Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2025:3761-1 Final 1 1 2025-10-23T15:04:37Z current 2025-10-23T15:04:37Z 2025-10-23T15:04:37Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP5 RT kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2022-49138: Bluetooth: hci_event: Fix checking conn for le_conn_complete_evt (bsc#1238160). - CVE-2022-50233: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} (bsc#1246968). - CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249846). - CVE-2022-50409: net: If sock is dead do not access sock's sk_wq in sk_stream_wait_memory (bsc#1250392). - CVE-2023-53178: mm: fix zswap writeback race condition (bsc#1249827). - CVE-2023-53257: wifi: mac80211: check S1G action frame size (bsc#1249869). - CVE-2023-53321: wifi: mac80211_hwsim: drop short frames (bsc#1250313). - CVE-2023-53438: x86/MCE: Always save CS register on AMD Zen IF Poison errors (bsc#1250180). - CVE-2025-37738: ext4: ignore xattrs past end (bsc#1242846). - CVE-2025-37958: mm/huge_memory: fix dereferencing invalid pmd migration entry (bsc#1243539). - CVE-2025-38014: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper (bsc#1244732). - CVE-2025-38111: net/mdiobus: Fix potential out-of-bounds read/write access (bsc#1245666). - CVE-2025-38380: i2c/designware: Fix an initialization issue (bsc#1247028). - CVE-2025-38488: smb: client: fix use-after-free in crypt_message when using async crypto (bsc#1247239). - CVE-2025-38553: net/sched: Restrict conditions for adding duplicating netems to qdisc tree (bsc#1248255). - CVE-2025-38572: ipv6: reject malicious packets in ipv6_gso_segment() (bsc#1248399). - CVE-2025-38659: gfs2: No more self recovery (bsc#1248639). - CVE-2025-38664: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (bsc#1248628). - CVE-2025-38678: netfilter: nf_tables: reject duplicate device on updates (bsc#1249126). - CVE-2025-38685: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit (bsc#1249220). - CVE-2025-38706: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() (bsc#1249195). - CVE-2025-38713: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() (bsc#1249200). - CVE-2025-38734: net/smc: fix UAF on smcsk after smc_listen_out() (bsc#1249324). - CVE-2025-39691: fs/buffer: fix use-after-free when call bh_read() helper (bsc#1249374). - CVE-2025-39703: net, hsr: reject HSR frame if skb can't hold tag (bsc#1249315). - CVE-2025-39726: s390/ism: fix concurrency management in ism_cmd() (bsc#1249266). - CVE-2025-39746: wifi: ath10k: shutdown driver when hardware is unreliable (bsc#1249516). - CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (bsc#1249538). - CVE-2025-39790: bus: mhi: host: Detect events pointing to unexpected TREs (bsc#1249548). - CVE-2025-39823: KVM: x86: use array_index_nospec with indices that come from guest (bsc#1250002). - CVE-2025-39824: HID: asus: fix UAF via HID_CLAIMED_INPUT validation (bsc#1250007). - CVE-2025-39860: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() (bsc#1250247). - CVE-2025-39869: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map (bsc#1250406). The following non-security bugs were fixed: - Kconfig.suse: Add KABI checkiness macro (config) (bsc#1249186). - Limit patch filenames to 100 characters (bsc#1249604). - Move pesign-obs-integration requirement from kernel-syms to kernel devel subpackage (bsc#1248108). - Revert selinux patches that caused regressions (bsc#1249353). - btrfs: avoid NULL pointer dereference if no valid extent tree (bsc#1249158). - build_bug.h: Add KABI assert (bsc#1249186). - hv_netvsc: Fix panic during namespace deletion with VF (bsc#1248111). - kabi/severities: ignore kABI for atheros helper modules The symbols are used only internally by atheros drivers. - kernel-binary: Another installation ordering fix (bsc#1241353). - kernel-source: Do not list mkspec and its inputs as sources (bsc#1250522). - kernel-subpackage-build: Decompress ghost file when compressed version exists (bsc#1249346) - kernel-syms.spec: Drop old rpm release number hack (bsc#1247172). - net/sched: ets: use old 'nbands' while purging unused classes (git-fixes). - rpm/kernel-subpackage-spec: Skip brp-strip-debug to avoid file truncation (bsc#1246879). - rpm/mkspec: Fix missing kernel-syms-rt creation (bsc#1244337). - rpm: Configure KABI checkingness macro (bsc#1249186). - rpm: Drop support for kabi/arch/ignore-flavor (bsc#1249186). - rpm: Link arch-symbols script from scripts directory. - rpm: Link guards script from scripts directory. - supported.conf: mark hyperv_drm as external - use uniform permission checks for all mount propagation changes (git-fixes). - xfs: rework datasync tracking and execution (bsc#1237449). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle-micro/rt-5.5:latest-2025-3761,SUSE-2025-3761,SUSE-SLE-Micro-5.5-2025-3761 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ Link for SUSE-SU-2025:3761-1 https://lists.suse.com/pipermail/sle-updates/2025-October/042280.html E-Mail link for SUSE-SU-2025:3761-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1065729 SUSE Bug 1065729 https://bugzilla.suse.com/1164051 SUSE Bug 1164051 https://bugzilla.suse.com/1193629 SUSE Bug 1193629 https://bugzilla.suse.com/1194869 SUSE Bug 1194869 https://bugzilla.suse.com/1202700 SUSE Bug 1202700 https://bugzilla.suse.com/1203063 SUSE Bug 1203063 https://bugzilla.suse.com/1203332 SUSE Bug 1203332 https://bugzilla.suse.com/1204228 SUSE Bug 1204228 https://bugzilla.suse.com/1205128 SUSE Bug 1205128 https://bugzilla.suse.com/1205205 SUSE Bug 1205205 https://bugzilla.suse.com/1206451 SUSE Bug 1206451 https://bugzilla.suse.com/1206456 SUSE Bug 1206456 https://bugzilla.suse.com/1206468 SUSE Bug 1206468 https://bugzilla.suse.com/1206843 SUSE Bug 1206843 https://bugzilla.suse.com/1206883 SUSE Bug 1206883 https://bugzilla.suse.com/1206884 SUSE Bug 1206884 https://bugzilla.suse.com/1207158 SUSE Bug 1207158 https://bugzilla.suse.com/1207361 SUSE Bug 1207361 https://bugzilla.suse.com/1207621 SUSE Bug 1207621 https://bugzilla.suse.com/1207624 SUSE Bug 1207624 https://bugzilla.suse.com/1207625 SUSE Bug 1207625 https://bugzilla.suse.com/1207628 SUSE Bug 1207628 https://bugzilla.suse.com/1207629 SUSE Bug 1207629 https://bugzilla.suse.com/1207631 SUSE Bug 1207631 https://bugzilla.suse.com/1207645 SUSE Bug 1207645 https://bugzilla.suse.com/1207651 SUSE Bug 1207651 https://bugzilla.suse.com/1208607 SUSE Bug 1208607 https://bugzilla.suse.com/1209287 SUSE Bug 1209287 https://bugzilla.suse.com/1209291 SUSE Bug 1209291 https://bugzilla.suse.com/1209980 SUSE Bug 1209980 https://bugzilla.suse.com/1210584 SUSE Bug 1210584 https://bugzilla.suse.com/1211960 SUSE Bug 1211960 https://bugzilla.suse.com/1212603 SUSE Bug 1212603 https://bugzilla.suse.com/1213015 SUSE Bug 1213015 https://bugzilla.suse.com/1213016 SUSE Bug 1213016 https://bugzilla.suse.com/1213040 SUSE Bug 1213040 https://bugzilla.suse.com/1213041 SUSE Bug 1213041 https://bugzilla.suse.com/1213061 SUSE Bug 1213061 https://bugzilla.suse.com/1213099 SUSE Bug 1213099 https://bugzilla.suse.com/1213104 SUSE Bug 1213104 https://bugzilla.suse.com/1213533 SUSE Bug 1213533 https://bugzilla.suse.com/1213666 SUSE Bug 1213666 https://bugzilla.suse.com/1213747 SUSE Bug 1213747 https://bugzilla.suse.com/1214073 SUSE Bug 1214073 https://bugzilla.suse.com/1214953 SUSE Bug 1214953 https://bugzilla.suse.com/1214967 SUSE Bug 1214967 https://bugzilla.suse.com/1215150 SUSE Bug 1215150 https://bugzilla.suse.com/1215696 SUSE Bug 1215696 https://bugzilla.suse.com/1215911 SUSE Bug 1215911 https://bugzilla.suse.com/1216976 SUSE Bug 1216976 https://bugzilla.suse.com/1217790 SUSE Bug 1217790 https://bugzilla.suse.com/1220185 SUSE Bug 1220185 https://bugzilla.suse.com/1220186 SUSE Bug 1220186 https://bugzilla.suse.com/1223959 SUSE Bug 1223959 https://bugzilla.suse.com/1234639 SUSE Bug 1234639 https://bugzilla.suse.com/1236104 SUSE Bug 1236104 https://bugzilla.suse.com/1237449 SUSE Bug 1237449 https://bugzilla.suse.com/1238160 SUSE Bug 1238160 https://bugzilla.suse.com/1241353 SUSE Bug 1241353 https://bugzilla.suse.com/1242846 SUSE Bug 1242846 https://bugzilla.suse.com/1243539 SUSE Bug 1243539 https://bugzilla.suse.com/1244337 SUSE Bug 1244337 https://bugzilla.suse.com/1244732 SUSE Bug 1244732 https://bugzilla.suse.com/1245666 SUSE Bug 1245666 https://bugzilla.suse.com/1246879 SUSE Bug 1246879 https://bugzilla.suse.com/1246968 SUSE Bug 1246968 https://bugzilla.suse.com/1247028 SUSE Bug 1247028 https://bugzilla.suse.com/1247172 SUSE Bug 1247172 https://bugzilla.suse.com/1247239 SUSE Bug 1247239 https://bugzilla.suse.com/1248108 SUSE Bug 1248108 https://bugzilla.suse.com/1248111 SUSE Bug 1248111 https://bugzilla.suse.com/1248255 SUSE Bug 1248255 https://bugzilla.suse.com/1248399 SUSE Bug 1248399 https://bugzilla.suse.com/1248628 SUSE Bug 1248628 https://bugzilla.suse.com/1248639 SUSE Bug 1248639 https://bugzilla.suse.com/1248847 SUSE Bug 1248847 https://bugzilla.suse.com/1249126 SUSE Bug 1249126 https://bugzilla.suse.com/1249158 SUSE Bug 1249158 https://bugzilla.suse.com/1249159 SUSE Bug 1249159 https://bugzilla.suse.com/1249186 SUSE Bug 1249186 https://bugzilla.suse.com/1249195 SUSE Bug 1249195 https://bugzilla.suse.com/1249200 SUSE Bug 1249200 https://bugzilla.suse.com/1249220 SUSE Bug 1249220 https://bugzilla.suse.com/1249266 SUSE Bug 1249266 https://bugzilla.suse.com/1249315 SUSE Bug 1249315 https://bugzilla.suse.com/1249324 SUSE Bug 1249324 https://bugzilla.suse.com/1249346 SUSE Bug 1249346 https://bugzilla.suse.com/1249353 SUSE Bug 1249353 https://bugzilla.suse.com/1249374 SUSE Bug 1249374 https://bugzilla.suse.com/1249516 SUSE Bug 1249516 https://bugzilla.suse.com/1249538 SUSE Bug 1249538 https://bugzilla.suse.com/1249548 SUSE Bug 1249548 https://bugzilla.suse.com/1249604 SUSE Bug 1249604 https://bugzilla.suse.com/1249638 SUSE Bug 1249638 https://bugzilla.suse.com/1249639 SUSE Bug 1249639 https://bugzilla.suse.com/1249641 SUSE Bug 1249641 https://bugzilla.suse.com/1249642 SUSE Bug 1249642 https://bugzilla.suse.com/1249648 SUSE Bug 1249648 https://bugzilla.suse.com/1249650 SUSE Bug 1249650 https://bugzilla.suse.com/1249651 SUSE Bug 1249651 https://bugzilla.suse.com/1249658 SUSE Bug 1249658 https://bugzilla.suse.com/1249661 SUSE Bug 1249661 https://bugzilla.suse.com/1249664 SUSE Bug 1249664 https://bugzilla.suse.com/1249667 SUSE Bug 1249667 https://bugzilla.suse.com/1249669 SUSE Bug 1249669 https://bugzilla.suse.com/1249673 SUSE Bug 1249673 https://bugzilla.suse.com/1249677 SUSE Bug 1249677 https://bugzilla.suse.com/1249681 SUSE Bug 1249681 https://bugzilla.suse.com/1249683 SUSE Bug 1249683 https://bugzilla.suse.com/1249685 SUSE Bug 1249685 https://bugzilla.suse.com/1249687 SUSE Bug 1249687 https://bugzilla.suse.com/1249691 SUSE Bug 1249691 https://bugzilla.suse.com/1249695 SUSE Bug 1249695 https://bugzilla.suse.com/1249696 SUSE Bug 1249696 https://bugzilla.suse.com/1249699 SUSE Bug 1249699 https://bugzilla.suse.com/1249700 SUSE Bug 1249700 https://bugzilla.suse.com/1249701 SUSE Bug 1249701 https://bugzilla.suse.com/1249704 SUSE Bug 1249704 https://bugzilla.suse.com/1249705 SUSE Bug 1249705 https://bugzilla.suse.com/1249706 SUSE Bug 1249706 https://bugzilla.suse.com/1249707 SUSE Bug 1249707 https://bugzilla.suse.com/1249708 SUSE Bug 1249708 https://bugzilla.suse.com/1249709 SUSE Bug 1249709 https://bugzilla.suse.com/1249712 SUSE Bug 1249712 https://bugzilla.suse.com/1249713 SUSE Bug 1249713 https://bugzilla.suse.com/1249715 SUSE Bug 1249715 https://bugzilla.suse.com/1249716 SUSE Bug 1249716 https://bugzilla.suse.com/1249718 SUSE Bug 1249718 https://bugzilla.suse.com/1249722 SUSE Bug 1249722 https://bugzilla.suse.com/1249727 SUSE Bug 1249727 https://bugzilla.suse.com/1249730 SUSE Bug 1249730 https://bugzilla.suse.com/1249733 SUSE Bug 1249733 https://bugzilla.suse.com/1249734 SUSE Bug 1249734 https://bugzilla.suse.com/1249739 SUSE Bug 1249739 https://bugzilla.suse.com/1249740 SUSE Bug 1249740 https://bugzilla.suse.com/1249741 SUSE Bug 1249741 https://bugzilla.suse.com/1249742 SUSE Bug 1249742 https://bugzilla.suse.com/1249743 SUSE Bug 1249743 https://bugzilla.suse.com/1249745 SUSE Bug 1249745 https://bugzilla.suse.com/1249746 SUSE Bug 1249746 https://bugzilla.suse.com/1249747 SUSE Bug 1249747 https://bugzilla.suse.com/1249749 SUSE Bug 1249749 https://bugzilla.suse.com/1249750 SUSE Bug 1249750 https://bugzilla.suse.com/1249751 SUSE Bug 1249751 https://bugzilla.suse.com/1249753 SUSE Bug 1249753 https://bugzilla.suse.com/1249756 SUSE Bug 1249756 https://bugzilla.suse.com/1249757 SUSE Bug 1249757 https://bugzilla.suse.com/1249758 SUSE Bug 1249758 https://bugzilla.suse.com/1249762 SUSE Bug 1249762 https://bugzilla.suse.com/1249767 SUSE Bug 1249767 https://bugzilla.suse.com/1249777 SUSE Bug 1249777 https://bugzilla.suse.com/1249780 SUSE Bug 1249780 https://bugzilla.suse.com/1249781 SUSE Bug 1249781 https://bugzilla.suse.com/1249782 SUSE Bug 1249782 https://bugzilla.suse.com/1249784 SUSE Bug 1249784 https://bugzilla.suse.com/1249791 SUSE Bug 1249791 https://bugzilla.suse.com/1249799 SUSE Bug 1249799 https://bugzilla.suse.com/1249800 SUSE Bug 1249800 https://bugzilla.suse.com/1249802 SUSE Bug 1249802 https://bugzilla.suse.com/1249808 SUSE Bug 1249808 https://bugzilla.suse.com/1249810 SUSE Bug 1249810 https://bugzilla.suse.com/1249816 SUSE Bug 1249816 https://bugzilla.suse.com/1249820 SUSE Bug 1249820 https://bugzilla.suse.com/1249824 SUSE Bug 1249824 https://bugzilla.suse.com/1249825 SUSE Bug 1249825 https://bugzilla.suse.com/1249827 SUSE Bug 1249827 https://bugzilla.suse.com/1249836 SUSE Bug 1249836 https://bugzilla.suse.com/1249840 SUSE Bug 1249840 https://bugzilla.suse.com/1249844 SUSE Bug 1249844 https://bugzilla.suse.com/1249846 SUSE Bug 1249846 https://bugzilla.suse.com/1249853 SUSE Bug 1249853 https://bugzilla.suse.com/1249858 SUSE Bug 1249858 https://bugzilla.suse.com/1249860 SUSE Bug 1249860 https://bugzilla.suse.com/1249861 SUSE Bug 1249861 https://bugzilla.suse.com/1249864 SUSE Bug 1249864 https://bugzilla.suse.com/1249865 SUSE Bug 1249865 https://bugzilla.suse.com/1249866 SUSE Bug 1249866 https://bugzilla.suse.com/1249867 SUSE Bug 1249867 https://bugzilla.suse.com/1249868 SUSE Bug 1249868 https://bugzilla.suse.com/1249869 SUSE Bug 1249869 https://bugzilla.suse.com/1249872 SUSE Bug 1249872 https://bugzilla.suse.com/1249874 SUSE Bug 1249874 https://bugzilla.suse.com/1249877 SUSE Bug 1249877 https://bugzilla.suse.com/1249880 SUSE Bug 1249880 https://bugzilla.suse.com/1249882 SUSE Bug 1249882 https://bugzilla.suse.com/1249883 SUSE Bug 1249883 https://bugzilla.suse.com/1249884 SUSE Bug 1249884 https://bugzilla.suse.com/1249885 SUSE Bug 1249885 https://bugzilla.suse.com/1249890 SUSE Bug 1249890 https://bugzilla.suse.com/1249892 SUSE Bug 1249892 https://bugzilla.suse.com/1249894 SUSE Bug 1249894 https://bugzilla.suse.com/1249908 SUSE Bug 1249908 https://bugzilla.suse.com/1249910 SUSE Bug 1249910 https://bugzilla.suse.com/1249911 SUSE Bug 1249911 https://bugzilla.suse.com/1249913 SUSE Bug 1249913 https://bugzilla.suse.com/1249914 SUSE Bug 1249914 https://bugzilla.suse.com/1249917 SUSE Bug 1249917 https://bugzilla.suse.com/1249918 SUSE Bug 1249918 https://bugzilla.suse.com/1249920 SUSE Bug 1249920 https://bugzilla.suse.com/1249923 SUSE Bug 1249923 https://bugzilla.suse.com/1249924 SUSE Bug 1249924 https://bugzilla.suse.com/1249925 SUSE Bug 1249925 https://bugzilla.suse.com/1249927 SUSE Bug 1249927 https://bugzilla.suse.com/1249928 SUSE Bug 1249928 https://bugzilla.suse.com/1249930 SUSE Bug 1249930 https://bugzilla.suse.com/1249933 SUSE Bug 1249933 https://bugzilla.suse.com/1249934 SUSE Bug 1249934 https://bugzilla.suse.com/1249936 SUSE Bug 1249936 https://bugzilla.suse.com/1249938 SUSE Bug 1249938 https://bugzilla.suse.com/1249939 SUSE Bug 1249939 https://bugzilla.suse.com/1249940 SUSE Bug 1249940 https://bugzilla.suse.com/1249944 SUSE Bug 1249944 https://bugzilla.suse.com/1249947 SUSE Bug 1249947 https://bugzilla.suse.com/1249949 SUSE Bug 1249949 https://bugzilla.suse.com/1249950 SUSE Bug 1249950 https://bugzilla.suse.com/1249951 SUSE Bug 1249951 https://bugzilla.suse.com/1249954 SUSE Bug 1249954 https://bugzilla.suse.com/1249958 SUSE Bug 1249958 https://bugzilla.suse.com/1249979 SUSE Bug 1249979 https://bugzilla.suse.com/1249981 SUSE Bug 1249981 https://bugzilla.suse.com/1249991 SUSE Bug 1249991 https://bugzilla.suse.com/1249994 SUSE Bug 1249994 https://bugzilla.suse.com/1249997 SUSE Bug 1249997 https://bugzilla.suse.com/1250002 SUSE Bug 1250002 https://bugzilla.suse.com/1250006 SUSE Bug 1250006 https://bugzilla.suse.com/1250007 SUSE Bug 1250007 https://bugzilla.suse.com/1250009 SUSE Bug 1250009 https://bugzilla.suse.com/1250010 SUSE Bug 1250010 https://bugzilla.suse.com/1250011 SUSE Bug 1250011 https://bugzilla.suse.com/1250014 SUSE Bug 1250014 https://bugzilla.suse.com/1250015 SUSE Bug 1250015 https://bugzilla.suse.com/1250017 SUSE Bug 1250017 https://bugzilla.suse.com/1250023 SUSE Bug 1250023 https://bugzilla.suse.com/1250024 SUSE Bug 1250024 https://bugzilla.suse.com/1250026 SUSE Bug 1250026 https://bugzilla.suse.com/1250037 SUSE Bug 1250037 https://bugzilla.suse.com/1250039 SUSE Bug 1250039 https://bugzilla.suse.com/1250040 SUSE Bug 1250040 https://bugzilla.suse.com/1250041 SUSE Bug 1250041 https://bugzilla.suse.com/1250042 SUSE Bug 1250042 https://bugzilla.suse.com/1250044 SUSE Bug 1250044 https://bugzilla.suse.com/1250047 SUSE Bug 1250047 https://bugzilla.suse.com/1250049 SUSE Bug 1250049 https://bugzilla.suse.com/1250052 SUSE Bug 1250052 https://bugzilla.suse.com/1250055 SUSE Bug 1250055 https://bugzilla.suse.com/1250058 SUSE Bug 1250058 https://bugzilla.suse.com/1250060 SUSE Bug 1250060 https://bugzilla.suse.com/1250062 SUSE Bug 1250062 https://bugzilla.suse.com/1250065 SUSE Bug 1250065 https://bugzilla.suse.com/1250066 SUSE Bug 1250066 https://bugzilla.suse.com/1250068 SUSE Bug 1250068 https://bugzilla.suse.com/1250070 SUSE Bug 1250070 https://bugzilla.suse.com/1250071 SUSE Bug 1250071 https://bugzilla.suse.com/1250072 SUSE Bug 1250072 https://bugzilla.suse.com/1250075 SUSE Bug 1250075 https://bugzilla.suse.com/1250077 SUSE Bug 1250077 https://bugzilla.suse.com/1250080 SUSE Bug 1250080 https://bugzilla.suse.com/1250081 SUSE Bug 1250081 https://bugzilla.suse.com/1250083 SUSE Bug 1250083 https://bugzilla.suse.com/1250089 SUSE Bug 1250089 https://bugzilla.suse.com/1250103 SUSE Bug 1250103 https://bugzilla.suse.com/1250104 SUSE Bug 1250104 https://bugzilla.suse.com/1250105 SUSE Bug 1250105 https://bugzilla.suse.com/1250106 SUSE Bug 1250106 https://bugzilla.suse.com/1250107 SUSE Bug 1250107 https://bugzilla.suse.com/1250108 SUSE Bug 1250108 https://bugzilla.suse.com/1250112 SUSE Bug 1250112 https://bugzilla.suse.com/1250114 SUSE Bug 1250114 https://bugzilla.suse.com/1250117 SUSE Bug 1250117 https://bugzilla.suse.com/1250118 SUSE Bug 1250118 https://bugzilla.suse.com/1250121 SUSE Bug 1250121 https://bugzilla.suse.com/1250127 SUSE Bug 1250127 https://bugzilla.suse.com/1250128 SUSE Bug 1250128 https://bugzilla.suse.com/1250130 SUSE Bug 1250130 https://bugzilla.suse.com/1250131 SUSE Bug 1250131 https://bugzilla.suse.com/1250132 SUSE Bug 1250132 https://bugzilla.suse.com/1250134 SUSE Bug 1250134 https://bugzilla.suse.com/1250137 SUSE Bug 1250137 https://bugzilla.suse.com/1250138 SUSE Bug 1250138 https://bugzilla.suse.com/1250140 SUSE Bug 1250140 https://bugzilla.suse.com/1250144 SUSE Bug 1250144 https://bugzilla.suse.com/1250145 SUSE Bug 1250145 https://bugzilla.suse.com/1250151 SUSE Bug 1250151 https://bugzilla.suse.com/1250153 SUSE Bug 1250153 https://bugzilla.suse.com/1250156 SUSE Bug 1250156 https://bugzilla.suse.com/1250157 SUSE Bug 1250157 https://bugzilla.suse.com/1250159 SUSE Bug 1250159 https://bugzilla.suse.com/1250161 SUSE Bug 1250161 https://bugzilla.suse.com/1250165 SUSE Bug 1250165 https://bugzilla.suse.com/1250168 SUSE Bug 1250168 https://bugzilla.suse.com/1250178 SUSE Bug 1250178 https://bugzilla.suse.com/1250180 SUSE Bug 1250180 https://bugzilla.suse.com/1250181 SUSE Bug 1250181 https://bugzilla.suse.com/1250182 SUSE Bug 1250182 https://bugzilla.suse.com/1250183 SUSE Bug 1250183 https://bugzilla.suse.com/1250184 SUSE Bug 1250184 https://bugzilla.suse.com/1250187 SUSE Bug 1250187 https://bugzilla.suse.com/1250189 SUSE Bug 1250189 https://bugzilla.suse.com/1250191 SUSE Bug 1250191 https://bugzilla.suse.com/1250197 SUSE Bug 1250197 https://bugzilla.suse.com/1250198 SUSE Bug 1250198 https://bugzilla.suse.com/1250200 SUSE Bug 1250200 https://bugzilla.suse.com/1250201 SUSE Bug 1250201 https://bugzilla.suse.com/1250208 SUSE Bug 1250208 https://bugzilla.suse.com/1250209 SUSE Bug 1250209 https://bugzilla.suse.com/1250211 SUSE Bug 1250211 https://bugzilla.suse.com/1250215 SUSE Bug 1250215 https://bugzilla.suse.com/1250245 SUSE Bug 1250245 https://bugzilla.suse.com/1250247 SUSE Bug 1250247 https://bugzilla.suse.com/1250250 SUSE Bug 1250250 https://bugzilla.suse.com/1250257 SUSE Bug 1250257 https://bugzilla.suse.com/1250264 SUSE Bug 1250264 https://bugzilla.suse.com/1250269 SUSE Bug 1250269 https://bugzilla.suse.com/1250277 SUSE Bug 1250277 https://bugzilla.suse.com/1250278 SUSE Bug 1250278 https://bugzilla.suse.com/1250285 SUSE Bug 1250285 https://bugzilla.suse.com/1250287 SUSE Bug 1250287 https://bugzilla.suse.com/1250293 SUSE Bug 1250293 https://bugzilla.suse.com/1250301 SUSE Bug 1250301 https://bugzilla.suse.com/1250303 SUSE Bug 1250303 https://bugzilla.suse.com/1250306 SUSE Bug 1250306 https://bugzilla.suse.com/1250309 SUSE Bug 1250309 https://bugzilla.suse.com/1250311 SUSE Bug 1250311 https://bugzilla.suse.com/1250313 SUSE Bug 1250313 https://bugzilla.suse.com/1250315 SUSE Bug 1250315 https://bugzilla.suse.com/1250316 SUSE Bug 1250316 https://bugzilla.suse.com/1250322 SUSE Bug 1250322 https://bugzilla.suse.com/1250323 SUSE Bug 1250323 https://bugzilla.suse.com/1250324 SUSE Bug 1250324 https://bugzilla.suse.com/1250325 SUSE Bug 1250325 https://bugzilla.suse.com/1250327 SUSE Bug 1250327 https://bugzilla.suse.com/1250328 SUSE Bug 1250328 https://bugzilla.suse.com/1250331 SUSE Bug 1250331 https://bugzilla.suse.com/1250358 SUSE Bug 1250358 https://bugzilla.suse.com/1250362 SUSE Bug 1250362 https://bugzilla.suse.com/1250363 SUSE Bug 1250363 https://bugzilla.suse.com/1250370 SUSE Bug 1250370 https://bugzilla.suse.com/1250374 SUSE Bug 1250374 https://bugzilla.suse.com/1250391 SUSE Bug 1250391 https://bugzilla.suse.com/1250392 SUSE Bug 1250392 https://bugzilla.suse.com/1250393 SUSE Bug 1250393 https://bugzilla.suse.com/1250394 SUSE Bug 1250394 https://bugzilla.suse.com/1250395 SUSE Bug 1250395 https://bugzilla.suse.com/1250397 SUSE Bug 1250397 https://bugzilla.suse.com/1250406 SUSE Bug 1250406 https://bugzilla.suse.com/1250412 SUSE Bug 1250412 https://bugzilla.suse.com/1250418 SUSE Bug 1250418 https://bugzilla.suse.com/1250425 SUSE Bug 1250425 https://bugzilla.suse.com/1250428 SUSE Bug 1250428 https://bugzilla.suse.com/1250453 SUSE Bug 1250453 https://bugzilla.suse.com/1250454 SUSE Bug 1250454 https://bugzilla.suse.com/1250457 SUSE Bug 1250457 https://bugzilla.suse.com/1250459 SUSE Bug 1250459 https://bugzilla.suse.com/1250522 SUSE Bug 1250522 https://bugzilla.suse.com/1250759 SUSE Bug 1250759 https://bugzilla.suse.com/1250761 SUSE Bug 1250761 https://bugzilla.suse.com/1250762 SUSE Bug 1250762 https://bugzilla.suse.com/1250763 SUSE Bug 1250763 https://bugzilla.suse.com/1250765 SUSE Bug 1250765 https://bugzilla.suse.com/1250767 SUSE Bug 1250767 https://bugzilla.suse.com/1250768 SUSE Bug 1250768 https://bugzilla.suse.com/1250771 SUSE Bug 1250771 https://bugzilla.suse.com/1250774 SUSE Bug 1250774 https://bugzilla.suse.com/1250781 SUSE Bug 1250781 https://bugzilla.suse.com/1250784 SUSE Bug 1250784 https://bugzilla.suse.com/1250786 SUSE Bug 1250786 https://bugzilla.suse.com/1250787 SUSE Bug 1250787 https://bugzilla.suse.com/1250790 SUSE Bug 1250790 https://bugzilla.suse.com/1250791 SUSE Bug 1250791 https://bugzilla.suse.com/1250792 SUSE Bug 1250792 https://bugzilla.suse.com/1250793 SUSE Bug 1250793 https://bugzilla.suse.com/1250797 SUSE Bug 1250797 https://bugzilla.suse.com/1250799 SUSE Bug 1250799 https://bugzilla.suse.com/1250807 SUSE Bug 1250807 https://bugzilla.suse.com/1250810 SUSE Bug 1250810 https://bugzilla.suse.com/1250811 SUSE Bug 1250811 https://bugzilla.suse.com/1250814 SUSE Bug 1250814 https://bugzilla.suse.com/1250818 SUSE Bug 1250818 https://bugzilla.suse.com/1250819 SUSE Bug 1250819 https://bugzilla.suse.com/1250822 SUSE Bug 1250822 https://bugzilla.suse.com/1250823 SUSE Bug 1250823 https://bugzilla.suse.com/1250824 SUSE Bug 1250824 https://bugzilla.suse.com/1250825 SUSE Bug 1250825 https://bugzilla.suse.com/1250829 SUSE Bug 1250829 https://bugzilla.suse.com/1250830 SUSE Bug 1250830 https://bugzilla.suse.com/1250831 SUSE Bug 1250831 https://bugzilla.suse.com/1250832 SUSE Bug 1250832 https://bugzilla.suse.com/1250839 SUSE Bug 1250839 https://bugzilla.suse.com/1250841 SUSE Bug 1250841 https://bugzilla.suse.com/1250842 SUSE Bug 1250842 https://bugzilla.suse.com/1250843 SUSE Bug 1250843 https://bugzilla.suse.com/1250846 SUSE Bug 1250846 https://bugzilla.suse.com/1250847 SUSE Bug 1250847 https://bugzilla.suse.com/1250848 SUSE Bug 1250848 https://bugzilla.suse.com/1250849 SUSE Bug 1250849 https://bugzilla.suse.com/1250850 SUSE Bug 1250850 https://bugzilla.suse.com/1250851 SUSE Bug 1250851 https://bugzilla.suse.com/1250853 SUSE Bug 1250853 https://bugzilla.suse.com/1250856 SUSE Bug 1250856 https://bugzilla.suse.com/1250861 SUSE Bug 1250861 https://bugzilla.suse.com/1250862 SUSE Bug 1250862 https://bugzilla.suse.com/1250863 SUSE Bug 1250863 https://bugzilla.suse.com/1250864 SUSE Bug 1250864 https://bugzilla.suse.com/1250866 SUSE Bug 1250866 https://bugzilla.suse.com/1250867 SUSE Bug 1250867 https://bugzilla.suse.com/1250868 SUSE Bug 1250868 https://bugzilla.suse.com/1250872 SUSE Bug 1250872 https://bugzilla.suse.com/1250873 SUSE Bug 1250873 https://bugzilla.suse.com/1250874 SUSE Bug 1250874 https://bugzilla.suse.com/1250875 SUSE Bug 1250875 https://bugzilla.suse.com/1250877 SUSE Bug 1250877 https://bugzilla.suse.com/1250879 SUSE Bug 1250879 https://bugzilla.suse.com/1250881 SUSE Bug 1250881 https://bugzilla.suse.com/1250883 SUSE Bug 1250883 https://bugzilla.suse.com/1250887 SUSE Bug 1250887 https://bugzilla.suse.com/1250888 SUSE Bug 1250888 https://bugzilla.suse.com/1250889 SUSE Bug 1250889 https://bugzilla.suse.com/1250890 SUSE Bug 1250890 https://bugzilla.suse.com/1250891 SUSE Bug 1250891 https://bugzilla.suse.com/1250905 SUSE Bug 1250905 https://bugzilla.suse.com/1250913 SUSE Bug 1250913 https://bugzilla.suse.com/1250915 SUSE Bug 1250915 https://bugzilla.suse.com/1250917 SUSE Bug 1250917 https://bugzilla.suse.com/1250923 SUSE Bug 1250923 https://bugzilla.suse.com/1250927 SUSE Bug 1250927 https://bugzilla.suse.com/1250928 SUSE Bug 1250928 https://bugzilla.suse.com/1250931 SUSE Bug 1250931 https://bugzilla.suse.com/1250932 SUSE Bug 1250932 https://bugzilla.suse.com/1250948 SUSE Bug 1250948 https://bugzilla.suse.com/1250949 SUSE Bug 1250949 https://bugzilla.suse.com/1250953 SUSE Bug 1250953 https://bugzilla.suse.com/1250963 SUSE Bug 1250963 https://bugzilla.suse.com/1250964 SUSE Bug 1250964 https://bugzilla.suse.com/1250965 SUSE Bug 1250965 https://www.suse.com/security/cve/CVE-2022-2602/ SUSE CVE CVE-2022-2602 page https://www.suse.com/security/cve/CVE-2022-2978/ SUSE CVE CVE-2022-2978 page https://www.suse.com/security/cve/CVE-2022-36280/ SUSE CVE CVE-2022-36280 page https://www.suse.com/security/cve/CVE-2022-43945/ SUSE CVE CVE-2022-43945 page https://www.suse.com/security/cve/CVE-2022-49138/ SUSE CVE CVE-2022-49138 page https://www.suse.com/security/cve/CVE-2022-50233/ SUSE CVE CVE-2022-50233 page https://www.suse.com/security/cve/CVE-2022-50234/ SUSE CVE CVE-2022-50234 page https://www.suse.com/security/cve/CVE-2022-50235/ SUSE CVE CVE-2022-50235 page https://www.suse.com/security/cve/CVE-2022-50239/ SUSE CVE CVE-2022-50239 page https://www.suse.com/security/cve/CVE-2022-50241/ SUSE CVE CVE-2022-50241 page https://www.suse.com/security/cve/CVE-2022-50242/ SUSE CVE CVE-2022-50242 page https://www.suse.com/security/cve/CVE-2022-50246/ SUSE CVE CVE-2022-50246 page https://www.suse.com/security/cve/CVE-2022-50247/ SUSE CVE CVE-2022-50247 page https://www.suse.com/security/cve/CVE-2022-50248/ SUSE CVE CVE-2022-50248 page https://www.suse.com/security/cve/CVE-2022-50249/ SUSE CVE CVE-2022-50249 page https://www.suse.com/security/cve/CVE-2022-50250/ SUSE CVE CVE-2022-50250 page https://www.suse.com/security/cve/CVE-2022-50251/ SUSE CVE CVE-2022-50251 page https://www.suse.com/security/cve/CVE-2022-50252/ SUSE CVE CVE-2022-50252 page https://www.suse.com/security/cve/CVE-2022-50255/ SUSE CVE CVE-2022-50255 page https://www.suse.com/security/cve/CVE-2022-50257/ SUSE CVE CVE-2022-50257 page https://www.suse.com/security/cve/CVE-2022-50258/ SUSE CVE CVE-2022-50258 page https://www.suse.com/security/cve/CVE-2022-50260/ SUSE CVE CVE-2022-50260 page https://www.suse.com/security/cve/CVE-2022-50261/ SUSE CVE CVE-2022-50261 page https://www.suse.com/security/cve/CVE-2022-50264/ SUSE CVE CVE-2022-50264 page https://www.suse.com/security/cve/CVE-2022-50266/ SUSE CVE CVE-2022-50266 page https://www.suse.com/security/cve/CVE-2022-50267/ SUSE CVE CVE-2022-50267 page https://www.suse.com/security/cve/CVE-2022-50268/ SUSE CVE CVE-2022-50268 page https://www.suse.com/security/cve/CVE-2022-50269/ SUSE CVE CVE-2022-50269 page https://www.suse.com/security/cve/CVE-2022-50271/ SUSE CVE CVE-2022-50271 page https://www.suse.com/security/cve/CVE-2022-50272/ SUSE CVE CVE-2022-50272 page https://www.suse.com/security/cve/CVE-2022-50275/ SUSE CVE CVE-2022-50275 page https://www.suse.com/security/cve/CVE-2022-50276/ SUSE CVE CVE-2022-50276 page https://www.suse.com/security/cve/CVE-2022-50277/ SUSE CVE CVE-2022-50277 page https://www.suse.com/security/cve/CVE-2022-50278/ SUSE CVE CVE-2022-50278 page https://www.suse.com/security/cve/CVE-2022-50279/ SUSE CVE CVE-2022-50279 page https://www.suse.com/security/cve/CVE-2022-50282/ SUSE CVE CVE-2022-50282 page https://www.suse.com/security/cve/CVE-2022-50286/ SUSE CVE CVE-2022-50286 page https://www.suse.com/security/cve/CVE-2022-50287/ SUSE CVE CVE-2022-50287 page https://www.suse.com/security/cve/CVE-2022-50288/ SUSE CVE CVE-2022-50288 page https://www.suse.com/security/cve/CVE-2022-50289/ SUSE CVE CVE-2022-50289 page https://www.suse.com/security/cve/CVE-2022-50292/ SUSE CVE CVE-2022-50292 page https://www.suse.com/security/cve/CVE-2022-50294/ SUSE CVE CVE-2022-50294 page https://www.suse.com/security/cve/CVE-2022-50297/ SUSE CVE CVE-2022-50297 page https://www.suse.com/security/cve/CVE-2022-50298/ SUSE CVE CVE-2022-50298 page https://www.suse.com/security/cve/CVE-2022-50299/ SUSE CVE CVE-2022-50299 page https://www.suse.com/security/cve/CVE-2022-50301/ SUSE CVE CVE-2022-50301 page https://www.suse.com/security/cve/CVE-2022-50303/ SUSE CVE CVE-2022-50303 page https://www.suse.com/security/cve/CVE-2022-50308/ SUSE CVE CVE-2022-50308 page https://www.suse.com/security/cve/CVE-2022-50309/ SUSE CVE CVE-2022-50309 page https://www.suse.com/security/cve/CVE-2022-50312/ SUSE CVE CVE-2022-50312 page https://www.suse.com/security/cve/CVE-2022-50317/ SUSE CVE CVE-2022-50317 page https://www.suse.com/security/cve/CVE-2022-50318/ SUSE CVE CVE-2022-50318 page https://www.suse.com/security/cve/CVE-2022-50320/ SUSE CVE CVE-2022-50320 page https://www.suse.com/security/cve/CVE-2022-50321/ SUSE CVE CVE-2022-50321 page https://www.suse.com/security/cve/CVE-2022-50323/ SUSE CVE CVE-2022-50323 page https://www.suse.com/security/cve/CVE-2022-50324/ SUSE CVE CVE-2022-50324 page https://www.suse.com/security/cve/CVE-2022-50325/ SUSE CVE CVE-2022-50325 page https://www.suse.com/security/cve/CVE-2022-50328/ SUSE CVE CVE-2022-50328 page https://www.suse.com/security/cve/CVE-2022-50329/ SUSE CVE CVE-2022-50329 page https://www.suse.com/security/cve/CVE-2022-50330/ SUSE CVE CVE-2022-50330 page https://www.suse.com/security/cve/CVE-2022-50331/ SUSE CVE CVE-2022-50331 page https://www.suse.com/security/cve/CVE-2022-50333/ SUSE CVE CVE-2022-50333 page https://www.suse.com/security/cve/CVE-2022-50339/ SUSE CVE CVE-2022-50339 page https://www.suse.com/security/cve/CVE-2022-50340/ SUSE CVE CVE-2022-50340 page https://www.suse.com/security/cve/CVE-2022-50342/ SUSE CVE CVE-2022-50342 page https://www.suse.com/security/cve/CVE-2022-50344/ SUSE CVE CVE-2022-50344 page https://www.suse.com/security/cve/CVE-2022-50346/ SUSE CVE CVE-2022-50346 page https://www.suse.com/security/cve/CVE-2022-50347/ SUSE CVE CVE-2022-50347 page https://www.suse.com/security/cve/CVE-2022-50348/ SUSE CVE CVE-2022-50348 page https://www.suse.com/security/cve/CVE-2022-50349/ SUSE CVE CVE-2022-50349 page https://www.suse.com/security/cve/CVE-2022-50351/ SUSE CVE CVE-2022-50351 page https://www.suse.com/security/cve/CVE-2022-50353/ SUSE CVE CVE-2022-50353 page https://www.suse.com/security/cve/CVE-2022-50354/ SUSE CVE CVE-2022-50354 page https://www.suse.com/security/cve/CVE-2022-50355/ SUSE CVE CVE-2022-50355 page https://www.suse.com/security/cve/CVE-2022-50356/ SUSE CVE CVE-2022-50356 page https://www.suse.com/security/cve/CVE-2022-50357/ SUSE CVE CVE-2022-50357 page https://www.suse.com/security/cve/CVE-2022-50358/ SUSE CVE CVE-2022-50358 page https://www.suse.com/security/cve/CVE-2022-50359/ SUSE CVE CVE-2022-50359 page https://www.suse.com/security/cve/CVE-2022-50360/ SUSE CVE CVE-2022-50360 page https://www.suse.com/security/cve/CVE-2022-50362/ SUSE CVE CVE-2022-50362 page https://www.suse.com/security/cve/CVE-2022-50364/ SUSE CVE CVE-2022-50364 page https://www.suse.com/security/cve/CVE-2022-50367/ SUSE CVE CVE-2022-50367 page https://www.suse.com/security/cve/CVE-2022-50368/ SUSE CVE CVE-2022-50368 page https://www.suse.com/security/cve/CVE-2022-50369/ SUSE CVE CVE-2022-50369 page https://www.suse.com/security/cve/CVE-2022-50370/ SUSE CVE CVE-2022-50370 page https://www.suse.com/security/cve/CVE-2022-50372/ SUSE CVE CVE-2022-50372 page https://www.suse.com/security/cve/CVE-2022-50373/ SUSE CVE CVE-2022-50373 page https://www.suse.com/security/cve/CVE-2022-50374/ SUSE CVE CVE-2022-50374 page https://www.suse.com/security/cve/CVE-2022-50375/ SUSE CVE CVE-2022-50375 page https://www.suse.com/security/cve/CVE-2022-50376/ SUSE CVE CVE-2022-50376 page https://www.suse.com/security/cve/CVE-2022-50378/ SUSE CVE CVE-2022-50378 page https://www.suse.com/security/cve/CVE-2022-50379/ SUSE CVE CVE-2022-50379 page https://www.suse.com/security/cve/CVE-2022-50381/ SUSE CVE CVE-2022-50381 page https://www.suse.com/security/cve/CVE-2022-50385/ SUSE CVE CVE-2022-50385 page https://www.suse.com/security/cve/CVE-2022-50386/ SUSE CVE CVE-2022-50386 page https://www.suse.com/security/cve/CVE-2022-50388/ SUSE CVE CVE-2022-50388 page https://www.suse.com/security/cve/CVE-2022-50389/ SUSE CVE CVE-2022-50389 page https://www.suse.com/security/cve/CVE-2022-50390/ SUSE CVE CVE-2022-50390 page https://www.suse.com/security/cve/CVE-2022-50391/ SUSE CVE CVE-2022-50391 page https://www.suse.com/security/cve/CVE-2022-50392/ SUSE CVE CVE-2022-50392 page https://www.suse.com/security/cve/CVE-2022-50393/ SUSE CVE CVE-2022-50393 page https://www.suse.com/security/cve/CVE-2022-50394/ SUSE CVE CVE-2022-50394 page https://www.suse.com/security/cve/CVE-2022-50395/ SUSE CVE CVE-2022-50395 page https://www.suse.com/security/cve/CVE-2022-50396/ SUSE CVE CVE-2022-50396 page https://www.suse.com/security/cve/CVE-2022-50398/ SUSE CVE CVE-2022-50398 page https://www.suse.com/security/cve/CVE-2022-50399/ SUSE CVE CVE-2022-50399 page https://www.suse.com/security/cve/CVE-2022-50401/ SUSE CVE CVE-2022-50401 page https://www.suse.com/security/cve/CVE-2022-50402/ SUSE CVE CVE-2022-50402 page https://www.suse.com/security/cve/CVE-2022-50404/ SUSE CVE CVE-2022-50404 page https://www.suse.com/security/cve/CVE-2022-50406/ SUSE CVE CVE-2022-50406 page https://www.suse.com/security/cve/CVE-2022-50408/ SUSE CVE CVE-2022-50408 page https://www.suse.com/security/cve/CVE-2022-50409/ SUSE CVE CVE-2022-50409 page https://www.suse.com/security/cve/CVE-2022-50410/ SUSE CVE CVE-2022-50410 page https://www.suse.com/security/cve/CVE-2022-50411/ SUSE CVE CVE-2022-50411 page https://www.suse.com/security/cve/CVE-2022-50412/ SUSE CVE CVE-2022-50412 page https://www.suse.com/security/cve/CVE-2022-50414/ SUSE CVE CVE-2022-50414 page https://www.suse.com/security/cve/CVE-2022-50417/ SUSE CVE CVE-2022-50417 page https://www.suse.com/security/cve/CVE-2022-50418/ SUSE CVE CVE-2022-50418 page https://www.suse.com/security/cve/CVE-2022-50419/ SUSE CVE CVE-2022-50419 page https://www.suse.com/security/cve/CVE-2022-50422/ SUSE CVE CVE-2022-50422 page https://www.suse.com/security/cve/CVE-2022-50423/ SUSE CVE CVE-2022-50423 page https://www.suse.com/security/cve/CVE-2022-50425/ SUSE CVE CVE-2022-50425 page https://www.suse.com/security/cve/CVE-2022-50427/ SUSE CVE CVE-2022-50427 page https://www.suse.com/security/cve/CVE-2022-50428/ SUSE CVE CVE-2022-50428 page https://www.suse.com/security/cve/CVE-2022-50429/ SUSE CVE CVE-2022-50429 page https://www.suse.com/security/cve/CVE-2022-50430/ SUSE CVE CVE-2022-50430 page https://www.suse.com/security/cve/CVE-2022-50431/ SUSE CVE CVE-2022-50431 page https://www.suse.com/security/cve/CVE-2022-50432/ SUSE CVE CVE-2022-50432 page https://www.suse.com/security/cve/CVE-2022-50433/ SUSE CVE CVE-2022-50433 page https://www.suse.com/security/cve/CVE-2022-50434/ SUSE CVE CVE-2022-50434 page https://www.suse.com/security/cve/CVE-2022-50435/ SUSE CVE CVE-2022-50435 page https://www.suse.com/security/cve/CVE-2022-50436/ SUSE CVE CVE-2022-50436 page https://www.suse.com/security/cve/CVE-2022-50437/ SUSE CVE CVE-2022-50437 page https://www.suse.com/security/cve/CVE-2022-50439/ SUSE CVE CVE-2022-50439 page https://www.suse.com/security/cve/CVE-2022-50440/ SUSE CVE CVE-2022-50440 page https://www.suse.com/security/cve/CVE-2022-50441/ SUSE CVE CVE-2022-50441 page https://www.suse.com/security/cve/CVE-2022-50443/ SUSE CVE CVE-2022-50443 page https://www.suse.com/security/cve/CVE-2022-50444/ SUSE CVE CVE-2022-50444 page https://www.suse.com/security/cve/CVE-2022-50447/ SUSE CVE CVE-2022-50447 page https://www.suse.com/security/cve/CVE-2022-50449/ SUSE CVE CVE-2022-50449 page https://www.suse.com/security/cve/CVE-2022-50452/ SUSE CVE CVE-2022-50452 page https://www.suse.com/security/cve/CVE-2022-50453/ SUSE CVE CVE-2022-50453 page https://www.suse.com/security/cve/CVE-2022-50454/ SUSE CVE CVE-2022-50454 page https://www.suse.com/security/cve/CVE-2022-50456/ SUSE CVE CVE-2022-50456 page https://www.suse.com/security/cve/CVE-2022-50458/ SUSE CVE CVE-2022-50458 page https://www.suse.com/security/cve/CVE-2022-50459/ SUSE CVE CVE-2022-50459 page https://www.suse.com/security/cve/CVE-2022-50460/ SUSE CVE CVE-2022-50460 page https://www.suse.com/security/cve/CVE-2022-50464/ SUSE CVE CVE-2022-50464 page https://www.suse.com/security/cve/CVE-2022-50465/ SUSE CVE CVE-2022-50465 page https://www.suse.com/security/cve/CVE-2022-50466/ SUSE CVE CVE-2022-50466 page https://www.suse.com/security/cve/CVE-2022-50467/ SUSE CVE CVE-2022-50467 page https://www.suse.com/security/cve/CVE-2022-50468/ SUSE CVE CVE-2022-50468 page https://www.suse.com/security/cve/CVE-2022-50469/ SUSE CVE CVE-2022-50469 page https://www.suse.com/security/cve/CVE-2023-1380/ SUSE CVE CVE-2023-1380 page https://www.suse.com/security/cve/CVE-2023-28328/ SUSE CVE CVE-2023-28328 page https://www.suse.com/security/cve/CVE-2023-31248/ SUSE CVE CVE-2023-31248 page https://www.suse.com/security/cve/CVE-2023-3772/ SUSE CVE CVE-2023-3772 page https://www.suse.com/security/cve/CVE-2023-39197/ SUSE CVE CVE-2023-39197 page https://www.suse.com/security/cve/CVE-2023-42753/ SUSE CVE CVE-2023-42753 page https://www.suse.com/security/cve/CVE-2023-52923/ SUSE CVE CVE-2023-52923 page https://www.suse.com/security/cve/CVE-2023-53147/ SUSE CVE CVE-2023-53147 page https://www.suse.com/security/cve/CVE-2023-53149/ SUSE CVE CVE-2023-53149 page https://www.suse.com/security/cve/CVE-2023-53150/ SUSE CVE CVE-2023-53150 page https://www.suse.com/security/cve/CVE-2023-53151/ SUSE CVE CVE-2023-53151 page https://www.suse.com/security/cve/CVE-2023-53152/ SUSE CVE CVE-2023-53152 page https://www.suse.com/security/cve/CVE-2023-53153/ SUSE CVE CVE-2023-53153 page https://www.suse.com/security/cve/CVE-2023-53165/ SUSE CVE CVE-2023-53165 page https://www.suse.com/security/cve/CVE-2023-53167/ SUSE CVE CVE-2023-53167 page https://www.suse.com/security/cve/CVE-2023-53168/ SUSE CVE CVE-2023-53168 page https://www.suse.com/security/cve/CVE-2023-53171/ SUSE CVE CVE-2023-53171 page https://www.suse.com/security/cve/CVE-2023-53174/ SUSE CVE CVE-2023-53174 page https://www.suse.com/security/cve/CVE-2023-53176/ SUSE CVE CVE-2023-53176 page https://www.suse.com/security/cve/CVE-2023-53178/ SUSE CVE CVE-2023-53178 page https://www.suse.com/security/cve/CVE-2023-53179/ SUSE CVE CVE-2023-53179 page https://www.suse.com/security/cve/CVE-2023-53181/ SUSE CVE CVE-2023-53181 page https://www.suse.com/security/cve/CVE-2023-53182/ SUSE CVE CVE-2023-53182 page https://www.suse.com/security/cve/CVE-2023-53185/ SUSE CVE CVE-2023-53185 page https://www.suse.com/security/cve/CVE-2023-53189/ SUSE CVE CVE-2023-53189 page https://www.suse.com/security/cve/CVE-2023-53193/ SUSE CVE CVE-2023-53193 page https://www.suse.com/security/cve/CVE-2023-53196/ SUSE CVE CVE-2023-53196 page https://www.suse.com/security/cve/CVE-2023-53197/ SUSE CVE CVE-2023-53197 page https://www.suse.com/security/cve/CVE-2023-53199/ SUSE CVE CVE-2023-53199 page https://www.suse.com/security/cve/CVE-2023-53201/ SUSE CVE CVE-2023-53201 page https://www.suse.com/security/cve/CVE-2023-53205/ SUSE CVE CVE-2023-53205 page https://www.suse.com/security/cve/CVE-2023-53210/ SUSE CVE CVE-2023-53210 page https://www.suse.com/security/cve/CVE-2023-53213/ SUSE CVE CVE-2023-53213 page https://www.suse.com/security/cve/CVE-2023-53215/ SUSE CVE CVE-2023-53215 page https://www.suse.com/security/cve/CVE-2023-53216/ SUSE CVE CVE-2023-53216 page https://www.suse.com/security/cve/CVE-2023-53219/ SUSE CVE CVE-2023-53219 page https://www.suse.com/security/cve/CVE-2023-53222/ SUSE CVE CVE-2023-53222 page https://www.suse.com/security/cve/CVE-2023-53223/ SUSE CVE CVE-2023-53223 page https://www.suse.com/security/cve/CVE-2023-53226/ SUSE CVE CVE-2023-53226 page https://www.suse.com/security/cve/CVE-2023-53229/ SUSE CVE CVE-2023-53229 page https://www.suse.com/security/cve/CVE-2023-53230/ SUSE CVE CVE-2023-53230 page https://www.suse.com/security/cve/CVE-2023-53232/ SUSE CVE CVE-2023-53232 page https://www.suse.com/security/cve/CVE-2023-53234/ SUSE CVE CVE-2023-53234 page https://www.suse.com/security/cve/CVE-2023-53237/ SUSE CVE CVE-2023-53237 page https://www.suse.com/security/cve/CVE-2023-53238/ SUSE CVE CVE-2023-53238 page https://www.suse.com/security/cve/CVE-2023-53239/ SUSE CVE CVE-2023-53239 page https://www.suse.com/security/cve/CVE-2023-53241/ SUSE CVE CVE-2023-53241 page https://www.suse.com/security/cve/CVE-2023-53242/ SUSE CVE CVE-2023-53242 page https://www.suse.com/security/cve/CVE-2023-53244/ SUSE CVE CVE-2023-53244 page https://www.suse.com/security/cve/CVE-2023-53245/ SUSE CVE CVE-2023-53245 page https://www.suse.com/security/cve/CVE-2023-53246/ SUSE CVE CVE-2023-53246 page https://www.suse.com/security/cve/CVE-2023-53249/ SUSE CVE CVE-2023-53249 page https://www.suse.com/security/cve/CVE-2023-53250/ SUSE CVE CVE-2023-53250 page https://www.suse.com/security/cve/CVE-2023-53251/ SUSE CVE CVE-2023-53251 page https://www.suse.com/security/cve/CVE-2023-53252/ SUSE CVE CVE-2023-53252 page https://www.suse.com/security/cve/CVE-2023-53255/ SUSE CVE CVE-2023-53255 page https://www.suse.com/security/cve/CVE-2023-53257/ SUSE CVE CVE-2023-53257 page https://www.suse.com/security/cve/CVE-2023-53258/ SUSE CVE CVE-2023-53258 page https://www.suse.com/security/cve/CVE-2023-53259/ SUSE CVE CVE-2023-53259 page https://www.suse.com/security/cve/CVE-2023-53263/ SUSE CVE CVE-2023-53263 page https://www.suse.com/security/cve/CVE-2023-53265/ SUSE CVE CVE-2023-53265 page https://www.suse.com/security/cve/CVE-2023-53268/ SUSE CVE CVE-2023-53268 page https://www.suse.com/security/cve/CVE-2023-53270/ SUSE CVE CVE-2023-53270 page https://www.suse.com/security/cve/CVE-2023-53272/ SUSE CVE CVE-2023-53272 page https://www.suse.com/security/cve/CVE-2023-53273/ SUSE CVE CVE-2023-53273 page https://www.suse.com/security/cve/CVE-2023-53275/ SUSE CVE CVE-2023-53275 page https://www.suse.com/security/cve/CVE-2023-53276/ SUSE CVE CVE-2023-53276 page https://www.suse.com/security/cve/CVE-2023-53277/ SUSE CVE CVE-2023-53277 page https://www.suse.com/security/cve/CVE-2023-53280/ SUSE CVE CVE-2023-53280 page https://www.suse.com/security/cve/CVE-2023-53281/ SUSE CVE CVE-2023-53281 page https://www.suse.com/security/cve/CVE-2023-53282/ SUSE CVE CVE-2023-53282 page https://www.suse.com/security/cve/CVE-2023-53284/ SUSE CVE CVE-2023-53284 page https://www.suse.com/security/cve/CVE-2023-53286/ SUSE CVE CVE-2023-53286 page https://www.suse.com/security/cve/CVE-2023-53287/ SUSE CVE CVE-2023-53287 page https://www.suse.com/security/cve/CVE-2023-53288/ SUSE CVE CVE-2023-53288 page https://www.suse.com/security/cve/CVE-2023-53295/ SUSE CVE CVE-2023-53295 page https://www.suse.com/security/cve/CVE-2023-53297/ SUSE CVE CVE-2023-53297 page https://www.suse.com/security/cve/CVE-2023-53298/ SUSE CVE CVE-2023-53298 page https://www.suse.com/security/cve/CVE-2023-53299/ SUSE CVE CVE-2023-53299 page https://www.suse.com/security/cve/CVE-2023-53302/ SUSE CVE CVE-2023-53302 page https://www.suse.com/security/cve/CVE-2023-53304/ SUSE CVE CVE-2023-53304 page https://www.suse.com/security/cve/CVE-2023-53305/ SUSE CVE CVE-2023-53305 page https://www.suse.com/security/cve/CVE-2023-53309/ SUSE CVE CVE-2023-53309 page https://www.suse.com/security/cve/CVE-2023-53311/ SUSE CVE CVE-2023-53311 page https://www.suse.com/security/cve/CVE-2023-53313/ SUSE CVE CVE-2023-53313 page https://www.suse.com/security/cve/CVE-2023-53314/ SUSE CVE CVE-2023-53314 page https://www.suse.com/security/cve/CVE-2023-53315/ SUSE CVE CVE-2023-53315 page https://www.suse.com/security/cve/CVE-2023-53316/ SUSE CVE CVE-2023-53316 page https://www.suse.com/security/cve/CVE-2023-53317/ SUSE CVE CVE-2023-53317 page https://www.suse.com/security/cve/CVE-2023-53320/ SUSE CVE CVE-2023-53320 page https://www.suse.com/security/cve/CVE-2023-53321/ SUSE CVE CVE-2023-53321 page https://www.suse.com/security/cve/CVE-2023-53322/ SUSE CVE CVE-2023-53322 page https://www.suse.com/security/cve/CVE-2023-53324/ SUSE CVE CVE-2023-53324 page https://www.suse.com/security/cve/CVE-2023-53326/ SUSE CVE CVE-2023-53326 page https://www.suse.com/security/cve/CVE-2023-53330/ SUSE CVE CVE-2023-53330 page https://www.suse.com/security/cve/CVE-2023-53331/ SUSE CVE CVE-2023-53331 page https://www.suse.com/security/cve/CVE-2023-53332/ SUSE CVE CVE-2023-53332 page https://www.suse.com/security/cve/CVE-2023-53333/ SUSE CVE CVE-2023-53333 page https://www.suse.com/security/cve/CVE-2023-53334/ SUSE CVE CVE-2023-53334 page https://www.suse.com/security/cve/CVE-2023-53335/ SUSE CVE CVE-2023-53335 page https://www.suse.com/security/cve/CVE-2023-53337/ SUSE CVE CVE-2023-53337 page https://www.suse.com/security/cve/CVE-2023-53340/ SUSE CVE CVE-2023-53340 page https://www.suse.com/security/cve/CVE-2023-53344/ SUSE CVE CVE-2023-53344 page https://www.suse.com/security/cve/CVE-2023-53347/ SUSE CVE CVE-2023-53347 page https://www.suse.com/security/cve/CVE-2023-53349/ SUSE CVE CVE-2023-53349 page https://www.suse.com/security/cve/CVE-2023-53352/ SUSE CVE CVE-2023-53352 page https://www.suse.com/security/cve/CVE-2023-53356/ SUSE CVE CVE-2023-53356 page https://www.suse.com/security/cve/CVE-2023-53357/ SUSE CVE CVE-2023-53357 page https://www.suse.com/security/cve/CVE-2023-53359/ SUSE CVE CVE-2023-53359 page https://www.suse.com/security/cve/CVE-2023-53368/ SUSE CVE CVE-2023-53368 page https://www.suse.com/security/cve/CVE-2023-53370/ SUSE CVE CVE-2023-53370 page https://www.suse.com/security/cve/CVE-2023-53371/ SUSE CVE CVE-2023-53371 page https://www.suse.com/security/cve/CVE-2023-53373/ SUSE CVE CVE-2023-53373 page https://www.suse.com/security/cve/CVE-2023-53375/ SUSE CVE CVE-2023-53375 page https://www.suse.com/security/cve/CVE-2023-53377/ SUSE CVE CVE-2023-53377 page https://www.suse.com/security/cve/CVE-2023-53378/ SUSE CVE CVE-2023-53378 page https://www.suse.com/security/cve/CVE-2023-53379/ SUSE CVE CVE-2023-53379 page https://www.suse.com/security/cve/CVE-2023-53380/ SUSE CVE CVE-2023-53380 page https://www.suse.com/security/cve/CVE-2023-53381/ SUSE CVE CVE-2023-53381 page https://www.suse.com/security/cve/CVE-2023-53383/ SUSE CVE CVE-2023-53383 page https://www.suse.com/security/cve/CVE-2023-53384/ SUSE CVE CVE-2023-53384 page https://www.suse.com/security/cve/CVE-2023-53386/ SUSE CVE CVE-2023-53386 page https://www.suse.com/security/cve/CVE-2023-53388/ SUSE CVE CVE-2023-53388 page https://www.suse.com/security/cve/CVE-2023-53390/ SUSE CVE CVE-2023-53390 page https://www.suse.com/security/cve/CVE-2023-53391/ SUSE CVE CVE-2023-53391 page https://www.suse.com/security/cve/CVE-2023-53393/ SUSE CVE CVE-2023-53393 page https://www.suse.com/security/cve/CVE-2023-53395/ SUSE CVE CVE-2023-53395 page https://www.suse.com/security/cve/CVE-2023-53396/ SUSE CVE CVE-2023-53396 page https://www.suse.com/security/cve/CVE-2023-53398/ SUSE CVE CVE-2023-53398 page https://www.suse.com/security/cve/CVE-2023-53400/ SUSE CVE CVE-2023-53400 page https://www.suse.com/security/cve/CVE-2023-53404/ SUSE CVE CVE-2023-53404 page https://www.suse.com/security/cve/CVE-2023-53405/ SUSE CVE CVE-2023-53405 page https://www.suse.com/security/cve/CVE-2023-53406/ SUSE CVE CVE-2023-53406 page https://www.suse.com/security/cve/CVE-2023-53409/ SUSE CVE CVE-2023-53409 page https://www.suse.com/security/cve/CVE-2023-53413/ SUSE CVE CVE-2023-53413 page https://www.suse.com/security/cve/CVE-2023-53414/ SUSE CVE CVE-2023-53414 page https://www.suse.com/security/cve/CVE-2023-53415/ SUSE CVE CVE-2023-53415 page https://www.suse.com/security/cve/CVE-2023-53416/ SUSE CVE CVE-2023-53416 page https://www.suse.com/security/cve/CVE-2023-53422/ SUSE CVE CVE-2023-53422 page https://www.suse.com/security/cve/CVE-2023-53427/ SUSE CVE CVE-2023-53427 page https://www.suse.com/security/cve/CVE-2023-53431/ SUSE CVE CVE-2023-53431 page https://www.suse.com/security/cve/CVE-2023-53435/ SUSE CVE CVE-2023-53435 page https://www.suse.com/security/cve/CVE-2023-53436/ SUSE CVE CVE-2023-53436 page https://www.suse.com/security/cve/CVE-2023-53437/ SUSE CVE CVE-2023-53437 page https://www.suse.com/security/cve/CVE-2023-53438/ SUSE CVE CVE-2023-53438 page https://www.suse.com/security/cve/CVE-2023-53440/ SUSE CVE CVE-2023-53440 page https://www.suse.com/security/cve/CVE-2023-53442/ SUSE CVE CVE-2023-53442 page https://www.suse.com/security/cve/CVE-2023-53443/ SUSE CVE CVE-2023-53443 page https://www.suse.com/security/cve/CVE-2023-53444/ SUSE CVE CVE-2023-53444 page https://www.suse.com/security/cve/CVE-2023-53446/ SUSE CVE CVE-2023-53446 page https://www.suse.com/security/cve/CVE-2023-53448/ SUSE CVE CVE-2023-53448 page https://www.suse.com/security/cve/CVE-2023-53449/ SUSE CVE CVE-2023-53449 page https://www.suse.com/security/cve/CVE-2023-53451/ SUSE CVE CVE-2023-53451 page https://www.suse.com/security/cve/CVE-2023-53452/ SUSE CVE CVE-2023-53452 page https://www.suse.com/security/cve/CVE-2023-53453/ SUSE CVE CVE-2023-53453 page https://www.suse.com/security/cve/CVE-2023-53454/ SUSE CVE CVE-2023-53454 page https://www.suse.com/security/cve/CVE-2023-53456/ SUSE CVE CVE-2023-53456 page https://www.suse.com/security/cve/CVE-2023-53457/ SUSE CVE CVE-2023-53457 page https://www.suse.com/security/cve/CVE-2023-53458/ SUSE CVE CVE-2023-53458 page https://www.suse.com/security/cve/CVE-2023-53463/ SUSE CVE CVE-2023-53463 page https://www.suse.com/security/cve/CVE-2023-53464/ SUSE CVE CVE-2023-53464 page https://www.suse.com/security/cve/CVE-2023-53465/ SUSE CVE CVE-2023-53465 page https://www.suse.com/security/cve/CVE-2023-53466/ SUSE CVE CVE-2023-53466 page https://www.suse.com/security/cve/CVE-2023-53468/ SUSE CVE CVE-2023-53468 page https://www.suse.com/security/cve/CVE-2023-53471/ SUSE CVE CVE-2023-53471 page https://www.suse.com/security/cve/CVE-2023-53472/ SUSE CVE CVE-2023-53472 page https://www.suse.com/security/cve/CVE-2023-53473/ SUSE CVE CVE-2023-53473 page https://www.suse.com/security/cve/CVE-2023-53474/ SUSE CVE CVE-2023-53474 page https://www.suse.com/security/cve/CVE-2023-53475/ SUSE CVE CVE-2023-53475 page https://www.suse.com/security/cve/CVE-2023-53476/ SUSE CVE CVE-2023-53476 page https://www.suse.com/security/cve/CVE-2023-53480/ SUSE CVE CVE-2023-53480 page https://www.suse.com/security/cve/CVE-2023-53482/ SUSE CVE CVE-2023-53482 page https://www.suse.com/security/cve/CVE-2023-53485/ SUSE CVE CVE-2023-53485 page https://www.suse.com/security/cve/CVE-2023-53487/ SUSE CVE CVE-2023-53487 page https://www.suse.com/security/cve/CVE-2023-53488/ SUSE CVE CVE-2023-53488 page https://www.suse.com/security/cve/CVE-2023-53489/ SUSE CVE CVE-2023-53489 page https://www.suse.com/security/cve/CVE-2023-53492/ SUSE CVE CVE-2023-53492 page https://www.suse.com/security/cve/CVE-2023-53494/ SUSE CVE CVE-2023-53494 page https://www.suse.com/security/cve/CVE-2023-53496/ SUSE CVE CVE-2023-53496 page https://www.suse.com/security/cve/CVE-2023-53498/ SUSE CVE CVE-2023-53498 page https://www.suse.com/security/cve/CVE-2023-53499/ SUSE CVE CVE-2023-53499 page https://www.suse.com/security/cve/CVE-2023-53505/ SUSE CVE CVE-2023-53505 page https://www.suse.com/security/cve/CVE-2023-53506/ SUSE CVE CVE-2023-53506 page https://www.suse.com/security/cve/CVE-2023-53509/ SUSE CVE CVE-2023-53509 page https://www.suse.com/security/cve/CVE-2023-53511/ SUSE CVE CVE-2023-53511 page https://www.suse.com/security/cve/CVE-2023-53512/ SUSE CVE CVE-2023-53512 page https://www.suse.com/security/cve/CVE-2023-53515/ SUSE CVE CVE-2023-53515 page https://www.suse.com/security/cve/CVE-2023-53518/ SUSE CVE CVE-2023-53518 page https://www.suse.com/security/cve/CVE-2023-53519/ SUSE CVE CVE-2023-53519 page https://www.suse.com/security/cve/CVE-2023-53521/ SUSE CVE CVE-2023-53521 page https://www.suse.com/security/cve/CVE-2023-53524/ SUSE CVE CVE-2023-53524 page https://www.suse.com/security/cve/CVE-2023-53525/ SUSE CVE CVE-2023-53525 page https://www.suse.com/security/cve/CVE-2023-53526/ SUSE CVE CVE-2023-53526 page https://www.suse.com/security/cve/CVE-2023-53530/ SUSE CVE CVE-2023-53530 page https://www.suse.com/security/cve/CVE-2023-53531/ SUSE CVE CVE-2023-53531 page https://www.suse.com/security/cve/CVE-2023-53532/ SUSE CVE CVE-2023-53532 page https://www.suse.com/security/cve/CVE-2024-26583/ SUSE CVE CVE-2024-26583 page https://www.suse.com/security/cve/CVE-2024-26584/ SUSE CVE CVE-2024-26584 page https://www.suse.com/security/cve/CVE-2024-58240/ SUSE CVE CVE-2024-58240 page https://www.suse.com/security/cve/CVE-2025-37738/ SUSE CVE CVE-2025-37738 page https://www.suse.com/security/cve/CVE-2025-37958/ SUSE CVE CVE-2025-37958 page https://www.suse.com/security/cve/CVE-2025-38014/ SUSE CVE CVE-2025-38014 page https://www.suse.com/security/cve/CVE-2025-38111/ SUSE CVE CVE-2025-38111 page https://www.suse.com/security/cve/CVE-2025-38380/ SUSE CVE CVE-2025-38380 page https://www.suse.com/security/cve/CVE-2025-38488/ SUSE CVE CVE-2025-38488 page https://www.suse.com/security/cve/CVE-2025-38553/ SUSE CVE CVE-2025-38553 page https://www.suse.com/security/cve/CVE-2025-38572/ SUSE CVE CVE-2025-38572 page https://www.suse.com/security/cve/CVE-2025-38659/ SUSE CVE CVE-2025-38659 page https://www.suse.com/security/cve/CVE-2025-38664/ SUSE CVE CVE-2025-38664 page https://www.suse.com/security/cve/CVE-2025-38678/ SUSE CVE CVE-2025-38678 page https://www.suse.com/security/cve/CVE-2025-38683/ SUSE CVE CVE-2025-38683 page https://www.suse.com/security/cve/CVE-2025-38685/ SUSE CVE CVE-2025-38685 page https://www.suse.com/security/cve/CVE-2025-38706/ SUSE CVE CVE-2025-38706 page https://www.suse.com/security/cve/CVE-2025-38713/ SUSE CVE CVE-2025-38713 page https://www.suse.com/security/cve/CVE-2025-38734/ SUSE CVE CVE-2025-38734 page https://www.suse.com/security/cve/CVE-2025-39691/ SUSE CVE CVE-2025-39691 page https://www.suse.com/security/cve/CVE-2025-39703/ SUSE CVE CVE-2025-39703 page https://www.suse.com/security/cve/CVE-2025-39726/ SUSE CVE CVE-2025-39726 page https://www.suse.com/security/cve/CVE-2025-39746/ SUSE CVE CVE-2025-39746 page https://www.suse.com/security/cve/CVE-2025-39751/ SUSE CVE CVE-2025-39751 page https://www.suse.com/security/cve/CVE-2025-39790/ SUSE CVE CVE-2025-39790 page https://www.suse.com/security/cve/CVE-2025-39823/ SUSE CVE CVE-2025-39823 page https://www.suse.com/security/cve/CVE-2025-39824/ SUSE CVE CVE-2025-39824 page https://www.suse.com/security/cve/CVE-2025-39860/ SUSE CVE CVE-2025-39860 page https://www.suse.com/security/cve/CVE-2025-39869/ SUSE CVE CVE-2025-39869 page Container suse/sle-micro/rt-5.5:latest SUSE Linux Enterprise Micro 5.5 kernel-rt-5.14.21-150500.13.109.1 cluster-md-kmp-rt-5.14.21-150500.13.109.1 dlm-kmp-rt-5.14.21-150500.13.109.1 gfs2-kmp-rt-5.14.21-150500.13.109.1 kernel-devel-rt-5.14.21-150500.13.109.1 kernel-rt-devel-5.14.21-150500.13.109.1 kernel-rt-extra-5.14.21-150500.13.109.1 kernel-rt-livepatch-5.14.21-150500.13.109.1 kernel-rt-livepatch-devel-5.14.21-150500.13.109.1 kernel-rt-optional-5.14.21-150500.13.109.1 kernel-rt-vdso-5.14.21-150500.13.109.1 kernel-rt_debug-5.14.21-150500.13.109.1 kernel-rt_debug-devel-5.14.21-150500.13.109.1 kernel-rt_debug-vdso-5.14.21-150500.13.109.1 kernel-source-rt-5.14.21-150500.13.109.1 kernel-syms-rt-5.14.21-150500.13.109.1 kselftests-kmp-rt-5.14.21-150500.13.109.1 ocfs2-kmp-rt-5.14.21-150500.13.109.1 reiserfs-kmp-rt-5.14.21-150500.13.109.1 kernel-rt-5.14.21-150500.13.109.1 as a component of Container suse/sle-micro/rt-5.5:latest kernel-devel-rt-5.14.21-150500.13.109.1 as a component of SUSE Linux Enterprise Micro 5.5 kernel-rt-5.14.21-150500.13.109.1 as a component of SUSE Linux Enterprise Micro 5.5 kernel-source-rt-5.14.21-150500.13.109.1 as a component of SUSE Linux Enterprise Micro 5.5 io_uring UAF, Unix SCM garbage collection CVE-2022-2602 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-2602.html CVE-2022-2602 https://bugzilla.suse.com/1204228 SUSE Bug 1204228 https://bugzilla.suse.com/1205186 SUSE Bug 1205186 A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function nilfs_mdt_destroy. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. CVE-2022-2978 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-2978.html CVE-2022-2978 https://bugzilla.suse.com/1202700 SUSE Bug 1202700 https://bugzilla.suse.com/1204745 SUSE Bug 1204745 An out-of-bounds(OOB) memory access vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_kms.c in GPU component in the Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). CVE-2022-36280 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-36280.html CVE-2022-36280 https://bugzilla.suse.com/1203332 SUSE Bug 1203332 The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD thread by combining the receive and send buffers of a remote procedure call (RPC) into a single array of pages. A client can force the send buffer to shrink by sending an RPC message over TCP with garbage data added at the end of the message. The RPC message with garbage data is still correctly formed according to the specification and is passed forward to handlers. Vulnerable code in NFSD is not expecting the oversized request and writes beyond the allocated buffer space. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2022-43945 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-43945.html CVE-2022-43945 https://bugzilla.suse.com/1205128 SUSE Bug 1205128 https://bugzilla.suse.com/1205130 SUSE Bug 1205130 https://bugzilla.suse.com/1208030 SUSE Bug 1208030 https://bugzilla.suse.com/1208085 SUSE Bug 1208085 https://bugzilla.suse.com/1209225 SUSE Bug 1209225 https://bugzilla.suse.com/1210124 SUSE Bug 1210124 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Ignore multiple conn complete events When one of the three connection complete events is received multiple times for the same handle, the device is registered multiple times which leads to memory corruptions. Therefore, consequent events for a single connection are ignored. The conn->state can hold different values, therefore HCI_CONN_HANDLE_UNSET is introduced to identify new connections. To make sure the events do not contain this or another invalid handle HCI_CONN_HANDLE_MAX and checks are introduced. Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=215497 CVE-2022-49138 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-49138.html CVE-2022-49138 https://bugzilla.suse.com/1238160 SUSE Bug 1238160 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix using strlen with hdev->{dev_name,short_name} Both dev_name and short_name are not guaranteed to be NULL terminated so this instead use strnlen and then attempt to determine if the resulting string needs to be truncated or not. CVE-2022-50233 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50233.html CVE-2022-50233 https://bugzilla.suse.com/1246968 SUSE Bug 1246968 https://bugzilla.suse.com/1249242 SUSE Bug 1249242 In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: defer registered files gc to io_uring release Instead of putting io_uring's registered files in unix_gc() we want it to be done by io_uring itself. The trick here is to consider io_uring registered files for cycle detection but not actually putting them down. Because io_uring can't register other ring instances, this will remove all refs to the ring file triggering the ->release path and clean up with io_ring_ctx_free(). [axboe: add kerneldoc comment to skb, fold in skb leak fix] CVE-2022-50234 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50234.html CVE-2022-50234 https://bugzilla.suse.com/1249664 SUSE Bug 1249664 In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READDIR Restore the previous limit on the @count argument to prevent a buffer overflow attack. CVE-2022-50235 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50235.html CVE-2022-50235 https://bugzilla.suse.com/1249667 SUSE Bug 1249667 In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fix writes in read-only memory region This commit fixes a kernel oops because of a write in some read-only memory: [ 9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8 ..snip.. [ 9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP ..snip.. [ 9.269161] Call trace: [ 9.276271] __memcpy+0x5c/0x230 [ 9.278531] snprintf+0x58/0x80 [ 9.282002] qcom_cpufreq_msm8939_name_version+0xb4/0x190 [ 9.284869] qcom_cpufreq_probe+0xc8/0x39c ..snip.. The following line defines a pointer that point to a char buffer stored in read-only memory: char *pvs_name = "speedXX-pvsXX-vXX"; This pointer is meant to hold a template "speedXX-pvsXX-vXX" where the XX values get overridden by the qcom_cpufreq_krait_name_version function. Since the template is actually stored in read-only memory, when the function executes the following call we get an oops: snprintf(*pvs_name, sizeof("speedXX-pvsXX-vXX"), "speed%d-pvs%d-v%d", speed, pvs, pvs_ver); To fix this issue, we instead store the template name onto the stack by using the following syntax: char pvs_name_buffer[] = "speedXX-pvsXX-vXX"; Because the `pvs_name` needs to be able to be assigned to NULL, the template buffer is stored in the pvs_name_buffer and not under the pvs_name variable. CVE-2022-50239 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50239.html CVE-2022-50239 https://bugzilla.suse.com/1249836 SUSE Bug 1249836 In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on source server when doing inter-server copy Use-after-free occurred when the laundromat tried to free expired cpntf_state entry on the s2s_cp_stateids list after inter-server copy completed. The sc_cp_list that the expired copy state was inserted on was already freed. When COPY completes, the Linux client normally sends LOCKU(lock_state x), FREE_STATEID(lock_state x) and CLOSE(open_state y) to the source server. The nfs4_put_stid call from nfsd4_free_stateid cleans up the copy state from the s2s_cp_stateids list before freeing the lock state's stid. However, sometimes the CLOSE was sent before the FREE_STATEID request. When this happens, the nfsd4_close_open_stateid call from nfsd4_close frees all lock states on its st_locks list without cleaning up the copy state on the sc_cp_list list. When the time the FREE_STATEID arrives the server returns BAD_STATEID since the lock state was freed. This causes the use-after-free error to occur when the laundromat tries to free the expired cpntf_state. This patch adds a call to nfs4_free_cpntf_statelist in nfsd4_close_open_stateid to clean up the copy state before calling free_ol_stateid_reaplist to free the lock state's stid on the reaplist. CVE-2022-50241 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50241.html CVE-2022-50241 https://bugzilla.suse.com/1249691 SUSE Bug 1249691 In the Linux kernel, the following vulnerability has been resolved: drivers: net: qlcnic: Fix potential memory leak in qlcnic_sriov_init() If vp alloc failed in qlcnic_sriov_init(), all previously allocated vp needs to be freed. CVE-2022-50242 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50242.html CVE-2022-50242 https://bugzilla.suse.com/1249696 SUSE Bug 1249696 In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() I got the following report while doing device(mt6370-tcpc) load test with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enabled: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@34/tcpc/connector The 'fwnode' set in tcpci_parse_config() which is called in tcpci_register_port(), its node refcount is increased in device_get_named_child_node(). It needs be put while exiting, so call fwnode_handle_put() in the error path of tcpci_register_port() and in tcpci_unregister_port() to avoid leak. CVE-2022-50246 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50246.html CVE-2022-50246 https://bugzilla.suse.com/1249746 SUSE Bug 1249746 https://bugzilla.suse.com/1249759 SUSE Bug 1249759 In the Linux kernel, the following vulnerability has been resolved: usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq Can not set the @shared_hcd to NULL before decrease the usage count by usb_put_hcd(), this will cause the shared hcd not released. CVE-2022-50247 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50247.html CVE-2022-50247 https://bugzilla.suse.com/1249681 SUSE Bug 1249681 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double free on tx path. We see kernel crashes and lockups and KASAN errors related to ax210 firmware crashes. One of the KASAN dumps pointed at the tx path, and it appears there is indeed a way to double-free an skb. If iwl_mvm_tx_skb_sta returns non-zero, then the 'skb' sent into the method will be freed. But, in case where we build TSO skb buffer, the skb may also be freed in error case. So, return 0 in that particular error case and do cleanup manually. BUG: KASAN: use-after-free in __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000000 | tsf hi Read of size 8 at addr ffff88813cfa4ba0 by task btserver/9650 CPU: 4 PID: 9650 Comm: btserver Tainted: G W 5.19.8+ #5 iwlwifi 0000:06:00.0: 0x00000000 | time gp1 Hardware name: Default string Default string/SKYBAY, BIOS 5.12 02/19/2019 Call Trace: <TASK> dump_stack_lvl+0x55/0x6d print_report.cold.12+0xf2/0x684 iwlwifi 0000:06:00.0: 0x1D0915A8 | time gp2 ? __list_del_entry_valid+0x12/0x90 kasan_report+0x8b/0x180 iwlwifi 0000:06:00.0: 0x00000001 | uCode revision type ? __list_del_entry_valid+0x12/0x90 __list_del_entry_valid+0x12/0x90 iwlwifi 0000:06:00.0: 0x00000048 | uCode version major tcp_update_skb_after_send+0x5d/0x170 __tcp_transmit_skb+0xb61/0x15c0 iwlwifi 0000:06:00.0: 0xDAA05125 | uCode version minor ? __tcp_select_window+0x490/0x490 iwlwifi 0000:06:00.0: 0x00000420 | hw version ? trace_kmalloc_node+0x29/0xd0 ? __kmalloc_node_track_caller+0x12a/0x260 ? memset+0x1f/0x40 ? __build_skb_around+0x125/0x150 ? __alloc_skb+0x1d4/0x220 ? skb_zerocopy_clone+0x55/0x230 iwlwifi 0000:06:00.0: 0x00489002 | board version ? kmalloc_reserve+0x80/0x80 ? rcu_read_lock_bh_held+0x60/0xb0 tcp_write_xmit+0x3f1/0x24d0 iwlwifi 0000:06:00.0: 0x034E001C | hcmd ? __check_object_size+0x180/0x350 iwlwifi 0000:06:00.0: 0x24020000 | isr0 tcp_sendmsg_locked+0x8a9/0x1520 iwlwifi 0000:06:00.0: 0x01400000 | isr1 ? tcp_sendpage+0x50/0x50 iwlwifi 0000:06:00.0: 0x48F0000A | isr2 ? lock_release+0xb9/0x400 ? tcp_sendmsg+0x14/0x40 iwlwifi 0000:06:00.0: 0x00C3080C | isr3 ? lock_downgrade+0x390/0x390 ? do_raw_spin_lock+0x114/0x1d0 iwlwifi 0000:06:00.0: 0x00200000 | isr4 ? rwlock_bug.part.2+0x50/0x50 iwlwifi 0000:06:00.0: 0x034A001C | last cmd Id ? rwlock_bug.part.2+0x50/0x50 ? lockdep_hardirqs_on_prepare+0xe/0x200 iwlwifi 0000:06:00.0: 0x0000C2F0 | wait_event ? __local_bh_enable_ip+0x87/0xe0 ? inet_send_prepare+0x220/0x220 iwlwifi 0000:06:00.0: 0x000000C4 | l2p_control tcp_sendmsg+0x22/0x40 sock_sendmsg+0x5f/0x70 iwlwifi 0000:06:00.0: 0x00010034 | l2p_duration __sys_sendto+0x19d/0x250 iwlwifi 0000:06:00.0: 0x00000007 | l2p_mhvalid ? __ia32_sys_getpeername+0x40/0x40 iwlwifi 0000:06:00.0: 0x00000000 | l2p_addr_match ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_sched_held+0x5a/0xd0 ? lock_release+0xb9/0x400 ? lock_downgrade+0x390/0x390 ? ktime_get+0x64/0x130 ? ktime_get+0x8d/0x130 ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_held_common+0x12/0x50 ? rcu_read_lock_sched_held+0x5a/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? rcu_read_lock_bh_held+0xb0/0xb0 __x64_sys_sendto+0x6f/0x80 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f1d126e4531 Code: 00 00 00 00 0f 1f 44 00 00 f3 0f 1e fa 48 8d 05 35 80 0c 00 41 89 ca 8b 00 85 c0 75 1c 45 31 c9 45 31 c0 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 67 c3 66 0f 1f 44 00 00 55 48 83 ec 20 48 89 RSP: 002b:00007ffe21a679d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000000000000ffdc RCX: 00007f1d126e4531 RDX: 0000000000010000 RSI: 000000000374acf0 RDI: 0000000000000014 RBP: 00007ffe21a67ac0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R ---truncated--- CVE-2022-50248 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50248.html CVE-2022-50248 https://bugzilla.suse.com/1249840 SUSE Bug 1249840 In the Linux kernel, the following vulnerability has been resolved: memory: of: Fix refcount leak bug in of_get_ddr_timings() We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refcount. CVE-2022-50249 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50249.html CVE-2022-50249 https://bugzilla.suse.com/1249747 SUSE Bug 1249747 In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix use_count leakage when handling boot-on I found a use_count leakage towards supply regulator of rdev with boot-on option. ───────────────────┐ ───────────────────┐ | regulator_dev A | | regulator_dev B | | (boot-on) | | (boot-on) | | use_count=0 |◀──supply──| use_count=1 | | | | | ───────────────────┘ ───────────────────┘ In case of rdev(A) configured with `regulator-boot-on', the use_count of supplying regulator(B) will increment inside regulator_enable(rdev->supply). Thus, B will acts like always-on, and further balanced regulator_enable/disable cannot actually disable it anymore. However, B was also configured with `regulator-boot-on', we wish it could be disabled afterwards. CVE-2022-50250 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50250.html CVE-2022-50250 https://bugzilla.suse.com/1249844 SUSE Bug 1249844 In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, the timer added before mmc_add_host() needs be del. And this patch fixes another missing call mmc_free_host() if usb_control_msg() fails. CVE-2022-50251 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50251.html CVE-2022-50251 https://bugzilla.suse.com/1249745 SUSE Bug 1249745 In the Linux kernel, the following vulnerability has been resolved: igb: Do not free q_vector unless new one was allocated Avoid potential use-after-free condition under memory pressure. If the kzalloc() fails, q_vector will be freed but left in the original adapter->q_vector[v_idx] array position. CVE-2022-50252 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50252.html CVE-2022-50252 https://bugzilla.suse.com/1249846 SUSE Bug 1249846 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix reading strings from synthetic events The follow commands caused a crash: # cd /sys/kernel/tracing # echo 's:open char file[]' > dynamic_events # echo 'hist:keys=common_pid:file=filename:onchange($file).trace(open,$file)' > events/syscalls/sys_enter_openat/trigger' # echo 1 > events/synthetic/open/enable BOOM! The problem is that the synthetic event field "char file[]" will read the value given to it as a string without any memory checks to make sure the address is valid. The above example will pass in the user space address and the sythetic event code will happily call strlen() on it and then strscpy() where either one will cause an oops when accessing user space addresses. Use the helper functions from trace_kprobe and trace_eprobe that can read strings safely (and actually succeed when the address is from user space and the memory is mapped in). Now the above can show: packagekitd-1721 [000] ...2. 104.597170: open: file=/usr/lib/rpm/fileattrs/cmake.attr in:imjournal-978 [006] ...2. 104.599642: open: file=/var/lib/rsyslog/imjournal.state.tmp packagekitd-1721 [000] ...2. 104.626308: open: file=/usr/lib/rpm/fileattrs/debuginfo.attr CVE-2022-50255 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50255.html CVE-2022-50255 https://bugzilla.suse.com/1249910 SUSE Bug 1249910 In the Linux kernel, the following vulnerability has been resolved: xen/gntdev: Prevent leaking grants Prior to this commit, if a grant mapping operation failed partially, some of the entries in the map_ops array would be invalid, whereas all of the entries in the kmap_ops array would be valid. This in turn would cause the following logic in gntdev_map_grant_pages to become invalid: for (i = 0; i < map->count; i++) { if (map->map_ops[i].status == GNTST_okay) { map->unmap_ops[i].handle = map->map_ops[i].handle; if (!use_ptemod) alloced++; } if (use_ptemod) { if (map->kmap_ops[i].status == GNTST_okay) { if (map->map_ops[i].status == GNTST_okay) alloced++; map->kunmap_ops[i].handle = map->kmap_ops[i].handle; } } } ... atomic_add(alloced, &map->live_grants); Assume that use_ptemod is true (i.e., the domain mapping the granted pages is a paravirtualized domain). In the code excerpt above, note that the "alloced" variable is only incremented when both kmap_ops[i].status and map_ops[i].status are set to GNTST_okay (i.e., both mapping operations are successful). However, as also noted above, there are cases where a grant mapping operation fails partially, breaking the assumption of the code excerpt above. The aforementioned causes map->live_grants to be incorrectly set. In some cases, all of the map_ops mappings fail, but all of the kmap_ops mappings succeed, meaning that live_grants may remain zero. This in turn makes it impossible to unmap the successfully grant-mapped pages pointed to by kmap_ops, because unmap_grant_pages has the following snippet of code at its beginning: if (atomic_read(&map->live_grants) == 0) return; /* Nothing to do */ In other cases where only some of the map_ops mappings fail but all kmap_ops mappings succeed, live_grants is made positive, but when the user requests unmapping the grant-mapped pages, __unmap_grant_pages_done will then make map->live_grants negative, because the latter function does not check if all of the pages that were requested to be unmapped were actually unmapped, and the same function unconditionally subtracts "data->count" (i.e., a value that can be greater than map->live_grants) from map->live_grants. The side effects of a negative live_grants value have not been studied. The net effect of all of this is that grant references are leaked in one of the above conditions. In Qubes OS v4.1 (which uses Xen's grant mechanism extensively for X11 GUI isolation), this issue manifests itself with warning messages like the following to be printed out by the Linux kernel in the VM that had granted pages (that contain X11 GUI window data) to dom0: "g.e. 0x1234 still pending", especially after the user rapidly resizes GUI VM windows (causing some grant-mapping operations to partially or completely fail, due to the fact that the VM unshares some of the pages as part of the window resizing, making the pages impossible to grant-map from dom0). The fix for this issue involves counting all successful map_ops and kmap_ops mappings separately, and then adding the sum to live_grants. During unmapping, only the number of successfully unmapped grants is subtracted from live_grants. The code is also modified to check for negative live_grants values after the subtraction and warn the user. CVE-2022-50257 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50257.html CVE-2022-50257 https://bugzilla.suse.com/1249743 SUSE Bug 1249743 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as an argument of strsep() in brcmf_c_preinit_dcmds(). This buffer is filled with a firmware version string by memcpy() in brcmf_fil_iovar_data_get(). The patch ensures buf is null-terminated. Found by a modified version of syzkaller. [ 47.569679][ T1897] brcmfmac: brcmf_fw_alloc_request: using brcm/brcmfmac43236b for chip BCM43236/3 [ 47.582839][ T1897] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available [ 47.601565][ T1897] ================================================================== [ 47.602574][ T1897] BUG: KASAN: stack-out-of-bounds in strsep+0x1b2/0x1f0 [ 47.603447][ T1897] Read of size 1 at addr ffffc90001f6f000 by task kworker/0:2/1897 [ 47.604336][ T1897] [ 47.604621][ T1897] CPU: 0 PID: 1897 Comm: kworker/0:2 Tainted: G O 5.14.0+ #131 [ 47.605617][ T1897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 47.606907][ T1897] Workqueue: usb_hub_wq hub_event [ 47.607453][ T1897] Call Trace: [ 47.607801][ T1897] dump_stack_lvl+0x8e/0xd1 [ 47.608295][ T1897] print_address_description.constprop.0.cold+0xf/0x334 [ 47.609009][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609434][ T1897] ? strsep+0x1b2/0x1f0 [ 47.609863][ T1897] kasan_report.cold+0x83/0xdf [ 47.610366][ T1897] ? strsep+0x1b2/0x1f0 [ 47.610882][ T1897] strsep+0x1b2/0x1f0 [ 47.611300][ T1897] ? brcmf_fil_iovar_data_get+0x3a/0xf0 [ 47.611883][ T1897] brcmf_c_preinit_dcmds+0x995/0xc40 [ 47.612434][ T1897] ? brcmf_c_set_joinpref_default+0x100/0x100 [ 47.613078][ T1897] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 47.613662][ T1897] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 47.614208][ T1897] ? lock_acquire+0x19d/0x4e0 [ 47.614704][ T1897] ? find_held_lock+0x2d/0x110 [ 47.615236][ T1897] ? brcmf_usb_deq+0x1a7/0x260 [ 47.615741][ T1897] ? brcmf_usb_rx_fill_all+0x5a/0xf0 [ 47.616288][ T1897] brcmf_attach+0x246/0xd40 [ 47.616758][ T1897] ? wiphy_new_nm+0x1703/0x1dd0 [ 47.617280][ T1897] ? kmemdup+0x43/0x50 [ 47.617720][ T1897] brcmf_usb_probe+0x12de/0x1690 [ 47.618244][ T1897] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470 [ 47.618901][ T1897] usb_probe_interface+0x2aa/0x760 [ 47.619429][ T1897] ? usb_probe_device+0x250/0x250 [ 47.619950][ T1897] really_probe+0x205/0xb70 [ 47.620435][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.621048][ T1897] __driver_probe_device+0x311/0x4b0 [ 47.621595][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.622209][ T1897] driver_probe_device+0x4e/0x150 [ 47.622739][ T1897] __device_attach_driver+0x1cc/0x2a0 [ 47.623287][ T1897] bus_for_each_drv+0x156/0x1d0 [ 47.623796][ T1897] ? bus_rescan_devices+0x30/0x30 [ 47.624309][ T1897] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 47.624907][ T1897] ? trace_hardirqs_on+0x46/0x160 [ 47.625437][ T1897] __device_attach+0x23f/0x3a0 [ 47.625924][ T1897] ? device_bind_driver+0xd0/0xd0 [ 47.626433][ T1897] ? kobject_uevent_env+0x287/0x14b0 [ 47.627057][ T1897] bus_probe_device+0x1da/0x290 [ 47.627557][ T1897] device_add+0xb7b/0x1eb0 [ 47.628027][ T1897] ? wait_for_completion+0x290/0x290 [ 47.628593][ T1897] ? __fw_devlink_link_to_suppliers+0x5a0/0x5a0 [ 47.629249][ T1897] usb_set_configuration+0xf59/0x16f0 [ 47.629829][ T1897] usb_generic_driver_probe+0x82/0xa0 [ 47.630385][ T1897] usb_probe_device+0xbb/0x250 [ 47.630927][ T1897] ? usb_suspend+0x590/0x590 [ 47.631397][ T1897] really_probe+0x205/0xb70 [ 47.631855][ T1897] ? driver_allows_async_probing+0x130/0x130 [ 47.632469][ T1897] __driver_probe_device+0x311/0x4b0 [ 47.633002][ ---truncated--- CVE-2022-50258 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50258.html CVE-2022-50258 https://bugzilla.suse.com/1249947 SUSE Bug 1249947 In the Linux kernel, the following vulnerability has been resolved: drm/msm: Make .remove and .shutdown HW shutdown consistent Drivers' .remove and .shutdown callbacks are executed on different code paths. The former is called when a device is removed from the bus, while the latter is called at system shutdown time to quiesce the device. This means that some overlap exists between the two, because both have to take care of properly shutting down the hardware. But currently the logic used in these two callbacks isn't consistent in msm drivers, which could lead to kernel panic. For example, on .remove the component is deleted and its .unbind callback leads to the hardware being shutdown but only if the DRM device has been marked as registered. That check doesn't exist in the .shutdown logic and this can lead to the driver calling drm_atomic_helper_shutdown() for a DRM device that hasn't been properly initialized. A situation like this can happen if drivers for expected sub-devices fail to probe, since the .bind callback will never be executed. If that is the case, drm_atomic_helper_shutdown() will attempt to take mutexes that are only initialized if drm_mode_config_init() is called during a device bind. This bug was attempted to be fixed in commit 623f279c7781 ("drm/msm: fix shutdown hook in case GPU components failed to bind"), but unfortunately it still happens in some cases as the one mentioned above, i.e: systemd-shutdown[1]: Powering off. kvm: exiting hardware virtualization platform wifi-firmware.0: Removing from iommu group 12 platform video-firmware.0: Removing from iommu group 10 ------------[ cut here ]------------ WARNING: CPU: 6 PID: 1 at drivers/gpu/drm/drm_modeset_lock.c:317 drm_modeset_lock_all_ctx+0x3c4/0x3d0 ... Hardware name: Google CoachZ (rev3+) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : drm_modeset_lock_all_ctx+0x3c4/0x3d0 lr : drm_modeset_lock_all_ctx+0x48/0x3d0 sp : ffff80000805bb80 x29: ffff80000805bb80 x28: ffff327c00128000 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000001 x24: ffffc95d820ec030 x23: ffff327c00bbd090 x22: ffffc95d8215eca0 x21: ffff327c039c5800 x20: ffff327c039c5988 x19: ffff80000805bbe8 x18: 0000000000000034 x17: 000000040044ffff x16: ffffc95d80cac920 x15: 0000000000000000 x14: 0000000000000315 x13: 0000000000000315 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : ffff80000805bc28 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff327c00128000 x1 : 0000000000000000 x0 : ffff327c039c59b0 Call trace: drm_modeset_lock_all_ctx+0x3c4/0x3d0 drm_atomic_helper_shutdown+0x70/0x134 msm_drv_shutdown+0x30/0x40 platform_shutdown+0x28/0x40 device_shutdown+0x148/0x350 kernel_power_off+0x38/0x80 __do_sys_reboot+0x288/0x2c0 __arm64_sys_reboot+0x28/0x34 invoke_syscall+0x48/0x114 el0_svc_common.constprop.0+0x44/0xec do_el0_svc+0x2c/0xc0 el0_svc+0x2c/0x84 el0t_64_sync_handler+0x11c/0x150 el0t_64_sync+0x18c/0x190 ---[ end trace 0000000000000000 ]--- Unable to handle kernel NULL pointer dereference at virtual address 0000000000000018 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 user pgtable: 4k pages, 48-bit VAs, pgdp=000000010eab1000 [0000000000000018] pgd=0000000000000000, p4d=0000000000000000 Internal error: Oops: 96000004 [#1] PREEMPT SMP ... Hardware name: Google CoachZ (rev3+) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : ww_mutex_lock+0x28/0x32c lr : drm_modeset_lock_all_ctx+0x1b0/0x3d0 sp : ffff80000805bb50 x29: ffff80000805bb50 x28: ffff327c00128000 x27: 0000000000000000 x26: 00000 ---truncated--- CVE-2022-50260 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50260.html CVE-2022-50260 https://bugzilla.suse.com/1249885 SUSE Bug 1249885 In the Linux kernel, the following vulnerability has been resolved: drm/sti: Fix return type of sti_{dvo,hda,hdmi}_connector_mode_valid() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals: