry A 7. swapin of slot X brings A in memory instead of B The fix: Once the swap page cache has been allocated (case ZSWAP_SWAPCACHE_NEW), zswap-shrink work just checks that the local zswap_entry reference is still the same as the one in the tree. If it's not the same it means that it's either been invalidated or replaced, in both cases the writeback is aborted because the local entry contains stale data. Reproducer: I originally found this by running `stress` overnight to validate my work on the zswap writeback mechanism, it manifested after hours on my test machine. The key to make it happen is having zswap writebacks, so whatever setup pumps /sys/kernel/debug/zswap/written_back_pages should do the trick. In order to reproduce this faster on a vm, I setup a system with ~100M of available memory and a 500M swap file, then running `stress --vm 1 --vm-bytes 300000000 --vm-stride 4000` makes it happen in matter of tens of minutes. One can speed things up even more by swinging /sys/module/zswap/parameters/max_pool_percent up and down between, say, 20 and 1; this makes it reproduce in tens of seconds. It's crucial to set `--vm-stride` to something other than 4096 otherwise `stress` won't realize that memory has been corrupted because all pages would have the same data. CVE-2023-53178 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53178.html CVE-2023-53178 https://bugzilla.suse.com/1249827 SUSE Bug 1249827 In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to slab out-of-bound access. This patch adds back the IP_SET_HASH_WITH_NET0 macro to ip_set_hash_netportnet to address the issue. CVE-2023-53179 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53179.html CVE-2023-53179 https://bugzilla.suse.com/1249825 SUSE Bug 1249825 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info->req_len, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WL_EXTRA_BUF_MAX. Add the size check for req_len/resp_len of assoc_info. Found by a modified version of syzkaller. [ 46.592467][ T7] ================================================================== [ 46.594687][ T7] BUG: KASAN: slab-out-of-bounds in kmemdup+0x3e/0x50 [ 46.596572][ T7] Read of size 3014656 at addr ffff888019442000 by task kworker/0:1/7 [ 46.598575][ T7] [ 46.599157][ T7] CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #145 [ 46.601333][ T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 46.604360][ T7] Workqueue: events brcmf_fweh_event_worker [ 46.605943][ T7] Call Trace: [ 46.606584][ T7] dump_stack_lvl+0x8e/0xd1 [ 46.607446][ T7] print_address_description.constprop.0.cold+0x93/0x334 [ 46.608610][ T7] ? kmemdup+0x3e/0x50 [ 46.609341][ T7] kasan_report.cold+0x79/0xd5 [ 46.610151][ T7] ? kmemdup+0x3e/0x50 [ 46.610796][ T7] kasan_check_range+0x14e/0x1b0 [ 46.611691][ T7] memcpy+0x20/0x60 [ 46.612323][ T7] kmemdup+0x3e/0x50 [ 46.612987][ T7] brcmf_get_assoc_ies+0x967/0xf60 [ 46.613904][ T7] ? brcmf_notify_vif_event+0x3d0/0x3d0 [ 46.614831][ T7] ? lock_chain_count+0x20/0x20 [ 46.615683][ T7] ? mark_lock.part.0+0xfc/0x2770 [ 46.616552][ T7] ? lock_chain_count+0x20/0x20 [ 46.617409][ T7] ? mark_lock.part.0+0xfc/0x2770 [ 46.618244][ T7] ? lock_chain_count+0x20/0x20 [ 46.619024][ T7] brcmf_bss_connect_done.constprop.0+0x241/0x2e0 [ 46.620019][ T7] ? brcmf_parse_configure_security.isra.0+0x2a0/0x2a0 [ 46.620818][ T7] ? __lock_acquire+0x181f/0x5790 [ 46.621462][ T7] brcmf_notify_connect_status+0x448/0x1950 [ 46.622134][ T7] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 46.622736][ T7] ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0 [ 46.623390][ T7] ? find_held_lock+0x2d/0x110 [ 46.623962][ T7] ? brcmf_fweh_event_worker+0x19f/0xc60 [ 46.624603][ T7] ? mark_held_locks+0x9f/0xe0 [ 46.625145][ T7] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 46.625871][ T7] ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0 [ 46.626545][ T7] brcmf_fweh_call_event_handler.isra.0+0x90/0x100 [ 46.627338][ T7] brcmf_fweh_event_worker+0x557/0xc60 [ 46.627962][ T7] ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100 [ 46.628736][ T7] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 46.629396][ T7] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 46.629970][ T7] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 46.630649][ T7] process_one_work+0x92b/0x1460 [ 46.631205][ T7] ? pwq_dec_nr_in_flight+0x330/0x330 [ 46.631821][ T7] ? rwlock_bug.part.0+0x90/0x90 [ 46.632347][ T7] worker_thread+0x95/0xe00 [ 46.632832][ T7] ? __kthread_parkme+0x115/0x1e0 [ 46.633393][ T7] ? process_one_work+0x1460/0x1460 [ 46.633957][ T7] kthread+0x3a1/0x480 [ 46.634369][ T7] ? set_kthread_struct+0x120/0x120 [ 46.634933][ T7] ret_from_fork+0x1f/0x30 [ 46.635431][ T7] [ 46.635687][ T7] Allocated by task 7: [ 46.636151][ T7] kasan_save_stack+0x1b/0x40 [ 46.636628][ T7] __kasan_kmalloc+0x7c/0x90 [ 46.637108][ T7] kmem_cache_alloc_trace+0x19e/0x330 [ 46.637696][ T7] brcmf_cfg80211_attach+0x4a0/0x4040 [ 46.638275][ T7] brcmf_attach+0x389/0xd40 [ 46.638739][ T7] brcmf_usb_probe+0x12de/0x1690 [ 46.639279][ T7] usb_probe_interface+0x2aa/0x760 [ 46.639820][ T7] really_probe+0x205/0xb70 [ 46.640342][ T7] __driver_probe_device+0 ---truncated--- CVE-2023-53213 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53213.html CVE-2023-53213 https://bugzilla.suse.com/1249918 SUSE Bug 1249918 In the Linux kernel, the following vulnerability has been resolved: ubi: ensure that VID header offset + VID header size <= alloc, size Ensure that the VID header offset + VID header size does not exceed the allocated area to avoid slab OOB. BUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197 Read of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555 CPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G W 6.0.0-1868 #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x85/0xad lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433 kasan_report+0xa7/0x11b mm/kasan/report.c:495 crc32_body lib/crc32.c:111 [inline] crc32_le_generic lib/crc32.c:179 [inline] crc32_le_base+0x58c/0x626 lib/crc32.c:197 ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067 create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 RIP: 0033:0x7f96d5cf753d Code: RSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d RDX: 0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003 RBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0 R13: 00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 1555: kasan_save_stack+0x20/0x3d mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525 kasan_kmalloc include/linux/kasan.h:234 [inline] __kmalloc+0x138/0x257 mm/slub.c:4429 kmalloc include/linux/slab.h:605 [inline] ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline] create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 The buggy address belongs to the object at ffff88802bb36e00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff88802bb36e00, ffff88802bb36f00) The buggy address belongs to the physical page: page:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bb36 head:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40 raw: 0000000000000000 00000000001 ---truncated--- CVE-2023-53265 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53265.html CVE-2023-53265 https://bugzilla.suse.com/1249908 SUSE Bug 1249908 In the Linux kernel, the following vulnerability has been resolved: Drivers: vmbus: Check for channel allocation before looking up relids relid2channel() assumes vmbus channel array to be allocated when called. However, in cases such as kdump/kexec, not all relids will be reset by the host. When the second kernel boots and if the guest receives a vmbus interrupt during vmbus driver initialization before vmbus_connect() is called, before it finishes, or if it fails, the vmbus interrupt service routine is called which in turn calls relid2channel() and can cause a null pointer dereference. Print a warning and error out in relid2channel() for a channel id that's invalid in the second kernel. CVE-2023-53273 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53273.html CVE-2023-53273 https://bugzilla.suse.com/1249930 SUSE Bug 1249930 In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix overlap expiration walk The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any. Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0 in nftables.git and kmemleak enabled kernel. Second bug is the use of rbe_prev vs. prev pointer. If rbe_prev() returns NULL after at least one iteration, rbe_prev points to element that is not an end interval, hence it should not be removed. Lastly, check the genmask of the end interval if this is active in the current generation. CVE-2023-53304 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53304.html CVE-2023-53304 https://bugzilla.suse.com/1249923 SUSE Bug 1249923 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: drop short frames While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address header to avoid accessing invalid memory if shorter frames are passed in. CVE-2023-53321 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53321.html CVE-2023-53321 https://bugzilla.suse.com/1250313 SUSE Bug 1250313 https://bugzilla.suse.com/1250314 SUSE Bug 1250314 In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header. While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them. Compile tested only. v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric) Heads-up: I intend to remove dccp conntrack support later this year. CVE-2023-53333 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53333.html CVE-2023-53333 https://bugzilla.suse.com/1249949 SUSE Bug 1249949 In the Linux kernel, the following vulnerability has been resolved: x86/MCE: Always save CS register on AMD Zen IF Poison errors The Instruction Fetch (IF) units on current AMD Zen-based systems do not guarantee a synchronous #MC is delivered for poison consumption errors. Therefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the microarchitecture does guarantee that the exception is delivered within the same context. In other words, the exact rIP is not known, but the context is known to not have changed. There is no architecturally-defined method to determine this behavior. The Code Segment (CS) register is always valid on such IF unit poison errors regardless of the value of MCG_STATUS[EIPV|RIPV]. Add a quirk to save the CS register for poison consumption from the IF unit banks. This is needed to properly determine the context of the error. Otherwise, the severity grading function will assume the context is IN_KERNEL due to the m->cs value being 0 (the initialized value). This leads to unnecessary kernel panics on data poison errors due to the kernel believing the poison consumption occurred in kernel context. CVE-2023-53438 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53438.html CVE-2023-53438 https://bugzilla.suse.com/1250180 SUSE Bug 1250180 https://bugzilla.suse.com/1250708 SUSE Bug 1250708 In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() The validity of sock should be checked before assignment to avoid incorrect values. Commit 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()") introduced this change which may lead to inconsistent values of tcp_sw_conn->sendpage and conn->datadgst_en. Fix the issue by moving the position of the assignment. CVE-2023-53464 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53464.html CVE-2023-53464 https://bugzilla.suse.com/1250868 SUSE Bug 1250868 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not ignore genmask when looking up chain by id When adding a rule to a chain referring to its ID, if that chain had been deleted on the same batch, the rule might end up referring to a deleted chain. This will lead to a WARNING like following: [ 33.098431] ------------[ cut here ]------------ [ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260 [ 33.099217] Modules linked in: [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409 [ 33.099726] Workqueue: events nf_tables_trans_destroy_work [ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260 [ 33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 [ 33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS: 00010202 [ 33.101546] RAX: 0000000000000001 RBX: ffff888006fc0a28 RCX: 0000000000000000 [ 33.101920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.102649] RBP: ffffc900004ffc78 R08: 0000000000000000 R09: 0000000000000000 [ 33.103018] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880135ef500 [ 33.103385] R13: 0000000000000000 R14: dead000000000122 R15: ffff888006fc0a10 [ 33.103762] FS: 0000000000000000(0000) GS:ffff888024c80000(0000) knlGS:0000000000000000 [ 33.104184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.104493] CR2: 00007fe863b56a50 CR3: 00000000124b0001 CR4: 0000000000770ee0 [ 33.104872] PKRU: 55555554 [ 33.104999] Call Trace: [ 33.105113] <TASK> [ 33.105214] ? show_regs+0x72/0x90 [ 33.105371] ? __warn+0xa5/0x210 [ 33.105520] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.105732] ? report_bug+0x1f2/0x200 [ 33.105902] ? handle_bug+0x46/0x90 [ 33.106546] ? exc_invalid_op+0x19/0x50 [ 33.106762] ? asm_exc_invalid_op+0x1b/0x20 [ 33.106995] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.107249] ? nf_tables_chain_destroy+0x30/0x260 [ 33.107506] nf_tables_trans_destroy_work+0x669/0x680 [ 33.107782] ? mark_held_locks+0x28/0xa0 [ 33.107996] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [ 33.108294] ? _raw_spin_unlock_irq+0x28/0x70 [ 33.108538] process_one_work+0x68c/0xb70 [ 33.108755] ? lock_acquire+0x17f/0x420 [ 33.108977] ? __pfx_process_one_work+0x10/0x10 [ 33.109218] ? do_raw_spin_lock+0x128/0x1d0 [ 33.109435] ? _raw_spin_lock_irq+0x71/0x80 [ 33.109634] worker_thread+0x2bd/0x700 [ 33.109817] ? __pfx_worker_thread+0x10/0x10 [ 33.110254] kthread+0x18b/0x1d0 [ 33.110410] ? __pfx_kthread+0x10/0x10 [ 33.110581] ret_from_fork+0x29/0x50 [ 33.110757] </TASK> [ 33.110866] irq event stamp: 1651 [ 33.111017] hardirqs last enabled at (1659): [<ffffffffa206a209>] __up_console_sem+0x79/0xa0 [ 33.111379] hardirqs last disabled at (1666): [<ffffffffa206a1ee>] __up_console_sem+0x5e/0xa0 [ 33.111740] softirqs last enabled at (1616): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0 [ 33.112094] softirqs last disabled at (1367): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0 [ 33.112453] ---[ end trace 0000000000000000 ]--- This is due to the nft_chain_lookup_byid ignoring the genmask. After this change, adding the new rule will fail as it will not find the chain. CVE-2023-53492 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2023-53492.html CVE-2023-53492 https://bugzilla.suse.com/1250823 SUSE Bug 1250823 In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires. CVE-2024-26583 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2024-26583.html CVE-2024-26583 https://bugzilla.suse.com/1220185 SUSE Bug 1220185 In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRESS in valid situations. For example, when the cryptd queue for AESNI is full (easy to trigger with an artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued to the backlog but still processed. In that case, the async callback will also be called twice: first with err == -EINPROGRESS, which it seems we can just ignore, then with err == 0. Compared to Sabrina's original patch this version uses the new tls_*crypt_async_wait() helpers and converts the EBUSY to EINPROGRESS to avoid having to modify all the error handling paths. The handling is identical. CVE-2024-26584 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2024-26584.html CVE-2024-26584 https://bugzilla.suse.com/1220186 SUSE Bug 1220186 In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 ("tls: fix race between async notify and socket close") took care of it. This will make the next fix easier. CVE-2024-58240 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2024-58240.html CVE-2024-58240 https://bugzilla.suse.com/1248847 SUSE Bug 1248847 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd After the hci sync command releases l2cap_conn, the hci receive data work queue references the released l2cap_conn when sending to the upper layer. Add hci dev lock to the hci receive data work queue to synchronize the two. [1] BUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 Read of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837 CPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci1 hci_rx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline] l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954 l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline] l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline] l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817 hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline] hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 5837: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329 kmalloc_noprof include/linux/slab.h:901 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860 l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726 hci_event_func net/bluetooth/hci_event.c:7473 [inline] hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525 hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 54: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235 hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline] hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266 hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entr ---truncated--- CVE-2025-21969 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-21969.html CVE-2025-21969 https://bugzilla.suse.com/1240784 SUSE Bug 1240784 In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction steps: 1. create a tun interface 2. enable l2 bearer 3. TIPC_NL_UDP_GET_REMOTEIP with media name set to tun tipc: Started in network mode tipc: Node identity 8af312d38a21, cluster identity 4711 tipc: Enabled bearer <eth:syz_tun>, priority 1 Oops: general protection fault KASAN: null-ptr-deref in range CPU: 1 UID: 1000 PID: 559 Comm: poc Not tainted 6.16.0-rc1+ #117 PREEMPT Hardware name: QEMU Ubuntu 24.04 PC RIP: 0010:tipc_udp_nl_dump_remoteip+0x4a4/0x8f0 the ub was in fact a struct dev. when bid != 0 && skip_cnt != 0, bearer_list[bid] may be NULL or other media when other thread changes it. fix this by checking media_id. CVE-2025-38184 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-38184.html CVE-2025-38184 https://bugzilla.suse.com/1245956 SUSE Bug 1245956 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes: crypt_message() // Allocate the creq buffer containing the req creq = smb2_get_aead_req(..., &req); // Async encryption returns -EINPROGRESS immediately rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); // Free