drivers/gpu/drm/sti/sti_hda.c:637:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict] .mode_valid = sti_hda_connector_mode_valid, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/sti/sti_dvo.c:376:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict] .mode_valid = sti_dvo_connector_mode_valid, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/sti/sti_hdmi.c:1035:16: error: incompatible function pointer types initializing 'enum drm_mode_status (*)(struct drm_connector *, struct drm_display_mode *)' with an expression of type 'int (struct drm_connector *, struct drm_display_mode *)' [-Werror,-Wincompatible-function-pointer-types-strict] .mode_valid = sti_hdmi_connector_mode_valid, ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ->mode_valid() in 'struct drm_connector_helper_funcs' expects a return type of 'enum drm_mode_status', not 'int'. Adjust the return type of sti_{dvo,hda,hdmi}_connector_mode_valid() to match the prototype's to resolve the warning and CFI failure. CVE-2022-50261 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50261.html CVE-2022-50261 https://bugzilla.suse.com/1249742 SUSE Bug 1249742 In the Linux kernel, the following vulnerability has been resolved: clk: socfpga: Fix memory leak in socfpga_gate_init() Free @socfpga_clk and @ops on the error path to avoid memory leak issue. CVE-2022-50264 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50264.html CVE-2022-50264 https://bugzilla.suse.com/1249685 SUSE Bug 1249685 In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix check for probe enabled in kill_kprobe() In kill_kprobe(), the check whether disarm_kprobe_ftrace() needs to be called always fails. This is because before that we set the KPROBE_FLAG_GONE flag for kprobe so that "!kprobe_disabled(p)" is always false. The disarm_kprobe_ftrace() call introduced by commit: 0cb2f1372baa ("kprobes: Fix NULL pointer dereference at kprobe_ftrace_handler") to fix the NULL pointer reference problem. When the probe is enabled, if we do not disarm it, this problem still exists. Fix it by putting the probe enabled check before setting the KPROBE_FLAG_GONE flag. CVE-2022-50266 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50266.html CVE-2022-50266 https://bugzilla.suse.com/1249810 SUSE Bug 1249810 In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_pci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, beside, runtime PM also needs be disabled. CVE-2022-50267 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50267.html CVE-2022-50267 https://bugzilla.suse.com/1249749 SUSE Bug 1249749 In the Linux kernel, the following vulnerability has been resolved: mmc: moxart: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(). CVE-2022-50268 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50268.html CVE-2022-50268 https://bugzilla.suse.com/1249741 SUSE Bug 1249741 In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix memory leak in vkms_init() A memory leak was reported after the vkms module install failed. unreferenced object 0xffff88810bc28520 (size 16): comm "modprobe", pid 9662, jiffies 4298009455 (age 42.590s) hex dump (first 16 bytes): 01 01 00 64 81 88 ff ff 00 00 dc 0a 81 88 ff ff ...d............ backtrace: [<00000000e7561ff8>] kmalloc_trace+0x27/0x60 [<000000000b1954a0>] 0xffffffffc45200a9 [<00000000abbf1da0>] do_one_initcall+0xd0/0x4f0 [<000000001505ee87>] do_init_module+0x1a4/0x680 [<00000000958079ad>] load_module+0x6249/0x7110 [<00000000117e4696>] __do_sys_finit_module+0x140/0x200 [<00000000f74b12d2>] do_syscall_64+0x35/0x80 [<000000008fc6fcde>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 The reason is that the vkms_init() returns without checking the return value of vkms_create(), and if the vkms_create() failed, the config allocated at the beginning of vkms_init() is leaked. vkms_init() config = kmalloc(...) # config allocated ... return vkms_create() # vkms_create failed and config is leaked Fix this problem by checking return value of vkms_create() and free the config if error happened. CVE-2022-50269 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50269.html CVE-2022-50269 https://bugzilla.suse.com/1249777 SUSE Bug 1249777 In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: Use kvmalloc/kvfree for larger packets. When copying a large file over sftp over vsock, data size is usually 32kB, and kmalloc seems to fail to try to allocate 32 32kB regions. vhost-5837: page allocation failure: order:4, mode:0x24040c0 Call Trace: [<ffffffffb6a0df64>] dump_stack+0x97/0xdb [<ffffffffb68d6aed>] warn_alloc_failed+0x10f/0x138 [<ffffffffb68d868a>] ? __alloc_pages_direct_compact+0x38/0xc8 [<ffffffffb664619f>] __alloc_pages_nodemask+0x84c/0x90d [<ffffffffb6646e56>] alloc_kmem_pages+0x17/0x19 [<ffffffffb6653a26>] kmalloc_order_trace+0x2b/0xdb [<ffffffffb66682f3>] __kmalloc+0x177/0x1f7 [<ffffffffb66e0d94>] ? copy_from_iter+0x8d/0x31d [<ffffffffc0689ab7>] vhost_vsock_handle_tx_kick+0x1fa/0x301 [vhost_vsock] [<ffffffffc06828d9>] vhost_worker+0xf7/0x157 [vhost] [<ffffffffb683ddce>] kthread+0xfd/0x105 [<ffffffffc06827e2>] ? vhost_dev_set_owner+0x22e/0x22e [vhost] [<ffffffffb683dcd1>] ? flush_kthread_worker+0xf3/0xf3 [<ffffffffb6eb332e>] ret_from_fork+0x4e/0x80 [<ffffffffb683dcd1>] ? flush_kthread_worker+0xf3/0xf3 Work around by doing kvmalloc instead. CVE-2022-50271 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50271.html CVE-2022-50271 https://bugzilla.suse.com/1249740 SUSE Bug 1249740 In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace: <TASK> __i2c_transfer+0x77e/0x1930 drivers/i2c/i2c-core-base.c:2109 i2c_transfer+0x1d5/0x3d0 drivers/i2c/i2c-core-base.c:2170 i2cdev_ioctl_rdwr+0x393/0x660 drivers/i2c/i2c-dev.c:297 i2cdev_ioctl+0x75d/0x9f0 drivers/i2c/i2c-dev.c:458 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl+0xfb/0x170 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd834a8bded In az6027_i2c_xfer(), if msg[i].addr is 0x99, a null-ptr-deref will caused when accessing msg[i].buf. For msg[i].len is 0 and msg[i].buf is null. Fix this by checking msg[i].len in az6027_i2c_xfer(). CVE-2022-50272 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50272.html CVE-2022-50272 https://bugzilla.suse.com/1249808 SUSE Bug 1249808 In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Add the missed acpi_put_table() to fix memory leak When the radeon driver reads the bios information from ACPI table in radeon_acpi_vfct_bios(), it misses to call acpi_put_table() to release the ACPI memory after the init, so add acpi_put_table() properly to fix the memory leak. v2: fix text formatting (Alex) CVE-2022-50275 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50275.html CVE-2022-50275 https://bugzilla.suse.com/1249705 SUSE Bug 1249705 In the Linux kernel, the following vulnerability has been resolved: power: supply: fix null pointer dereferencing in power_supply_get_battery_info when kmalloc() fail to allocate memory in kasprintf(), propname will be NULL, strcmp() called by of_get_property() will cause null pointer dereference. So return ENOMEM if kasprintf() return NULL pointer. CVE-2022-50276 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50276.html CVE-2022-50276 https://bugzilla.suse.com/1249651 SUSE Bug 1249651 In the Linux kernel, the following vulnerability has been resolved: ext4: don't allow journal inode to have encrypt flag Mounting a filesystem whose journal inode has the encrypt flag causes a NULL dereference in fscrypt_limit_io_blocks() when the 'inlinecrypt' mount option is used. The problem is that when jbd2_journal_init_inode() calls bmap(), it eventually finds its way into ext4_iomap_begin(), which calls fscrypt_limit_io_blocks(). fscrypt_limit_io_blocks() requires that if the inode is encrypted, then its encryption key must already be set up. That's not the case here, since the journal inode is never "opened" like a normal file would be. Hence the crash. A reproducer is: mkfs.ext4 -F /dev/vdb debugfs -w /dev/vdb -R "set_inode_field <8> flags 0x80808" mount /dev/vdb /mnt -o inlinecrypt To fix this, make ext4 consider journal inodes with the encrypt flag to be invalid. (Note, maybe other flags should be rejected on the journal inode too. For now, this is just the minimal fix for the above issue.) I've marked this as fixing the commit that introduced the call to fscrypt_limit_io_blocks(), since that's what made an actual crash start being possible. But this fix could be applied to any version of ext4 that supports the encrypt feature. CVE-2022-50277 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50277.html CVE-2022-50277 https://bugzilla.suse.com/1249750 SUSE Bug 1249750 In the Linux kernel, the following vulnerability has been resolved: PNP: fix name memory leak in pnp_alloc_dev() After commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically, move dev_set_name() after pnp_add_id() to avoid memory leak. CVE-2022-50278 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50278.html CVE-2022-50278 https://bugzilla.suse.com/1249715 SUSE Bug 1249715 In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK> The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough. Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit. CVE-2022-50279 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50279.html CVE-2022-50279 https://bugzilla.suse.com/1249751 SUSE Bug 1249751 In the Linux kernel, the following vulnerability has been resolved: chardev: fix error handling in cdev_device_add() While doing fault injection test, I got the following report: ------------[ cut here ]------------ kobject: '(null)' (0000000039956980): is not initialized, yet kobject_put() is being called. WARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0 CPU: 3 PID: 6306 Comm: 283 Tainted: G W 6.1.0-rc2-00005-g307c1086d7c9 #1253 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:kobject_put+0x23d/0x4e0 Call Trace: <TASK> cdev_device_add+0x15e/0x1b0 __iio_device_register+0x13b4/0x1af0 [industrialio] __devm_iio_device_register+0x22/0x90 [industrialio] max517_probe+0x3d8/0x6b4 [max517] i2c_device_probe+0xa81/0xc00 When device_add() is injected fault and returns error, if dev->devt is not set, cdev_add() is not called, cdev_del() is not needed. Fix this by checking dev->devt in error path. CVE-2022-50282 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50282.html CVE-2022-50282 https://bugzilla.suse.com/1249739 SUSE Bug 1249739 In the Linux kernel, the following vulnerability has been resolved: ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline When converting files with inline data to extents, delayed allocations made on a file system created with both the bigalloc and inline options can result in invalid extent status cache content, incorrect reserved cluster counts, kernel memory leaks, and potential kernel panics. With bigalloc, the code that determines whether a block must be delayed allocated searches the extent tree to see if that block maps to a previously allocated cluster. If not, the block is delayed allocated, and otherwise, it isn't. However, if the inline option is also used, and if the file containing the block is marked as able to store data inline, there isn't a valid extent tree associated with the file. The current code in ext4_clu_mapped() calls ext4_find_extent() to search the non-existent tree for a previously allocated cluster anyway, which typically finds nothing, as desired. However, a side effect of the search can be to cache invalid content from the non-existent tree (garbage) in the extent status tree, including bogus entries in the pending reservation tree. To fix this, avoid searching the extent tree when allocating blocks for bigalloc + inline files that are being converted from inline to extent mapped. CVE-2022-50286 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50286.html CVE-2022-50286 https://bugzilla.suse.com/1249753 SUSE Bug 1249753 In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs When (size != 0 || ptrs->lvds_ entries != 3), the program tries to free() the ptrs. However, the ptrs is not created by calling kzmalloc(), but is obtained by pointer offset operation. This may lead to memory leaks or undefined behavior. Fix this by replacing the arguments of kfree() with ptrs_block. (cherry picked from commit 7674cd0b7d28b952151c3df26bbfa7e07eb2b4ec) CVE-2022-50287 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50287.html CVE-2022-50287 https://bugzilla.suse.com/1249757 SUSE Bug 1249757 In the Linux kernel, the following vulnerability has been resolved: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure adapter->dcb would get silently freed inside qlcnic_dcb_enable() in case qlcnic_dcb_attach() would return an error, which always happens under OOM conditions. This would lead to use-after-free because both of the existing callers invoke qlcnic_dcb_get_info() on the obtained pointer, which is potentially freed at that point. Propagate errors from qlcnic_dcb_enable(), and instead free the dcb pointer at callsite using qlcnic_dcb_free(). This also removes the now unused qlcnic_clear_dcb_ops() helper, which was a simple wrapper around kfree() also causing memory leaks for partially initialized dcb. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. CVE-2022-50288 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50288.html CVE-2022-50288 https://bugzilla.suse.com/1249802 SUSE Bug 1249802 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2_stack_glue_init() ocfs2_table_header should be free in ocfs2_stack_glue_init() if ocfs2_sysfs_init() failed, otherwise kmemleak will report memleak. BUG: memory leak unreferenced object 0xffff88810eeb5800 (size 128): comm "modprobe", pid 4507, jiffies 4296182506 (age 55.888s) hex dump (first 32 bytes): c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00 .@.............. 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000001e59e1cd>] __register_sysctl_table+0xca/0xef0 [<00000000c04f70f7>] 0xffffffffa0050037 [<000000001bd12912>] do_one_initcall+0xdb/0x480 [<0000000064f766c9>] do_init_module+0x1cf/0x680 [<000000002ba52db0>] load_module+0x6441/0x6f20 [<000000009772580d>] __do_sys_finit_module+0x12f/0x1c0 [<00000000380c1f22>] do_syscall_64+0x3f/0x90 [<000000004cf473bc>] entry_SYSCALL_64_after_hwframe+0x63/0xcd CVE-2022-50289 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50289.html CVE-2022-50289 https://bugzilla.suse.com/1249981 SUSE Bug 1249981 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: fix bridge lifetime Device-managed resources allocated post component bind must be tied to the lifetime of the aggregate DRM device or they will not necessarily be released when binding of the aggregate device is deferred. This can lead resource leaks or failure to bind the aggregate device when binding is later retried and a second attempt to allocate the resources is made. For the DP bridges, previously allocated bridges will leak on probe deferral. Fix this by amending the DP parser interface and tying the lifetime of the bridge device to the DRM device rather than DP platform device. Patchwork: https://patchwork.freedesktop.org/patch/502667/ CVE-2022-50292 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50292.html CVE-2022-50292 https://bugzilla.suse.com/1249800 SUSE Bug 1249800 In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix memory leak in lbs_init_adapter() When kfifo_alloc() failed in lbs_init_adapter(), cmd buffer is not released. Add free memory to processing error path. CVE-2022-50294 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50294.html CVE-2022-50294 https://bugzilla.suse.com/1249799 SUSE Bug 1249799 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: verify the expected usb_endpoints are present The bug arises when a USB device claims to be an ATH9K but doesn't have the expected endpoints. (In this case there was an interrupt endpoint where the driver expected a bulk endpoint.) The kernel needs to be able to handle such devices without getting an internal error. usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 Modules linked in: CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events request_firmware_work_func RIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 Call Trace: ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline] ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019 ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109 [inline] ath9k_hif_usb_firmware_cb+0x142/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1242 request_firmware_work_func+0x12e/0x240 drivers/base/firmware_loader/main.c:1097 process_one_work+0x9af/0x1600 kernel/workqueue.c:2279 worker_thread+0x61d/0x12f0 kernel/workqueue.c:2425 kthread+0x3b4/0x4a0 kernel/kthread.c:313 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:299 Found by Linux Verification Center (linuxtesting.org) with Syzkaller. CVE-2022-50297 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50297.html CVE-2022-50297 https://bugzilla.suse.com/1250250 SUSE Bug 1250250 In the Linux kernel, the following vulnerability has been resolved: slimbus: qcom-ngd: cleanup in probe error path Add proper error path in probe() to cleanup resources previously acquired/allocated to fix warnings visible during probe deferral: notifier callback qcom_slim_ngd_ssr_notify already registered WARNING: CPU: 6 PID: 70 at kernel/notifier.c:28 notifier_chain_register+0x5c/0x90 Modules linked in: CPU: 6 PID: 70 Comm: kworker/u16:1 Not tainted 6.0.0-rc3-next-20220830 #380 Call trace: notifier_chain_register+0x5c/0x90 srcu_notifier_chain_register+0x44/0x90 qcom_register_ssr_notifier+0x38/0x4c qcom_slim_ngd_ctrl_probe+0xd8/0x400 platform_probe+0x6c/0xe0 really_probe+0xbc/0x2d4 __driver_probe_device+0x78/0xe0 driver_probe_device+0x3c/0x12c __device_attach_driver+0xb8/0x120 bus_for_each_drv+0x78/0xd0 __device_attach+0xa8/0x1c0 device_initial_probe+0x18/0x24 bus_probe_device+0xa0/0xac deferred_probe_work_func+0x88/0xc0 process_one_work+0x1d4/0x320 worker_thread+0x2cc/0x44c kthread+0x110/0x114 ret_from_fork+0x10/0x20 CVE-2022-50298 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50298.html CVE-2022-50298 https://bugzilla.suse.com/1249934 SUSE Bug 1249934 In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf() returns the number of characters generated from the given input, which could cause the expression "200 - len" to wrap around to a large positive number. Fix this by using scnprintf() instead, which returns the actual number of characters written into the buffer. [ 1513.267938] ------------[ cut here ]------------ [ 1513.267943] WARNING: CPU: 15 PID: 37247 at <snip>/lib/vsprintf.c:2509 vsnprintf+0x2c8/0x510 [ 1513.267944] Modules linked in: <snip> [ 1513.267969] CPU: 15 PID: 37247 Comm: mdadm Not tainted 5.4.0-1085-azure #90~18.04.1-Ubuntu [ 1513.267969] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 05/09/2022 [ 1513.267971] RIP: 0010:vsnprintf+0x2c8/0x510 <-snip-> [ 1513.267982] Call Trace: [ 1513.267986] snprintf+0x45/0x70 [ 1513.267990] ? disk_name+0x71/0xa0 [ 1513.267993] dump_zones+0x114/0x240 [raid0] [ 1513.267996] ? _cond_resched+0x19/0x40 [ 1513.267998] raid0_run+0x19e/0x270 [raid0] [ 1513.268000] md_run+0x5e0/0xc50 [ 1513.268003] ? security_capable+0x3f/0x60 [ 1513.268005] do_md_run+0x19/0x110 [ 1513.268006] md_ioctl+0x195e/0x1f90 [ 1513.268007] blkdev_ioctl+0x91f/0x9f0 [ 1513.268010] block_ioctl+0x3d/0x50 [ 1513.268012] do_vfs_ioctl+0xa9/0x640 [ 1513.268014] ? __fput+0x162/0x260 [ 1513.268016] ksys_ioctl+0x75/0x80 [ 1513.268017] __x64_sys_ioctl+0x1a/0x20 [ 1513.268019] do_syscall_64+0x5e/0x200 [ 1513.268021] entry_SYSCALL_64_after_hwframe+0x44/0xa9 CVE-2022-50299 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50299.html CVE-2022-50299 https://bugzilla.suse.com/1249734 SUSE Bug 1249734 In the Linux kernel, the following vulnerability has been resolved: iommu/omap: Fix buffer overflow in debugfs There are two issues here: 1) The "len" variable needs to be checked before the very first write. Otherwise if omap2_iommu_dump_ctx() with "bytes" less than 32 it is a buffer overflow. 2) The snprintf() function returns the number of bytes that *would* have been copied if there were enough space. But we want to know the number of bytes which were *actually* copied so use scnprintf() instead. CVE-2022-50301 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50301.html CVE-2022-50301 https://bugzilla.suse.com/1249733 SUSE Bug 1249733 In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix double release compute pasid If kfd_process_device_init_vm returns failure after vm is converted to compute vm and vm->pasid set to compute pasid, KFD will not take pdd->drm_file reference. As a result, drm close file handler maybe called to release the compute pasid before KFD process destroy worker to release the same pasid and set vm->pasid to zero, this generates below WARNING backtrace and NULL pointer access. Add helper amdgpu_amdkfd_gpuvm_set_vm_pasid and call it at the last step of kfd_process_device_init_vm, to ensure vm pasid is the original pasid if acquiring vm failed or is the compute pasid with pdd->drm_file reference taken to avoid double release same pasid. amdgpu: Failed to create process VM object ida_free called for id=32770 which is not allocated. WARNING: CPU: 57 PID: 72542 at ../lib/idr.c:522 ida_free+0x96/0x140 RIP: 0010:ida_free+0x96/0x140 Call Trace: amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu] drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70 [drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20 task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10 BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:ida_free+0x76/0x140 Call Trace: amdgpu_pasid_free_delayed+0xe1/0x2a0 [amdgpu] amdgpu_driver_postclose_kms+0x2d8/0x340 [amdgpu] drm_file_free.part.13+0x216/0x270 [drm] drm_close_helper.isra.14+0x60/0x70 [drm] drm_release+0x6e/0xf0 [drm] __fput+0xcc/0x280 ____fput+0xe/0x20 task_work_run+0x96/0xc0 do_exit+0x3d0/0xc10 CVE-2022-50303 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50303.html CVE-2022-50303 https://bugzilla.suse.com/1249884 SUSE Bug 1249884 In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Add checks for devm_kcalloc As the devm_kcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference. CVE-2022-50308 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50308.html CVE-2022-50308 https://bugzilla.suse.com/1249722 SUSE Bug 1249722 In the Linux kernel, the following vulnerability has been resolved: media: xilinx: vipp: Fix refcount leak in xvip_graph_dma_init of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. CVE-2022-50309 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50309.html CVE-2022-50309 https://bugzilla.suse.com/1249718 SUSE Bug 1249718 In the Linux kernel, the following vulnerability has been resolved: drivers: serial: jsm: fix some leaks in probe This error path needs to unwind instead of just returning directly. CVE-2022-50312 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50312.html CVE-2022-50312 https://bugzilla.suse.com/1249716 SUSE Bug 1249716 In the Linux kernel, the following vulnerability has been resolved: drm/bridge: megachips: Fix a null pointer dereference bug When removing the module we will get the following warning: [ 31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered [ 31.912484] general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI [ 31.913338] KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] [ 31.915280] RIP: 0010:drm_bridge_remove+0x97/0x130 [ 31.921825] Call Trace: [ 31.922533] stdp4028_ge_b850v3_fw_remove+0x34/0x60 [megachips_stdpxxxx_ge_b850v3_fw] [ 31.923139] i2c_device_remove+0x181/0x1f0 The two bridges (stdp2690, stdp4028) do not probe at the same time, so the driver does not call ge_b850v3_resgiter() when probing, causing the driver to try to remove the object that has not been initialized. Fix this by checking whether both the bridges are probed. CVE-2022-50317 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50317.html CVE-2022-50317 https://bugzilla.suse.com/1249713 SUSE Bug 1249713 In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() pci_get_device() will increase the reference count for the returned 'dev'. We need to call pci_dev_put() to decrease the reference count. Since 'dev' is only used in pci_read_config_dword(), let's add pci_dev_put() right after it. CVE-2022-50318 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50318.html CVE-2022-50318 https://bugzilla.suse.com/1249709 SUSE Bug 1249709 In the Linux kernel, the following vulnerability has been resolved: ACPI: tables: FPDT: Don't call acpi_os_map_memory() on invalid phys address On a Packard Bell Dot SC (Intel Atom N2600 model) there is a FPDT table which contains invalid physical addresses, with high bits set which fall outside the range of the CPU-s supported physical address range. Calling acpi_os_map_memory() on such an invalid phys address leads to the below WARN_ON in ioremap triggering resulting in an oops/stacktrace. Add code to verify the physical address before calling acpi_os_map_memory() to fix / avoid the oops. [ 1.226900] ioremap: invalid physical address 3001000000000000 [ 1.226949] ------------[ cut here ]------------ [ 1.226962] WARNING: CPU: 1 PID: 1 at arch/x86/mm/ioremap.c:200 __ioremap_caller.cold+0x43/0x5f [ 1.226996] Modules linked in: [ 1.227016] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc3+ #490 [ 1.227029] Hardware name: Packard Bell dot s/SJE01_CT, BIOS V1.10 07/23/2013 [ 1.227038] RIP: 0010:__ioremap_caller.cold+0x43/0x5f [ 1.227054] Code: 96 00 00 e9 f8 af 24 ff 89 c6 48 c7 c7 d8 0c 84 99 e8 6a 96 00 00 e9 76 af 24 ff 48 89 fe 48 c7 c7 a8 0c 84 99 e8 56 96 00 00 <0f> 0b e9 60 af 24 ff 48 8b 34 24 48 c7 c7 40 0d 84 99 e8 3f 96 00 [ 1.227067] RSP: 0000:ffffb18c40033d60 EFLAGS: 00010286 [ 1.227084] RAX: 0000000000000032 RBX: 3001000000000000 RCX: 0000000000000000 [ 1.227095] RDX: 0000000000000001 RSI: 00000000ffffdfff RDI: 00000000ffffffff [ 1.227105] RBP: 3001000000000000 R08: 0000000000000000 R09: ffffb18c40033c18 [ 1.227115] R10: 0000000000000003 R11: ffffffff99d62fe8 R12: 0000000000000008 [ 1.227124] R13: 0003001000000000 R14: 0000000000001000 R15: 3001000000000000 [ 1.227135] FS: 0000000000000000(0000) GS:ffff913a3c080000(0000) knlGS:0000000000000000 [ 1.227146] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1.227156] CR2: 0000000000000000 CR3: 0000000018c26000 CR4: 00000000000006e0 [ 1.227167] Call Trace: [ 1.227176] <TASK> [ 1.227185] ? acpi_os_map_iomem+0x1c9/0x1e0 [ 1.227215] ? kmem_cache_alloc_trace+0x187/0x370 [ 1.227254] acpi_os_map_iomem+0x1c9/0x1e0 [ 1.227288] acpi_init_fpdt+0xa8/0x253 [ 1.227308] ? acpi_debugfs_init+0x1f/0x1f [ 1.227339] do_one_initcall+0x5a/0x300 [ 1.227406] ? rcu_read_lock_sched_held+0x3f/0x80 [ 1.227442] kernel_init_freeable+0x28b/0x2cc [ 1.227512] ? rest_init+0x170/0x170 [ 1.227538] kernel_init+0x16/0x140 [ 1.227552] ret_from_fork+0x1f/0x30 [ 1.227639] </TASK> [ 1.227647] irq event stamp: 186819 [ 1.227656] hardirqs last enabled at (186825): [<ffffffff98184a6e>] __up_console_sem+0x5e/0x70 [ 1.227672] hardirqs last disabled at (186830): [<ffffffff98184a53>] __up_console_sem+0x43/0x70 [ 1.227686] softirqs last enabled at (186576): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160 [ 1.227701] softirqs last disabled at (186569): [<ffffffff980fbc9d>] __irq_exit_rcu+0xed/0x160 [ 1.227715] ---[ end trace 0000000000000000 ]--- CVE-2022-50320 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50320.html CVE-2022-50320 https://bugzilla.suse.com/1249858 SUSE Bug 1249858 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() The brcmf_netdev_start_xmit() returns NETDEV_TX_OK without freeing skb in case of pskb_expand_head() fails, add dev_kfree_skb() to fix it. Compile tested only. CVE-2022-50321 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50321.html CVE-2022-50321 https://bugzilla.suse.com/1249706 SUSE Bug 1249706 In the Linux kernel, the following vulnerability has been resolved: net: do not sense pfmemalloc status in skb_append_pagefrags() skb_append_pagefrags() is used by af_unix and udp sendpage() implementation so far. In commit 326140063946 ("tcp: TX zerocopy should not sense pfmemalloc status") we explained why we should not sense pfmemalloc status for pages owned by user space. We should also use skb_fill_page_desc_noacc() in skb_append_pagefrags() to avoid following KCSAN report: BUG: KCSAN: data-race in lru_add_fn / skb_append_pagefrags write to 0xffffea00058fc1c8 of 8 bytes by task 17319 on cpu 0: __list_add include/linux/list.h:73 [inline] list_add include/linux/list.h:88 [inline] lruvec_add_folio include/linux/mm_inline.h:323 [inline] lru_add_fn+0x327/0x410 mm/swap.c:228 folio_batch_move_lru+0x1e1/0x2a0 mm/swap.c:246 lru_add_drain_cpu+0x73/0x250 mm/swap.c:669 lru_add_drain+0x21/0x60 mm/swap.c:773 free_pages_and_swap_cache+0x16/0x70 mm/swap_state.c:311 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:256 [inline] tlb_flush_mmu+0x5b2/0x640 mm/mmu_gather.c:263 tlb_finish_mmu+0x86/0x100 mm/mmu_gather.c:363 exit_mmap+0x190/0x4d0 mm/mmap.c:3098 __mmput+0x27/0x1b0 kernel/fork.c:1185 mmput+0x3d/0x50 kernel/fork.c:1207 copy_process+0x19fc/0x2100 kernel/fork.c:2518 kernel_clone+0x166/0x550 kernel/fork.c:2671 __do_sys_clone kernel/fork.c:2812 [inline] __se_sys_clone kernel/fork.c:2796 [inline] __x64_sys_clone+0xc3/0xf0 kernel/fork.c:2796 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffffea00058fc1c8 of 8 bytes by task 17325 on cpu 1: page_is_pfmemalloc include/linux/mm.h:1817 [inline] __skb_fill_page_desc include/linux/skbuff.h:2432 [inline] skb_fill_page_desc include/linux/skbuff.h:2453 [inline] skb_append_pagefrags+0x210/0x600 net/core/skbuff.c:3974 unix_stream_sendpage+0x45e/0x990 net/unix/af_unix.c:2338 kernel_sendpage+0x184/0x300 net/socket.c:3561 sock_sendpage+0x5a/0x70 net/socket.c:1054 pipe_to_sendpage+0x128/0x160 fs/splice.c:361 splice_from_pipe_feed fs/splice.c:415 [inline] __splice_from_pipe+0x222/0x4d0 fs/splice.c:559 splice_from_pipe fs/splice.c:594 [inline] generic_splice_sendpage+0x89/0xc0 fs/splice.c:743 do_splice_from fs/splice.c:764 [inline] direct_splice_actor+0x80/0xa0 fs/splice.c:931 splice_direct_to_actor+0x305/0x620 fs/splice.c:886 do_splice_direct+0xfb/0x180 fs/splice.c:974 do_sendfile+0x3bf/0x910 fs/read_write.c:1255 __do_sys_sendfile64 fs/read_write.c:1323 [inline] __se_sys_sendfile64 fs/read_write.c:1309 [inline] __x64_sys_sendfile64+0x10c/0x150 fs/read_write.c:1309 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0x0000000000000000 -> 0xffffea00058fc188 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 17325 Comm: syz-executor.0 Not tainted 6.1.0-rc1-syzkaller-00158-g440b7895c990-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022 CVE-2022-50323 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50323.html CVE-2022-50323 https://bugzilla.suse.com/1249708 SUSE Bug 1249708 In the Linux kernel, the following vulnerability has been resolved: mtd: maps: pxa2xx-flash: fix memory leak in probe Free 'info' upon remapping error to avoid a memory leak. [<miquel.raynal@bootlin.com>: Reword the commit log] CVE-2022-50324 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50324.html CVE-2022-50324 https://bugzilla.suse.com/1249701 SUSE Bug 1249701 In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix potential RX buffer overflow If an event caused firmware to return invalid RX size for LARGE_CONFIG_GET, memcpy_fromio() could end up copying too many bytes. Fix by utilizing min_t(). CVE-2022-50325 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50325.html CVE-2022-50325 https://bugzilla.suse.com/1249704 SUSE Bug 1249704 In the Linux kernel, the following vulnerability has been resolved: jbd2: fix potential use-after-free in jbd2_fc_wait_bufs In 'jbd2_fc_wait_bufs' use 'bh' after put buffer head reference count which may lead to use-after-free. So judge buffer if uptodate before put buffer head reference count. CVE-2022-50328 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50328.html CVE-2022-50328 https://bugzilla.suse.com/1250181 SUSE Bug 1250181 In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq() can free bfqq first, and then call bic_set_bfqq(), which will cause uaf. Fix the problem by moving bfq_exit_bfqq() behind bic_set_bfqq(). CVE-2022-50329 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50329.html CVE-2022-50329 https://bugzilla.suse.com/1249699 SUSE Bug 1249699 In the Linux kernel, the following vulnerability has been resolved: crypto: cavium - prevent integer overflow loading firmware The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow. CVE-2022-50330 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50330.html CVE-2022-50330 https://bugzilla.suse.com/1249700 SUSE Bug 1249700 In the Linux kernel, the following vulnerability has been resolved: wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() Inject fault while probing module, if device_register() fails, but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function kobject_cleanup(). unreferenced object 0xffff88810152ad20 (size 8): comm "modprobe", pid 252, jiffies 4294849206 (age 22.713s) hex dump (first 8 bytes): 68 77 73 69 6d 30 00 ff hwsim0.. backtrace: [<000000009c3504ed>] __kmalloc_node_track_caller+0x44/0x1b0 [<00000000c0228a5e>] kvasprintf+0xb5/0x140 [<00000000cff8c21f>] kvasprintf_const+0x55/0x180 [<0000000055a1e073>] kobject_set_name_vargs+0x56/0x150 [<000000000a80b139>] dev_set_name+0xab/0xe0 CVE-2022-50331 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50331.html CVE-2022-50331 https://bugzilla.suse.com/1249695 SUSE Bug 1249695 In the Linux kernel, the following vulnerability has been resolved: fs: jfs: fix shift-out-of-bounds in dbDiscardAG This should be applied to most URSAN bugs found recently by syzbot, by guarding the dbMount. As syzbot feeding rubbish into the bmap descriptor. CVE-2022-50333 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50333.html CVE-2022-50333 https://bugzilla.suse.com/1249860 SUSE Bug 1249860 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: avoid hci_dev_test_and_set_flag() in mgmt_init_hdev() syzbot is again reporting attempt to cancel uninitialized work at mgmt_index_removed() [1], for setting of HCI_MGMT flag from mgmt_init_hdev() from hci_mgmt_cmd() from hci_sock_sendmsg() can race with testing of HCI_MGMT flag from mgmt_index_removed() from hci_sock_bind() due to lack of serialization via hci_dev_lock(). Since mgmt_init_hdev() is called with mgmt_chan_list_lock held, we can safely split hci_dev_test_and_set_flag() into hci_dev_test_flag() and hci_dev_set_flag(). Thus, in order to close this race, set HCI_MGMT flag after INIT_DELAYED_WORK() completed. This is a local fix based on mgmt_chan_list_lock. Lack of serialization via hci_dev_lock() might be causing different race conditions somewhere else. But a global fix based on hci_dev_lock() should deserve a future patch. CVE-2022-50339 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50339.html CVE-2022-50339 https://bugzilla.suse.com/1249913 SUSE Bug 1249913 In the Linux kernel, the following vulnerability has been resolved: media: vimc: Fix wrong function called when vimc_init() fails In vimc_init(), when platform_driver_register(&vimc_pdrv) fails, platform_driver_unregister(&vimc_pdrv) is wrongly called rather than platform_device_unregister(&vimc_pdev), which causes kernel warning: Unexpected driver unregister! WARNING: CPU: 1 PID: 14517 at drivers/base/driver.c:270 driver_unregister+0x8f/0xb0 RIP: 0010:driver_unregister+0x8f/0xb0 Call Trace: <TASK> vimc_init+0x7d/0x1000 [vimc] do_one_initcall+0xd0/0x4e0 do_init_module+0x1cf/0x6b0 load_module+0x65c2/0x7820 CVE-2022-50340 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50340.html CVE-2022-50340 https://bugzilla.suse.com/1249892 SUSE Bug 1249892 In the Linux kernel, the following vulnerability has been resolved: floppy: Fix memory leak in do_floppy_init() A memory leak was reported when floppy_alloc_disk() failed in do_floppy_init(). unreferenced object 0xffff888115ed25a0 (size 8): comm "modprobe", pid 727, jiffies 4295051278 (age 25.529s) hex dump (first 8 bytes): 00 ac 67 5b 81 88 ff ff ..g[.... backtrace: [<000000007f457abb>] __kmalloc_node+0x4c/0xc0 [<00000000a87bfa9e>] blk_mq_realloc_tag_set_tags.part.0+0x6f/0x180 [<000000006f02e8b1>] blk_mq_alloc_tag_set+0x573/0x1130 [<0000000066007fd7>] 0xffffffffc06b8b08 [<0000000081f5ac40>] do_one_initcall+0xd0/0x4f0 [<00000000e26d04ee>] do_init_module+0x1a4/0x680 [<000000001bb22407>] load_module+0x6249/0x7110 [<00000000ad31ac4d>] __do_sys_finit_module+0x140/0x200 [<000000007bddca46>] do_syscall_64+0x35/0x80 [<00000000b5afec39>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff88810fc30540 (size 32): comm "modprobe", pid 727, jiffies 4295051278 (age 25.529s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000007f457abb>] __kmalloc_node+0x4c/0xc0 [<000000006b91eab4>] blk_mq_alloc_tag_set+0x393/0x1130 [<0000000066007fd7>] 0xffffffffc06b8b08 [<0000000081f5ac40>] do_one_initcall+0xd0/0x4f0 [<00000000e26d04ee>] do_init_module+0x1a4/0x680 [<000000001bb22407>] load_module+0x6249/0x7110 [<00000000ad31ac4d>] __do_sys_finit_module+0x140/0x200 [<000000007bddca46>] do_syscall_64+0x35/0x80 [<00000000b5afec39>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 If the floppy_alloc_disk() failed, disks of current drive will not be set, thus the lastest allocated set->tag cannot be freed in the error handling path. A simple call graph shown as below: floppy_module_init() floppy_init() do_floppy_init() for (drive = 0; drive < N_DRIVE; drive++) blk_mq_alloc_tag_set() blk_mq_alloc_tag_set_tags() blk_mq_realloc_tag_set_tags() # set->tag allocated floppy_alloc_disk() blk_mq_alloc_disk() # error occurred, disks failed to allocated ->out_put_disk: for (drive = 0; drive < N_DRIVE; drive++) if (!disks[drive][0]) # the last disks is not set and loop break break; blk_mq_free_tag_set() # the latest allocated set->tag leaked Fix this problem by free the set->tag of current drive before jump to error handling path. [efremov: added stable list, changed title] CVE-2022-50342 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50342.html CVE-2022-50342 https://bugzilla.suse.com/1249890 SUSE Bug 1249890 In the Linux kernel, the following vulnerability has been resolved: ext4: fix null-ptr-deref in ext4_write_info I caught a null-ptr-deref bug as follows: ================================================================== KASAN: null-ptr-deref in range [0x0000000000000068-0x000000000000006f] CPU: 1 PID: 1589 Comm: umount Not tainted 5.10.0-02219-dirty #339 RIP: 0010:ext4_write_info+0x53/0x1b0 [...] Call Trace: dquot_writeback_dquots+0x341/0x9a0 ext4_sync_fs+0x19e/0x800 __sync_filesystem+0x83/0x100 sync_filesystem+0x89/0xf0 generic_shutdown_super+0x79/0x3e0 kill_block_super+0xa1/0x110 deactivate_locked_super+0xac/0x130 deactivate_super+0xb6/0xd0 cleanup_mnt+0x289/0x400 __cleanup_mnt+0x16/0x20 task_work_run+0x11c/0x1c0 exit_to_user_mode_prepare+0x203/0x210 syscall_exit_to_user_mode+0x5b/0x3a0 do_syscall_64+0x59/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 ================================================================== Above issue may happen as follows: ------------------------------------- exit_to_user_mode_prepare task_work_run __cleanup_mnt cleanup_mnt deactivate_super deactivate_locked_super kill_block_super generic_shutdown_super shrink_dcache_for_umount dentry = sb->s_root sb->s_root = NULL <--- Here set NULL sync_filesystem __sync_filesystem sb->s_op->sync_fs > ext4_sync_fs dquot_writeback_dquots sb->dq_op->write_info > ext4_write_info ext4_journal_start(d_inode(sb->s_root), EXT4_HT_QUOTA, 2) d_inode(sb->s_root) s_root->d_inode <--- Null pointer dereference To solve this problem, we use ext4_journal_start_sb directly to avoid s_root being used. CVE-2022-50344 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50344.html CVE-2022-50344 https://bugzilla.suse.com/1250014 SUSE Bug 1250014 In the Linux kernel, the following vulnerability has been resolved: ext4: init quota for 'old.inode' in 'ext4_rename' Syzbot found the following issue: ext4_parse_param: s_want_extra_isize=128 ext4_inode_info_init: s_want_extra_isize=32 ext4_rename: old.inode=ffff88823869a2c8 old.dir=ffff888238699828 new.inode=ffff88823869d7e8 new.dir=ffff888238699828 __ext4_mark_inode_dirty: inode=ffff888238699828 ea_isize=32 want_ea_size=128 __ext4_mark_inode_dirty: inode=ffff88823869a2c8 ea_isize=32 want_ea_size=128 ext4_xattr_block_set: inode=ffff88823869a2c8 ------------[ cut here ]------------ WARNING: CPU: 13 PID: 2234 at fs/ext4/xattr.c:2070 ext4_xattr_block_set.cold+0x22/0x980 Modules linked in: RIP: 0010:ext4_xattr_block_set.cold+0x22/0x980 RSP: 0018:ffff888227d3f3b0 EFLAGS: 00010202 RAX: 0000000000000001 RBX: ffff88823007a000 RCX: 0000000000000000 RDX: 0000000000000a03 RSI: 0000000000000040 RDI: ffff888230078178 RBP: 0000000000000000 R08: 000000000000002c R09: ffffed1075c7df8e R10: ffff8883ae3efc6b R11: ffffed1075c7df8d R12: 0000000000000000 R13: ffff88823869a2c8 R14: ffff8881012e0460 R15: dffffc0000000000 FS: 00007f350ac1f740(0000) GS:ffff8883ae200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f350a6ed6a0 CR3: 0000000237456000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? ext4_xattr_set_entry+0x3b7/0x2320 ? ext4_xattr_block_set+0x0/0x2020 ? ext4_xattr_set_entry+0x0/0x2320 ? ext4_xattr_check_entries+0x77/0x310 ? ext4_xattr_ibody_set+0x23b/0x340 ext4_xattr_move_to_block+0x594/0x720 ext4_expand_extra_isize_ea+0x59a/0x10f0 __ext4_expand_extra_isize+0x278/0x3f0 __ext4_mark_inode_dirty.cold+0x347/0x410 ext4_rename+0xed3/0x174f vfs_rename+0x13a7/0x2510 do_renameat2+0x55d/0x920 __x64_sys_rename+0x7d/0xb0 do_syscall_64+0x3b/0xa0 entry_SYSCALL_64_after_hwframe+0x72/0xdc As 'ext4_rename' will modify 'old.inode' ctime and mark inode dirty, which may trigger expand 'extra_isize' and allocate block. If inode didn't init quota will lead to warning. To solve above issue, init 'old.inode' firstly in 'ext4_rename'. CVE-2022-50346 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50346.html CVE-2022-50346 https://bugzilla.suse.com/1250044 SUSE Bug 1250044 In the Linux kernel, the following vulnerability has been resolved: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path, besides, led_classdev_unregister() and pm_runtime_disable() also need be called. CVE-2022-50347 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50347.html CVE-2022-50347 https://bugzilla.suse.com/1249928 SUSE Bug 1249928 In the Linux kernel, the following vulnerability has been resolved: nfsd: Fix a memory leak in an error handling path If this memdup_user() call fails, the memory allocated in a previous call a few lines above should be freed. Otherwise it leaks. CVE-2022-50348 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50348.html CVE-2022-50348 https://bugzilla.suse.com/1249924 SUSE Bug 1249924 In the Linux kernel, the following vulnerability has been resolved: misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() If device_register() returns error in tifm_7xx1_switch_media(), name of kobject which is allocated in dev_set_name() called in device_add() is leaked. Never directly free @dev after calling device_register(), even if it returned an error! Always use put_device() to give up the reference initialized. CVE-2022-50349 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50349.html CVE-2022-50349 https://bugzilla.suse.com/1249920 SUSE Bug 1249920 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_create() If the cifs already shutdown, we should free the xid before return, otherwise, the xid will be leaked. CVE-2022-50351 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50351.html CVE-2022-50351 https://bugzilla.suse.com/1249925 SUSE Bug 1249925 In the Linux kernel, the following vulnerability has been resolved: mmc: wmt-sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, clk_disable_unprepare() also needs be called. CVE-2022-50353 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50353.html CVE-2022-50353 https://bugzilla.suse.com/1250047 SUSE Bug 1250047 In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kfd_process_device_init_vm error handling Should only destroy the ib_mem and let process cleanup worker to free the outstanding BOs. Reset the pointer in pdd->qpd structure, to avoid NULL pointer access in process destroy worker. BUG: kernel NULL pointer dereference, address: 0000000000000010 Call Trace: amdgpu_amdkfd_gpuvm_unmap_gtt_bo_from_kernel+0x46/0xb0 [amdgpu] kfd_process_device_destroy_cwsr_dgpu+0x40/0x70 [amdgpu] kfd_process_destroy_pdds+0x71/0x190 [amdgpu] kfd_process_wq_release+0x2a2/0x3b0 [amdgpu] process_one_work+0x2a1/0x600 worker_thread+0x39/0x3d0 CVE-2022-50354 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50354.html CVE-2022-50354 https://bugzilla.suse.com/1250215 SUSE Bug 1250215 In the Linux kernel, the following vulnerability has been resolved: staging: vt6655: fix some erroneous memory clean-up loops In some initialization functions of this driver, memory is allocated with 'i' acting as an index variable and increasing from 0. The commit in "Fixes" introduces some clean-up codes in case of allocation failure, which free memory in reverse order with 'i' decreasing to 0. However, there are some problems: - The case i=0 is left out. Thus memory is leaked. - In case memory allocation fails right from the start, the memory freeing loops will start with i=-1 and invalid memory locations will be accessed. One of these loops has been fixed in commit c8ff91535880 ("staging: vt6655: fix potential memory leak"). Fix the remaining erroneous loops. CVE-2022-50355 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50355.html CVE-2022-50355 https://bugzilla.suse.com/1250041 SUSE Bug 1250041 In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked to clear resources. In this case, the q->qdisc is NULL, and it will cause gpf issue. The process is as follows: qdisc_create_dflt() sfb_init() tcf_block_get() --->failed, q->qdisc is NULL ... qdisc_put() ... sfb_reset() qdisc_reset(q->qdisc) --->q->qdisc is NULL ops = qdisc->ops The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:qdisc_reset+0x2b/0x6f0 Call Trace: <TASK> sfb_reset+0x37/0xd0 qdisc_reset+0xed/0x6f0 qdisc_destroy+0x82/0x4c0 qdisc_put+0x9e/0xb0 qdisc_create_dflt+0x2c3/0x4a0 mqprio_init+0xa71/0x1760 qdisc_create+0x3eb/0x1000 tc_modify_qdisc+0x408/0x1720 rtnetlink_rcv_msg+0x38e/0xac0 netlink_rcv_skb+0x12d/0x3a0 netlink_unicast+0x4a2/0x740 netlink_sendmsg+0x826/0xcc0 sock_sendmsg+0xc5/0x100 ____sys_sendmsg+0x583/0x690 ___sys_sendmsg+0xe8/0x160 __sys_sendmsg+0xbf/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f2164122d04 </TASK> CVE-2022-50356 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50356.html CVE-2022-50356 https://bugzilla.suse.com/1250040 SUSE Bug 1250040 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: fix some leaks in probe The dwc3_get_properties() function calls: dwc->usb_psy = power_supply_get_by_name(usb_psy_name); so there is some additional clean up required on these error paths. CVE-2022-50357 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50357.html CVE-2022-50357 https://bugzilla.suse.com/1250042 SUSE Bug 1250042 In the Linux kernel, the following vulnerability has been resolved: brcmfmac: return error when getting invalid max_flowrings from dongle When firmware hit trap at initialization, host will read abnormal max_flowrings number from dongle, and it will cause kernel panic when doing iowrite to initialize dongle ring. To detect this error at early stage, we directly return error when getting invalid max_flowrings(>256). CVE-2022-50358 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50358.html CVE-2022-50358 https://bugzilla.suse.com/1250264 SUSE Bug 1250264 In the Linux kernel, the following vulnerability has been resolved: media: cx88: Fix a null-ptr-deref bug in buffer_prepare() When the driver calls cx88_risc_buffer() to prepare the buffer, the function call may fail, resulting in a empty buffer and null-ptr-deref later in buffer_queue(). The following log can reveal it: [ 41.822762] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN PTI [ 41.824488] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 41.828027] RIP: 0010:buffer_queue+0xc2/0x500 [ 41.836311] Call Trace: [ 41.836945] __enqueue_in_driver+0x141/0x360 [ 41.837262] vb2_start_streaming+0x62/0x4a0 [ 41.838216] vb2_core_streamon+0x1da/0x2c0 [ 41.838516] __vb2_init_fileio+0x981/0xbc0 [ 41.839141] __vb2_perform_fileio+0xbf9/0x1120 [ 41.840072] vb2_fop_read+0x20e/0x400 [ 41.840346] v4l2_read+0x215/0x290 [ 41.840603] vfs_read+0x162/0x4c0 Fix this by checking the return value of cx88_risc_buffer() [hverkuil: fix coding style issues] CVE-2022-50359 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50359.html CVE-2022-50359 https://bugzilla.suse.com/1250269 SUSE Bug 1250269 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: fix aux-bus EP lifetime Device-managed resources allocated post component bind must be tied to the lifetime of the aggregate DRM device or they will not necessarily be released when binding of the aggregate device is deferred. This can lead resource leaks or failure to bind the aggregate device when binding is later retried and a second attempt to allocate the resources is made. For the DP aux-bus, an attempt to populate the bus a second time will simply fail ("DP AUX EP device already populated"). Fix this by tying the lifetime of the EP device to the DRM device rather than DP controller platform device. Patchwork: https://patchwork.freedesktop.org/patch/502672/ CVE-2022-50360 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50360.html CVE-2022-50360 https://bugzilla.suse.com/1250037 SUSE Bug 1250037 In the Linux kernel, the following vulnerability has been resolved: dmaengine: hisilicon: Add multi-thread support for a DMA channel When we get a DMA channel and try to use it in multiple threads it will cause oops and hanging the system. % echo 100 > /sys/module/dmatest/parameters/threads_per_chan % echo 100 > /sys/module/dmatest/parameters/iterations % echo 1 > /sys/module/dmatest/parameters/run [383493.327077] Unable to handle kernel paging request at virtual address dead000000000108 [383493.335103] Mem abort info: [383493.335103] ESR = 0x96000044 [383493.335105] EC = 0x25: DABT (current EL), IL = 32 bits [383493.335107] SET = 0, FnV = 0 [383493.335108] EA = 0, S1PTW = 0 [383493.335109] FSC = 0x04: level 0 translation fault [383493.335110] Data abort info: [383493.335111] ISV = 0, ISS = 0x00000044 [383493.364739] CM = 0, WnR = 1 [383493.367793] [dead000000000108] address between user and kernel address ranges [383493.375021] Internal error: Oops: 96000044 [#1] PREEMPT SMP [383493.437574] CPU: 63 PID: 27895 Comm: dma0chan0-copy2 Kdump: loaded Tainted: GO 5.17.0-rc4+ #2 [383493.457851] pstate: 204000c9 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [383493.465331] pc : vchan_tx_submit+0x64/0xa0 [383493.469957] lr : vchan_tx_submit+0x34/0xa0 This occurs because the transmission timed out, and that's due to data race. Each thread rewrite channels's descriptor as soon as device_issue_pending is called. It leads to the situation that the driver thinks that it uses the right descriptor in interrupt handler while channels's descriptor has been changed by other thread. The descriptor which in fact reported interrupt will not be handled any more, as well as its tx->callback. That's why timeout reports. With current fixes channels' descriptor changes it's value only when it has been used. A new descriptor is acquired from vc->desc_issued queue that is already filled with descriptors that are ready to be sent. Threads have no direct access to DMA channel descriptor. In case of channel's descriptor is busy, try to submit to HW again when a descriptor is completed. In this case, vc->desc_issued may be empty when hisi_dma_start_transfer is called, so delete error reporting on this. Now it is just possible to queue a descriptor for further processing. CVE-2022-50362 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50362.html CVE-2022-50362 https://bugzilla.suse.com/1250039 SUSE Bug 1250039 In the Linux kernel, the following vulnerability has been resolved: i2c: mux: reg: check return value after calling platform_get_resource() It will cause null-ptr-deref in resource_size(), if platform_get_resource() returns NULL, move calling resource_size() after devm_ioremap_resource() that will check 'res' to avoid null-ptr-deref. And use devm_platform_get_and_ioremap_resource() to simplify code. CVE-2022-50364 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50364.html CVE-2022-50364 https://bugzilla.suse.com/1250083 SUSE Bug 1250083 In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfs_mdt_destroy In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then nilfs_is_metadata_file_inode() returns true and nilfs_free_inode() wrongly calls nilfs_mdt_destroy(), which frees the uninitialized inode->i_private and leads to crashes(e.g., UAF/GPF). Fix this by moving security_inode_alloc just prior to this_cpu_inc(nr_inodes) CVE-2022-50367 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50367.html CVE-2022-50367 https://bugzilla.suse.com/1250277 SUSE Bug 1250277 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork: https://patchwork.freedesktop.org/patch/502668/ CVE-2022-50368 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50368.html CVE-2022-50368 https://bugzilla.suse.com/1250009 SUSE Bug 1250009 In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix null-ptr-deref in vkms_release() A null-ptr-deref is triggered when it tries to destroy the workqueue in vkms->output.composer_workq in vkms_release(). KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] CPU: 5 PID: 17193 Comm: modprobe Not tainted 6.0.0-11331-gd465bff130bf #24 RIP: 0010:destroy_workqueue+0x2f/0x710 ... Call Trace: <TASK> ? vkms_config_debugfs_init+0x50/0x50 [vkms] __devm_drm_dev_alloc+0x15a/0x1c0 [drm] vkms_init+0x245/0x1000 [vkms] do_one_initcall+0xd0/0x4f0 do_init_module+0x1a4/0x680 load_module+0x6249/0x7110 __do_sys_finit_module+0x140/0x200 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The reason is that an OOM happened which triggers the destroy of the workqueue, however, the workqueue is alloced in the later process, thus a null-ptr-deref happened. A simple call graph is shown as below: vkms_init() vkms_create() devm_drm_dev_alloc() __devm_drm_dev_alloc() devm_drm_dev_init() devm_add_action_or_reset() devm_add_action() # an error happened devm_drm_dev_init_release() drm_dev_put() kref_put() drm_dev_release() vkms_release() destroy_workqueue() # null-ptr-deref happened vkms_modeset_init() vkms_output_init() vkms_crtc_init() # where the workqueue get allocated Fix this by checking if composer_workq is NULL before passing it to the destroy_workqueue() in vkms_release(). CVE-2022-50369 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50369.html CVE-2022-50369 https://bugzilla.suse.com/1250026 SUSE Bug 1250026 In the Linux kernel, the following vulnerability has been resolved: i2c: designware: Fix handling of real but unexpected device interrupts Commit c7b79a752871 ("mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs") caused a regression on certain Gigabyte motherboards for Intel Alder Lake-S where system crashes to NULL pointer dereference in i2c_dw_xfer_msg() when system resumes from S3 sleep state ("deep"). I was able to debug the issue on Gigabyte Z690 AORUS ELITE and made following notes: - Issue happens when resuming from S3 but not when resuming from "s2idle" - PCI device 00:15.0 == i2c_designware.0 is already in D0 state when system enters into pci_pm_resume_noirq() while all other i2c_designware PCI devices are in D3. Devices were runtime suspended and in D3 prior entering into suspend - Interrupt comes after pci_pm_resume_noirq() when device interrupts are re-enabled - According to register dump the interrupt really comes from the i2c_designware.0. Controller is enabled, I2C target address register points to a one detectable I2C device address 0x60 and the DW_IC_RAW_INTR_STAT register START_DET, STOP_DET, ACTIVITY and TX_EMPTY bits are set indicating completed I2C transaction. My guess is that the firmware uses this controller to communicate with an on-board I2C device during resume but does not disable the controller before giving control to an operating system. I was told the UEFI update fixes this but never the less it revealed the driver is not ready to handle TX_EMPTY (or RX_FULL) interrupt when device is supposed to be idle and state variables are not set (especially the dev->msgs pointer which may point to NULL or stale old data). Introduce a new software status flag STATUS_ACTIVE indicating when the controller is active in driver point of view. Now treat all interrupts that occur when is not set as unexpected and mask all interrupts from the controller. CVE-2022-50370 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50370.html CVE-2022-50370 https://bugzilla.suse.com/1250011 SUSE Bug 1250011 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory leak when build ntlmssp negotiate blob failed There is a memory leak when mount cifs: unreferenced object 0xffff888166059600 (size 448): comm "mount.cifs", pid 51391, jiffies 4295596373 (age 330.596s) hex dump (first 32 bytes): fe 53 4d 42 40 00 00 00 00 00 00 00 01 00 82 00 .SMB@........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000060609a61>] mempool_alloc+0xe1/0x260 [<00000000adfa6c63>] cifs_small_buf_get+0x24/0x60 [<00000000ebb404c7>] __smb2_plain_req_init+0x32/0x460 [<00000000bcf875b4>] SMB2_sess_alloc_buffer+0xa4/0x3f0 [<00000000753a2987>] SMB2_sess_auth_rawntlmssp_negotiate+0xf5/0x480 [<00000000f0c1f4f9>] SMB2_sess_setup+0x253/0x410 [<00000000a8b83303>] cifs_setup_session+0x18f/0x4c0 [<00000000854bd16d>] cifs_get_smb_ses+0xae7/0x13c0 [<000000006cbc43d9>] mount_get_conns+0x7a/0x730 [<000000005922d816>] cifs_mount+0x103/0xd10 [<00000000e33def3b>] cifs_smb3_do_mount+0x1dd/0xc90 [<0000000078034979>] smb3_get_tree+0x1d5/0x300 [<000000004371f980>] vfs_get_tree+0x41/0xf0 [<00000000b670d8a7>] path_mount+0x9b3/0xdd0 [<000000005e839a7d>] __x64_sys_mount+0x190/0x1d0 [<000000009404c3b9>] do_syscall_64+0x35/0x80 When build ntlmssp negotiate blob failed, the session setup request should be freed. CVE-2022-50372 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50372.html CVE-2022-50372 https://bugzilla.suse.com/1250052 SUSE Bug 1250052 In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix race in lowcomms This patch fixes a race between queue_work() in _dlm_lowcomms_commit_msg() and srcu_read_unlock(). The queue_work() can take the final reference of a dlm_msg and so msg->idx can contain garbage which is signaled by the following warning: [ 676.237050] ------------[ cut here ]------------ [ 676.237052] WARNING: CPU: 0 PID: 1060 at include/linux/srcu.h:189 dlm_lowcomms_commit_msg+0x41/0x50 [ 676.238945] Modules linked in: dlm_locktorture torture rpcsec_gss_krb5 intel_rapl_msr intel_rapl_common iTCO_wdt iTCO_vendor_support qxl kvm_intel drm_ttm_helper vmw_vsock_virtio_transport kvm vmw_vsock_virtio_transport_common ttm irqbypass crc32_pclmul joydev crc32c_intel serio_raw drm_kms_helper vsock virtio_scsi virtio_console virtio_balloon snd_pcm drm syscopyarea sysfillrect sysimgblt snd_timer fb_sys_fops i2c_i801 lpc_ich snd i2c_smbus soundcore pcspkr [ 676.244227] CPU: 0 PID: 1060 Comm: lock_torture_wr Not tainted 5.19.0-rc3+ #1546 [ 676.245216] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-2.module+el8.7.0+15506+033991b0 04/01/2014 [ 676.246460] RIP: 0010:dlm_lowcomms_commit_msg+0x41/0x50 [ 676.247132] Code: fe ff ff ff 75 24 48 c7 c6 bd 0f 49 bb 48 c7 c7 38 7c 01 bd e8 00 e7 ca ff 89 de 48 c7 c7 60 78 01 bd e8 42 3d cd ff 5b 5d c3 <0f> 0b eb d8 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 [ 676.249253] RSP: 0018:ffffa401c18ffc68 EFLAGS: 00010282 [ 676.249855] RAX: 0000000000000001 RBX: 00000000ffff8b76 RCX: 0000000000000006 [ 676.250713] RDX: 0000000000000000 RSI: ffffffffbccf3a10 RDI: ffffffffbcc7b62e [ 676.251610] RBP: ffffa401c18ffc70 R08: 0000000000000001 R09: 0000000000000001 [ 676.252481] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000005 [ 676.253421] R13: ffff8b76786ec370 R14: ffff8b76786ec370 R15: ffff8b76786ec480 [ 676.254257] FS: 0000000000000000(0000) GS:ffff8b7777800000(0000) knlGS:0000000000000000 [ 676.255239] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 676.255897] CR2: 00005590205d88b8 CR3: 000000017656c003 CR4: 0000000000770ee0 [ 676.256734] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 676.257567] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 676.258397] PKRU: 55555554 [ 676.258729] Call Trace: [ 676.259063] <TASK> [ 676.259354] dlm_midcomms_commit_mhandle+0xcc/0x110 [ 676.259964] queue_bast+0x8b/0xb0 [ 676.260423] grant_pending_locks+0x166/0x1b0 [ 676.261007] _unlock_lock+0x75/0x90 [ 676.261469] unlock_lock.isra.57+0x62/0xa0 [ 676.262009] dlm_unlock+0x21e/0x330 [ 676.262457] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 676.263183] torture_unlock+0x5a/0x90 [dlm_locktorture] [ 676.263815] ? preempt_count_sub+0xba/0x100 [ 676.264361] ? complete+0x1d/0x60 [ 676.264777] lock_torture_writer+0xb8/0x150 [dlm_locktorture] [ 676.265555] kthread+0x10a/0x130 [ 676.266007] ? kthread_complete_and_exit+0x20/0x20 [ 676.266616] ret_from_fork+0x22/0x30 [ 676.267097] </TASK> [ 676.267381] irq event stamp: 9579855 [ 676.267824] hardirqs last enabled at (9579863): [<ffffffffbb14e6f8>] __up_console_sem+0x58/0x60 [ 676.268896] hardirqs last disabled at (9579872): [<ffffffffbb14e6dd>] __up_console_sem+0x3d/0x60 [ 676.270008] softirqs last enabled at (9579798): [<ffffffffbc200349>] __do_softirq+0x349/0x4c7 [ 676.271438] softirqs last disabled at (9579897): [<ffffffffbb0d54c0>] irq_exit_rcu+0xb0/0xf0 [ 676.272796] ---[ end trace 0000000000000000 ]--- I reproduced this warning with dlm_locktorture test which is currently not upstream. However this patch fix the issue by make a additional refcount between dlm_lowcomms_new_msg() and dlm_lowcomms_commit_msg(). In case of the race the kref_put() in dlm_lowcomms_commit_msg() will be the final put. CVE-2022-50373 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50373.html CVE-2022-50373 https://bugzilla.suse.com/1250287 SUSE Bug 1250287 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure syzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1], for rcu_sync_enter() is called without rcu_sync_init() due to hci_uart_tty_open() ignoring percpu_init_rwsem() failure. While we are at it, fix that hci_uart_register_device() ignores percpu_init_rwsem() failure and hci_uart_unregister_device() does not call percpu_free_rwsem(). CVE-2022-50374 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50374.html CVE-2022-50374 https://bugzilla.suse.com/1250060 SUSE Bug 1250060 In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown lpuart_dma_shutdown tears down lpuart dma, but lpuart_flush_buffer can still occur which in turn tries to access dma apis if lpuart_dma_tx_use flag is true. At this point since dma is torn down, these dma apis can abort. Set lpuart_dma_tx_use and the corresponding rx flag lpuart_dma_rx_use to false in lpuart_dma_shutdown so that dmas are not accessed after they are relinquished. Otherwise, when try to kill btattach, kernel may panic. This patch may fix this issue. root@imx8ulpevk:~# btattach -B /dev/ttyLP2 -S 115200 ^C[ 90.182296] Internal error: synchronous external abort: 96000210 [#1] PREEMPT SMP [ 90.189806] Modules linked in: moal(O) mlan(O) [ 90.194258] CPU: 0 PID: 503 Comm: btattach Tainted: G O 5.15.32-06136-g34eecdf2f9e4 #37 [ 90.203554] Hardware name: NXP i.MX8ULP 9X9 EVK (DT) [ 90.208513] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 90.215470] pc : fsl_edma3_disable_request+0x8/0x60 [ 90.220358] lr : fsl_edma3_terminate_all+0x34/0x20c [ 90.225237] sp : ffff800013f0bac0 [ 90.228548] x29: ffff800013f0bac0 x28: 0000000000000001 x27: ffff000008404800 [ 90.235681] x26: ffff000008404960 x25: ffff000008404a08 x24: ffff000008404a00 [ 90.242813] x23: ffff000008404a60 x22: 0000000000000002 x21: 0000000000000000 [ 90.249946] x20: ffff800013f0baf8 x19: ffff00000559c800 x18: 0000000000000000 [ 90.257078] x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 [ 90.264211] x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000040 [ 90.271344] x11: ffff00000600c248 x10: ffff800013f0bb10 x9 : ffff000057bcb090 [ 90.278477] x8 : fffffc0000241a08 x7 : ffff00000534ee00 x6 : ffff000008404804 [ 90.285609] x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff0000055b3480 [ 90.292742] x2 : ffff8000135c0000 x1 : ffff00000534ee00 x0 : ffff00000559c800 [ 90.299876] Call trace: [ 90.302321] fsl_edma3_disable_request+0x8/0x60 [ 90.306851] lpuart_flush_buffer+0x40/0x160 [ 90.311037] uart_flush_buffer+0x88/0x120 [ 90.315050] tty_driver_flush_buffer+0x20/0x30 [ 90.319496] hci_uart_flush+0x44/0x90 [ 90.323162] +0x34/0x12c [ 90.327253] tty_ldisc_close+0x38/0x70 [ 90.331005] tty_ldisc_release+0xa8/0x190 [ 90.335018] tty_release_struct+0x24/0x8c [ 90.339022] tty_release+0x3ec/0x4c0 [ 90.342593] __fput+0x70/0x234 [ 90.345652] ____fput+0x14/0x20 [ 90.348790] task_work_run+0x84/0x17c [ 90.352455] do_exit+0x310/0x96c [ 90.355688] do_group_exit+0x3c/0xa0 [ 90.359259] __arm64_sys_exit_group+0x1c/0x20 [ 90.363609] invoke_syscall+0x48/0x114 [ 90.367362] el0_svc_common.constprop.0+0xd4/0xfc [ 90.372068] do_el0_svc+0x2c/0x94 [ 90.375379] el0_svc+0x28/0x80 [ 90.378438] el0t_64_sync_handler+0xa8/0x130 [ 90.382711] el0t_64_sync+0x1a0/0x1a4 [ 90.386376] Code: 17ffffda d503201f d503233f f9409802 (b9400041) [ 90.392467] ---[ end trace 2f60524b4a43f1f6 ]--- [ 90.397073] note: btattach[503] exited with preempt_count 1 [ 90.402636] Fixing recursive fault but reboot is needed! CVE-2022-50375 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50375.html CVE-2022-50375 https://bugzilla.suse.com/1250132 SUSE Bug 1250132 In the Linux kernel, the following vulnerability has been resolved: orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() When insert and remove the orangefs module, there are memory leaked as below: unreferenced object 0xffff88816b0cc000 (size 2048): comm "insmod", pid 783, jiffies 4294813439 (age 65.512s) hex dump (first 32 bytes): 6e 6f 6e 65 0a 00 00 00 00 00 00 00 00 00 00 00 none............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000031ab7788>] kmalloc_trace+0x27/0xa0 [<000000005b405fee>] orangefs_debugfs_init.cold+0xaf/0x17f [<00000000e5a0085b>] 0xffffffffa02780f9 [<000000004232d9f7>] do_one_initcall+0x87/0x2a0 [<0000000054f22384>] do_init_module+0xdf/0x320 [<000000003263bdea>] load_module+0x2f98/0x3330 [<0000000052cd4153>] __do_sys_finit_module+0x113/0x1b0 [<00000000250ae02b>] do_syscall_64+0x35/0x80 [<00000000f11c03c7>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Use the golbal variable as the buffer rather than dynamic allocate to slove the problem. CVE-2022-50376 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50376.html CVE-2022-50376 https://bugzilla.suse.com/1250209 SUSE Bug 1250209 In the Linux kernel, the following vulnerability has been resolved: drm/meson: reorder driver deinit sequence to fix use-after-free bug Unloading the driver triggers the following KASAN warning: [ +0.006275] ============================================================= [ +0.000029] BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0x1a0 [ +0.000026] Read of size 8 at addr ffff000020c395e0 by task rmmod/2695 [ +0.000019] CPU: 5 PID: 2695 Comm: rmmod Tainted: G C O 5.19.0-rc6-lrmbkasan+ #1 [ +0.000013] Hardware name: Hardkernel ODROID-N2Plus (DT) [ +0.000008] Call trace: [ +0.000007] dump_backtrace+0x1ec/0x280 [ +0.000013] show_stack+0x24/0x80 [ +0.000008] dump_stack_lvl+0x98/0xd4 [ +0.000011] print_address_description.constprop.0+0x80/0x520 [ +0.000011] print_report+0x128/0x260 [ +0.000007] kasan_report+0xb8/0xfc [ +0.000008] __asan_report_load8_noabort+0x3c/0x50 [ +0.000010] __list_del_entry_valid+0xe0/0x1a0 [ +0.000009] drm_atomic_private_obj_fini+0x30/0x200 [drm] [ +0.000172] drm_bridge_detach+0x94/0x260 [drm] [ +0.000145] drm_encoder_cleanup+0xa4/0x290 [drm] [ +0.000144] drm_mode_config_cleanup+0x118/0x740 [drm] [ +0.000143] drm_mode_config_init_release+0x1c/0x2c [drm] [ +0.000144] drm_managed_release+0x170/0x414 [drm] [ +0.000142] drm_dev_put.part.0+0xc0/0x124 [drm] [ +0.000143] drm_dev_put+0x20/0x30 [drm] [ +0.000142] meson_drv_unbind+0x1d8/0x2ac [meson_drm] [ +0.000028] take_down_aggregate_device+0xb0/0x160 [ +0.000016] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000015] platform_remove+0x64/0xb0 [ +0.000009] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000009] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000012] __do_sys_delete_module+0x288/0x400 [ +0.000011] __arm64_sys_delete_module+0x5c/0x80 [ +0.000009] invoke_syscall+0x74/0x260 [ +0.000009] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000009] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000012] el0t_64_sync_handler+0x11c/0x150 [ +0.000008] el0t_64_sync+0x18c/0x190 [ +0.000018] Allocated by task 0: [ +0.000007] (stack is not available) [ +0.000011] Freed by task 2695: [ +0.000008] kasan_save_stack+0x2c/0x5c [ +0.000011] kasan_set_track+0x2c/0x40 [ +0.000008] kasan_set_free_info+0x28/0x50 [ +0.000009] ____kasan_slab_free+0x128/0x1d4 [ +0.000008] __kasan_slab_free+0x18/0x24 [ +0.000007] slab_free_freelist_hook+0x108/0x230 [ +0.000011] kfree+0x110/0x35c [ +0.000008] release_nodes+0xf0/0x16c [ +0.000009] devres_release_group+0x180/0x270 [ +0.000008] component_unbind+0x128/0x1e0 [ +0.000010] component_unbind_all+0x1b8/0x264 [ +0.000009] meson_drv_unbind+0x1a0/0x2ac [meson_drm] [ +0.000025] take_down_aggregate_device+0xb0/0x160 [ +0.000009] component_del+0x18c/0x360 [ +0.000009] meson_dw_hdmi_remove+0x28/0x40 [meson_dw_hdmi] [ +0.000012] platform_remove+0x64/0xb0 [ +0.000008] device_remove+0xb8/0x154 [ +0.000009] device_release_driver_internal+0x398/0x5b0 [ +0.000009] driver_detach+0xac/0x1b0 [ +0.000009] bus_remove_driver+0x158/0x29c [ +0.000008] driver_unregister+0x70/0xb0 [ +0.000008] platform_driver_unregister+0x20/0x2c [ +0.000008] meson_dw_hdmi_platform_driver_exit+0x1c/0x30 [meson_dw_hdmi] [ +0.000011] __do_sys_delete_module+0x288/0x400 [ +0.000010] __arm64_sys_delete_module+0x5c/0x80 [ +0.000008] invoke_syscall+0x74/0x260 [ +0.000008] el0_svc_common.constprop.0+0xcc/0x260 [ +0.000008] do_el0_svc+0x50/0x70 [ +0.000007] el0_svc+0x68/0x1a0 [ +0.000009] el0t_64_sync_handler+0x11c/0x150 [ +0.000009] el0t_64_sync+0x18c/0x190 [ +0.000014] The buggy address belongs to the object at ffff000020c39000 ---truncated--- CVE-2022-50378 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50378.html CVE-2022-50378 https://bugzilla.suse.com/1250306 SUSE Bug 1250306 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota enable and quota rescan ioctl When enabling quotas, at btrfs_quota_enable(), after committing the transaction, we change fs_info->quota_root to point to the quota root we created and set BTRFS_FS_QUOTA_ENABLED at fs_info->flags. Then we try to start the qgroup rescan worker, first by initializing it with a call to qgroup_rescan_init() - however if that fails we end up freeing the quota root but we leave fs_info->quota_root still pointing to it, this can later result in a use-after-free somewhere else. We have previously set the flags BTRFS_FS_QUOTA_ENABLED and BTRFS_QGROUP_STATUS_FLAG_ON, so we can only fail with -EINPROGRESS at btrfs_quota_enable(), which is possible if someone already called the quota rescan ioctl, and therefore started the rescan worker. So fix this by ignoring an -EINPROGRESS and asserting we can't get any other error. CVE-2022-50379 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50379.html CVE-2022-50379 https://bugzilla.suse.com/1250245 SUSE Bug 1250245 In the Linux kernel, the following vulnerability has been resolved: md: fix a crash in mempool_free There's a crash in mempool_free when running the lvm test shell/lvchange-rebuild-raid.sh. The reason for the crash is this: * super_written calls atomic_dec_and_test(&mddev->pending_writes) and wake_up(&mddev->sb_wait). Then it calls rdev_dec_pending(rdev, mddev) and bio_put(bio). * so, the process that waited on sb_wait and that is woken up is racing with bio_put(bio). * if the process wins the race, it calls bioset_exit before bio_put(bio) is executed. * bio_put(bio) attempts to free a bio into a destroyed bio set - causing a crash in mempool_free. We fix this bug by moving bio_put before atomic_dec_and_test. We also move rdev_dec_pending before atomic_dec_and_test as suggested by Neil Brown. The function md_end_flush has a similar bug - we must call bio_put before we decrement the number of in-progress bios. BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 11557f0067 P4D 11557f0067 PUD 0 Oops: 0002 [#1] PREEMPT SMP CPU: 0 PID: 73 Comm: kworker/0:1 Not tainted 6.1.0-rc3 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014 Workqueue: kdelayd flush_expired_bios [dm_delay] RIP: 0010:mempool_free+0x47/0x80 Code: 48 89 ef 5b 5d ff e0 f3 c3 48 89 f7 e8 32 45 3f 00 48 63 53 08 48 89 c6 3b 53 04 7d 2d 48 8b 43 10 8d 4a 01 48 89 df 89 4b 08 <48> 89 2c d0 e8 b0 45 3f 00 48 8d 7b 30 5b 5d 31 c9 ba 01 00 00 00 RSP: 0018:ffff88910036bda8 EFLAGS: 00010093 RAX: 0000000000000000 RBX: ffff8891037b65d8 RCX: 0000000000000001 RDX: 0000000000000000 RSI: 0000000000000202 RDI: ffff8891037b65d8 RBP: ffff8891447ba240 R08: 0000000000012908 R09: 00000000003d0900 R10: 0000000000000000 R11: 0000000000173544 R12: ffff889101a14000 R13: ffff8891562ac300 R14: ffff889102b41440 R15: ffffe8ffffa00d05 FS: 0000000000000000(0000) GS:ffff88942fa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000001102e99000 CR4: 00000000000006b0 Call Trace: <TASK> clone_endio+0xf4/0x1c0 [dm_mod] clone_endio+0xf4/0x1c0 [dm_mod] __submit_bio+0x76/0x120 submit_bio_noacct_nocheck+0xb6/0x2a0 flush_expired_bios+0x28/0x2f [dm_delay] process_one_work+0x1b4/0x300 worker_thread+0x45/0x3e0 ? rescuer_thread+0x380/0x380 kthread+0xc2/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 </TASK> Modules linked in: brd dm_delay dm_raid dm_mod af_packet uvesafb cfbfillrect cfbimgblt cn cfbcopyarea fb font fbdev tun autofs4 binfmt_misc configfs ipv6 virtio_rng virtio_balloon rng_core virtio_net pcspkr net_failover failover qemu_fw_cfg button mousedev raid10 raid456 libcrc32c async_raid6_recov async_memcpy async_pq raid6_pq async_xor xor async_tx raid1 raid0 md_mod sd_mod t10_pi crc64_rocksoft crc64 virtio_scsi scsi_mod evdev psmouse bsg scsi_common [last unloaded: brd] CR2: 0000000000000000 ---[ end trace 0000000000000000 ]--- CVE-2022-50381 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50381.html CVE-2022-50381 https://bugzilla.suse.com/1250257 SUSE Bug 1250257 In the Linux kernel, the following vulnerability has been resolved: NFS: Fix an Oops in nfs_d_automount() When mounting from a NFSv4 referral, path->dentry can end up being a negative dentry, so derive the struct nfs_server from the dentry itself instead. CVE-2022-50385 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50385.html CVE-2022-50385 https://bugzilla.suse.com/1250131 SUSE Bug 1250131 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_chan_destroy(struct kref *kref) Bluetooth: chan 0000000023c4974d Bluetooth: parent 00000000ae861c08 ================================================================== BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline] BUG: KASAN: use-after-free in __mutex_lock_common kernel/locking/mutex.c:671 [inline] BUG: KASAN: use-after-free in __mutex_lock+0x278/0x400 kernel/locking/mutex.c:729 Read of size 8 at addr ffff888006a49b08 by task kworker/u3:2/389 CVE-2022-50386 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50386.html CVE-2022-50386 https://bugzilla.suse.com/1250301 SUSE Bug 1250301 In the Linux kernel, the following vulnerability has been resolved: nvme: fix multipath crash caused by flush request when blktrace is enabled The flush request initialized by blk_kick_flush has NULL bio, and it may be dealt with nvme_end_req during io completion. When blktrace is enabled, nvme_trace_bio_complete with multipath activated trying to access NULL pointer bio from flush request results in the following crash: [ 2517.831677] BUG: kernel NULL pointer dereference, address: 000000000000001a [ 2517.835213] #PF: supervisor read access in kernel mode [ 2517.838724] #PF: error_code(0x0000) - not-present page [ 2517.842222] PGD 7b2d51067 P4D 0 [ 2517.845684] Oops: 0000 [#1] SMP NOPTI [ 2517.849125] CPU: 2 PID: 732 Comm: kworker/2:1H Kdump: loaded Tainted: G S 5.15.67-0.cl9.x86_64 #1 [ 2517.852723] Hardware name: XFUSION 2288H V6/BC13MBSBC, BIOS 1.13 07/27/2022 [ 2517.856358] Workqueue: nvme_tcp_wq nvme_tcp_io_work [nvme_tcp] [ 2517.859993] RIP: 0010:blk_add_trace_bio_complete+0x6/0x30 [ 2517.863628] Code: 1f 44 00 00 48 8b 46 08 31 c9 ba 04 00 10 00 48 8b 80 50 03 00 00 48 8b 78 50 e9 e5 fe ff ff 0f 1f 44 00 00 41 54 49 89 f4 55 <0f> b6 7a 1a 48 89 d5 e8 3e 1c 2b 00 48 89 ee 4c 89 e7 5d 89 c1 ba [ 2517.871269] RSP: 0018:ff7f6a008d9dbcd0 EFLAGS: 00010286 [ 2517.875081] RAX: ff3d5b4be00b1d50 RBX: 0000000002040002 RCX: ff3d5b0a270f2000 [ 2517.878966] RDX: 0000000000000000 RSI: ff3d5b0b021fb9f8 RDI: 0000000000000000 [ 2517.882849] RBP: ff3d5b0b96a6fa00 R08: 0000000000000001 R09: 0000000000000000 [ 2517.886718] R10: 000000000000000c R11: 000000000000000c R12: ff3d5b0b021fb9f8 [ 2517.890575] R13: 0000000002000000 R14: ff3d5b0b021fb1b0 R15: 0000000000000018 [ 2517.894434] FS: 0000000000000000(0000) GS:ff3d5b42bfc80000(0000) knlGS:0000000000000000 [ 2517.898299] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2517.902157] CR2: 000000000000001a CR3: 00000004f023e005 CR4: 0000000000771ee0 [ 2517.906053] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2517.909930] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 2517.913761] PKRU: 55555554 [ 2517.917558] Call Trace: [ 2517.921294] <TASK> [ 2517.924982] nvme_complete_rq+0x1c3/0x1e0 [nvme_core] [ 2517.928715] nvme_tcp_recv_pdu+0x4d7/0x540 [nvme_tcp] [ 2517.932442] nvme_tcp_recv_skb+0x4f/0x240 [nvme_tcp] [ 2517.936137] ? nvme_tcp_recv_pdu+0x540/0x540 [nvme_tcp] [ 2517.939830] tcp_read_sock+0x9c/0x260 [ 2517.943486] nvme_tcp_try_recv+0x65/0xa0 [nvme_tcp] [ 2517.947173] nvme_tcp_io_work+0x64/0x90 [nvme_tcp] [ 2517.950834] process_one_work+0x1e8/0x390 [ 2517.954473] worker_thread+0x53/0x3c0 [ 2517.958069] ? process_one_work+0x390/0x390 [ 2517.961655] kthread+0x10c/0x130 [ 2517.965211] ? set_kthread_struct+0x40/0x40 [ 2517.968760] ret_from_fork+0x1f/0x30 [ 2517.972285] </TASK> To avoid this situation, add a NULL check for req->bio before calling trace_block_bio_complete. CVE-2022-50388 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50388.html CVE-2022-50388 https://bugzilla.suse.com/1250293 SUSE Bug 1250293 In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak In crb_acpi_add(), we get the TPM2 table to retrieve information like start method, and then assign them to the priv data, so the TPM2 table is not used after the init, should be freed, call acpi_put_table() to fix the memory leak. CVE-2022-50389 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50389.html CVE-2022-50389 https://bugzilla.suse.com/1250121 SUSE Bug 1250121 In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning calltrace like below: UBSAN: shift-out-of-bounds in ./include/drm/ttm/ttm_tt.h:122:26 left shift of 1 by 31 places cannot be represented in type 'int' Call Trace: <TASK> dump_stack_lvl+0x7d/0xa5 dump_stack+0x15/0x1b ubsan_epilogue+0xe/0x4e __ubsan_handle_shift_out_of_bounds+0x1e7/0x20c ttm_bo_move_memcpy+0x3b4/0x460 [ttm] bo_driver_move+0x32/0x40 [drm_vram_helper] ttm_bo_handle_move_mem+0x118/0x200 [ttm] ttm_bo_validate+0xfa/0x220 [ttm] drm_gem_vram_pin_locked+0x70/0x1b0 [drm_vram_helper] drm_gem_vram_pin+0x48/0xb0 [drm_vram_helper] drm_gem_vram_plane_helper_prepare_fb+0x53/0xe0 [drm_vram_helper] drm_gem_vram_simple_display_pipe_prepare_fb+0x26/0x30 [drm_vram_helper] drm_simple_kms_plane_prepare_fb+0x4d/0xe0 [drm_kms_helper] drm_atomic_helper_prepare_planes+0xda/0x210 [drm_kms_helper] drm_atomic_helper_commit+0xc3/0x1e0 [drm_kms_helper] drm_atomic_commit+0x9c/0x160 [drm] drm_client_modeset_commit_atomic+0x33a/0x380 [drm] drm_client_modeset_commit_locked+0x77/0x220 [drm] drm_client_modeset_commit+0x31/0x60 [drm] __drm_fb_helper_restore_fbdev_mode_unlocked+0xa7/0x170 [drm_kms_helper] drm_fb_helper_set_par+0x51/0x90 [drm_kms_helper] fbcon_init+0x316/0x790 visual_init+0x113/0x1d0 do_bind_con_driver+0x2a3/0x5c0 do_take_over_console+0xa9/0x270 do_fbcon_takeover+0xa1/0x170 do_fb_registered+0x2a8/0x340 fbcon_fb_registered+0x47/0xe0 register_framebuffer+0x294/0x4a0 __drm_fb_helper_initial_config_and_unlock+0x43c/0x880 [drm_kms_helper] drm_fb_helper_initial_config+0x52/0x80 [drm_kms_helper] drm_fbdev_client_hotplug+0x156/0x1b0 [drm_kms_helper] drm_fbdev_generic_setup+0xfc/0x290 [drm_kms_helper] bochs_pci_probe+0x6ca/0x772 [bochs] local_pci_probe+0x4d/0xb0 pci_device_probe+0x119/0x320 really_probe+0x181/0x550 __driver_probe_device+0xc6/0x220 driver_probe_device+0x32/0x100 __driver_attach+0x195/0x200 bus_for_each_dev+0xbb/0x120 driver_attach+0x27/0x30 bus_add_driver+0x22e/0x2f0 driver_register+0xa9/0x190 __pci_register_driver+0x90/0xa0 bochs_pci_driver_init+0x52/0x1000 [bochs] do_one_initcall+0x76/0x430 do_init_module+0x61/0x28a load_module+0x1f82/0x2e50 __do_sys_finit_module+0xf8/0x190 __x64_sys_finit_module+0x23/0x30 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> CVE-2022-50390 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50390.html CVE-2022-50390 https://bugzilla.suse.com/1250130 SUSE Bug 1250130 In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix memory leak in set_mempolicy_home_node system call When encountering any vma in the range with policy other than MPOL_BIND or MPOL_PREFERRED_MANY, an error is returned without issuing a mpol_put on the policy just allocated with mpol_dup(). This allows arbitrary users to leak kernel memory. CVE-2022-50391 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50391.html CVE-2022-50391 https://bugzilla.suse.com/1250138 SUSE Bug 1250138 In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() The node returned by of_parse_phandle() with refcount incremented, of_node_put() needs be called when finish using it. So add it in the error path in mt8183_mt6358_ts3a227_max98357_dev_probe(). CVE-2022-50392 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50392.html CVE-2022-50392 https://bugzilla.suse.com/1250105 SUSE Bug 1250105 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: SDMA update use unlocked iterator SDMA update page table may be called from unlocked context, this generate below warning. Use unlocked iterator to handle this case. WARNING: CPU: 0 PID: 1475 at drivers/dma-buf/dma-resv.c:483 dma_resv_iter_next Call Trace: dma_resv_iter_first+0x43/0xa0 amdgpu_vm_sdma_update+0x69/0x2d0 [amdgpu] amdgpu_vm_ptes_update+0x29c/0x870 [amdgpu] amdgpu_vm_update_range+0x2f6/0x6c0 [amdgpu] svm_range_unmap_from_gpus+0x115/0x300 [amdgpu] svm_range_cpu_invalidate_pagetables+0x510/0x5e0 [amdgpu] __mmu_notifier_invalidate_range_start+0x1d3/0x230 unmap_vmas+0x140/0x150 unmap_region+0xa8/0x110 CVE-2022-50393 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50393.html CVE-2022-50393 https://bugzilla.suse.com/1250278 SUSE Bug 1250278 In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The following log can reveal it: [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE [ 33.996475] ================================================================== [ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485 [ 33.999450] Call Trace: [ 34.001849] memcpy+0x20/0x60 [ 34.002077] ismt_access.cold+0x374/0x214b [ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0 [ 34.004007] i2c_smbus_xfer+0x10a/0x390 [ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710 [ 34.005196] i2cdev_ioctl+0x5ec/0x74c Fix this bug by checking the size of 'data->block[0]' first. CVE-2022-50394 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50394.html CVE-2022-50394 https://bugzilla.suse.com/1250107 SUSE Bug 1250107 In the Linux kernel, the following vulnerability has been resolved: integrity: Fix memory leakage in keyring allocation error path Key restriction is allocated in integrity_init_keyring(). However, if keyring allocation failed, it is not freed, causing memory leaks. CVE-2022-50395 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50395.html CVE-2022-50395 https://bugzilla.suse.com/1250211 SUSE Bug 1250211 In the Linux kernel, the following vulnerability has been resolved: net: sched: fix memory leak in