creq while async operation is still in progress kvfree_sensitive(creq, ...); Hardware crypto modules often implement async AEAD operations for performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the operation completes asynchronously. Without crypto_wait_req(), the function immediately frees the request buffer, leading to crashes when the driver later accesses the freed memory. This results in a use-after-free condition when the hardware crypto driver later accesses the freed request structure, leading to kernel crashes with NULL pointer dereferences. The issue occurs because crypto_alloc_aead() with mask=0 doesn't guarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in the mask, async implementations can be selected. Fix by restoring the async crypto handling: - DECLARE_CRYPTO_WAIT(wait) for completion tracking - aead_request_set_callback() for async completion notification - crypto_wait_req() to wait for operation completion This ensures the request buffer isn't freed until the crypto operation completes, whether synchronous or asynchronous, while preserving the CVE-2024-50047 fix. CVE-2025-38488 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-38488.html CVE-2025-38488 https://bugzilla.suse.com/1247239 SUSE Bug 1247239 https://bugzilla.suse.com/1247240 SUSE Bug 1247240 In the Linux kernel, the following vulnerability has been resolved: net/sched: Restrict conditions for adding duplicating netems to qdisc tree netem_enqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netem_dequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems. Previous approaches suggested in discussions in chronological order: 1) Track duplication status or ttl in the sk_buff struct. Considered too specific a use case to extend such a struct, though this would be a resilient fix and address other previous and potential future DOS bugs like the one described in loopy fun [2]. 2) Restrict netem_enqueue recursion depth like in act_mirred with a per cpu variable. However, netem_dequeue can call enqueue on its child, and the depth restriction could be bypassed if the child is a netem. 3) Use the same approach as in 2, but add metadata in netem_skb_cb to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, and Jamal notes that the skb cb can be overwritten to circumvent this safeguard. 4) Prevent the addition of a netem to a qdisc tree if its ancestral path contains a netem. However, filters and actions can cause a packet to change paths when re-enqueued to the root from netem duplication, leading us to the current solution: prevent a duplicating netem from inhabiting the same tree as other netems. [1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ [2] https://lwn.net/Articles/719297/ CVE-2025-38553 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-38553.html CVE-2025-38553 https://bugzilla.suse.com/1248255 SUSE Bug 1248255 In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 CVE-2025-38572 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-38572.html CVE-2025-38572 https://bugzilla.suse.com/1248399 SUSE Bug 1248399 https://bugzilla.suse.com/1248400 SUSE Bug 1248400 In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. CVE-2025-38664 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-38664.html CVE-2025-38664 https://bugzilla.suse.com/1248628 SUSE Bug 1248628 https://bugzilla.suse.com/1248631 SUSE Bug 1248631 In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs(). CVE-2025-38685 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-38685.html CVE-2025-38685 https://bugzilla.suse.com/1249220 SUSE Bug 1249220 https://bugzilla.suse.com/1249240 SUSE Bug 1249240 In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated--- CVE-2025-38713 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-38713.html CVE-2025-38713 https://bugzilla.suse.com/1249200 SUSE Bug 1249200 https://bugzilla.suse.com/1249738 SUSE Bug 1249738 This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2025-39751 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-39751.html CVE-2025-39751 https://bugzilla.suse.com/1249538 SUSE Bug 1249538 https://bugzilla.suse.com/1249539 SUSE Bug 1249539 In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels. CVE-2025-39823 SUSE Linux Enterprise Micro 5.1:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.1:kernel-source-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-rt-5.3.18-150300.223.1 SUSE Linux Enterprise Micro 5.2:kernel-source-rt-5.3.18-150300.223.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-202503613-1/ https://www.suse.com/security/cve/CVE-2025-39823.html CVE-2025-39823 https://bugzilla.suse.com/1250002 SUSE Bug 1250002