tcindex_set_parms Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810c287f00 (size 256): comm "syz-executor105", pid 3600, jiffies 4294943292 (age 12.990s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff814cf9f0>] kmalloc_trace+0x20/0x90 mm/slab_common.c:1046 [<ffffffff839c9e07>] kmalloc include/linux/slab.h:576 [inline] [<ffffffff839c9e07>] kmalloc_array include/linux/slab.h:627 [inline] [<ffffffff839c9e07>] kcalloc include/linux/slab.h:659 [inline] [<ffffffff839c9e07>] tcf_exts_init include/net/pkt_cls.h:250 [inline] [<ffffffff839c9e07>] tcindex_set_parms+0xa7/0xbe0 net/sched/cls_tcindex.c:342 [<ffffffff839caa1f>] tcindex_change+0xdf/0x120 net/sched/cls_tcindex.c:553 [<ffffffff8394db62>] tc_new_tfilter+0x4f2/0x1100 net/sched/cls_api.c:2147 [<ffffffff8389e91c>] rtnetlink_rcv_msg+0x4dc/0x5d0 net/core/rtnetlink.c:6082 [<ffffffff839eba67>] netlink_rcv_skb+0x87/0x1d0 net/netlink/af_netlink.c:2540 [<ffffffff839eab87>] netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] [<ffffffff839eab87>] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink.c:1345 [<ffffffff839eb046>] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink.c:1921 [<ffffffff8383e796>] sock_sendmsg_nosec net/socket.c:714 [inline] [<ffffffff8383e796>] sock_sendmsg+0x56/0x80 net/socket.c:734 [<ffffffff8383eb08>] ____sys_sendmsg+0x178/0x410 net/socket.c:2482 [<ffffffff83843678>] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536 [<ffffffff838439c5>] __sys_sendmmsg+0x105/0x330 net/socket.c:2622 [<ffffffff83843c14>] __do_sys_sendmmsg net/socket.c:2651 [inline] [<ffffffff83843c14>] __se_sys_sendmmsg net/socket.c:2648 [inline] [<ffffffff83843c14>] __x64_sys_sendmmsg+0x24/0x30 net/socket.c:2648 [<ffffffff84605fd5>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff84605fd5>] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [<ffffffff84800087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd ==================================== Kernel uses tcindex_change() to change an existing filter properties. Yet the problem is that, during the process of changing, if `old_r` is retrieved from `p->perfect`, then kernel uses tcindex_alloc_perfect_hash() to newly allocate filter results, uses tcindex_filter_result_init() to clear the old filter result, without destroying its tcf_exts structure, which triggers the above memory leak. To be more specific, there are only two source for the `old_r`, according to the tcindex_lookup(). `old_r` is retrieved from `p->perfect`, or `old_r` is retrieved from `p->h`. * If `old_r` is retrieved from `p->perfect`, kernel uses tcindex_alloc_perfect_hash() to newly allocate the filter results. Then `r` is assigned with `cp->perfect + handle`, which is newly allocated. So condition `old_r && old_r != r` is true in this situation, and kernel uses tcindex_filter_result_init() to clear the old filter result, without destroying its tcf_exts structure * If `old_r` is retrieved from `p->h`, then `p->perfect` is NULL according to the tcindex_lookup(). Considering that `cp->h` is directly copied from `p->h` and `p->perfect` is NULL, `r` is assigned with `tcindex_lookup(cp, handle)`, whose value should be the same as `old_r`, so condition `old_r && old_r != r` is false in this situation, kernel ignores using tcindex_filter_result_init() to clear the old filter result. So only when `old_r` is retrieved from `p->perfect` does kernel use tcindex_filter_result_init() to clear the old filter result, which triggers the above memory leak. Considering that there already exists a tc_filter_wq workqueue to destroy the old tcindex_d ---truncated--- CVE-2022-50396 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50396.html CVE-2022-50396 https://bugzilla.suse.com/1250104 SUSE Bug 1250104 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: add atomic_check to bridge ops DRM commit_tails() will disable downstream crtc/encoder/bridge if both disable crtc is required and crtc->active is set before pushing a new frame downstream. There is a rare case that user space display manager issue an extra screen update immediately followed by close DRM device while down stream display interface is disabled. This extra screen update will timeout due to the downstream interface is disabled but will cause crtc->active be set. Hence the followed commit_tails() called by drm_release() will pass the disable downstream crtc/encoder/bridge conditions checking even downstream interface is disabled. This cause the crash to happen at dp_bridge_disable() due to it trying to access the main link register to push the idle pattern out while main link clocks is disabled. This patch adds atomic_check to prevent the extra frame will not be pushed down if display interface is down so that crtc->active will not be set neither. This will fail the conditions checking of disabling down stream crtc/encoder/bridge which prevent drm_release() from calling dp_bridge_disable() so that crash at dp_bridge_disable() prevented. There is no protection in the DRM framework to check if the display pipeline has been already disabled before trying again. The only check is the crtc_state->active but this is controlled by usermode using UAPI. Hence if the usermode sets this and then crashes, the driver needs to protect against double disable. SError Interrupt on CPU7, code 0x00000000be000411 -- SError CPU: 7 PID: 3878 Comm: Xorg Not tainted 5.19.0-stb-cbq #19 Hardware name: Google Lazor (rev3 - 8) (DT) pstate: a04000c9 (NzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __cmpxchg_case_acq_32+0x14/0x2c lr : do_raw_spin_lock+0xa4/0xdc sp : ffffffc01092b6a0 x29: ffffffc01092b6a0 x28: 0000000000000028 x27: 0000000000000038 x26: 0000000000000004 x25: ffffffd2973dce48 x24: 0000000000000000 x23: 00000000ffffffff x22: 00000000ffffffff x21: ffffffd2978d0008 x20: ffffffd2978d0008 x19: ffffff80ff759fc0 x18: 0000000000000000 x17: 004800a501260460 x16: 0441043b04600438 x15: 04380000089807d0 x14: 07b0089807800780 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000438 x10: 00000000000007d0 x9 : ffffffd2973e09e4 x8 : ffffff8092d53300 x7 : ffffff808902e8b8 x6 : 0000000000000001 x5 : ffffff808902e880 x4 : 0000000000000000 x3 : ffffff80ff759fc0 x2 : 0000000000000001 x1 : 0000000000000000 x0 : ffffff80ff759fc0 Kernel panic - not syncing: Asynchronous SError Interrupt CPU: 7 PID: 3878 Comm: Xorg Not tainted 5.19.0-stb-cbq #19 Hardware name: Google Lazor (rev3 - 8) (DT) Call trace: dump_backtrace.part.0+0xbc/0xe4 show_stack+0x24/0x70 dump_stack_lvl+0x68/0x84 dump_stack+0x18/0x34 panic+0x14c/0x32c nmi_panic+0x58/0x7c arm64_serror_panic+0x78/0x84 do_serror+0x40/0x64 el1h_64_error_handler+0x30/0x48 el1h_64_error+0x68/0x6c __cmpxchg_case_acq_32+0x14/0x2c _raw_spin_lock_irqsave+0x38/0x4c lock_timer_base+0x40/0x78 __mod_timer+0xf4/0x25c schedule_timeout+0xd4/0xfc __wait_for_common+0xac/0x140 wait_for_completion_timeout+0x2c/0x54 dp_ctrl_push_idle+0x40/0x88 dp_bridge_disable+0x24/0x30 drm_atomic_bridge_chain_disable+0x90/0xbc drm_atomic_helper_commit_modeset_disables+0x198/0x444 msm_atomic_commit_tail+0x1d0/0x374 commit_tail+0x80/0x108 drm_atomic_helper_commit+0x118/0x11c drm_atomic_commit+0xb4/0xe0 drm_client_modeset_commit_atomic+0x184/0x224 drm_client_modeset_commit_locked+0x58/0x160 drm_client_modeset_commit+0x3c/0x64 __drm_fb_helper_restore_fbdev_mode_unlocked+0x98/0xac drm_fb_helper_set_par+0x74/0x80 drm_fb_helper_hotplug_event+0xdc/0xe0 __drm_fb_helper_restore_fbdev_mode_unlocked+0x7c/0xac drm_fb_helper_restore_fbdev_mode_unlocked+0x20/0x2c drm_fb_helper_lastclose+0x20/0x2c drm_lastclose+0x44/0x6c drm_release+0x88/0xd4 __fput+0x104/0x220 ____fput+0x1c/0x28 task_work_run+0x8c/0x100 d ---truncated--- CVE-2022-50398 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50398.html CVE-2022-50398 https://bugzilla.suse.com/1250103 SUSE Bug 1250103 In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in sh_css_set_black_frame() The "height" and "width" values come from the user so the "height * width" multiplication can overflow. CVE-2022-50399 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50399.html CVE-2022-50399 https://bugzilla.suse.com/1250108 SUSE Bug 1250108 In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and the error handling path of the caller call to put it. Better to delay handing over the reference to a later branch. [ 72.530665] refcount_t: underflow; use-after-free. [ 72.531933] WARNING: CPU: 0 PID: 173 at lib/refcount.c:28 refcount_warn_saturate+0xcf/0x120 [ 72.533075] Modules linked in: nfsd(OE) nfsv4(OE) nfsv3(OE) nfs(OE) lockd(OE) compat_nfs_ssc(OE) nfs_acl(OE) rpcsec_gss_krb5(OE) auth_rpcgss(OE) rpcrdma(OE) dns_resolver fscache netfs grace rdma_cm iw_cm ib_cm sunrpc(OE) mlx5_ib mlx5_core mlxfw pci_hyperv_intf ib_uverbs ib_core xt_MASQUERADE nf_conntrack_netlink nft_counter xt_addrtype nft_compat br_netfilter bridge stp llc nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set overlay nf_tables nfnetlink crct10dif_pclmul crc32_pclmul ghash_clmulni_intel xfs serio_raw virtio_net virtio_blk net_failover failover fuse [last unloaded: sunrpc] [ 72.540389] CPU: 0 PID: 173 Comm: kworker/u16:5 Tainted: G OE 5.15.82-dan #1 [ 72.541511] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+1084+97b81f61 04/01/2014 [ 72.542717] Workqueue: nfsd4_callbacks nfsd4_run_cb_work [nfsd] [ 72.543575] RIP: 0010:refcount_warn_saturate+0xcf/0x120 [ 72.544299] Code: 55 00 0f 0b 5d e9 01 50 98 00 80 3d 75 9e 39 08 00 0f 85 74 ff ff ff 48 c7 c7 e8 d1 60 8e c6 05 61 9e 39 08 01 e8 f6 51 55 00 <0f> 0b 5d e9 d9 4f 98 00 80 3d 4b 9e 39 08 00 0f 85 4c ff ff ff 48 [ 72.546666] RSP: 0018:ffffb3f841157cf0 EFLAGS: 00010286 [ 72.547393] RAX: 0000000000000026 RBX: ffff89ac6231d478 RCX: 0000000000000000 [ 72.548324] RDX: ffff89adb7c2c2c0 RSI: ffff89adb7c205c0 RDI: ffff89adb7c205c0 [ 72.549271] RBP: ffffb3f841157cf0 R08: 0000000000000000 R09: c0000000ffefffff [ 72.550209] R10: 0000000000000001 R11: ffffb3f841157ad0 R12: ffff89ac6231d180 [ 72.551142] R13: ffff89ac6231d478 R14: ffff89ac40c06180 R15: ffff89ac6231d4b0 [ 72.552089] FS: 0000000000000000(0000) GS:ffff89adb7c00000(0000) knlGS:0000000000000000 [ 72.553175] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 72.553934] CR2: 0000563a310506a8 CR3: 0000000109a66000 CR4: 0000000000350ef0 [ 72.554874] Call Trace: [ 72.555278] <TASK> [ 72.555614] svc_xprt_put+0xaf/0xe0 [sunrpc] [ 72.556276] nfsd4_process_cb_update.isra.11+0xb7/0x410 [nfsd] [ 72.557087] ? update_load_avg+0x82/0x610 [ 72.557652] ? cpuacct_charge+0x60/0x70 [ 72.558212] ? dequeue_entity+0xdb/0x3e0 [ 72.558765] ? queued_spin_unlock+0x9/0x20 [ 72.559358] nfsd4_run_cb_work+0xfc/0x270 [nfsd] [ 72.560031] process_one_work+0x1df/0x390 [ 72.560600] worker_thread+0x37/0x3b0 [ 72.561644] ? process_one_work+0x390/0x390 [ 72.562247] kthread+0x12f/0x150 [ 72.562710] ? set_kthread_struct+0x50/0x50 [ 72.563309] ret_from_fork+0x22/0x30 [ 72.563818] </TASK> [ 72.564189] ---[ end trace 031117b1c72ec616 ]--- [ 72.566019] list_add corruption. next->prev should be prev (ffff89ac4977e538), but was ffff89ac4763e018. (next=ffff89ac4763e018). [ 72.567647] ------------[ cut here ]------------ CVE-2022-50401 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50401.html CVE-2022-50401 https://bugzilla.suse.com/1250140 SUSE Bug 1250140 In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() Check the return value of md_bitmap_get_counter() in case it returns NULL pointer, which will result in a null pointer dereference. v2: update the check to include other dereference CVE-2022-50402 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50402.html CVE-2022-50402 https://bugzilla.suse.com/1250363 SUSE Bug 1250363 In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: release buffer when fbcon_do_set_font() failed syzbot is reporting memory leak at fbcon_do_set_font() [1], for commit a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed") missed that the buffer might be newly allocated by fbcon_set_font(). CVE-2022-50404 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50404.html CVE-2022-50404 https://bugzilla.suse.com/1250153 SUSE Bug 1250153 In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00000000000000f8 Buffer I/O error on dev dm-0, logical block 8733687, async page read Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 user pgtable: 64k pages, 42-bit VAs, pgdp=0000000139750000 [00000000000000f8] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Buffer I/O error on dev dm-0, logical block 8733688, async page read Dumping ftrace buffer: Buffer I/O error on dev dm-0, logical block 8733689, async page read (ftrace buffer empty) XFS (dm-0): log I/O error -5 Modules linked in: dm_thin_pool dm_persistent_data XFS (dm-0): Metadata I/O Error (0x1) detected at xfs_trans_read_buf_map+0x1ec/0x590 [xfs] (fs/xfs/xfs_trans_buf.c:296). dm_bio_prison XFS (dm-0): Please unmount the filesystem and rectify the problem(s) XFS (dm-0): xfs_imap_lookup: xfs_ialloc_read_agi() returned error -5, agno 0 dm_bufio dm_log_writes xfs nft_chain_nat xt_REDIRECT nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip6t_REJECT potentially unexpected fatal signal 6. nf_reject_ipv6 potentially unexpected fatal signal 6. ipt_REJECT nf_reject_ipv4 CPU: 1 PID: 122166 Comm: fsstress Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7 rpcsec_gss_krb5 auth_rpcgss xt_tcpudp ip_set_hash_ip ip_set_hash_net xt_set nft_compat ip_set_hash_mac ip_set nf_tables Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 pstate: 60001000 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE=--) ip_tables pc : 000003fd6d7df200 x_tables lr : 000003fd6d7df1ec overlay nfsv4 CPU: 0 PID: 54031 Comm: u4:3 Tainted: G W 6.0.0-rc5-djwa #rc5 3004c9f1de887ebae86015f2677638ce51ee7405 Hardware name: QEMU KVM Virtual Machine, BIOS 1.5.1 06/16/2021 Workqueue: writeback wb_workfn sp : 000003ffd9522fd0 (flush-253:0) pstate: 60401005 (nZCv daif +PAN -UAO -TCO -DIT +SSBS BTYPE=--) pc : errseq_set+0x1c/0x100 x29: 000003ffd9522fd0 x28: 0000000000000023 x27: 000002acefeb6780 x26: 0000000000000005 x25: 0000000000000001 x24: 0000000000000000 x23: 00000000ffffffff x22: 0000000000000005 lr : __filemap_set_wb_err+0x24/0xe0 x21: 0000000000000006 sp : fffffe000f80f760 x29: fffffe000f80f760 x28: 0000000000000003 x27: fffffe000f80f9f8 x26: 0000000002523000 x25: 00000000fffffffb x24: fffffe000f80f868 x23: fffffe000f80fbb0 x22: fffffc0180c26a78 x21: 0000000002530000 x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000 x14: 0000000000000001 x13: 0000000000470af3 x12: fffffc0058f70000 x11: 0000000000000040 x10: 0000000000001b20 x9 : fffffe000836b288 x8 : fffffc00eb9fd480 x7 : 0000000000f83659 x6 : 0000000000000000 x5 : 0000000000000869 x4 : 0000000000000005 x3 : 00000000000000f8 x20: 000003fd6d740020 x19: 000000000001dd36 x18: 0000000000000001 x17: 000003fd6d78704c x16: 0000000000000001 x15: 000002acfac87668 x2 : 0000000000000ffa x1 : 00000000fffffffb x0 : 00000000000000f8 Call trace: errseq_set+0x1c/0x100 __filemap_set_wb_err+0x24/0xe0 iomap_do_writepage+0x5e4/0xd5c write_cache_pages+0x208/0x674 iomap_writepages+0x34/0x60 xfs_vm_writepages+0x8c/0xcc [xfs 7a861f39c43631f15d3a5884246ba5035d4ca78b] x14: 0000000000000000 x13: 2064656e72757465 x12: 0000000000002180 x11: 000003fd6d8a82d0 x10: 0000000000000000 x9 : 000003fd6d8ae288 x8 : 0000000000000083 x7 : 00000000ffffffff x6 : 00000000ffffffee x5 : 00000000fbad2887 x4 : 000003fd6d9abb58 x3 : 000003fd6d740020 x2 : 0000000000000006 x1 : 000000000001dd36 x0 : 0000000000000000 CPU: ---truncated--- CVE-2022-50406 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50406.html CVE-2022-50406 https://bugzilla.suse.com/1250165 SUSE Bug 1250165 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.tx_bytes += skb->len; [ 46.912801] ================================================================== [ 46.920552] BUG: KASAN: use-after-free in brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.928673] Read of size 4 at addr ffffff803f5882e8 by task systemd-resolve/328 [ 46.935991] [ 46.937514] CPU: 1 PID: 328 Comm: systemd-resolve Tainted: G O 5.4.199-[REDACTED] #1 [ 46.947255] Hardware name: [REDACTED] [ 46.954568] Call trace: [ 46.957037] dump_backtrace+0x0/0x2b8 [ 46.960719] show_stack+0x24/0x30 [ 46.964052] dump_stack+0x128/0x194 [ 46.967557] print_address_description.isra.0+0x64/0x380 [ 46.972877] __kasan_report+0x1d4/0x240 [ 46.976723] kasan_report+0xc/0x18 [ 46.980138] __asan_report_load4_noabort+0x18/0x20 [ 46.985027] brcmf_netdev_start_xmit+0x718/0x8c8 [brcmfmac] [ 46.990613] dev_hard_start_xmit+0x1bc/0xda0 [ 46.994894] sch_direct_xmit+0x198/0xd08 [ 46.998827] __qdisc_run+0x37c/0x1dc0 [ 47.002500] __dev_queue_xmit+0x1528/0x21f8 [ 47.006692] dev_queue_xmit+0x24/0x30 [ 47.010366] neigh_resolve_output+0x37c/0x678 [ 47.014734] ip_finish_output2+0x598/0x2458 [ 47.018927] __ip_finish_output+0x300/0x730 [ 47.023118] ip_output+0x2e0/0x430 [ 47.026530] ip_local_out+0x90/0x140 [ 47.030117] igmpv3_sendpack+0x14c/0x228 [ 47.034049] igmpv3_send_cr+0x384/0x6b8 [ 47.037895] igmp_ifc_timer_expire+0x4c/0x118 [ 47.042262] call_timer_fn+0x1cc/0xbe8 [ 47.046021] __run_timers+0x4d8/0xb28 [ 47.049693] run_timer_softirq+0x24/0x40 [ 47.053626] __do_softirq+0x2c0/0x117c [ 47.057387] irq_exit+0x2dc/0x388 [ 47.060715] __handle_domain_irq+0xb4/0x158 [ 47.064908] gic_handle_irq+0x58/0xb0 [ 47.068581] el0_irq_naked+0x50/0x5c [ 47.072162] [ 47.073665] Allocated by task 328: [ 47.077083] save_stack+0x24/0xb0 [ 47.080410] __kasan_kmalloc.isra.0+0xc0/0xe0 [ 47.084776] kasan_slab_alloc+0x14/0x20 [ 47.088622] kmem_cache_alloc+0x15c/0x468 [ 47.092643] __alloc_skb+0xa4/0x498 [ 47.096142] igmpv3_newpack+0x158/0xd78 [ 47.099987] add_grhead+0x210/0x288 [ 47.103485] add_grec+0x6b0/0xb70 [ 47.106811] igmpv3_send_cr+0x2e0/0x6b8 [ 47.110657] igmp_ifc_timer_expire+0x4c/0x118 [ 47.115027] call_timer_fn+0x1cc/0xbe8 [ 47.118785] __run_timers+0x4d8/0xb28 [ 47.122457] run_timer_softirq+0x24/0x40 [ 47.126389] __do_softirq+0x2c0/0x117c [ 47.130142] [ 47.131643] Freed by task 180: [ 47.134712] save_stack+0x24/0xb0 [ 47.138041] __kasan_slab_free+0x108/0x180 [ 47.142146] kasan_slab_free+0x10/0x18 [ 47.145904] slab_free_freelist_hook+0xa4/0x1b0 [ 47.150444] kmem_cache_free+0x8c/0x528 [ 47.154292] kfree_skbmem+0x94/0x108 [ 47.157880] consume_skb+0x10c/0x5a8 [ 47.161466] __dev_kfree_skb_any+0x88/0xa0 [ 47.165598] brcmu_pkt_buf_free_skb+0x44/0x68 [brcmutil] [ 47.171023] brcmf_txfinalize+0xec/0x190 [brcmfmac] [ 47.176016] brcmf_proto_bcdc_txcomplete+0x1c0/0x210 [brcmfmac] [ 47.182056] brcmf_sdio_sendfromq+0x8dc/0x1e80 [brcmfmac] [ 47.187568] brcmf_sdio_dpc+0xb48/0x2108 [brcmfmac] [ 47.192529] brcmf_sdio_dataworker+0xc8/0x238 [brcmfmac] [ 47.197859] process_one_work+0x7fc/0x1a80 [ 47.201965] worker_thread+0x31c/0xc40 [ 47.205726] kthread+0x2d8/0x370 [ 47.208967] ret_from_fork+0x10/0x18 [ 47.212546] [ 47.214051] The buggy address belongs to the object at ffffff803f588280 [ 47.214051] which belongs to the cache skbuff_head_cache of size 208 [ 47.227086] The buggy address is located 104 bytes inside of [ 47.227086] 208-byte region [ffffff803f588280, ffffff803f588350) [ 47.238814] The buggy address belongs to the page: [ 47.243618] page:ffffffff00dd6200 refcount:1 mapcou ---truncated--- CVE-2022-50408 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50408.html CVE-2022-50408 https://bugzilla.suse.com/1250391 SUSE Bug 1250391 In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+0x245/0x2e0 [ 14.472416] ? remove_wait_queue+0x12/0x50 [ 14.473014] ? _raw_spin_lock_irqsave+0x17/0x50 [ 14.473681] _raw_spin_lock_irqsave+0x3d/0x50 [ 14.474318] ? remove_wait_queue+0x12/0x50 [ 14.474907] remove_wait_queue+0x12/0x50 [ 14.475480] sk_stream_wait_memory+0x20d/0x340 [ 14.476127] ? do_wait_intr_irq+0x80/0x80 [ 14.476704] do_tcp_sendpages+0x287/0x600 [ 14.477283] tcp_bpf_push+0xab/0x260 [ 14.477817] tcp_bpf_sendmsg_redir+0x297/0x500 [ 14.478461] ? __local_bh_enable_ip+0x77/0xe0 [ 14.479096] tcp_bpf_send_verdict+0x105/0x470 [ 14.479729] tcp_bpf_sendmsg+0x318/0x4f0 [ 14.480311] sock_sendmsg+0x2d/0x40 [ 14.480822] ____sys_sendmsg+0x1b4/0x1c0 [ 14.481390] ? copy_msghdr_from_user+0x62/0x80 [ 14.482048] ___sys_sendmsg+0x78/0xb0 [ 14.482580] ? vmf_insert_pfn_prot+0x91/0x150 [ 14.483215] ? __do_fault+0x2a/0x1a0 [ 14.483738] ? do_fault+0x15e/0x5d0 [ 14.484246] ? __handle_mm_fault+0x56b/0x1040 [ 14.484874] ? lock_is_held_type+0xdf/0x130 [ 14.485474] ? find_held_lock+0x2d/0x90 [ 14.486046] ? __sys_sendmsg+0x41/0x70 [ 14.486587] __sys_sendmsg+0x41/0x70 [ 14.487105] ? intel_pmu_drain_pebs_core+0x350/0x350 [ 14.487822] do_syscall_64+0x34/0x80 [ 14.488345] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] The test scenario has the following flow: thread1 thread2 ----------- --------------- tcp_bpf_sendmsg tcp_bpf_send_verdict tcp_bpf_sendmsg_redir sock_close tcp_bpf_push_locked __sock_release tcp_bpf_push //inet_release do_tcp_sendpages sock->ops->release sk_stream_wait_memory // tcp_close sk_wait_event sk->sk_prot->close release_sock(__sk); *** lock_sock(sk); __tcp_close sock_orphan(sk) sk->sk_wq = NULL release_sock **** lock_sock(__sk); remove_wait_queue(sk_sleep(sk), &wait); sk_sleep(sk) //NULL pointer dereference &rcu_dereference_raw(sk->sk_wq)->wait While waiting for memory in thread1, the socket is released with its wait queue because thread2 has closed it. This caused by tcp_bpf_send_verdict didn't increase the f_count of psock->sk_redir->sk_socket->file in thread1. We should check if SOCK_DEAD flag is set on wakeup in sk_stream_wait_memory before accessing the wait queue. CVE-2022-50409 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50409.html CVE-2022-50409 https://bugzilla.suse.com/1250392 SUSE Bug 1250392 https://bugzilla.suse.com/1250665 SUSE Bug 1250665 In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffers into a single array of pages. This works because there are no cases where an operation needs a large RPC Call message and a large RPC Reply at the same time. Once an RPC Call has been received, svc_process() updates svc_rqst::rq_res to describe the part of rq_pages that can be used for constructing the Reply. This means that the send buffer (rq_res) shrinks when the received RPC record containing the RPC Call is large. A client can force this shrinkage on TCP by sending a correctly- formed RPC Call header contained in an RPC record that is excessively large. The full maximum payload size cannot be constructed in that case. CVE-2022-50410 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50410.html CVE-2022-50410 https://bugzilla.suse.com/1250187 SUSE Bug 1250187 In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and code inspection reveals that next_walk_state pushed to the thread by acpi_ds_create_walk_state() is freed on errors, but it is not popped from the thread beforehand. Thus acpi_ds_get_current_walk_state() called by acpi_ps_parse_aml() subsequently returns it as the new walk state which is incorrect. To address this, make acpi_ds_call_control_method() call acpi_ds_pop_walk_state() to pop next_walk_state from the thread before returning an error. CVE-2022-50411 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50411.html CVE-2022-50411 https://bugzilla.suse.com/1250393 SUSE Bug 1250393 In the Linux kernel, the following vulnerability has been resolved: drm: bridge: adv7511: unregister cec i2c device after cec adapter cec_unregister_adapter() assumes that the underlying adapter ops are callable. For example, if the CEC adapter currently has a valid physical address, then the unregistration procedure will invalidate the physical address by setting it to f.f.f.f. Whence the following kernel oops observed after removing the adv7511 module: Unable to handle kernel execution of user memory at virtual address 0000000000000000 Internal error: Oops: 86000004 [#1] PREEMPT_RT SMP Call trace: 0x0 adv7511_cec_adap_log_addr+0x1ac/0x1c8 [adv7511] cec_adap_unconfigure+0x44/0x90 [cec] __cec_s_phys_addr.part.0+0x68/0x230 [cec] __cec_s_phys_addr+0x40/0x50 [cec] cec_unregister_adapter+0xb4/0x118 [cec] adv7511_remove+0x60/0x90 [adv7511] i2c_device_remove+0x34/0xe0 device_release_driver_internal+0x114/0x1f0 driver_detach+0x54/0xe0 bus_remove_driver+0x60/0xd8 driver_unregister+0x34/0x60 i2c_del_driver+0x2c/0x68 adv7511_exit+0x1c/0x67c [adv7511] __arm64_sys_delete_module+0x154/0x288 invoke_syscall+0x48/0x100 el0_svc_common.constprop.0+0x48/0xe8 do_el0_svc+0x28/0x88 el0_svc+0x1c/0x50 el0t_64_sync_handler+0xa8/0xb0 el0t_64_sync+0x15c/0x160 Code: bad PC value ---[ end trace 0000000000000000 ]--- Protect against this scenario by unregistering i2c_cec after unregistering the CEC adapter. Duly disable the CEC clock afterwards too. CVE-2022-50412 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50412.html CVE-2022-50412 https://bugzilla.suse.com/1250189 SUSE Bug 1250189 In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport), but when fcoe_if_init() fails, &fcoe_sw_transport is not detached and leaves freed &fcoe_sw_transport on fcoe_transports list. This causes panic when reinserting module. BUG: unable to handle page fault for address: fffffbfff82e2213 RIP: 0010:fcoe_transport_attach+0xe1/0x230 [libfcoe] Call Trace: <TASK> do_one_initcall+0xd0/0x4e0 load_module+0x5eee/0x7210 ... CVE-2022-50414 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50414.html CVE-2022-50414 https://bugzilla.suse.com/1250183 SUSE Bug 1250183 In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix GEM handle creation ref-counting panfrost_gem_create_with_handle() previously returned a BO but with the only reference being from the handle, which user space could in theory guess and release, causing a use-after-free. Additionally if the call to panfrost_gem_mapping_get() in panfrost_ioctl_create_bo() failed then a(nother) reference on the BO was dropped. The _create_with_handle() is a problematic pattern, so ditch it and instead create the handle in panfrost_ioctl_create_bo(). If the call to panfrost_gem_mapping_get() fails then this means that user space has indeed gone behind our back and freed the handle. In which case just return an error code. CVE-2022-50417 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50417.html CVE-2022-50417 https://bugzilla.suse.com/1250184 SUSE Bug 1250184 In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() mhi_alloc_controller() allocates a memory space for mhi_ctrl. When gets some error, mhi_ctrl should be freed with mhi_free_controller(). But when ath11k_mhi_read_addr_from_dt() fails, the function returns without calling mhi_free_controller(), which will lead to a memory leak. We can fix it by calling mhi_free_controller() when ath11k_mhi_read_addr_from_dt() fails. CVE-2022-50418 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50418.html CVE-2022-50418 https://bugzilla.suse.com/1250285 SUSE Bug 1250285 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_add shall not be called multiple times as stated in its documentation: 'Do not call this routine or device_register() more than once for any device structure' Syzkaller reports a bug as follows [1]: ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:33! invalid opcode: 0000 [#1] PREEMPT SMP KASAN [...] Call Trace: <TASK> __list_add include/linux/list.h:69 [inline] list_add_tail include/linux/list.h:102 [inline] kobj_kset_join lib/kobject.c:164 [inline] kobject_add_internal+0x18f/0x8f0 lib/kobject.c:214 kobject_add_varg lib/kobject.c:358 [inline] kobject_add+0x150/0x1c0 lib/kobject.c:410 device_add+0x368/0x1e90 drivers/base/core.c:3452 hci_conn_add_sysfs+0x9b/0x1b0 net/bluetooth/hci_sysfs.c:53 hci_le_cis_estabilished_evt+0x57c/0xae0 net/bluetooth/hci_event.c:6799 hci_le_meta_evt+0x2b8/0x510 net/bluetooth/hci_event.c:7110 hci_event_func net/bluetooth/hci_event.c:7440 [inline] hci_event_packet+0x63d/0xfd0 net/bluetooth/hci_event.c:7495 hci_rx_work+0xae7/0x1230 net/bluetooth/hci_core.c:4007 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> CVE-2022-50419 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50419.html CVE-2022-50419 https://bugzilla.suse.com/1250394 SUSE Bug 1250394 In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() When executing SMP task failed, the smp_execute_task_sg() calls del_timer() to delete "slow_task->timer". However, if the timer handler sas_task_internal_timedout() is running, the del_timer() in smp_execute_task_sg() will not stop it and a UAF will happen. The process is shown below: (thread 1) | (thread 2) smp_execute_task_sg() | sas_task_internal_timedout() ... | del_timer() | ... | ... sas_free_task(task) | kfree(task->slow_task) //FREE| | task->slow_task->... //USE Fix by calling del_timer_sync() in smp_execute_task_sg(), which makes sure the timer handler have finished before the "task->slow_task" is deallocated. CVE-2022-50422 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50422.html CVE-2022-50422 https://bugzilla.suse.com/1250774 SUSE Bug 1250774 In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1 at addr ffff888112afc460 by task modprobe/2111 CPU: 0 PID: 2111 Comm: modprobe Not tainted 6.1.0-rc7-dirty Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), Call Trace: <TASK> kasan_report+0xae/0xe0 acpi_ut_remove_reference+0x3b/0x82 acpi_ut_copy_iobject_to_iobject+0x3be/0x3d5 acpi_ds_store_object_to_local+0x15d/0x3a0 acpi_ex_store+0x78d/0x7fd acpi_ex_opcode_1A_1T_1R+0xbe4/0xf9b acpi_ps_parse_aml+0x217/0x8d5 ... </TASK> The root cause of the problem is that the acpi_operand_object is freed when acpi_ut_walk_package_tree() fails in acpi_ut_copy_ipackage_to_ipackage(), lead to repeated release in acpi_ut_copy_iobject_to_iobject(). The problem was introduced by "8aa5e56eeb61" commit, this commit is to fix memory leak in acpi_ut_copy_iobject_to_iobject(), repeatedly adding remove operation, lead to "acpi_operand_object" used after free. Fix it by removing acpi_ut_remove_reference() in acpi_ut_copy_ipackage_to_ipackage(). acpi_ut_copy_ipackage_to_ipackage() is called to copy an internal package object into another internal package object, when it fails, the memory of acpi_operand_object should be freed by the caller. CVE-2022-50423 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50423.html CVE-2022-50423 https://bugzilla.suse.com/1250784 SUSE Bug 1250784 In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly When an extended state component is not present in fpstate, but in init state, the function copies from init_fpstate via copy_feature(). But, dynamic states are not present in init_fpstate because of all-zeros init states. Then retrieving them from init_fpstate will explode like this: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... RIP: 0010:memcpy_erms+0x6/0x10 ? __copy_xstate_to_uabi_buf+0x381/0x870 fpu_copy_guest_fpstate_to_uabi+0x28/0x80 kvm_arch_vcpu_ioctl+0x14c/0x1460 [kvm] ? __this_cpu_preempt_check+0x13/0x20 ? vmx_vcpu_put+0x2e/0x260 [kvm_intel] kvm_vcpu_ioctl+0xea/0x6b0 [kvm] ? kvm_vcpu_ioctl+0xea/0x6b0 [kvm] ? __fget_light+0xd4/0x130 __x64_sys_ioctl+0xe3/0x910 ? debug_smp_processor_id+0x17/0x20 ? fpregs_assert_state_consistent+0x27/0x50 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Adjust the 'mask' to zero out the userspace buffer for the features that are not available both from fpstate and from init_fpstate. The dynamic features depend on the compacted XSAVE format. Ensure it is enabled before reading XCOMP_BV in init_fpstate. CVE-2022-50425 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50425.html CVE-2022-50425 https://bugzilla.suse.com/1250781 SUSE Bug 1250781 In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() If device_register() fails in snd_ac97_dev_register(), it should call put_device() to give up reference, or the name allocated in dev_set_name() is leaked. CVE-2022-50427 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50427.html CVE-2022-50427 https://bugzilla.suse.com/1250787 SUSE Bug 1250787 In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one errors in fast-commit block filling Due to several different off-by-one errors, or perhaps due to a late change in design that wasn't fully reflected in the code that was actually merged, there are several very strange constraints on how fast-commit blocks are filled with tlv entries: - tlvs must start at least 10 bytes before the end of the block, even though the minimum tlv length is 8. Otherwise, the replay code will ignore them. (BUG: ext4_fc_reserve_space() could violate this requirement if called with a len of blocksize - 9 or blocksize - 8. Fortunately, this doesn't seem to happen currently.) - tlvs must end at least 1 byte before the end of the block. Otherwise the replay code will consider them to be invalid. This quirk contributed to a bug (fixed by an earlier commit) where uninitialized memory was being leaked to disk in the last byte of blocks. Also, strangely these constraints don't apply to the replay code in e2fsprogs, which will accept any tlvs in the blocks (with no bounds checks at all, but that is a separate issue...). Given that this all seems to be a bug, let's fix it by just filling blocks with tlv entries in the natural way. Note that old kernels will be unable to replay fast-commit journals created by kernels that have this commit. CVE-2022-50428 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50428.html CVE-2022-50428 https://bugzilla.suse.com/1250786 SUSE Bug 1250786 In the Linux kernel, the following vulnerability has been resolved: memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refcount. CVE-2022-50429 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50429.html CVE-2022-50429 https://bugzilla.suse.com/1250811 SUSE Bug 1250811 In the Linux kernel, the following vulnerability has been resolved: mmc: vub300: fix warning - do not call blocking ops when !TASK_RUNNING vub300_enable_sdio_irq() works with mutex and need TASK_RUNNING here. Ensure that we mark current as TASK_RUNNING for sleepable context. [ 77.554641] do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff92a72c1d>] sdio_irq_thread+0x17d/0x5b0 [ 77.554652] WARNING: CPU: 2 PID: 1983 at kernel/sched/core.c:9813 __might_sleep+0x116/0x160 [ 77.554905] CPU: 2 PID: 1983 Comm: ksdioirqd/mmc1 Tainted: G OE 6.1.0-rc5 #1 [ 77.554910] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020 [ 77.554912] RIP: 0010:__might_sleep+0x116/0x160 [ 77.554920] RSP: 0018:ffff888107b7fdb8 EFLAGS: 00010282 [ 77.554923] RAX: 0000000000000000 RBX: ffff888118c1b740 RCX: 0000000000000000 [ 77.554926] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffed1020f6ffa9 [ 77.554928] RBP: ffff888107b7fde0 R08: 0000000000000001 R09: ffffed1043ea60ba [ 77.554930] R10: ffff88821f5305cb R11: ffffed1043ea60b9 R12: ffffffff93aa3a60 [ 77.554932] R13: 000000000000011b R14: 7fffffffffffffff R15: ffffffffc0558660 [ 77.554934] FS: 0000000000000000(0000) GS:ffff88821f500000(0000) knlGS:0000000000000000 [ 77.554937] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 77.554939] CR2: 00007f8a44010d68 CR3: 000000024421a003 CR4: 00000000003706e0 [ 77.554942] Call Trace: [ 77.554944] <TASK> [ 77.554952] mutex_lock+0x78/0xf0 [ 77.554973] vub300_enable_sdio_irq+0x103/0x3c0 [vub300] [ 77.554981] sdio_irq_thread+0x25c/0x5b0 [ 77.555006] kthread+0x2b8/0x370 [ 77.555017] ret_from_fork+0x1f/0x30 [ 77.555023] </TASK> [ 77.555025] ---[ end trace 0000000000000000 ]--- CVE-2022-50430 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50430.html CVE-2022-50430 https://bugzilla.suse.com/1250791 SUSE Bug 1250791 In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() dev_set_name() in soundbus_add_one() allocates memory for name, it need be freed when of_device_register() fails, call soundbus_dev_put() to give up the reference that hold in device_initialize(), so that it can be freed in kobject_cleanup() when the refcount hit to 0. And other resources are also freed in i2sbus_release_dev(), so it can return 0 directly. CVE-2022-50431 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50431.html CVE-2022-50431 https://bugzilla.suse.com/1250790 SUSE Bug 1250790 In the Linux kernel, the following vulnerability has been resolved: kernfs: fix use-after-free in __kernfs_remove Syzkaller managed to trigger concurrent calls to kernfs_remove_by_name_ns() for the same file resulting in a KASAN detected use-after-free. The race occurs when the root node is freed during kernfs_drain(). To prevent this acquire an additional reference for the root of the tree that is removed before calling __kernfs_remove(). Found by syzkaller with the following reproducer (slab_nomerge is required): syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) close(r0) pipe2(&(0x7f0000000140)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x800) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) Sample report: ================================================================== BUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline] BUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 CPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 kasan_report+0xa3/0x130 mm/kasan/report.c:495 kernfs_type include/linux/kernfs.h:335 [inline] kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 __kernfs_remove fs/kernfs/dir.c:1356 [inline] kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943 __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 create_cache mm/slab_common.c:229 [inline] kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 p9_client_create+0xd4d/0x1190 net/9p/client.c:993 v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 vfs_get_tree+0x85/0x2e0 fs/super.c:1530 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x675/0x1d00 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f725f983aed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f725f0f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 RBP: 00007f725f9f419c R08: 0000000020000280 R09: 0000000000000000 R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 </TASK> Allocated by task 855: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:7 ---truncated--- CVE-2022-50432 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50432.html CVE-2022-50432 https://bugzilla.suse.com/1250851 SUSE Bug 1250851 In the Linux kernel, the following vulnerability has been resolved: efi: ssdt: Don't free memory if ACPI table was loaded successfully Amadeusz reports KASAN use-after-free errors introduced by commit 3881ee0b1edc ("efi: avoid efivars layer when loading SSDTs from variables"). The problem appears to be that the memory that holds the new ACPI table is now freed unconditionally, instead of only when the ACPI core reported a failure to load the table. So let's fix this, by omitting the kfree() on success. CVE-2022-50433 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50433.html CVE-2022-50433 https://bugzilla.suse.com/1250814 SUSE Bug 1250814 In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix possible memleak when register 'hctx' failed There's issue as follows when do fault injection test: unreferenced object 0xffff888132a9f400 (size 512): comm "insmod", pid 308021, jiffies 4324277909 (age 509.733s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 08 f4 a9 32 81 88 ff ff ...........2.... 08 f4 a9 32 81 88 ff ff 00 00 00 00 00 00 00 00 ...2............ backtrace: [<00000000e8952bb4>] kmalloc_node_trace+0x22/0xa0 [<00000000f9980e0f>] blk_mq_alloc_and_init_hctx+0x3f1/0x7e0 [<000000002e719efa>] blk_mq_realloc_hw_ctxs+0x1e6/0x230 [<000000004f1fda40>] blk_mq_init_allocated_queue+0x27e/0x910 [<00000000287123ec>] __blk_mq_alloc_disk+0x67/0xf0 [<00000000a2a34657>] 0xffffffffa2ad310f [<00000000b173f718>] 0xffffffffa2af824a [<0000000095a1dabb>] do_one_initcall+0x87/0x2a0 [<00000000f32fdf93>] do_init_module+0xdf/0x320 [<00000000cbe8541e>] load_module+0x3006/0x3390 [<0000000069ed1bdb>] __do_sys_finit_module+0x113/0x1b0 [<00000000a1a29ae8>] do_syscall_64+0x35/0x80 [<000000009cd878b0>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fault injection context as follows: kobject_add blk_mq_register_hctx blk_mq_sysfs_register blk_register_queue device_add_disk null_add_dev.part.0 [null_blk] As 'blk_mq_register_hctx' may already add some objects when failed halfway, but there isn't do fallback, caller don't know which objects add failed. To solve above issue just do fallback when add objects failed halfway in 'blk_mq_register_hctx'. CVE-2022-50434 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50434.html CVE-2022-50434 https://bugzilla.suse.com/1250792 SUSE Bug 1250792 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid crash when inline data creation follows DIO write When inode is created and written to using direct IO, there is nothing to clear the EXT4_STATE_MAY_INLINE_DATA flag. Thus when inode gets truncated later to say 1 byte and written using normal write, we will try to store the data as inline data. This confuses the code later because the inode now has both normal block and inline data allocated and the confusion manifests for example as: kernel BUG at fs/ext4/inode.c:2721! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 359 Comm: repro Not tainted 5.19.0-rc8-00001-g31ba1e3b8305-dirty #15 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 RIP: 0010:ext4_writepages+0x363d/0x3660 RSP: 0018:ffffc90000ccf260 EFLAGS: 00010293 RAX: ffffffff81e1abcd RBX: 0000008000000000 RCX: ffff88810842a180 RDX: 0000000000000000 RSI: 0000008000000000 RDI: 0000000000000000 RBP: ffffc90000ccf650 R08: ffffffff81e17d58 R09: ffffed10222c680b R10: dfffe910222c680c R11: 1ffff110222c680a R12: ffff888111634128 R13: ffffc90000ccf880 R14: 0000008410000000 R15: 0000000000000001 FS: 00007f72635d2640(0000) GS:ffff88811b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000565243379180 CR3: 000000010aa74000 CR4: 0000000000150eb0 Call Trace: <TASK> do_writepages+0x397/0x640 filemap_fdatawrite_wbc+0x151/0x1b0 file_write_and_wait_range+0x1c9/0x2b0 ext4_sync_file+0x19e/0xa00 vfs_fsync_range+0x17b/0x190 ext4_buffered_write_iter+0x488/0x530 ext4_file_write_iter+0x449/0x1b90 vfs_write+0xbcd/0xf40 ksys_write+0x198/0x2c0 __x64_sys_write+0x7b/0x90 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Fix the problem by clearing EXT4_STATE_MAY_INLINE_DATA when we are doing direct IO write to a file. CVE-2022-50435 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50435.html CVE-2022-50435 https://bugzilla.suse.com/1250799 SUSE Bug 1250799 In the Linux kernel, the following vulnerability has been resolved: ext4: don't set up encryption key during jbd2 transaction Commit a80f7fcf1867 ("ext4: fixup ext4_fc_track_* functions' signature") extended the scope of the transaction in ext4_unlink() too far, making it include the call to ext4_find_entry(). However, ext4_find_entry() can deadlock when called from within a transaction because it may need to set up the directory's encryption key. Fix this by restoring the transaction to its original scope. CVE-2022-50436 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50436.html CVE-2022-50436 https://bugzilla.suse.com/1250846 SUSE Bug 1250846 In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: fix memory corruption with too many bridges Add the missing sanity check on the bridge counter to avoid corrupting data beyond the fixed-sized bridge array in case there are ever more than eight bridges. Patchwork: https://patchwork.freedesktop.org/patch/502670/ CVE-2022-50437 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50437.html CVE-2022-50437 https://bugzilla.suse.com/1250797 SUSE Bug 1250797 In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8173: Enable IRQ when pdata is ready If the device does not come straight from reset, we might receive an IRQ before we are ready to handle it. [ 2.334737] Unable to handle kernel read from unreadable memory at virtual address 00000000000001e4 [ 2.522601] Call trace: [ 2.525040] regmap_read+0x1c/0x80 [ 2.528434] mt8173_afe_irq_handler+0x40/0xf0 ... [ 2.598921] start_kernel+0x338/0x42c CVE-2022-50439 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50439.html CVE-2022-50439 https://bugzilla.suse.com/1250948 SUSE Bug 1250948 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. To fix it the dimensions of the copybox have to be validated against the expected size of the snooped cursor. CVE-2022-50440 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50440.html CVE-2022-50440 https://bugzilla.suse.com/1250853 SUSE Bug 1250853 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Lag, fix failure to cancel delayed bond work Commit 0d4e8ed139d8 ("net/mlx5: Lag, avoid lockdep warnings") accidentally removed a call to cancel delayed bond work thus it may cause queued delay to expire and fall on an already destroyed work queue. Fix by restoring the call cancel_delayed_work_sync() before destroying the workqueue. This prevents call trace such as this: [ 329.230417] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 329.231444] #PF: supervisor write access in kernel mode [ 329.232233] #PF: error_code(0x0002) - not-present page [ 329.233007] PGD 0 P4D 0 [ 329.233476] Oops: 0002 [#1] SMP [ 329.234012] CPU: 5 PID: 145 Comm: kworker/u20:4 Tainted: G OE 6.0.0-rc5_mlnx #1 [ 329.235282] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 329.236868] Workqueue: mlx5_cmd_0000:08:00.1 cmd_work_handler [mlx5_core] [ 329.237886] RIP: 0010:_raw_spin_lock+0xc/0x20 [ 329.238585] Code: f0 0f b1 17 75 02 f3 c3 89 c6 e9 6f 3c 5f ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 02 f3 c3 89 c6 e9 45 3c 5f ff 0f 1f 44 00 00 0f 1f [ 329.241156] RSP: 0018:ffffc900001b0e98 EFLAGS: 00010046 [ 329.241940] RAX: 0000000000000000 RBX: ffffffff82374ae0 RCX: 0000000000000000 [ 329.242954] RDX: 0000000000000001 RSI: 0000000000000014 RDI: 0000000000000000 [ 329.243974] RBP: ffff888106ccf000 R08: ffff8881004000c8 R09: ffff888100400000 [ 329.244990] R10: 0000000000000000 R11: ffffffff826669f8 R12: 0000000000002000 [ 329.246009] R13: 0000000000000005 R14: ffff888100aa7ce0 R15: ffff88852ca80000 [ 329.247030] FS: 0000000000000000(0000) GS:ffff88852ca80000(0000) knlGS:0000000000000000 [ 329.248260] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 329.249111] CR2: 0000000000000000 CR3: 000000016d675001 CR4: 0000000000770ee0 [ 329.250133] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 329.251152] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 329.252176] PKRU: 55555554 CVE-2022-50441 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50441.html CVE-2022-50441 https://bugzilla.suse.com/1250849 SUSE Bug 1250849 In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: lvds: fix PM usage counter unbalance in poweron pm_runtime_get_sync will increment pm usage counter even it failed. Forgetting to putting operation will result in reference leak here. We fix it by replacing it with the newest pm_runtime_resume_and_get to keep usage counter balanced. CVE-2022-50443 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50443.html CVE-2022-50443 https://bugzilla.suse.com/1250768 SUSE Bug 1250768 In the Linux kernel, the following vulnerability has been resolved: clk: tegra20: Fix refcount leak in tegra20_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. CVE-2022-50444 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50444.html CVE-2022-50444 https://bugzilla.suse.com/1250767 SUSE Bug 1250767 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix crash on hci_create_cis_sync When attempting to connect multiple ISO sockets without using DEFER_SETUP may result in the following crash: BUG: KASAN: null-ptr-deref in hci_create_cis_sync+0x18b/0x2b0 Read of size 2 at addr 0000000000000036 by task kworker/u3:1/50 CPU: 0 PID: 50 Comm: kworker/u3:1 Not tainted 6.0.0-rc7-02243-gb84a13ff4eda #4373 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.0-1.fc36 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> dump_stack_lvl+0x19/0x27 kasan_report+0xbc/0xf0 ? hci_create_cis_sync+0x18b/0x2b0 hci_create_cis_sync+0x18b/0x2b0 ? get_link_mode+0xd0/0xd0 ? __ww_mutex_lock_slowpath+0x10/0x10 ? mutex_lock+0xe0/0xe0 ? get_link_mode+0xd0/0xd0 hci_cmd_sync_work+0x111/0x190 process_one_work+0x427/0x650 worker_thread+0x87/0x750 ? process_one_work+0x650/0x650 kthread+0x14e/0x180 ? kthread_exit+0x50/0x50 ret_from_fork+0x22/0x30 </TASK> CVE-2022-50447 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50447.html CVE-2022-50447 https://bugzilla.suse.com/1250771 SUSE Bug 1250771 In the Linux kernel, the following vulnerability has been resolved: clk: samsung: Fix memory leak in _samsung_clk_register_pll() If clk_register() fails, @pll->rate_table may have allocated memory by kmemdup(), so it needs to be freed, otherwise will cause memory leak issue, this patch fixes it. CVE-2022-50449 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50449.html CVE-2022-50449 https://bugzilla.suse.com/1250889 SUSE Bug 1250889 In the Linux kernel, the following vulnerability has been resolved: net: sched: cake: fix null pointer access issue when cake_init() fails When the default qdisc is cake, if the qdisc of dev_queue fails to be inited during mqprio_init(), cake_reset() is invoked to clear resources. In this case, the tins is NULL, and it will cause gpf issue. The process is as follows: qdisc_create_dflt() cake_init() q->tins = kvcalloc(...) --->failed, q->tins is NULL ... qdisc_put() ... cake_reset() ... cake_dequeue_one() b = &q->tins[...] --->q->tins is NULL The following is the Call Trace information: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:cake_dequeue_one+0xc9/0x3c0 Call Trace: <TASK> cake_reset+0xb1/0x140 qdisc_reset+0xed/0x6f0 qdisc_destroy+0x82/0x4c0 qdisc_put+0x9e/0xb0 qdisc_create_dflt+0x2c3/0x4a0 mqprio_init+0xa71/0x1760 qdisc_create+0x3eb/0x1000 tc_modify_qdisc+0x408/0x1720 rtnetlink_rcv_msg+0x38e/0xac0 netlink_rcv_skb+0x12d/0x3a0 netlink_unicast+0x4a2/0x740 netlink_sendmsg+0x826/0xcc0 sock_sendmsg+0xc5/0x100 ____sys_sendmsg+0x583/0x690 ___sys_sendmsg+0xe8/0x160 __sys_sendmsg+0xbf/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7f89e5122d04 </TASK> CVE-2022-50452 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50452.html CVE-2022-50452 https://bugzilla.suse.com/1250793 SUSE Bug 1250793 In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix NULL-pointer dereferences There are several places where we can crash the kernel by requesting lines, unbinding the GPIO device, then calling any of the system calls relevant to the GPIO character device's annonymous file descriptors: ioctl(), read(), poll(). While I observed it with the GPIO simulator, it will also happen for any of the GPIO devices that can be hot-unplugged - for instance any HID GPIO expander (e.g. CP2112). This affects both v1 and v2 uAPI. This fixes it partially by checking if gdev->chip is not NULL but it doesn't entirely remedy the situation as we still have a race condition in which another thread can remove the device after the check. CVE-2022-50453 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50453.html CVE-2022-50453 https://bugzilla.suse.com/1250887 SUSE Bug 1250887 In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in nouveau_gem_prime_import_sg_table() nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code back to the caller. On failures, ttm will call nouveau_bo_del_ttm() and free the memory.Thus, when nouveau_bo_init() returns an error, the gem object has already been released. Then the call to nouveau_bo_ref() will use the freed "nvbo->bo" and lead to a use-after-free bug. We should delete the call to nouveau_bo_ref() to avoid the use-after-free. CVE-2022-50454 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50454.html CVE-2022-50454 https://bugzilla.suse.com/1250890 SUSE Bug 1250890 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix resolving backrefs for inline extent followed by prealloc If a file consists of an inline extent followed by a regular or prealloc extent, then a legitimate attempt to resolve a logical address in the non-inline region will result in add_all_parents reading the invalid offset field of the inline extent. If the inline extent item is placed in the leaf eb s.t. it is the first item, attempting to access the offset field will not only be meaningless, it will go past the end of the eb and cause this panic: [17.626048] BTRFS warning (device dm-2): bad eb member end: ptr 0x3fd4 start 30834688 member offset 16377 size 8 [17.631693] general protection fault, probably for non-canonical address 0x5088000000000: 0000 [#1] SMP PTI [17.635041] CPU: 2 PID: 1267 Comm: btrfs Not tainted 5.12.0-07246-g75175d5adc74-dirty #199 [17.637969] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [17.641995] RIP: 0010:btrfs_get_64+0xe7/0x110 [17.649890] RSP: 0018:ffffc90001f73a08 EFLAGS: 00010202 [17.651652] RAX: 0000000000000001 RBX: ffff88810c42d000 RCX: 0000000000000000 [17.653921] RDX: 0005088000000000 RSI: ffffc90001f73a0f RDI: 0000000000000001 [17.656174] RBP: 0000000000000ff9 R08: 0000000000000007 R09: c0000000fffeffff [17.658441] R10: ffffc90001f73790 R11: ffffc90001f73788 R12: ffff888106afe918 [17.661070] R13: 0000000000003fd4 R14: 0000000000003f6f R15: cdcdcdcdcdcdcdcd [17.663617] FS: 00007f64e7627d80(0000) GS:ffff888237c80000(0000) knlGS:0000000000000000 [17.666525] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [17.668664] CR2: 000055d4a39152e8 CR3: 000000010c596002 CR4: 0000000000770ee0 [17.671253] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [17.673634] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [17.676034] PKRU: 55555554 [17.677004] Call Trace: [17.677877] add_all_parents+0x276/0x480 [17.679325] find_parent_nodes+0xfae/0x1590 [17.680771] btrfs_find_all_leafs+0x5e/0xa0 [17.682217] iterate_extent_inodes+0xce/0x260 [17.683809] ? btrfs_inode_flags_to_xflags+0x50/0x50 [17.685597] ? iterate_inodes_from_logical+0xa1/0xd0 [17.687404] iterate_inodes_from_logical+0xa1/0xd0 [17.689121] ? btrfs_inode_flags_to_xflags+0x50/0x50 [17.691010] btrfs_ioctl_logical_to_ino+0x131/0x190 [17.692946] btrfs_ioctl+0x104a/0x2f60 [17.694384] ? selinux_file_ioctl+0x182/0x220 [17.695995] ? __x64_sys_ioctl+0x84/0xc0 [17.697394] __x64_sys_ioctl+0x84/0xc0 [17.698697] do_syscall_64+0x33/0x40 [17.700017] entry_SYSCALL_64_after_hwframe+0x44/0xae [17.701753] RIP: 0033:0x7f64e72761b7 [17.709355] RSP: 002b:00007ffefb067f58 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [17.712088] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f64e72761b7 [17.714667] RDX: 00007ffefb067fb0 RSI: 00000000c0389424 RDI: 0000000000000003 [17.717386] RBP: 00007ffefb06d188 R08: 000055d4a390d2b0 R09: 00007f64e7340a60 [17.719938] R10: 0000000000000231 R11: 0000000000000246 R12: 0000000000000001 [17.722383] R13: 0000000000000000 R14: 00000000c0389424 R15: 000055d4a38fd2a0 [17.724839] Modules linked in: Fix the bug by detecting the inline extent item in add_all_parents and skipping to the next extent item. CVE-2022-50456 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50456.html CVE-2022-50456 https://bugzilla.suse.com/1250856 SUSE Bug 1250856 In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra210_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. CVE-2022-50458 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50458.html CVE-2022-50458 https://bugzilla.suse.com/1250891 SUSE Bug 1250891 In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() Fix a NULL pointer crash that occurs when we are freeing the socket at the same time we access it via sysfs. The problem is that: 1. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() take the frwd_lock and do sock_hold() then drop the frwd_lock. sock_hold() does a get on the "struct sock". 2. iscsi_sw_tcp_release_conn() does sockfd_put() which does the last put on the "struct socket" and that does __sock_release() which sets the sock->ops to NULL. 3. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() then call kernel_getpeername() which accesses the NULL sock->ops. Above we do a get on the "struct sock", but we needed a get on the "struct socket". Originally, we just held the frwd_lock the entire time but in commit bcf3a2953d36 ("scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling getpeername()") we switched to refcount based because the network layer changed and started taking a mutex in that path, so we could no longer hold the frwd_lock. Instead of trying to maintain multiple refcounts, this just has us use a mutex for accessing the socket in the interface code paths. CVE-2022-50459 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50459.html CVE-2022-50459 https://bugzilla.suse.com/1250850 SUSE Bug 1250850 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_flock() If not flock, before return -ENOLCK, should free the xid, otherwise, the xid will be leaked. CVE-2022-50460 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50460.html CVE-2022-50460 https://bugzilla.suse.com/1250879 SUSE Bug 1250879 In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() As comment of pci_get_device() says, it returns a pci_device with its refcount increased. We need to call pci_dev_put() to decrease the refcount. Save the return value of pci_get_device() and call pci_dev_put() to decrease the refcount. CVE-2022-50464 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50464.html CVE-2022-50464 https://bugzilla.suse.com/1250881 SUSE Bug 1250881 In the Linux kernel, the following vulnerability has been resolved: ext4: fix leaking uninitialized memory in fast-commit journal When space at the end of fast-commit journal blocks is unused, make sure to zero it out so that uninitialized memory is not leaked to disk. CVE-2022-50465 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50465.html CVE-2022-50465 https://bugzilla.suse.com/1250883 SUSE Bug 1250883 In the Linux kernel, the following vulnerability has been resolved: fs/binfmt_elf: Fix memory leak in load_elf_binary() There is a memory leak reported by kmemleak: unreferenced object 0xffff88817104ef80 (size 224): comm "xfs_admin", pid 47165, jiffies 4298708825 (age 1333.476s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 60 a8 b3 00 81 88 ff ff a8 10 5a 00 81 88 ff ff `.........Z..... backtrace: [<ffffffff819171e1>] __alloc_file+0x21/0x250 [<ffffffff81918061>] alloc_empty_file+0x41/0xf0 [<ffffffff81948cda>] path_openat+0xea/0x3d30 [<ffffffff8194ec89>] do_filp_open+0x1b9/0x290 [<ffffffff8192660e>] do_open_execat+0xce/0x5b0 [<ffffffff81926b17>] open_exec+0x27/0x50 [<ffffffff81a69250>] load_elf_binary+0x510/0x3ed0 [<ffffffff81927759>] bprm_execve+0x599/0x1240 [<ffffffff8192a997>] do_execveat_common.isra.0+0x4c7/0x680 [<ffffffff8192b078>] __x64_sys_execve+0x88/0xb0 [<ffffffff83bbf0a5>] do_syscall_64+0x35/0x80 If "interp_elf_ex" fails to allocate memory in load_elf_binary(), the program will take the "out_free_ph" error handing path, resulting in "interpreter" file resource is not released. Fix it by adding an error handing path "out_free_file", which will release the file resource when "interp_elf_ex" failed to allocate memory. CVE-2022-50466 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50466.html CVE-2022-50466 https://bugzilla.suse.com/1250875 SUSE Bug 1250875 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID An error case exit from lpfc_cmpl_ct_cmd_gft_id() results in a call to lpfc_nlp_put() with a null pointer to a nodelist structure. Changed lpfc_cmpl_ct_cmd_gft_id() to initialize nodelist pointer upon entry. CVE-2022-50467 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50467.html CVE-2022-50467 https://bugzilla.suse.com/1250847 SUSE Bug 1250847 In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() The following WARNING message was given when rmmod cros_usbpd_notify: Unexpected driver unregister! WARNING: CPU: 0 PID: 253 at drivers/base/driver.c:270 driver_unregister+0x8a/0xb0 Modules linked in: cros_usbpd_notify(-) CPU: 0 PID: 253 Comm: rmmod Not tainted 6.1.0-rc3 #24 ... Call Trace: <TASK> cros_usbpd_notify_exit+0x11/0x1e [cros_usbpd_notify] __x64_sys_delete_module+0x3c7/0x570 ? __ia32_sys_delete_module+0x570/0x570 ? lock_is_held_type+0xe3/0x140 ? syscall_enter_from_user_mode+0x17/0x50 ? rcu_read_lock_sched_held+0xa0/0xd0 ? syscall_enter_from_user_mode+0x1c/0x50 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f333fe9b1b7 The reason is that the cros_usbpd_notify_init() does not check the return value of platform_driver_register(), and the cros_usbpd_notify can install successfully even if platform_driver_register() failed. Fix by checking the return value of platform_driver_register() and unregister cros_usbpd_notify_plat_driver when it failed. CVE-2022-50468 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50468.html CVE-2022-50468 https://bugzilla.suse.com/1250877 SUSE Bug 1250877 In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw() In rtw_init_drv_sw(), there are various init functions are called to populate the padapter structure and some checks for their return value. However, except for the first one error path, the other five error paths do not properly release the previous allocated resources, which leads to various memory leaks. This patch fixes them and keeps the success and error separate. Note that these changes keep the form of `rtw_init_drv_sw()` in "drivers/staging/r8188eu/os_dep/os_intfs.c". As there is no proper device to test with, no runtime testing was performed. CVE-2022-50469 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2022-50469.html CVE-2022-50469 https://bugzilla.suse.com/1250824 SUSE Bug 1250824 A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. CVE-2023-1380 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-1380.html CVE-2023-1380 https://bugzilla.suse.com/1209287 SUSE Bug 1209287 A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. CVE-2023-28328 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-28328.html CVE-2023-28328 https://bugzilla.suse.com/1209291 SUSE Bug 1209291 https://bugzilla.suse.com/1222212 SUSE Bug 1222212 Linux Kernel nftables Use-After-Free Local Privilege Escalation Vulnerability; `nft_chain_lookup_byid()` failed to check whether a chain was active and CAP_NET_ADMIN is in any user or network namespace CVE-2023-31248 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-31248.html CVE-2023-31248 https://bugzilla.suse.com/1213061 SUSE Bug 1213061 https://bugzilla.suse.com/1213064 SUSE Bug 1213064 A flaw was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel crash and denial of service. CVE-2023-3772 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-3772.html CVE-2023-3772 https://bugzilla.suse.com/1213666 SUSE Bug 1213666 An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol. CVE-2023-39197 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-39197.html CVE-2023-39197 https://bugzilla.suse.com/1216976 SUSE Bug 1216976 https://bugzilla.suse.com/1220015 SUSE Bug 1220015 An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system. CVE-2023-42753 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-42753.html CVE-2023-42753 https://bugzilla.suse.com/1215150 SUSE Bug 1215150 https://bugzilla.suse.com/1218613 SUSE Bug 1218613 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: adapt set backend to use GC transaction API Use the GC transaction API to replace the old and buggy gc API and the busy mark approach. No set elements are removed from async garbage collection anymore, instead the _DEAD bit is set on so the set element is not visible from lookup path anymore. Async GC enqueues transaction work that might be aborted and retried later. rbtree and pipapo set backends does not set on the _DEAD bit from the sync GC path since this runs in control plane path where mutex is held. In this case, set elements are deactivated, removed and then released via RCU callback, sync GC never fails. CVE-2023-52923 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-52923.html CVE-2023-52923 https://bugzilla.suse.com/1236104 SUSE Bug 1236104 In the Linux kernel, the following vulnerability has been resolved: xfrm: add NULL check in xfrm_update_ae_params Normally, x->replay_esn and x->preplay_esn should be allocated at xfrm_alloc_replay_state_esn(...) in xfrm_state_construct(...), hence the xfrm_update_ae_params(...) is okay to update them. However, the current implementation of xfrm_new_ae(...) allows a malicious user to directly dereference a NULL pointer and crash the kernel like below. BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 8253067 P4D 8253067 PUD 8e0e067 PMD 0 Oops: 0002 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 98 Comm: poc.npd Not tainted 6.4.0-rc7-00072-gdad9774deaf1 #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.o4 RIP: 0010:memcpy_orig+0xad/0x140 Code: e8 4c 89 5f e0 48 8d 7f e0 73 d2 83 c2 20 48 29 d6 48 29 d7 83 fa 10 72 34 4c 8b 06 4c 8b 4e 08 c RSP: 0018:ffff888008f57658 EFLAGS: 00000202 RAX: 0000000000000000 RBX: ffff888008bd0000 RCX: ffffffff8238e571 RDX: 0000000000000018 RSI: ffff888007f64844 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff888008f57818 R13: ffff888007f64aa4 R14: 0000000000000000 R15: 0000000000000000 FS: 00000000014013c0(0000) GS:ffff88806d600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000054d8000 CR4: 00000000000006f0 Call Trace: <TASK> ? __die+0x1f/0x70 ? page_fault_oops+0x1e8/0x500 ? __pfx_is_prefetch.constprop.0+0x10/0x10 ? __pfx_page_fault_oops+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? fixup_exception+0x36/0x460 ? _raw_spin_unlock_irqrestore+0x11/0x40 ? exc_page_fault+0x5e/0xc0 ? asm_exc_page_fault+0x26/0x30 ? xfrm_update_ae_params+0xd1/0x260 ? memcpy_orig+0xad/0x140 ? __pfx__raw_spin_lock_bh+0x10/0x10 xfrm_update_ae_params+0xe7/0x260 xfrm_new_ae+0x298/0x4e0 ? __pfx_xfrm_new_ae+0x10/0x10 ? __pfx_xfrm_new_ae+0x10/0x10 xfrm_user_rcv_msg+0x25a/0x410 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __alloc_skb+0xcf/0x210 ? stack_trace_save+0x90/0xd0 ? filter_irq_stacks+0x1c/0x70 ? __stack_depot_save+0x39/0x4e0 ? __kasan_slab_free+0x10a/0x190 ? kmem_cache_free+0x9c/0x340 ? netlink_recvmsg+0x23c/0x660 ? sock_recvmsg+0xeb/0xf0 ? __sys_recvfrom+0x13c/0x1f0 ? __x64_sys_recvfrom+0x71/0x90 ? do_syscall_64+0x3f/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc ? copyout+0x3e/0x50 netlink_rcv_skb+0xd6/0x210 ? __pfx_xfrm_user_rcv_msg+0x10/0x10 ? __pfx_netlink_rcv_skb+0x10/0x10 ? __pfx_sock_has_perm+0x10/0x10 ? mutex_lock+0x8d/0xe0 ? __pfx_mutex_lock+0x10/0x10 xfrm_netlink_rcv+0x44/0x50 netlink_unicast+0x36f/0x4c0 ? __pfx_netlink_unicast+0x10/0x10 ? netlink_recvmsg+0x500/0x660 netlink_sendmsg+0x3b7/0x700 This Null-ptr-deref bug is assigned CVE-2023-3772. And this commit adds additional NULL check in xfrm_update_ae_params to fix the NPD. CVE-2023-53147 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53147.html CVE-2023-53147 https://bugzilla.suse.com/1249880 SUSE Bug 1249880 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid deadlock in fs reclaim with page writeback Ext4 has a filesystem wide lock protecting ext4_writepages() calls to avoid races with switching of journalled data flag or inode format. This lock can however cause a deadlock like: CPU0 CPU1 ext4_writepages() percpu_down_read(sbi->s_writepages_rwsem); ext4_change_inode_journal_flag() percpu_down_write(sbi->s_writepages_rwsem); - blocks, all readers block from now on ext4_do_writepages() ext4_init_io_end() kmem_cache_zalloc(io_end_cachep, GFP_KERNEL) fs_reclaim frees dentry... dentry_unlink_inode() iput() - last ref => iput_final() - inode dirty => write_inode_now()... ext4_writepages() tries to acquire sbi->s_writepages_rwsem and blocks forever Make sure we cannot recurse into filesystem reclaim from writeback code to avoid the deadlock. CVE-2023-53149 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53149.html CVE-2023-53149 https://bugzilla.suse.com/1249882 SUSE Bug 1249882 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Pointer may be dereferenced Klocwork tool reported pointer 'rport' returned from call to function fc_bsg_to_rport() may be NULL and will be dereferenced. Add a fix to validate rport before dereferencing. CVE-2023-53150 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53150.html CVE-2023-53150 https://bugzilla.suse.com/1249853 SUSE Bug 1249853 In the Linux kernel, the following vulnerability has been resolved: md/raid10: prevent soft lockup while flush writes Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't, and too many writes can cause soft lockup. Follow up soft lockup can be triggered easily with writeback test for raid10 with ramdisks: watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [md0_raid10:1293] Call Trace: <TASK> call_rcu+0x16/0x20 put_object+0x41/0x80 __delete_object+0x50/0x90 delete_object_full+0x2b/0x40 kmemleak_free+0x46/0xa0 slab_free_freelist_hook.constprop.0+0xed/0x1a0 kmem_cache_free+0xfd/0x300 mempool_free_slab+0x1f/0x30 mempool_free+0x3a/0x100 bio_free+0x59/0x80 bio_put+0xcf/0x2c0 free_r10bio+0xbf/0xf0 raid_end_bio_io+0x78/0xb0 one_write_done+0x8a/0xa0 raid10_end_write_request+0x1b4/0x430 bio_endio+0x175/0x320 brd_submit_bio+0x3b9/0x9b7 [brd] __submit_bio+0x69/0xe0 submit_bio_noacct_nocheck+0x1e6/0x5a0 submit_bio_noacct+0x38c/0x7e0 flush_pending_writes+0xf0/0x240 raid10d+0xac/0x1ed0 Fix the problem by adding cond_resched() to raid10 like what raid1 did. Note that unlimited plugged bio still need to be optimized, for example, in the case of lots of dirty pages writeback, this will take lots of memory and io will spend a long time in plug, hence io latency is bad. CVE-2023-53151 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53151.html CVE-2023-53151 https://bugzilla.suse.com/1249865 SUSE Bug 1249865 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix calltrace warning in amddrm_buddy_fini The following call trace is observed when removing the amdgpu driver, which is caused by that BOs allocated for psp are not freed until removing. [61811.450562] RIP: 0010:amddrm_buddy_fini.cold+0x29/0x47 [amddrm_buddy] [61811.450577] Call Trace: [61811.450577] <TASK> [61811.450579] amdgpu_vram_mgr_fini+0x135/0x1c0 [amdgpu] [61811.450728] amdgpu_ttm_fini+0x207/0x290 [amdgpu] [61811.450870] amdgpu_bo_fini+0x27/0xa0 [amdgpu] [61811.451012] gmc_v9_0_sw_fini+0x4a/0x60 [amdgpu] [61811.451166] amdgpu_device_fini_sw+0x117/0x520 [amdgpu] [61811.451306] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] [61811.451447] devm_drm_dev_init_release+0x4d/0x80 [drm] [61811.451466] devm_action_release+0x15/0x20 [61811.451469] release_nodes+0x40/0xb0 [61811.451471] devres_release_all+0x9b/0xd0 [61811.451473] __device_release_driver+0x1bb/0x2a0 [61811.451476] driver_detach+0xf3/0x140 [61811.451479] bus_remove_driver+0x6c/0xf0 [61811.451481] driver_unregister+0x31/0x60 [61811.451483] pci_unregister_driver+0x40/0x90 [61811.451486] amdgpu_exit+0x15/0x447 [amdgpu] For smu v13_0_2, if the GPU supports xgmi, refer to commit f5c7e7797060 ("drm/amdgpu: Adjust removal control flow for smu v13_0_2"), it will run gpu recover in AMDGPU_RESET_FOR_DEVICE_REMOVE mode when removing, which makes all devices in hive list have hw reset but no resume except the basic ip blocks, then other ip blocks will not call .hw_fini according to ip_block.status.hw. Since psp_free_shared_bufs just includes some software operations, so move it to psp_sw_fini. CVE-2023-53152 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53152.html CVE-2023-53152 https://bugzilla.suse.com/1249883 SUSE Bug 1249883 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection. Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory. Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work. CVE-2023-53153 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53153.html CVE-2023-53153 https://bugzilla.suse.com/1249877 SUSE Bug 1249877 In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer. The only practical impact is that the name may be prepended a "unification hash" when it is not actually needed but still it is good to fix this. CVE-2023-53165 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53165.html CVE-2023-53165 https://bugzilla.suse.com/1250395 SUSE Bug 1250395 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix null pointer dereference in tracing_err_log_open() Fix an issue in function 'tracing_err_log_open'. The function doesn't call 'seq_open' if the file is opened only with write permissions, which results in 'file->private_data' being left as null. If we then use 'lseek' on that opened file, 'seq_lseek' dereferences 'file->private_data' in 'mutex_lock(&m->lock)', resulting in a kernel panic. Writing to this node requires root privileges, therefore this bug has very little security impact. Tracefs node: /sys/kernel/tracing/error_log Example Kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 Call trace: mutex_lock+0x30/0x110 seq_lseek+0x34/0xb8 __arm64_sys_lseek+0x6c/0xb8 invoke_syscall+0x58/0x13c el0_svc_common+0xc4/0x10c do_el0_svc+0x24/0x98 el0_svc+0x24/0x88 el0t_64_sync_handler+0x84/0xe4 el0t_64_sync+0x1b4/0x1b8 Code: d503201f aa0803e0 aa1f03e1 aa0103e9 (c8e97d02) ---[ end trace 561d1b49c12cf8a5 ]--- Kernel panic - not syncing: Oops: Fatal exception CVE-2023-53167 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53167.html CVE-2023-53167 https://bugzilla.suse.com/1249712 SUSE Bug 1249712 In the Linux kernel, the following vulnerability has been resolved: usb: ucsi_acpi: Increase the command completion timeout Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command completion timeout value") increased the timeout from 5 seconds to 60 seconds due to issues related to alternate mode discovery. After the alternate mode discovery switch to polled mode the timeout was reduced, but instead of being set back to 5 seconds it was reduced to 1 second. This is causing problems when using a Lenovo ThinkPad X1 yoga gen7 connected over Type-C to a LG 27UL850-W (charging DP over Type-C). When the monitor is already connected at boot the following error is logged: "PPM init failed (-110)", /sys/class/typec is empty and on unplugging the NULL pointer deref fixed earlier in this series happens. When the monitor is connected after boot the following error is logged instead: "GET_CONNECTOR_STATUS failed (-110)". Setting the timeout back to 5 seconds fixes both cases. CVE-2023-53168 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53168.html CVE-2023-53168 https://bugzilla.suse.com/1249874 SUSE Bug 1249874 In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of locked_vm via exec() When a vfio container is preserved across exec, the task does not change, but it gets a new mm with locked_vm=0, and loses the count from existing dma mappings. If the user later unmaps a dma mapping, locked_vm underflows to a large unsigned value, and a subsequent dma map request fails with ENOMEM in __account_locked_vm. To avoid underflow, grab and save the mm at the time a dma is mapped. Use that mm when adjusting locked_vm, rather than re-acquiring the saved task's mm, which may have changed. If the saved mm is dead, do nothing. locked_vm is incremented for existing mappings in a subsequent patch. CVE-2023-53171 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53171.html CVE-2023-53171 https://bugzilla.suse.com/1249933 SUSE Bug 1249933 In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix possible memory leak if device_add() fails If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device() should be used to decrease the reference count in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanp(). CVE-2023-53174 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53174.html CVE-2023-53174 https://bugzilla.suse.com/1250024 SUSE Bug 1250024 In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Reinit port->pm on port specific driver unbind When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see an oops about 10 seconds later. This can produce the following at least on some TI SoCs: Unhandled fault: imprecise external abort (0x1406) Internal error: : 1406 [#1] SMP ARM Turns out that we may still have the serial port hardware specific driver port->pm in use, and serial8250_pm() tries to call it after the port specific driver is gone: serial8250_pm [8250_base] from uart_change_pm+0x54/0x8c [serial_base] uart_change_pm [serial_base] from uart_hangup+0x154/0x198 [serial_base] uart_hangup [serial_base] from __tty_hangup.part.0+0x328/0x37c __tty_hangup.part.0 from disassociate_ctty+0x154/0x20c disassociate_ctty from do_exit+0x744/0xaac do_exit from do_group_exit+0x40/0x8c do_group_exit from __wake_up_parent+0x0/0x1c Let's fix the issue by calling serial8250_set_defaults() in serial8250_unregister_port(). This will set the port back to using the serial8250 default functions, and sets the port->pm to point to serial8250_pm. CVE-2023-53176 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53176.html CVE-2023-53176 https://bugzilla.suse.com/1249991 SUSE Bug 1249991 In the Linux kernel, the following vulnerability has been resolved: mm: fix zswap writeback race condition The zswap writeback mechanism can cause a race condition resulting in memory corruption, where a swapped out page gets swapped in with data that was written to a different page. The race unfolds like this: 1. a page with data A and swap offset X is stored in zswap 2. page A is removed off the LRU by zpool driver for writeback in zswap-shrink work, data for A is mapped by zpool driver 3. user space program faults and invalidates page entry A, offset X is considered free 4. kswapd stores page B at offset X in zswap (zswap could also be full, if so, page B would then be IOed to X, then skip step 5.) 5. entry A is replaced by B in tree->rbroot, this doesn't affect the local reference held by zswap-shrink work 6. zswap-shrink work writes back A at X, and frees zswap entry A 7. swapin of slot X brings A in memory instead of B The fix: Once the swap page cache has been allocated (case ZSWAP_SWAPCACHE_NEW), zswap-shrink work just checks that the local zswap_entry reference is still the same as the one in the tree. If it's not the same it means that it's either been invalidated or replaced, in both cases the writeback is aborted because the local entry contains stale data. Reproducer: I originally found this by running `stress` overnight to validate my work on the zswap writeback mechanism, it manifested after hours on my test machine. The key to make it happen is having zswap writebacks, so whatever setup pumps /sys/kernel/debug/zswap/written_back_pages should do the trick. In order to reproduce this faster on a vm, I setup a system with ~100M of available memory and a 500M swap file, then running `stress --vm 1 --vm-bytes 300000000 --vm-stride 4000` makes it happen in matter of tens of minutes. One can speed things up even more by swinging /sys/module/zswap/parameters/max_pool_percent up and down between, say, 20 and 1; this makes it reproduce in tens of seconds. It's crucial to set `--vm-stride` to something other than 4096 otherwise `stress` won't realize that memory has been corrupted because all pages would have the same data. CVE-2023-53178 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53178.html CVE-2023-53178 https://bugzilla.suse.com/1249827 SUSE Bug 1249827 In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can lead to the use of wrong `CIDR_POS(c)` for calculating array offsets, which can lead to integer underflow. As a result, it leads to slab out-of-bound access. This patch adds back the IP_SET_HASH_WITH_NET0 macro to ip_set_hash_netportnet to address the issue. CVE-2023-53179 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53179.html CVE-2023-53179 https://bugzilla.suse.com/1249825 SUSE Bug 1249825 In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fails. Free the old array by hand, and make sure we still clear the returned *fences so the caller won't end up accessing freed memory. Some (but not all) of the callers of dma_resv_get_fences() seem to still trawl through the array even when dma_resv_get_fences() failed. And let's zero out *num_fences as well for good measure. CVE-2023-53181 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53181.html CVE-2023-53181 https://bugzilla.suse.com/1249824 SUSE Bug 1249824 In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e Before this change we see the following UBSAN stack trace in Fuchsia: #0 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302 #1.2 0x000020d0f660777f in ubsan_get_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:41 <libclang_rt.asan.so>+0x3d77f #1.1 0x000020d0f660777f in maybe_print_stack_trace() compiler-rt/lib/ubsan/ubsan_diag.cpp:51 <libclang_rt.asan.so>+0x3d77f #1 0x000020d0f660777f in ~scoped_report() compiler-rt/lib/ubsan/ubsan_diag.cpp:387 <libclang_rt.asan.so>+0x3d77f #2 0x000020d0f660b96d in handlepointer_overflow_impl() compiler-rt/lib/ubsan/ubsan_handlers.cpp:809 <libclang_rt.asan.so>+0x4196d #3 0x000020d0f660b50d in compiler-rt/lib/ubsan/ubsan_handlers.cpp:815 <libclang_rt.asan.so>+0x4150d #4 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682 <platform-bus-x86.so>+0x233302 #5 0x000021e4213e2369 in acpi_ds_call_control_method(struct acpi_thread_state*, struct acpi_walk_state*, union acpi_parse_object*) ../../third_party/acpica/source/components/dispatcher/dsmethod.c:605 <platform-bus-x86.so>+0x262369 #6 0x000021e421437fac in acpi_ps_parse_aml(struct acpi_walk_state*) ../../third_party/acpica/source/components/parser/psparse.c:550 <platform-bus-x86.so>+0x2b7fac #7 0x000021e4214464d2 in acpi_ps_execute_method(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/parser/psxface.c:244 <platform-bus-x86.so>+0x2c64d2 #8 0x000021e4213aa052 in acpi_ns_evaluate(struct acpi_evaluate_info*) ../../third_party/acpica/source/components/namespace/nseval.c:250 <platform-bus-x86.so>+0x22a052 #9 0x000021e421413dd8 in acpi_ns_init_one_device(acpi_handle, u32, void*, void**) ../../third_party/acpica/source/components/namespace/nsinit.c:735 <platform-bus-x86.so>+0x293dd8 #10 0x000021e421429e98 in acpi_ns_walk_namespace(acpi_object_type, acpi_handle, u32, u32, acpi_walk_callback, acpi_walk_callback, void*, void**) ../../third_party/acpica/source/components/namespace/nswalk.c:298 <platform-bus-x86.so>+0x2a9e98 #11 0x000021e4214131ac in acpi_ns_initialize_devices(u32) ../../third_party/acpica/source/components/namespace/nsinit.c:268 <platform-bus-x86.so>+0x2931ac #12 0x000021e42147c40d in acpi_initialize_objects(u32) ../../third_party/acpica/source/components/utilities/utxfinit.c:304 <platform-bus-x86.so>+0x2fc40d #13 0x000021e42126d603 in acpi::acpi_impl::initialize_acpi(acpi::acpi_impl*) ../../src/devices/board/lib/acpi/acpi-impl.cc:224 <platform-bus-x86.so>+0xed603 Add a simple check that avoids incrementing a pointer by zero, but otherwise behaves as before. Note that our findings are against ACPICA 20221020, but the same code exists on master. CVE-2023-53182 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53182.html CVE-2023-53182 https://bugzilla.suse.com/1250010 SUSE Bug 1250010 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved for HTC_CTRL_RSVD_SVC and should not be modified to be used for any other services. Reject such service connection responses. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. CVE-2023-53185 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53185.html CVE-2023-53185 https://bugzilla.suse.com/1249820 SUSE Bug 1249820 In the Linux kernel, the following vulnerability has been resolved: ipv6/addrconf: fix a potential refcount underflow for idev Now in addrconf_mod_rs_timer(), reference idev depends on whether rs_timer is not pending. Then modify rs_timer timeout. There is a time gap in [1], during which if the pending rs_timer becomes not pending. It will miss to hold idev, but the rs_timer is activated. Thus rs_timer callback function addrconf_rs_timer() will be executed and put idev later without holding idev. A refcount underflow issue for idev can be caused by this. if (!timer_pending(&idev->rs_timer)) in6_dev_hold(idev); <--------------[1] mod_timer(&idev->rs_timer, jiffies + when); To fix the issue, hold idev if mod_timer() return 0. CVE-2023-53189 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53189.html CVE-2023-53189 https://bugzilla.suse.com/1249894 SUSE Bug 1249894 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini The gmc.ecc_irq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. So, it is meaningless to use the amdgpu_irq_put function in gmc_v10_0_hw_fini, which also leads to the call trace. [ 82.340264] Call Trace: [ 82.340265] <TASK> [ 82.340269] gmc_v10_0_hw_fini+0x83/0xa0 [amdgpu] [ 82.340447] gmc_v10_0_suspend+0xe/0x20 [amdgpu] [ 82.340623] amdgpu_device_ip_suspend_phase2+0x127/0x1c0 [amdgpu] [ 82.340789] amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu] [ 82.340955] amdgpu_device_pre_asic_reset+0xdd/0x2b0 [amdgpu] [ 82.341122] amdgpu_device_gpu_recover.cold+0x4dd/0xbb2 [amdgpu] [ 82.341359] amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu] [ 82.341529] process_one_work+0x21d/0x3f0 [ 82.341535] worker_thread+0x1fa/0x3c0 [ 82.341538] ? process_one_work+0x3f0/0x3f0 [ 82.341540] kthread+0xff/0x130 [ 82.341544] ? kthread_complete_and_exit+0x20/0x20 [ 82.341547] ret_from_fork+0x22/0x30 CVE-2023-53193 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53193.html CVE-2023-53193 https://bugzilla.suse.com/1249816 SUSE Bug 1249816 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: Fix potential memory leak Function dwc3_qcom_probe() allocates memory for resource structure which is pointed by parent_res pointer. This memory is not freed. This leads to memory leak. Use stack memory to prevent memory leak. Found by Linux Verification Center (linuxtesting.org) with SVACE. CVE-2023-53196 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53196.html CVE-2023-53196 https://bugzilla.suse.com/1249758 SUSE Bug 1249758 In the Linux kernel, the following vulnerability has been resolved: USB: uhci: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53197 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53197.html CVE-2023-53197 https://bugzilla.suse.com/1249791 SUSE Bug 1249791 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and freed. Added a comment describing this issue. The patch also makes remain_skb NULL after being processed so that it cannot be referenced after potential free. The initialization of hif_dev fields which are associated with remain_skb (rx_remain_len, rx_transfer_len and rx_pad_len) is moved after a new remain_skb is allocated. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. CVE-2023-53199 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53199.html CVE-2023-53199 https://bugzilla.suse.com/1249683 SUSE Bug 1249683 In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: wraparound mbox producer index Driver is not handling the wraparound of the mbox producer index correctly. Currently the wraparound happens once u32 max is reached. Bit 31 of the producer index register is special and should be set only once for the first command. Because the producer index overflow setting bit31 after a long time, FW goes to initialization sequence and this causes FW hang. Fix is to wraparound the mbox producer index once it reaches u16 max. CVE-2023-53201 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53201.html CVE-2023-53201 https://bugzilla.suse.com/1249687 SUSE Bug 1249687 In the Linux kernel, the following vulnerability has been resolved: KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler We do check for target CPU == -1, but this might change at the time we are going to use it. Hold the physical target CPU in a local variable to avoid out-of-bound accesses to the cpu arrays. CVE-2023-53205 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53205.html CVE-2023-53205 https://bugzilla.suse.com/1249677 SUSE Bug 1249677 In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() r5l_flush_stripe_to_raid() will check if the list 'flushing_ios' is empty, and then submit 'flush_bio', however, r5l_log_flush_endio() is clearing the list first and then clear the bio, which will cause null-ptr-deref: T1: submit flush io raid5d handle_active_stripes r5l_flush_stripe_to_raid // list is empty // add 'io_end_ios' to the list bio_init submit_bio // io1 T2: io1 is done r5l_log_flush_endio list_splice_tail_init // clear the list T3: submit new flush io ... r5l_flush_stripe_to_raid // list is empty // add 'io_end_ios' to the list bio_init bio_uninit // clear bio->bi_blkg submit_bio // null-ptr-deref Fix this problem by clearing bio before clearing the list in r5l_log_flush_endio(). CVE-2023-53210 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53210.html CVE-2023-53210 https://bugzilla.suse.com/1249673 SUSE Bug 1249673 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info->req_len, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WL_EXTRA_BUF_MAX. Add the size check for req_len/resp_len of assoc_info. Found by a modified version of syzkaller. [ 46.592467][ T7] ================================================================== [ 46.594687][ T7] BUG: KASAN: slab-out-of-bounds in kmemdup+0x3e/0x50 [ 46.596572][ T7] Read of size 3014656 at addr ffff888019442000 by task kworker/0:1/7 [ 46.598575][ T7] [ 46.599157][ T7] CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #145 [ 46.601333][ T7] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 [ 46.604360][ T7] Workqueue: events brcmf_fweh_event_worker [ 46.605943][ T7] Call Trace: [ 46.606584][ T7] dump_stack_lvl+0x8e/0xd1 [ 46.607446][ T7] print_address_description.constprop.0.cold+0x93/0x334 [ 46.608610][ T7] ? kmemdup+0x3e/0x50 [ 46.609341][ T7] kasan_report.cold+0x79/0xd5 [ 46.610151][ T7] ? kmemdup+0x3e/0x50 [ 46.610796][ T7] kasan_check_range+0x14e/0x1b0 [ 46.611691][ T7] memcpy+0x20/0x60 [ 46.612323][ T7] kmemdup+0x3e/0x50 [ 46.612987][ T7] brcmf_get_assoc_ies+0x967/0xf60 [ 46.613904][ T7] ? brcmf_notify_vif_event+0x3d0/0x3d0 [ 46.614831][ T7] ? lock_chain_count+0x20/0x20 [ 46.615683][ T7] ? mark_lock.part.0+0xfc/0x2770 [ 46.616552][ T7] ? lock_chain_count+0x20/0x20 [ 46.617409][ T7] ? mark_lock.part.0+0xfc/0x2770 [ 46.618244][ T7] ? lock_chain_count+0x20/0x20 [ 46.619024][ T7] brcmf_bss_connect_done.constprop.0+0x241/0x2e0 [ 46.620019][ T7] ? brcmf_parse_configure_security.isra.0+0x2a0/0x2a0 [ 46.620818][ T7] ? __lock_acquire+0x181f/0x5790 [ 46.621462][ T7] brcmf_notify_connect_status+0x448/0x1950 [ 46.622134][ T7] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 46.622736][ T7] ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0 [ 46.623390][ T7] ? find_held_lock+0x2d/0x110 [ 46.623962][ T7] ? brcmf_fweh_event_worker+0x19f/0xc60 [ 46.624603][ T7] ? mark_held_locks+0x9f/0xe0 [ 46.625145][ T7] ? lockdep_hardirqs_on_prepare+0x3e0/0x3e0 [ 46.625871][ T7] ? brcmf_cfg80211_join_ibss+0x7b0/0x7b0 [ 46.626545][ T7] brcmf_fweh_call_event_handler.isra.0+0x90/0x100 [ 46.627338][ T7] brcmf_fweh_event_worker+0x557/0xc60 [ 46.627962][ T7] ? brcmf_fweh_call_event_handler.isra.0+0x100/0x100 [ 46.628736][ T7] ? rcu_read_lock_sched_held+0xa1/0xd0 [ 46.629396][ T7] ? rcu_read_lock_bh_held+0xb0/0xb0 [ 46.629970][ T7] ? lockdep_hardirqs_on_prepare+0x273/0x3e0 [ 46.630649][ T7] process_one_work+0x92b/0x1460 [ 46.631205][ T7] ? pwq_dec_nr_in_flight+0x330/0x330 [ 46.631821][ T7] ? rwlock_bug.part.0+0x90/0x90 [ 46.632347][ T7] worker_thread+0x95/0xe00 [ 46.632832][ T7] ? __kthread_parkme+0x115/0x1e0 [ 46.633393][ T7] ? process_one_work+0x1460/0x1460 [ 46.633957][ T7] kthread+0x3a1/0x480 [ 46.634369][ T7] ? set_kthread_struct+0x120/0x120 [ 46.634933][ T7] ret_from_fork+0x1f/0x30 [ 46.635431][ T7] [ 46.635687][ T7] Allocated by task 7: [ 46.636151][ T7] kasan_save_stack+0x1b/0x40 [ 46.636628][ T7] __kasan_kmalloc+0x7c/0x90 [ 46.637108][ T7] kmem_cache_alloc_trace+0x19e/0x330 [ 46.637696][ T7] brcmf_cfg80211_attach+0x4a0/0x4040 [ 46.638275][ T7] brcmf_attach+0x389/0xd40 [ 46.638739][ T7] brcmf_usb_probe+0x12de/0x1690 [ 46.639279][ T7] usb_probe_interface+0x2aa/0x760 [ 46.639820][ T7] really_probe+0x205/0xb70 [ 46.640342][ T7] __driver_probe_device+0 ---truncated--- CVE-2023-53213 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53213.html CVE-2023-53213 https://bugzilla.suse.com/1249918 SUSE Bug 1249918 In the Linux kernel, the following vulnerability has been resolved: sched/fair: Don't balance task to its current running CPU We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like below: ------------[ cut here ]------------ WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240 Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip> CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G O 6.1.0-rc4+ #1 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021 pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : set_task_cpu+0x188/0x240 lr : load_balance+0x5d0/0xc60 sp : ffff80000803bc70 x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040 x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001 x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78 x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000 x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000 x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530 x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001 Call trace: set_task_cpu+0x188/0x240 load_balance+0x5d0/0xc60 rebalance_domains+0x26c/0x380 _nohz_idle_balance.isra.0+0x1e0/0x370 run_rebalance_domains+0x6c/0x80 __do_softirq+0x128/0x3d8 ____do_softirq+0x18/0x24 call_on_irq_stack+0x2c/0x38 do_softirq_own_stack+0x24/0x3c __irq_exit_rcu+0xcc/0xf4 irq_exit_rcu+0x18/0x24 el1_interrupt+0x4c/0xe4 el1h_64_irq_handler+0x18/0x2c el1h_64_irq+0x74/0x78 arch_cpu_idle+0x18/0x4c default_idle_call+0x58/0x194 do_idle+0x244/0x2b0 cpu_startup_entry+0x30/0x3c secondary_start_kernel+0x14c/0x190 __secondary_switched+0xb0/0xb4 ---[ end trace 0000000000000000 ]--- Further investigation shows that the warning is superfluous, the migration disabled task is just going to be migrated to its current running CPU. This is because that on load balance if the dst_cpu is not allowed by the task, we'll re-select a new_dst_cpu as a candidate. If no task can be balanced to dst_cpu we'll try to balance the task to the new_dst_cpu instead. In this case when the migration disabled task is not on CPU it only allows to run on its current CPU, load balance will select its current CPU as new_dst_cpu and later triggers the warning above. The new_dst_cpu is chosen from the env->dst_grpmask. Currently it contains CPUs in sched_group_span() and if we have overlapped groups it's possible to run into this case. This patch makes env->dst_grpmask of group_balance_mask() which exclude any CPUs from the busiest group and solve the issue. For balancing in a domain with no overlapped groups the behaviour keeps same as before. CVE-2023-53215 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53215.html CVE-2023-53215 https://bugzilla.suse.com/1250397 SUSE Bug 1250397 In the Linux kernel, the following vulnerability has been resolved: arm64: efi: Make efi_rt_lock a raw_spinlock Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs the following: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9, name: kworker/u320:0 preempt_count: 2, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by kworker/u320:0/9: #0: ffff3fff8c27d128 ((wq_completion)efi_rts_wq){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41) #1: ffff80000861bdd0 ((work_completion)(&efi_rts_work.work)){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41) #2: ffffdf7e1ed3e460 (efi_rt_lock){+.+.}-{3:3}, at: efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) Preemption disabled at: efi_virtmap_load (./arch/arm64/include/asm/mmu_context.h:248) CPU: 0 PID: 9 Comm: kworker/u320:0 Tainted: G W 6.2.0-rc3-rt1 Hardware name: WIWYNN Mt.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18 Workqueue: efi_rts_wq efi_call_rts Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:158) show_stack (arch/arm64/kernel/stacktrace.c:165) dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) dump_stack (lib/dump_stack.c:114) __might_resched (kernel/sched/core.c:10134) rt_spin_lock (kernel/locking/rtmutex.c:1769 (discriminator 4)) efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) [...] This seems to come from commit ff7a167961d1 ("arm64: efi: Execute runtime services from a dedicated stack") which adds a spinlock. This spinlock is taken through: efi_call_rts() \-efi_call_virt() \-efi_call_virt_pointer() \-arch_efi_call_virt_setup() Make 'efi_rt_lock' a raw_spinlock to avoid being preempted. [ardb: The EFI runtime services are called with a different set of translation tables, and are permitted to use the SIMD registers. The context switch code preserves/restores neither, and so EFI calls must be made with preemption disabled, rather than only disabling migration.] CVE-2023-53216 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53216.html CVE-2023-53216 https://bugzilla.suse.com/1249669 SUSE Bug 1249669 In the Linux kernel, the following vulnerability has been resolved: media: netup_unidvb: fix use-after-free at del_timer() When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below: (cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE Fix by changing del_timer() to del_timer_sync(). CVE-2023-53219 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53219.html CVE-2023-53219 https://bugzilla.suse.com/1249661 SUSE Bug 1249661 In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE CVE-2023-53222 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53222.html CVE-2023-53222 https://bugzilla.suse.com/1249864 SUSE Bug 1249864 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference. Patchwork: https://patchwork.freedesktop.org/patch/517646/ CVE-2023-53223 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53223.html CVE-2023-53223 https://bugzilla.suse.com/1250080 SUSE Bug 1250080 In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet not out-of-bounds access the skb->data buffer. CVE-2023-53226 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53226.html CVE-2023-53226 https://bugzilla.suse.com/1249658 SUSE Bug 1249658 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta Avoid potential data corruption issues caused by uninitialized driver private data structures. CVE-2023-53229 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53229.html CVE-2023-53229 https://bugzilla.suse.com/1249650 SUSE Bug 1249650 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning in cifs_smb3_do_mount() This fixes the following warning reported by kernel test robot fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible memory leak of 'cifs_sb' CVE-2023-53230 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53230.html CVE-2023-53230 https://bugzilla.suse.com/1249866 SUSE Bug 1249866 In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no longer uses eeprom.data, but the relevant code has not been removed completely since commit 16d98b548365 ("mt76: mt7921: rely on mcu_get_nic_capability"). This could result in potential invalid memory access. To fix the kernel panic issue in mt7921, it is necessary to avoid accessing unallocated eeprom.data which can lead to invalid memory access. Furthermore, it is possible to entirely eliminate the mt7921_mcu_parse_eeprom function and solely depend on mt7921_mcu_parse_response to divide the RxD header. [2.702735] BUG: kernel NULL pointer dereference, address: 0000000000000550 [2.702740] #PF: supervisor write access in kernel mode [2.702741] #PF: error_code(0x0002) - not-present page [2.702743] PGD 0 P4D 0 [2.702747] Oops: 0002 [#1] PREEMPT SMP NOPTI [2.702755] RIP: 0010:mt7921_mcu_parse_response+0x147/0x170 [mt7921_common] [2.702758] RSP: 0018:ffffae7c00fef828 EFLAGS: 00010286 [2.702760] RAX: ffffa367f57be024 RBX: ffffa367cc7bf500 RCX: 0000000000000000 [2.702762] RDX: 0000000000000550 RSI: 0000000000000000 RDI: ffffa367cc7bf500 [2.702763] RBP: ffffae7c00fef840 R08: ffffa367cb167000 R09: 0000000000000005 [2.702764] R10: 0000000000000000 R11: ffffffffc04702e4 R12: ffffa367e8329f40 [2.702766] R13: 0000000000000000 R14: 0000000000000001 R15: ffffa367e8329f40 [2.702768] FS: 000079ee6cf20c40(0000) GS:ffffa36b2f940000(0000) knlGS:0000000000000000 [2.702769] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [2.702775] CR2: 0000000000000550 CR3: 00000001233c6004 CR4: 0000000000770ee0 [2.702776] PKRU: 55555554 [2.702777] Call Trace: [2.702782] mt76_mcu_skb_send_and_get_msg+0xc3/0x11e [mt76 <HASH:1bc4 5>] [2.702785] mt7921_run_firmware+0x241/0x853 [mt7921_common <HASH:6a2f 6>] [2.702789] mt7921e_mcu_init+0x2b/0x56 [mt7921e <HASH:d290 7>] [2.702792] mt7921_register_device+0x2eb/0x5a5 [mt7921_common <HASH:6a2f 6>] [2.702795] ? mt7921_irq_tasklet+0x1d4/0x1d4 [mt7921e <HASH:d290 7>] [2.702797] mt7921_pci_probe+0x2d6/0x319 [mt7921e <HASH:d290 7>] [2.702799] pci_device_probe+0x9f/0x12a CVE-2023-53232 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53232.html CVE-2023-53232 https://bugzilla.suse.com/1249648 SUSE Bug 1249648 In the Linux kernel, the following vulnerability has been resolved: watchdog: Fix kmemleak in watchdog_cdev_register kmemleak reports memory leaks in watchdog_dev_register, as follows: unreferenced object 0xffff888116233000 (size 2048): comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 32 bytes): 80 fa b9 05 81 88 ff ff 08 30 23 16 81 88 ff ff .........0#..... 08 30 23 16 81 88 ff ff 00 00 00 00 00 00 00 00 .0#............. backtrace: [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 [<000000006a389304>] kmalloc_trace+0x21/0x110 [<000000008d640eea>] watchdog_dev_register+0x4e/0x780 [watchdog] [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] [<000000001f730178>] 0xffffffffc10880ae [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 [<00000000b98be325>] do_init_module+0x1ca/0x5f0 [<0000000046d08e7c>] load_module+0x6133/0x70f0 ... unreferenced object 0xffff888105b9fa80 (size 16): comm ""modprobe"", pid 28147, jiffies 4353426116 (age 61.741s) hex dump (first 16 bytes): 77 61 74 63 68 64 6f 67 31 00 b9 05 81 88 ff ff watchdog1....... backtrace: [<000000007f001ffd>] __kmem_cache_alloc_node+0x157/0x220 [<00000000486ab89b>] __kmalloc_node_track_caller+0x44/0x1b0 [<000000005a39aab0>] kvasprintf+0xb5/0x140 [<0000000024806f85>] kvasprintf_const+0x55/0x180 [<000000009276cb7f>] kobject_set_name_vargs+0x56/0x150 [<00000000a92e820b>] dev_set_name+0xab/0xe0 [<00000000cec812c6>] watchdog_dev_register+0x285/0x780 [watchdog] [<0000000053c9f248>] __watchdog_register_device+0x4f0/0x680 [watchdog] [<00000000b2979824>] watchdog_register_device+0xd2/0x110 [watchdog] [<000000001f730178>] 0xffffffffc10880ae [<000000007a1a8bcc>] do_one_initcall+0xcb/0x4d0 [<00000000b98be325>] do_init_module+0x1ca/0x5f0 [<0000000046d08e7c>] load_module+0x6133/0x70f0 ... The reason is that put_device is not be called if cdev_device_add fails and wdd->id != 0. watchdog_cdev_register wd_data = kzalloc [1] err = dev_set_name [2] .. err = cdev_device_add if (err) { if (wdd->id == 0) { // wdd->id != 0 .. } return err; // [1],[2] would be leaked To fix it, call put_device in all wdd->id cases. CVE-2023-53234 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53234.html CVE-2023-53234 https://bugzilla.suse.com/1249784 SUSE Bug 1249784 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini The gmc.ecc_irq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. So, it is meaningless to use the amdgpu_irq_put function in gmc_v11_0_hw_fini, which also leads to the call trace. [ 102.980303] Call Trace: [ 102.980303] <TASK> [ 102.980304] gmc_v11_0_hw_fini+0x54/0x90 [amdgpu] [ 102.980357] gmc_v11_0_suspend+0xe/0x20 [amdgpu] [ 102.980409] amdgpu_device_ip_suspend_phase2+0x240/0x460 [amdgpu] [ 102.980459] amdgpu_device_ip_suspend+0x3d/0x80 [amdgpu] [ 102.980520] amdgpu_device_pre_asic_reset+0xd9/0x490 [amdgpu] [ 102.980573] amdgpu_device_gpu_recover.cold+0x548/0xce6 [amdgpu] [ 102.980687] amdgpu_debugfs_reset_work+0x4c/0x70 [amdgpu] [ 102.980740] process_one_work+0x21f/0x3f0 [ 102.980741] worker_thread+0x200/0x3e0 [ 102.980742] ? process_one_work+0x3f0/0x3f0 [ 102.980743] kthread+0xfd/0x130 [ 102.980743] ? kthread_complete_and_exit+0x20/0x20 [ 102.980744] ret_from_fork+0x22/0x30 CVE-2023-53237 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53237.html CVE-2023-53237 https://bugzilla.suse.com/1249782 SUSE Bug 1249782 In the Linux kernel, the following vulnerability has been resolved: phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() The size of array 'priv->ports[]' is INNO_PHY_PORT_NUM. In the for loop, 'i' is used as the index for array 'priv->ports[]' with a check (i > INNO_PHY_PORT_NUM) which indicates that INNO_PHY_PORT_NUM is allowed value for 'i' in the same loop. This > comparison needs to be changed to >=, otherwise it potentially leads to an out of bounds write on the next iteration through the loop CVE-2023-53238 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53238.html CVE-2023-53238 https://bugzilla.suse.com/1249707 SUSE Bug 1249707 In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Add check for kzalloc As kzalloc may fail and return NULL pointer, it should be better to check the return value in order to avoid the NULL pointer dereference. Patchwork: https://patchwork.freedesktop.org/patch/514154/ CVE-2023-53239 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53239.html CVE-2023-53239 https://bugzilla.suse.com/1249781 SUSE Bug 1249781 In the Linux kernel, the following vulnerability has been resolved: nfsd: call op_release, even when op_func returns an error For ops with "trivial" replies, nfsd4_encode_operation will shortcut most of the encoding work and skip to just marshalling up the status. One of the things it skips is calling op_release. This could cause a memory leak in the layoutget codepath if there is an error at an inopportune time. Have the compound processing engine always call op_release, even when op_func sets an error in op->status. With this change, we also need nfsd4_block_get_device_info_scsi to set the gd_device pointer to NULL on error to avoid a double free. CVE-2023-53241 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53241.html CVE-2023-53241 https://bugzilla.suse.com/1249638 SUSE Bug 1249638 In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/hisi: Drop second sensor hi3660 The commit 74c8e6bffbe1 ("driver core: Add __alloc_size hint to devm allocators") exposes a panic "BRK handler: Fatal exception" on the hi3660_thermal_probe funciton. This is because the function allocates memory for only one sensors array entry, but tries to fill up a second one. Fix this by removing the unneeded second access. CVE-2023-53242 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53242.html CVE-2023-53242 https://bugzilla.suse.com/1249639 SUSE Bug 1249639 In the Linux kernel, the following vulnerability has been resolved: media: pci: tw68: Fix null-ptr-deref bug in buf prepare and finish When the driver calls tw68_risc_buffer() to prepare the buffer, the function call dma_alloc_coherent may fail, resulting in a empty buffer buf->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered. This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71. We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of tw68_risc_buffer() and the value of buf->cpu before buffer free. CVE-2023-53244 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53244.html CVE-2023-53244 https://bugzilla.suse.com/1249868 SUSE Bug 1249868 In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them in a guest VM as a SCSI device. I/O to the vFC device is handled by the storvsc driver. The storvsc driver includes a partial integration with the FC transport implemented in the generic portion of the Linux SCSI subsystem so that FC attributes can be displayed in /sys. However, the partial integration means that some aspects of vFC don't work properly. Unfortunately, a full and correct integration isn't practical because of limitations in what Hyper-V provides to the guest. In particular, in the context of Hyper-V storvsc, the FC transport timeout function fc_eh_timed_out() causes a kernel panic because it can't find the rport and dereferences a NULL pointer. The original patch that added the call from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this regard. In many cases a timeout is due to a transient condition, so the situation can be improved by just continuing to wait like with other I/O requests issued by storvsc, and avoiding the guaranteed panic. For a permanent failure, continuing to wait may result in a hung thread instead of a panic, which again may be better. So fix the panic by removing the storvsc call to fc_eh_timed_out(). This allows storvsc to keep waiting for a response. The change has been tested by users who experienced a panic in fc_eh_timed_out() due to transient timeouts, and it solves their problem. In the future we may want to deprecate the vFC functionality in storvsc since it can't be fully fixed. But it has current users for whom it is working well enough, so it should probably stay for a while longer. CVE-2023-53245 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53245.html CVE-2023-53245 https://bugzilla.suse.com/1249641 SUSE Bug 1249641 In the Linux kernel, the following vulnerability has been resolved: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to S_AUTOMOUNT and corresponding dentry flags is retained regardless of CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in VFS follow_automount() when traversing a DFS referral link: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... Call Trace: <TASK> __traverse_mounts+0xb5/0x220 ? cifs_revalidate_mapping+0x65/0xc0 [cifs] step_into+0x195/0x610 ? lookup_fast+0xe2/0xf0 path_lookupat+0x64/0x140 filename_lookup+0xc2/0x140 ? __create_object+0x299/0x380 ? kmem_cache_alloc+0x119/0x220 ? user_path_at_empty+0x31/0x50 user_path_at_empty+0x31/0x50 __x64_sys_chdir+0x2a/0xd0 ? exit_to_user_mode_prepare+0xca/0x100 do_syscall_64+0x42/0x90 entry_SYSCALL_64_after_hwframe+0x72/0xdc This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This approach was chosen as it provides more control over the error path. CVE-2023-53246 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53246.html CVE-2023-53246 https://bugzilla.suse.com/1249867 SUSE Bug 1249867 In the Linux kernel, the following vulnerability has been resolved: clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe Use devm_of_iomap() instead of of_iomap() to automatically handle the unused ioremap region. If any error occurs, regions allocated by kzalloc() will leak, but using devm_kzalloc() instead will automatically free the memory using devm_kfree(). CVE-2023-53249 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53249.html CVE-2023-53249 https://bugzilla.suse.com/1249642 SUSE Bug 1249642 In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: <TASK> kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]--- It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del(). However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fix this. CVE-2023-53250 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53250.html CVE-2023-53250 https://bugzilla.suse.com/1249727 SUSE Bug 1249727 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() rxq can be NULL only when trans_pcie->rxq is NULL and entry->entry is zero. For the case when entry->entry is not equal to 0, rxq won't be NULL even if trans_pcie->rxq is NULL. Modify checker to check for trans_pcie->rxq. CVE-2023-53251 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53251.html CVE-2023-53251 https://bugzilla.suse.com/1249730 SUSE Bug 1249730 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync hci_update_accept_list_sync iterates over hdev->pend_le_conns and hdev->pend_le_reports, and waits for controller events in the loop body, without holding hdev lock. Meanwhile, these lists and the items may be modified e.g. by le_scan_cleanup. This can invalidate the list cursor or any other item in the list, resulting to invalid behavior (eg use-after-free). Use RCU for the hci_conn_params action lists. Since the loop bodies in hci_sync block and we cannot use RCU or hdev->lock for the whole loop, copy list items first and then iterate on the copy. Only the flags field is written from elsewhere, so READ_ONCE/WRITE_ONCE should guarantee we read valid values. Free params everywhere with hci_conn_params_free so the cleanup is guaranteed to be done properly. This fixes the following, which can be triggered e.g. by BlueZ new mgmt-tester case "Add + Remove Device Nowait - Success", or by changing hci_le_set_cig_params to always return false, and running iso-tester: ================================================================== BUG: KASAN: slab-use-after-free in hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) Read of size 8 at addr ffff888001265018 by task kworker/u3:0/32 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> dump_stack_lvl (./arch/x86/include/asm/irqflags.h:134 lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) ? __virt_addr_valid (./include/linux/mmzone.h:1915 ./include/linux/mmzone.h:2011 arch/x86/mm/physaddr.c:65) ? hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) kasan_report (mm/kasan/report.c:538) ? hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) ? __pfx_hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2780) ? mutex_lock (kernel/locking/mutex.c:282) ? __pfx_mutex_lock (kernel/locking/mutex.c:282) ? __pfx_mutex_unlock (kernel/locking/mutex.c:538) ? __pfx_update_passive_scan_sync (net/bluetooth/hci_sync.c:2861) hci_cmd_sync_work (net/bluetooth/hci_sync.c:306) process_one_work (./arch/x86/include/asm/preempt.h:27 kernel/workqueue.c:2399) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2538) ? __pfx_worker_thread (kernel/workqueue.c:2480) kthread (kernel/kthread.c:376) ? __pfx_kthread (kernel/kthread.c:331) ret_from_fork (arch/x86/entry/entry_64.S:314) </TASK> Allocated by task 31: kasan_save_stack (mm/kasan/common.c:46) kasan_set_track (mm/kasan/common.c:52) __kasan_kmalloc (mm/kasan/common.c:374 mm/kasan/common.c:383) hci_conn_params_add (./include/linux/slab.h:580 ./include/linux/slab.h:720 net/bluetooth/hci_core.c:2277) hci_connect_le_scan (net/bluetooth/hci_conn.c:1419 net/bluetooth/hci_conn.c:1589) hci_connect_cis (net/bluetooth/hci_conn.c:2266) iso_connect_cis (net/bluetooth/iso.c:390) iso_sock_connect (net/bluetooth/iso.c:899) __sys_connect (net/socket.c:2003 net/socket.c:2020) __x64_sys_connect (net/socket.c:2027) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) Freed by task 15: kasan_save_stack (mm/kasan/common.c:46) kasan_set_track (mm/kasan/common.c:52) kasan_save_free_info (mm/kasan/generic.c:523) __kasan_slab_free (mm/kasan/common.c:238 mm/kasan/common.c:200 mm/kasan/common.c:244) __kmem_cache_free (mm/slub.c:1807 mm/slub.c:3787 mm/slub.c:3800) hci_conn_params_del (net/bluetooth/hci_core.c:2323) le_scan_cleanup (net/bluetooth/hci_conn.c:202) process_one_work (./arch/x86/include/asm/preempt. ---truncated--- CVE-2023-53252 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53252.html CVE-2023-53252 https://bugzilla.suse.com/1249756 SUSE Bug 1249756 In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() svc_create_memory_pool() is only called from stratix10_svc_drv_probe(). Most of resources in the probe are managed, but not this memremap() call. There is also no memunmap() call in the file. So switch to devm_memremap() to avoid a resource leak. CVE-2023-53255 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53255.html CVE-2023-53255 https://bugzilla.suse.com/1249762 SUSE Bug 1249762 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame. CVE-2023-53257 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53257.html CVE-2023-53257 https://bugzilla.suse.com/1249869 SUSE Bug 1249869 https://bugzilla.suse.com/1250730 SUSE Bug 1250730 In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix possible underflow for displays with large vblank [Why] Underflow observed when using a display with a large vblank region and low refresh rate [How] Simplify calculation of vblank_nom Increase value for VBlankNomDefaultUS to 800us CVE-2023-53258 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53258.html CVE-2023-53258 https://bugzilla.suse.com/1249780 SUSE Bug 1249780 In the Linux kernel, the following vulnerability has been resolved: VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so. general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace: <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40 __x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd CVE-2023-53259 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53259.html CVE-2023-53259 https://bugzilla.suse.com/1249767 SUSE Bug 1249767 In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create We can't simply free the connector after calling drm_connector_init on it. We need to clean up the drm side first. It might not fix all regressions from commit 2b5d1c29f6c4 ("drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts"), but at least it fixes a memory corruption in error handling related to that commit. CVE-2023-53263 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53263.html CVE-2023-53263 https://bugzilla.suse.com/1249861 SUSE Bug 1249861 In the Linux kernel, the following vulnerability has been resolved: ubi: ensure that VID header offset + VID header size <= alloc, size Ensure that the VID header offset + VID header size does not exceed the allocated area to avoid slab OOB. BUG: KASAN: slab-out-of-bounds in crc32_body lib/crc32.c:111 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_generic lib/crc32.c:179 [inline] BUG: KASAN: slab-out-of-bounds in crc32_le_base+0x58c/0x626 lib/crc32.c:197 Read of size 4 at addr ffff88802bb36f00 by task syz-executor136/1555 CPU: 2 PID: 1555 Comm: syz-executor136 Tainted: G W 6.0.0-1868 #1 Hardware name: Red Hat KVM, BIOS 1.13.0-2.module+el8.3.0+7860+a7792d29 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x85/0xad lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold.13+0xb6/0x6bb mm/kasan/report.c:433 kasan_report+0xa7/0x11b mm/kasan/report.c:495 crc32_body lib/crc32.c:111 [inline] crc32_le_generic lib/crc32.c:179 [inline] crc32_le_base+0x58c/0x626 lib/crc32.c:197 ubi_io_write_vid_hdr+0x1b7/0x472 drivers/mtd/ubi/io.c:1067 create_vtbl+0x4d5/0x9c4 drivers/mtd/ubi/vtbl.c:317 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 RIP: 0033:0x7f96d5cf753d Code: RSP: 002b:00007fffd72206f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f96d5cf753d RDX: 0000000020000080 RSI: 0000000040186f40 RDI: 0000000000000003 RBP: 0000000000400cd0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000400be0 R13: 00007fffd72207e0 R14: 0000000000000000 R15: 0000000000000000 </TASK> Allocated by task 1555: kasan_save_stack+0x20/0x3d mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] __kasan_kmalloc+0x88/0xa3 mm/kasan/common.c:525 kasan_kmalloc include/linux/kasan.h:234 [inline] __kmalloc+0x138/0x257 mm/slub.c:4429 kmalloc include/linux/slab.h:605 [inline] ubi_alloc_vid_buf drivers/mtd/ubi/ubi.h:1093 [inline] create_vtbl+0xcc/0x9c4 drivers/mtd/ubi/vtbl.c:295 create_empty_lvol drivers/mtd/ubi/vtbl.c:500 [inline] ubi_read_volume_table+0x67b/0x288a drivers/mtd/ubi/vtbl.c:812 ubi_attach+0xf34/0x1603 drivers/mtd/ubi/attach.c:1601 ubi_attach_mtd_dev+0x6f3/0x185e drivers/mtd/ubi/build.c:965 ctrl_cdev_ioctl+0x2db/0x347 drivers/mtd/ubi/cdev.c:1043 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x213 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3e/0x86 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0x0 The buggy address belongs to the object at ffff88802bb36e00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 0 bytes to the right of 256-byte region [ffff88802bb36e00, ffff88802bb36f00) The buggy address belongs to the physical page: page:00000000ea4d1263 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2bb36 head:00000000ea4d1263 order:1 compound_mapcount:0 compound_pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) raw: 000fffffc0010200 ffffea000066c300 dead000000000003 ffff888100042b40 raw: 0000000000000000 00000000001 ---truncated--- CVE-2023-53265 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53265.html CVE-2023-53265 https://bugzilla.suse.com/1249908 SUSE Bug 1249908 In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_mqs: move of_node_put() to the correct location of_node_put() should have been done directly after mqs_priv->regmap = syscon_node_to_regmap(gpr_np); otherwise it creates a reference leak on the success path. To fix this, of_node_put() is moved to the correct location, and change all the gotos to direct returns. CVE-2023-53268 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53268.html CVE-2023-53268 https://bugzilla.suse.com/1249914 SUSE Bug 1249914 In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_disksize exceeding i_size problem in paritally written case It is possible for i_disksize can exceed i_size, triggering a warning. generic_perform_write copied = iov_iter_copy_from_user_atomic(len) // copied < len ext4_da_write_end | ext4_update_i_disksize | new_i_size = pos + copied; | WRITE_ONCE(EXT4_I(inode)->i_disksize, newsize) // update i_disksize | generic_write_end | copied = block_write_end(copied, len) // copied = 0 | if (unlikely(copied < len)) | if (!PageUptodate(page)) | copied = 0; | if (pos + copied > inode->i_size) // return false if (unlikely(copied == 0)) goto again; if (unlikely(iov_iter_fault_in_readable(i, bytes))) { status = -EFAULT; break; } We get i_disksize greater than i_size here, which could trigger WARNING check 'i_size_read(inode) < EXT4_I(inode)->i_disksize' while doing dio: ext4_dio_write_iter iomap_dio_rw __iomap_dio_rw // return err, length is not aligned to 512 ext4_handle_inode_extension WARN_ON_ONCE(i_size_read(inode) < EXT4_I(inode)->i_disksize) // Oops WARNING: CPU: 2 PID: 2609 at fs/ext4/file.c:319 CPU: 2 PID: 2609 Comm: aa Not tainted 6.3.0-rc2 RIP: 0010:ext4_file_write_iter+0xbc7 Call Trace: vfs_write+0x3b1 ksys_write+0x77 do_syscall_64+0x39 Fix it by updating 'copied' value before updating i_disksize just like ext4_write_inline_data_end() does. A reproducer can be found in the buganizer link below. CVE-2023-53270 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53270.html CVE-2023-53270 https://bugzilla.suse.com/1249872 SUSE Bug 1249872 In the Linux kernel, the following vulnerability has been resolved: net: ena: fix shift-out-of-bounds in exponential backoff The ENA adapters on our instances occasionally reset. Once recently logged a UBSAN failure to console in the process: UBSAN: shift-out-of-bounds in build/linux/drivers/net/ethernet/amazon/ena/ena_com.c:540:13 shift exponent 32 is too large for 32-bit type 'unsigned int' CPU: 28 PID: 70012 Comm: kworker/u72:2 Kdump: loaded not tainted 5.15.117 Hardware name: Amazon EC2 c5d.9xlarge/, BIOS 1.0 10/16/2017 Workqueue: ena ena_fw_reset_device [ena] Call Trace: <TASK> dump_stack_lvl+0x4a/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x36 __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e ? __const_udelay+0x43/0x50 ena_delay_exponential_backoff_us.cold+0x16/0x1e [ena] wait_for_reset_state+0x54/0xa0 [ena] ena_com_dev_reset+0xc8/0x110 [ena] ena_down+0x3fe/0x480 [ena] ena_destroy_device+0xeb/0xf0 [ena] ena_fw_reset_device+0x30/0x50 [ena] process_one_work+0x22b/0x3d0 worker_thread+0x4d/0x3f0 ? process_one_work+0x3d0/0x3d0 kthread+0x12a/0x150 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x22/0x30 </TASK> Apparently, the reset delays are getting so large they can trigger a UBSAN panic. Looking at the code, the current timeout is capped at 5000us. Using a base value of 100us, the current code will overflow after (1<<29). Even at values before 32, this function wraps around, perhaps unintentionally. Cap the value of the exponent used for this backoff at (1<<16) which is larger than currently necessary, but large enough to support bigger values in the future. CVE-2023-53272 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53272.html CVE-2023-53272 https://bugzilla.suse.com/1249917 SUSE Bug 1249917 In the Linux kernel, the following vulnerability has been resolved: Drivers: vmbus: Check for channel allocation before looking up relids relid2channel() assumes vmbus channel array to be allocated when called. However, in cases such as kdump/kexec, not all relids will be reset by the host. When the second kernel boots and if the guest receives a vmbus interrupt during vmbus driver initialization before vmbus_connect() is called, before it finishes, or if it fails, the vmbus interrupt service routine is called which in turn calls relid2channel() and can cause a null pointer dereference. Print a warning and error out in relid2channel() for a channel id that's invalid in the second kernel. CVE-2023-53273 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53273.html CVE-2023-53273 https://bugzilla.suse.com/1249930 SUSE Bug 1249930 In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. However, it is accessed without holding the lock when is accessed in snd_hdac_regmap_sync(): if (codec->regmap) In my opinion, this may be a harmful race, because if codec->regmap is set to NULL right after the condition is checked, a null-pointer dereference can occur in the called function regcache_sync(): map->lock(map->lock_arg); --> Line 360 in drivers/base/regmap/regcache.c To fix this possible null-pointer dereference caused by data race, the mutex_lock coverage is extended to protect the if statement as well as the function call to regcache_sync(). [ Note: the lack of the regmap_lock itself is harmless for the current codec driver implementations, as snd_hdac_regmap_sync() is only for PM runtime resume that is prohibited during the codec probe. But the change makes the whole code more consistent, so it's merged as is -- tiwai ] CVE-2023-53275 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53275.html CVE-2023-53275 https://bugzilla.suse.com/1250459 SUSE Bug 1250459 In the Linux kernel, the following vulnerability has been resolved: ubifs: Free memory for tmpfile name When opening a ubifs tmpfile on an encrypted directory, function fscrypt_setup_filename allocates memory for the name that is to be stored in the directory entry, but after the name has been copied to the directory entry inode, the memory is not freed. When running kmemleak on it we see that it is registered as a leak. The report below is triggered by a simple program 'tmpfile' just opening a tmpfile: unreferenced object 0xffff88810178f380 (size 32): comm "tmpfile", pid 509, jiffies 4294934744 (age 1524.742s) backtrace: __kmem_cache_alloc_node __kmalloc fscrypt_setup_filename ubifs_tmpfile vfs_tmpfile path_openat Free this memory after it has been copied to the inode. CVE-2023-53276 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53276.html CVE-2023-53276 https://bugzilla.suse.com/1250309 SUSE Bug 1250309 In the Linux kernel, the following vulnerability has been resolved: wifi: iwl3945: Add missing check for create_singlethread_workqueue Add the check for the return value of the create_singlethread_workqueue in order to avoid NULL pointer dereference. CVE-2023-53277 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53277.html CVE-2023-53277 https://bugzilla.suse.com/1249936 SUSE Bug 1249936 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue System crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up gets called for uninitialized wait queue sp->nvme_ls_waitq. qla2xxx [0000:37:00.1]-2121:5: Returning existing qpair of ffff8ae2c0513400 for idx=0 qla2xxx [0000:37:00.1]-700e:5: qla2x00_start_sp failed = 11 BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI Hardware name: HPE ProLiant DL360 Gen10/ProLiant DL360 Gen10, BIOS U32 09/03/2021 Workqueue: nvme-wq nvme_fc_connect_ctrl_work [nvme_fc] RIP: 0010:__wake_up_common+0x4c/0x190 RSP: 0018:ffff95f3e0cb7cd0 EFLAGS: 00010086 RAX: 0000000000000000 RBX: ffff8b08d3b26328 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: ffff8b08d3b26320 RBP: 0000000000000001 R08: 0000000000000000 R09: ffffffffffffffe8 R10: 0000000000000000 R11: ffff95f3e0cb7a60 R12: ffff95f3e0cb7d20 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8b2fdf6c0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000002f1e410002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: __wake_up_common_lock+0x7c/0xc0 qla_nvme_ls_req+0x355/0x4c0 [qla2xxx] ? __nvme_fc_send_ls_req+0x260/0x380 [nvme_fc] ? nvme_fc_send_ls_req.constprop.42+0x1a/0x45 [nvme_fc] ? nvme_fc_connect_ctrl_work.cold.63+0x1e3/0xa7d [nvme_fc] Remove unused nvme_ls_waitq wait queue. nvme_ls_waitq logic was removed previously in the commits tagged Fixed: below. CVE-2023-53280 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53280.html CVE-2023-53280 https://bugzilla.suse.com/1249938 SUSE Bug 1249938 In the Linux kernel, the following vulnerability has been resolved: drivers: staging: rtl8723bs: Fix locking in _rtw_join_timeout_handler() Commit 041879b12ddb ("drivers: staging: rtl8192bs: Fix deadlock in rtw_joinbss_event_prehandle()") besides fixing the deadlock also modified _rtw_join_timeout_handler() to use spin_[un]lock_irq() instead of spin_[un]lock_bh(). _rtw_join_timeout_handler() calls rtw_do_join() which takes pmlmepriv->scanned_queue.lock using spin_[un]lock_bh(). This spin_unlock_bh() call re-enables softirqs which triggers an oops in kernel/softirq.c: __local_bh_enable_ip() when it calls lockdep_assert_irqs_enabled(): [ 244.506087] WARNING: CPU: 2 PID: 0 at kernel/softirq.c:376 __local_bh_enable_ip+0xa6/0x100 ... [ 244.509022] Call Trace: [ 244.509048] <IRQ> [ 244.509100] _rtw_join_timeout_handler+0x134/0x170 [r8723bs] [ 244.509468] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] [ 244.509772] ? __pfx__rtw_join_timeout_handler+0x10/0x10 [r8723bs] [ 244.510076] call_timer_fn+0x95/0x2a0 [ 244.510200] __run_timers.part.0+0x1da/0x2d0 This oops is causd by the switch to spin_[un]lock_irq() which disables the IRQs for the entire duration of _rtw_join_timeout_handler(). Disabling the IRQs is not necessary since all code taking this lock runs from either user contexts or from softirqs, switch back to spin_[un]lock_bh() to fix this. CVE-2023-53281 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53281.html CVE-2023-53281 https://bugzilla.suse.com/1249939 SUSE Bug 1249939 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write During the sysfs firmware write process, a use-after-free read warning is logged from the lpfc_wr_object() routine: BUG: KFENCE: use-after-free read in lpfc_wr_object+0x235/0x310 [lpfc] Use-after-free read at 0x0000000000cf164d (in kfence-#111): lpfc_wr_object+0x235/0x310 [lpfc] lpfc_write_firmware.cold+0x206/0x30d [lpfc] lpfc_sli4_request_firmware_update+0xa6/0x100 [lpfc] lpfc_request_firmware_upgrade_store+0x66/0xb0 [lpfc] kernfs_fop_write_iter+0x121/0x1b0 new_sync_write+0x11c/0x1b0 vfs_write+0x1ef/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x59/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd The driver accessed wr_object pointer data, which was initialized into mailbox payload memory, after the mailbox object was released back to the mailbox pool. Fix by moving the mailbox free calls to the end of the routine ensuring that we don't reference internal mailbox memory after release. CVE-2023-53282 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53282.html CVE-2023-53282 https://bugzilla.suse.com/1250311 SUSE Bug 1250311 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check for null return of devm_kzalloc() in dpu_writeback_init() Because of the possilble failure of devm_kzalloc(), dpu_wb_conn might be NULL and will cause null pointer dereference later. Therefore, it might be better to check it and directly return -ENOMEM. Patchwork: https://patchwork.freedesktop.org/patch/512277/ [DB: fixed typo in commit message] CVE-2023-53284 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53284.html CVE-2023-53284 https://bugzilla.suse.com/1249940 SUSE Bug 1249940 In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Return the firmware result upon destroying QP/RQ Previously when destroying a QP/RQ, the result of the firmware destruction function was ignored and upper layers weren't informed about the failure. Which in turn could lead to various problems since when upper layer isn't aware of the failure it continues its operation thinking that the related QP/RQ was successfully destroyed while it actually wasn't, which could lead to the below kernel WARN. Currently, we return the correct firmware destruction status to upper layers which in case of the RQ would be mlx5_ib_destroy_wq() which was already capable of handling RQ destruction failure or in case of a QP to destroy_qp_common(), which now would actually warn upon qp destruction failure. WARNING: CPU: 3 PID: 995 at drivers/infiniband/core/rdma_core.c:940 uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs] Modules linked in: xt_conntrack xt_MASQUERADE nf_conntrack_netlink nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter rpcrdma rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm ib_umad ib_ipoib iw_cm ib_cm mlx5_ib ib_uverbs ib_core overlay mlx5_core fuse CPU: 3 PID: 995 Comm: python3 Not tainted 5.16.0-rc5+ #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:uverbs_destroy_ufile_hw+0xcb/0xe0 [ib_uverbs] Code: 41 5c 41 5d 41 5e e9 44 34 f0 e0 48 89 df e8 4c 77 ff ff 49 8b 86 10 01 00 00 48 85 c0 74 a1 4c 89 e7 ff d0 eb 9a 0f 0b eb c1 <0f> 0b be 04 00 00 00 48 89 df e8 b6 f6 ff ff e9 75 ff ff ff 90 0f RSP: 0018:ffff8881533e3e78 EFLAGS: 00010287 RAX: ffff88811b2cf3e0 RBX: ffff888106209700 RCX: 0000000000000000 RDX: ffff888106209780 RSI: ffff8881533e3d30 RDI: ffff888109b101a0 RBP: 0000000000000001 R08: ffff888127cb381c R09: 0de9890000000009 R10: ffff888127cb3800 R11: 0000000000000000 R12: ffff888106209780 R13: ffff888106209750 R14: ffff888100f20660 R15: 0000000000000000 FS: 00007f8be353b740(0000) GS:ffff88852c980000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8bd5b117c0 CR3: 000000012cd8a004 CR4: 0000000000370ea0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ib_uverbs_close+0x1a/0x90 [ib_uverbs] __fput+0x82/0x230 task_work_run+0x59/0x90 exit_to_user_mode_prepare+0x138/0x140 syscall_exit_to_user_mode+0x1d/0x50 ? __x64_sys_close+0xe/0x40 do_syscall_64+0x4a/0x90 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f8be3ae0abb Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 83 43 f9 ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 c1 43 f9 ff 8b 44 RSP: 002b:00007ffdb51909c0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000557bb7f7c020 RCX: 00007f8be3ae0abb RDX: 0000557bb7c74010 RSI: 0000557bb7f14ca0 RDI: 0000000000000005 RBP: 0000557bb7fbd598 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 0000557bb7fbd5b8 R13: 0000557bb7fbd5a8 R14: 0000000000001000 R15: 0000557bb7f7c020 </TASK> CVE-2023-53286 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53286.html CVE-2023-53286 https://bugzilla.suse.com/1250325 SUSE Bug 1250325 In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Put the cdns set active part outside the spin lock The device may be scheduled during the resume process, so this cannot appear in atomic operations. Since pm_runtime_set_active will resume suppliers, put set active outside the spin lock, which is only used to protect the struct cdns data structure, otherwise the kernel will report the following warning: BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1163 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 651, name: sh preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 CPU: 0 PID: 651 Comm: sh Tainted: G WC 6.1.20 #1 Hardware name: Freescale i.MX8QM MEK (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x30 dump_stack_lvl+0x64/0x80 dump_stack+0x1c/0x38 __might_resched+0x1fc/0x240 __might_sleep+0x68/0xc0 __pm_runtime_resume+0x9c/0xe0 rpm_get_suppliers+0x68/0x1b0 __pm_runtime_set_status+0x298/0x560 cdns_resume+0xb0/0x1c0 cdns3_controller_resume.isra.0+0x1e0/0x250 cdns3_plat_resume+0x28/0x40 CVE-2023-53287 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53287.html CVE-2023-53287 https://bugzilla.suse.com/1250089 SUSE Bug 1250089 In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_modeset_probe When a new mode is set to modeset->mode, the previous mode should be freed. This fixes the following kmemleak report: drm_mode_duplicate+0x45/0x220 [drm] drm_client_modeset_probe+0x944/0xf50 [drm] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper] drm_client_register+0x169/0x240 [drm] ast_pci_probe+0x142/0x190 [ast] local_pci_probe+0xdc/0x180 work_for_cpu_fn+0x4e/0xa0 process_one_work+0x8b7/0x1540 worker_thread+0x70a/0xed0 kthread+0x29f/0x340 ret_from_fork+0x1f/0x30 CVE-2023-53288 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53288.html CVE-2023-53288 https://bugzilla.suse.com/1250058 SUSE Bug 1250058 In the Linux kernel, the following vulnerability has been resolved: udf: Do not update file length for failed writes to inline files When write to inline file fails (or happens only partly), we still updated length of inline data as if the whole write succeeded. Fix the update of length of inline data to happen only if the write succeeds. CVE-2023-53295 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53295.html CVE-2023-53295 https://bugzilla.suse.com/1250324 SUSE Bug 1250324 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered. CVE-2023-53297 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53297.html CVE-2023-53297 https://bugzilla.suse.com/1250322 SUSE Bug 1250322 https://bugzilla.suse.com/1250728 SUSE Bug 1250728 In the Linux kernel, the following vulnerability has been resolved: nfc: fix memory leak of se_io context in nfc_genl_se_io The callback context for sending/receiving APDUs to/from the selected secure element is allocated inside nfc_genl_se_io and supposed to be eventually freed in se_io_cb callback function. However, there are several error paths where the bwi_timer is not charged to call se_io_cb later, and the cb_context is leaked. The patch proposes to free the cb_context explicitly on those error paths. At the moment we can't simply check 'dev->ops->se_io()' return value as it may be negative in both cases: when the timer was charged and was not. CVE-2023-53298 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53298.html CVE-2023-53298 https://bugzilla.suse.com/1249944 SUSE Bug 1249944 In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio->remaining' for recovery raid10_sync_request() will add 'r10bio->remaining' for both rdev and replacement rdev. However, if the read io fails, recovery_request_write() returns without issuing the write io, in this case, end_sync_request() is only called once and 'remaining' is leaked, cause an io hang. Fix the problem by decreasing 'remaining' according to if 'bio' and 'repl_bio' is valid. CVE-2023-53299 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53299.html CVE-2023-53299 https://bugzilla.suse.com/1249927 SUSE Bug 1249927 In the Linux kernel, the following vulnerability has been resolved: wifi: iwl4965: Add missing check for create_singlethread_workqueue() Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference. CVE-2023-53302 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53302.html CVE-2023-53302 https://bugzilla.suse.com/1249958 SUSE Bug 1249958 In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix overlap expiration walk The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any. Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0 in nftables.git and kmemleak enabled kernel. Second bug is the use of rbe_prev vs. prev pointer. If rbe_prev() returns NULL after at least one iteration, rbe_prev points to element that is not an end interval, hence it should not be removed. Lastly, check the genmask of the end interval if this is active in the current generation. CVE-2023-53304 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53304.html CVE-2023-53304 https://bugzilla.suse.com/1249923 SUSE Bug 1249923 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej. CVE-2023-53305 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53305.html CVE-2023-53305 https://bugzilla.suse.com/1250049 SUSE Bug 1250049 In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix integer overflow in radeon_cs_parser_init The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later CVE-2023-53309 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53309.html CVE-2023-53309 https://bugzilla.suse.com/1250055 SUSE Bug 1250055 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). Previously, nilfs_evict_inode() could cause use-after-free read for nilfs_root if inodes are left in "garbage_list" and released by nilfs_dispose_list at the end of nilfs_detach_log_writer(), and this bug was fixed by commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()"). However, it turned out that there is another possibility of UAF in the call path where mark_inode_dirty_sync() is called from iput(): nilfs_detach_log_writer() nilfs_dispose_list() iput() mark_inode_dirty_sync() __mark_inode_dirty() nilfs_dirty_inode() __nilfs_mark_inode_dirty() nilfs_load_inode_block() --> causes UAF of nilfs_root struct This can happen after commit 0ae45f63d4ef ("vfs: add support for a lazytime mount option"), which changed iput() to call mark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME flag and i_nlink is non-zero. This issue appears after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only") when using the syzbot reproducer, but the issue has potentially existed before. Fix this issue by adding a "purging flag" to the nilfs structure, setting that flag while disposing the "garbage_list" and checking it in __nilfs_mark_inode_dirty(). Unlike commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()"), this patch does not rely on ns_writer to determine whether to skip operations, so as not to break recovery on mount. The nilfs_salvage_orphan_logs routine dirties the buffer of salvaged data before attaching the log writer, so changing __nilfs_mark_inode_dirty() to skip the operation when ns_writer is NULL will cause recovery write to fail. The purpose of using the cleanup-only flag is to allow for narrowing of such conditions. CVE-2023-53311 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53311.html CVE-2023-53311 https://bugzilla.suse.com/1250062 SUSE Bug 1250062 In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix wrong setting of max_corr_read_errors There is no input check when echo md/max_read_errors and overflow might occur. Add check of input number. CVE-2023-53313 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53313.html CVE-2023-53313 https://bugzilla.suse.com/1249911 SUSE Bug 1249911 In the Linux kernel, the following vulnerability has been resolved: fbdev/ep93xx-fb: Do not assign to struct fb_info.dev Do not assing the Linux device to struct fb_info.dev. The call to register_framebuffer() initializes the field to the fbdev device. Drivers should not override its value. Fixes a bug where the driver incorrectly decreases the hardware device's reference counter and leaks the fbdev device. v2: * add Fixes tag (Dan) CVE-2023-53314 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53314.html CVE-2023-53314 https://bugzilla.suse.com/1250065 SUSE Bug 1250065 In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix SKB corruption in REO destination ring While running traffics for a long time, randomly an RX descriptor filled with value "0" from REO destination ring is received. This descriptor which is invalid causes the wrong SKB (SKB stored in the IDR lookup with buffer id "0") to be fetched which in turn causes SKB memory corruption issue and the same leads to crash after some time. Changed the start id for idr allocation to "1" and the buffer id "0" is reserved for error validation. Introduced Sanity check to validate the descriptor, before processing the SKB. Crash Signature : Unable to handle kernel paging request at virtual address 3f004900 PC points to "b15_dma_inv_range+0x30/0x50" LR points to "dma_cache_maint_page+0x8c/0x128". The Backtrace obtained is as follows: [<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128) [<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc) [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k]) [<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k]) [<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci]) [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8) [<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280) [<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280) [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4) [<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4) [<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90) [<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 CVE-2023-53315 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53315.html CVE-2023-53315 https://bugzilla.suse.com/1250303 SUSE Bug 1250303 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: Free resources after unregistering them The DP component's unbind operation walks through the submodules to unregister and clean things up. But if the unbind happens because the DP controller itself is being removed, all the memory for those submodules has just been freed. Change the order of these operations to avoid the many use-after-free that otherwise happens in this code path. Patchwork: https://patchwork.freedesktop.org/patch/542166/ CVE-2023-53316 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53316.html CVE-2023-53316 https://bugzilla.suse.com/1250066 SUSE Bug 1250066 In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in mb_find_extent Syzbot found the following issue: EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! EXT4-fs (loop0): orphan cleanup on readonly fs ------------[ cut here ]------------ WARNING: CPU: 1 PID: 5067 at fs/ext4/mballoc.c:1869 mb_find_extent+0x8a1/0xe30 Modules linked in: CPU: 1 PID: 5067 Comm: syz-executor307 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:mb_find_extent+0x8a1/0xe30 fs/ext4/mballoc.c:1869 RSP: 0018:ffffc90003c9e098 EFLAGS: 00010293 RAX: ffffffff82405731 RBX: 0000000000000041 RCX: ffff8880783457c0 RDX: 0000000000000000 RSI: 0000000000000041 RDI: 0000000000000040 RBP: 0000000000000040 R08: ffffffff82405723 R09: ffffed10053c9402 R10: ffffed10053c9402 R11: 1ffff110053c9401 R12: 0000000000000000 R13: ffffc90003c9e538 R14: dffffc0000000000 R15: ffffc90003c9e2cc FS: 0000555556665300(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000056312f6796f8 CR3: 0000000022437000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ext4_mb_complex_scan_group+0x353/0x1100 fs/ext4/mballoc.c:2307 ext4_mb_regular_allocator+0x1533/0x3860 fs/ext4/mballoc.c:2735 ext4_mb_new_blocks+0xddf/0x3db0 fs/ext4/mballoc.c:5605 ext4_ext_map_blocks+0x1868/0x6880 fs/ext4/extents.c:4286 ext4_map_blocks+0xa49/0x1cc0 fs/ext4/inode.c:651 ext4_getblk+0x1b9/0x770 fs/ext4/inode.c:864 ext4_bread+0x2a/0x170 fs/ext4/inode.c:920 ext4_quota_write+0x225/0x570 fs/ext4/super.c:7105 write_blk fs/quota/quota_tree.c:64 [inline] get_free_dqblk+0x34a/0x6d0 fs/quota/quota_tree.c:130 do_insert_tree+0x26b/0x1aa0 fs/quota/quota_tree.c:340 do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375 do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375 do_insert_tree+0x722/0x1aa0 fs/quota/quota_tree.c:375 dq_insert_tree fs/quota/quota_tree.c:401 [inline] qtree_write_dquot+0x3b6/0x530 fs/quota/quota_tree.c:420 v2_write_dquot+0x11b/0x190 fs/quota/quota_v2.c:358 dquot_acquire+0x348/0x670 fs/quota/dquot.c:444 ext4_acquire_dquot+0x2dc/0x400 fs/ext4/super.c:6740 dqget+0x999/0xdc0 fs/quota/dquot.c:914 __dquot_initialize+0x3d0/0xcf0 fs/quota/dquot.c:1492 ext4_process_orphan+0x57/0x2d0 fs/ext4/orphan.c:329 ext4_orphan_cleanup+0xb60/0x1340 fs/ext4/orphan.c:474 __ext4_fill_super fs/ext4/super.c:5516 [inline] ext4_fill_super+0x81cd/0x8700 fs/ext4/super.c:5644 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Add some debug information: mb_find_extent: mb_find_extent block=41, order=0 needed=64 next=0 ex=0/41/1@3735929054 64 64 7 block_bitmap: ff 3f 0c 00 fc 01 00 00 d2 3d 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Acctually, blocks per group is 64, but block bitmap indicate at least has 128 blocks. Now, ext4_validate_block_bitmap() didn't check invalid block's bitmap if set. To resolve above issue, add check like fsck "Padding at end of block bitmap is not set". CVE-2023-53317 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53317.html CVE-2023-53317 https://bugzilla.suse.com/1250081 SUSE Bug 1250081 https://bugzilla.suse.com/1250194 SUSE Bug 1250194 In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() The function mpi3mr_get_all_tgt_info() has four issues: 1) It calculates valid entry length in alltgt_info assuming the header part of the struct mpi3mr_device_map_info would equal to sizeof(u32). The correct size is sizeof(u64). 2) When it calculates the valid entry length kern_entrylen, it excludes one entry by subtracting 1 from num_devices. 3) It copies num_device by calling memcpy(). Substitution is enough. 4) It does not specify the calculated length to sg_copy_from_buffer(). Instead, it specifies the payload length which is larger than the alltgt_info size. It causes "BUG: KASAN: slab-out-of-bounds". Fix the issues by using the correct header size, removing the subtraction from num_devices, replacing the memcpy() with substitution and specifying the correct length to sg_copy_from_buffer(). CVE-2023-53320 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53320.html CVE-2023-53320 https://bugzilla.suse.com/1250068 SUSE Bug 1250068 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: drop short frames While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar userspace, so require the full 3-address header to avoid accessing invalid memory if shorter frames are passed in. CVE-2023-53321 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53321.html CVE-2023-53321 https://bugzilla.suse.com/1250313 SUSE Bug 1250313 https://bugzilla.suse.com/1250314 SUSE Bug 1250314 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on terminate rport System crash due to use after free. Current code allows terminate_rport_io to exit before making sure all IOs has returned. For FCP-2 device, IO's can hang on in HW because driver has not tear down the session in FW at first sign of cable pull. When dev_loss_tmo timer pops, terminate_rport_io is called and upper layer is about to free various resources. Terminate_rport_io trigger qla to do the final cleanup, but the cleanup might not be fast enough where it leave qla still holding on to the same resource. Wait for IO's to return to upper layer before resources are freed. CVE-2023-53322 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53322.html CVE-2023-53322 https://bugzilla.suse.com/1250323 SUSE Bug 1250323 In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Don't leak some plane state Apparently no one noticed that mdp5 plane states leak like a sieve ever since we introduced plane_state->commit refcount a few years ago in 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too early by tracking commits, v3.") Fix it by using the right helpers. Patchwork: https://patchwork.freedesktop.org/patch/551236/ CVE-2023-53324 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53324.html CVE-2023-53324 https://bugzilla.suse.com/1250070 SUSE Bug 1250070 In the Linux kernel, the following vulnerability has been resolved: powerpc: Don't try to copy PPR for task with NULL pt_regs powerpc sets up PF_KTHREAD and PF_IO_WORKER with a NULL pt_regs, which from my (arguably very short) checking is not commonly done for other archs. This is fine, except when PF_IO_WORKER's have been created and the task does something that causes a coredump to be generated. Then we get this crash: Kernel attempted to read user page (160) - exploit attempt? (uid: 1000) BUG: Kernel NULL pointer dereference on read at 0x00000160 Faulting instruction address: 0xc0000000000c3a60 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=32 NUMA pSeries Modules linked in: bochs drm_vram_helper drm_kms_helper xts binfmt_misc ecb ctr syscopyarea sysfillrect cbc sysimgblt drm_ttm_helper aes_generic ttm sg libaes evdev joydev virtio_balloon vmx_crypto gf128mul drm dm_mod fuse loop configfs drm_panel_orientation_quirks ip_tables x_tables autofs4 hid_generic usbhid hid xhci_pci xhci_hcd usbcore usb_common sd_mod CPU: 1 PID: 1982 Comm: ppc-crash Not tainted 6.3.0-rc2+ #88 Hardware name: IBM pSeries (emulated by qemu) POWER9 (raw) 0x4e1202 0xf000005 of:SLOF,HEAD hv:linux,kvm pSeries NIP: c0000000000c3a60 LR: c000000000039944 CTR: c0000000000398e0 REGS: c0000000041833b0 TRAP: 0300 Not tainted (6.3.0-rc2+) MSR: 800000000280b033 <SF,VEC,VSX,EE,FP,ME,IR,DR,RI,LE> CR: 88082828 XER: 200400f8 ... NIP memcpy_power7+0x200/0x7d0 LR ppr_get+0x64/0xb0 Call Trace: ppr_get+0x40/0xb0 (unreliable) __regset_get+0x180/0x1f0 regset_get_alloc+0x64/0x90 elf_core_dump+0xb98/0x1b60 do_coredump+0x1c34/0x24a0 get_signal+0x71c/0x1410 do_notify_resume+0x140/0x6f0 interrupt_exit_user_prepare_main+0x29c/0x320 interrupt_exit_user_prepare+0x6c/0xa0 interrupt_return_srr_user+0x8/0x138 Because ppr_get() is trying to copy from a PF_IO_WORKER with a NULL pt_regs. Check for a valid pt_regs in both ppc_get/ppr_set, and return an error if not set. The actual error value doesn't seem to be important here, so just pick -EINVAL. [mpe: Trim oops in change log, add Fixes & Cc stable] CVE-2023-53326 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53326.html CVE-2023-53326 https://bugzilla.suse.com/1250071 SUSE Bug 1250071 In the Linux kernel, the following vulnerability has been resolved: caif: fix memory leak in cfctrl_linkup_request() When linktype is unknown or kzalloc failed in cfctrl_linkup_request(), pkt is not released. Add release process to error path. CVE-2023-53330 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53330.html CVE-2023-53330 https://bugzilla.suse.com/1249954 SUSE Bug 1249954 In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Check start of empty przs during init After commit 30696378f68a ("pstore/ram: Do not treat empty buffers as valid"), initialization would assume a prz was valid after seeing that the buffer_size is zero (regardless of the buffer start position). This unchecked start value means it could be outside the bounds of the buffer, leading to future access panics when written to: sysdump_panic_event+0x3b4/0x5b8 atomic_notifier_call_chain+0x54/0x90 panic+0x1c8/0x42c die+0x29c/0x2a8 die_kernel_fault+0x68/0x78 __do_kernel_fault+0x1c4/0x1e0 do_bad_area+0x40/0x100 do_translation_fault+0x68/0x80 do_mem_abort+0x68/0xf8 el1_da+0x1c/0xc0 __raw_writeb+0x38/0x174 __memcpy_toio+0x40/0xac persistent_ram_update+0x44/0x12c persistent_ram_write+0x1a8/0x1b8 ramoops_pstore_write+0x198/0x1e8 pstore_console_write+0x94/0xe0 ... To avoid this, also check if the prz start is 0 during the initialization phase. If not, the next prz sanity check case will discover it (start > size) and zap the buffer back to a sane state. [kees: update commit log with backtrace and clarifications] CVE-2023-53331 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53331.html CVE-2023-53331 https://bugzilla.suse.com/1249950 SUSE Bug 1249950 In the Linux kernel, the following vulnerability has been resolved: genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() If ipi_send_{mask|single}() is called with an invalid interrupt number, all the local variables there will be NULL. ipi_send_verify() which is invoked from these functions does verify its 'data' parameter, resulting in a kernel oops in irq_data_get_affinity_mask() as the passed NULL pointer gets dereferenced. Add a missing NULL pointer check in ipi_send_verify()... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. CVE-2023-53332 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53332.html CVE-2023-53332 https://bugzilla.suse.com/1249951 SUSE Bug 1249951 In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_dh), &_dh); And nothing more is 'pulled' from the packet, depending on the content. dh->dccph_doff, and/or dh->dccph_x ...) So dccp_ack_seq() is happily reading stuff past the _dh buffer. BUG: KASAN: stack-out-of-bounds in nf_conntrack_dccp_packet+0x1134/0x11c0 Read of size 4 at addr ffff000128f66e0c by task syz-executor.2/29371 [..] Fix this by increasing the stack buffer to also include room for the extra sequence numbers and all the known dccp packet type headers, then pull again after the initial validation of the basic header. While at it, mark packets invalid that lack 48bit sequence bit but where RFC says the type MUST use them. Compile tested only. v2: first skb_header_pointer() now needs to adjust the size to only pull the generic header. (Eric) Heads-up: I intend to remove dccp conntrack support later this year. CVE-2023-53333 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53333.html CVE-2023-53333 https://bugzilla.suse.com/1249949 SUSE Bug 1249949 In the Linux kernel, the following vulnerability has been resolved: USB: chipidea: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53334 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53334.html CVE-2023-53334 https://bugzilla.suse.com/1250077 SUSE Bug 1250077 In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is dereferenced later regardless of whether it is empty. This patch adds a simple sanity check to fix the issue. Found by Linux Verification Center (linuxtesting.org) with SVACE. CVE-2023-53335 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53335.html CVE-2023-53335 https://bugzilla.suse.com/1250072 SUSE Bug 1250072 In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not write dirty data after degenerating to read-only According to syzbot's report, mark_buffer_dirty() called from nilfs_segctor_do_construct() outputs a warning with some patterns after nilfs2 detects metadata corruption and degrades to read-only mode. After such read-only degeneration, page cache data may be cleared through nilfs_clear_dirty_page() which may also clear the uptodate flag for their buffer heads. However, even after the degeneration, log writes are still performed by unmount processing etc., which causes mark_buffer_dirty() to be called for buffer heads without the "uptodate" flag and causes the warning. Since any writes should not be done to a read-only file system in the first place, this fixes the warning in mark_buffer_dirty() by letting nilfs_segctor_do_construct() abort early if in read-only mode. This also changes the retry check of nilfs_segctor_write_out() to avoid unnecessary log write retries if it detects -EROFS that nilfs_segctor_do_construct() returned. CVE-2023-53337 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53337.html CVE-2023-53337 https://bugzilla.suse.com/1250315 SUSE Bug 1250315 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't use it. This lead to array-index-out-of-bounds error. Fix it by checking whether the command is known before collecting the failure data. CVE-2023-53340 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53340.html CVE-2023-53340 https://bugzilla.suse.com/1250075 SUSE Bug 1250075 In the Linux kernel, the following vulnerability has been resolved: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write Syzkaller reported the following issue: ===================================================== BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 aio_rw_done fs/aio.c:1520 [inline] aio_write+0x899/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc+0x11d/0x3b0 mm/slab_common.c:981 kmalloc_array include/linux/slab.h:636 [inline] bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] sock_write_iter+0x495/0x5e0 net/socket.c:1108 call_write_iter include/linux/fs.h:2189 [inline] aio_write+0x63a/0x950 fs/aio.c:1600 io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 __do_sys_io_submit fs/aio.c:2078 [inline] __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 ===================================================== We can follow the call chain and find that 'bcm_tx_setup' function calls 'memcpy_from_msg' to copy some content to the newly allocated frame of 'op->frames'. After that the 'len' field of copied structure being compared with some constant value (64 or 8). However, if 'memcpy_from_msg' returns an error, we will compare some uninitialized memory. This triggers 'uninit-value' issue. This patch will add 'memcpy_from_msg' possible errors processing to avoid uninit-value issue. Tested via syzkaller CVE-2023-53344 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53344.html CVE-2023-53344 https://bugzilla.suse.com/1250023 SUSE Bug 1250023 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Handle pairing of E-switch via uplink un/load APIs In case user switch a device from switchdev mode to legacy mode, mlx5 first unpair the E-switch and afterwards unload the uplink vport. From the other hand, in case user remove or reload a device, mlx5 first unload the uplink vport and afterwards unpair the E-switch. The latter is causing a bug[1], hence, handle pairing of E-switch as part of uplink un/load APIs. [1] In case VF_LAG is used, every tc fdb flow is duplicated to the peer esw. However, the original esw keeps a pointer to this duplicated flow, not the peer esw. e.g.: if user create tc fdb flow over esw0, the flow is duplicated over esw1, in FW/HW, but in SW, esw0 keeps a pointer to the duplicated flow. During module unload while a peer tc fdb flow is still offloaded, in case the first device to be removed is the peer device (esw1 in the example above), the peer net-dev is destroyed, and so the mlx5e_priv is memset to 0. Afterwards, the peer device is trying to unpair himself from the original device (esw0 in the example above). Unpair API invoke the original device to clear peer flow from its eswitch (esw0), but the peer flow, which is stored over the original eswitch (esw0), is trying to use the peer mlx5e_priv, which is memset to 0 and result in bellow kernel-oops. [ 157.964081 ] BUG: unable to handle page fault for address: 000000000002ce60 [ 157.964662 ] #PF: supervisor read access in kernel mode [ 157.965123 ] #PF: error_code(0x0000) - not-present page [ 157.965582 ] PGD 0 P4D 0 [ 157.965866 ] Oops: 0000 [#1] SMP [ 157.967670 ] RIP: 0010:mlx5e_tc_del_fdb_flow+0x48/0x460 [mlx5_core] [ 157.976164 ] Call Trace: [ 157.976437 ] <TASK> [ 157.976690 ] __mlx5e_tc_del_fdb_peer_flow+0xe6/0x100 [mlx5_core] [ 157.977230 ] mlx5e_tc_clean_fdb_peer_flows+0x67/0x90 [mlx5_core] [ 157.977767 ] mlx5_esw_offloads_unpair+0x2d/0x1e0 [mlx5_core] [ 157.984653 ] mlx5_esw_offloads_devcom_event+0xbf/0x130 [mlx5_core] [ 157.985212 ] mlx5_devcom_send_event+0xa3/0xb0 [mlx5_core] [ 157.985714 ] esw_offloads_disable+0x5a/0x110 [mlx5_core] [ 157.986209 ] mlx5_eswitch_disable_locked+0x152/0x170 [mlx5_core] [ 157.986757 ] mlx5_eswitch_disable+0x51/0x80 [mlx5_core] [ 157.987248 ] mlx5_unload+0x2a/0xb0 [mlx5_core] [ 157.987678 ] mlx5_uninit_one+0x5f/0xd0 [mlx5_core] [ 157.988127 ] remove_one+0x64/0xe0 [mlx5_core] [ 157.988549 ] pci_device_remove+0x31/0xa0 [ 157.988933 ] device_release_driver_internal+0x18f/0x1f0 [ 157.989402 ] driver_detach+0x3f/0x80 [ 157.989754 ] bus_remove_driver+0x70/0xf0 [ 157.990129 ] pci_unregister_driver+0x34/0x90 [ 157.990537 ] mlx5_cleanup+0xc/0x1c [mlx5_core] [ 157.990972 ] __x64_sys_delete_module+0x15a/0x250 [ 157.991398 ] ? exit_to_user_mode_prepare+0xea/0x110 [ 157.991840 ] do_syscall_64+0x3d/0x90 [ 157.992198 ] entry_SYSCALL_64_after_hwframe+0x46/0xb0 CVE-2023-53347 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53347.html CVE-2023-53347 https://bugzilla.suse.com/1250017 SUSE Bug 1250017 In the Linux kernel, the following vulnerability has been resolved: media: ov2740: Fix memleak in ov2740_init_controls() There is a kmemleak when testing the media/i2c/ov2740.c with bpf mock device: unreferenced object 0xffff8881090e19e0 (size 16): comm "51-i2c-ov2740", pid 278, jiffies 4294781584 (age 23.613s) hex dump (first 16 bytes): 00 f3 7c 0b 81 88 ff ff 80 75 6a 09 81 88 ff ff ..|......uj..... backtrace: [<000000004e9fad8f>] __kmalloc_node+0x44/0x1b0 [<0000000039c802f4>] kvmalloc_node+0x34/0x180 [<000000009b8b5c63>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [<0000000038644056>] ov2740_probe+0x37d/0x84f [ov2740] [<0000000092489f59>] i2c_device_probe+0x28d/0x680 [<000000001038babe>] really_probe+0x17c/0x3f0 [<0000000098c7af1c>] __driver_probe_device+0xe3/0x170 [<00000000e1b3dc24>] device_driver_attach+0x34/0x80 [<000000005a04a34d>] bind_store+0x10b/0x1a0 [<00000000ce25d4f2>] drv_attr_store+0x49/0x70 [<000000007d9f4e9a>] sysfs_kf_write+0x8c/0xb0 [<00000000be6cff0f>] kernfs_fop_write_iter+0x216/0x2e0 [<0000000031ddb40a>] vfs_write+0x658/0x810 [<0000000041beecdd>] ksys_write+0xd6/0x1b0 [<0000000023755840>] do_syscall_64+0x38/0x90 [<00000000b2cc2da2>] entry_SYSCALL_64_after_hwframe+0x63/0xcd ov2740_init_controls() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak. CVE-2023-53349 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53349.html CVE-2023-53349 https://bugzilla.suse.com/1250015 SUSE Bug 1250015 In the Linux kernel, the following vulnerability has been resolved: drm/ttm: check null pointer before accessing when swapping Add a check to avoid null pointer dereference as below: [ 90.002283] general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 90.002292] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 90.002346] ? exc_general_protection+0x159/0x240 [ 90.002352] ? asm_exc_general_protection+0x26/0x30 [ 90.002357] ? ttm_bo_evict_swapout_allowable+0x322/0x5e0 [ttm] [ 90.002365] ? ttm_bo_evict_swapout_allowable+0x42e/0x5e0 [ttm] [ 90.002373] ttm_bo_swapout+0x134/0x7f0 [ttm] [ 90.002383] ? __pfx_ttm_bo_swapout+0x10/0x10 [ttm] [ 90.002391] ? lock_acquire+0x44d/0x4f0 [ 90.002398] ? ttm_device_swapout+0xa5/0x260 [ttm] [ 90.002412] ? lock_acquired+0x355/0xa00 [ 90.002416] ? do_raw_spin_trylock+0xb6/0x190 [ 90.002421] ? __pfx_lock_acquired+0x10/0x10 [ 90.002426] ? ttm_global_swapout+0x25/0x210 [ttm] [ 90.002442] ttm_device_swapout+0x198/0x260 [ttm] [ 90.002456] ? __pfx_ttm_device_swapout+0x10/0x10 [ttm] [ 90.002472] ttm_global_swapout+0x75/0x210 [ttm] [ 90.002486] ttm_tt_populate+0x187/0x3f0 [ttm] [ 90.002501] ttm_bo_handle_move_mem+0x437/0x590 [ttm] [ 90.002517] ttm_bo_validate+0x275/0x430 [ttm] [ 90.002530] ? __pfx_ttm_bo_validate+0x10/0x10 [ttm] [ 90.002544] ? kasan_save_stack+0x33/0x60 [ 90.002550] ? kasan_set_track+0x25/0x30 [ 90.002554] ? __kasan_kmalloc+0x8f/0xa0 [ 90.002558] ? amdgpu_gtt_mgr_new+0x81/0x420 [amdgpu] [ 90.003023] ? ttm_resource_alloc+0xf6/0x220 [ttm] [ 90.003038] amdgpu_bo_pin_restricted+0x2dd/0x8b0 [amdgpu] [ 90.003210] ? __x64_sys_ioctl+0x131/0x1a0 [ 90.003210] ? do_syscall_64+0x60/0x90 CVE-2023-53352 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53352.html CVE-2023-53352 https://bugzilla.suse.com/1250006 SUSE Bug 1250006 In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Add null pointer check in gserial_suspend Consider a case where gserial_disconnect has already cleared gser->ioport. And if gserial_suspend gets called afterwards, it will lead to accessing of gser->ioport and thus causing null pointer dereference. Avoid this by adding a null pointer check. Added a static spinlock to prevent gser->ioport from becoming null after the newly added null pointer check. CVE-2023-53356 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53356.html CVE-2023-53356 https://bugzilla.suse.com/1249997 SUSE Bug 1249997 In the Linux kernel, the following vulnerability has been resolved: md/raid10: check slab-out-of-bounds in md_bitmap_get_counter If we write a large number to md/bitmap_set_bits, md_bitmap_checkpage() will return -EINVAL because 'page >= bitmap->pages', but the return value was not checked immediately in md_bitmap_get_counter() in order to set *blocks value and slab-out-of-bounds occurs. Move check of 'page >= bitmap->pages' to md_bitmap_get_counter() and return directly if true. CVE-2023-53357 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53357.html CVE-2023-53357 https://bugzilla.suse.com/1249994 SUSE Bug 1249994 In the Linux kernel, the following vulnerability has been resolved: USB: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53359 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53359.html CVE-2023-53359 https://bugzilla.suse.com/1250316 SUSE Bug 1250316 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race issue between cpu buffer write and swap Warning happened in rb_end_commit() at code: if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))) WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142 rb_commit+0x402/0x4a0 Call Trace: ring_buffer_unlock_commit+0x42/0x250 trace_buffer_unlock_commit_regs+0x3b/0x250 trace_event_buffer_commit+0xe5/0x440 trace_event_buffer_reserve+0x11c/0x150 trace_event_raw_event_sched_switch+0x23c/0x2c0 __traceiter_sched_switch+0x59/0x80 __schedule+0x72b/0x1580 schedule+0x92/0x120 worker_thread+0xa0/0x6f0 It is because the race between writing event into cpu buffer and swapping cpu buffer through file per_cpu/cpu0/snapshot: Write on CPU 0 Swap buffer by per_cpu/cpu0/snapshot on CPU 1 -------- -------- tracing_snapshot_write() [...] ring_buffer_lock_reserve() cpu_buffer = buffer->buffers[cpu]; // 1. Suppose find 'cpu_buffer_a'; [...] rb_reserve_next_event() [...] ring_buffer_swap_cpu() if (local_read(&cpu_buffer_a->committing)) goto out_dec; if (local_read(&cpu_buffer_b->committing)) goto out_dec; buffer_a->buffers[cpu] = cpu_buffer_b; buffer_b->buffers[cpu] = cpu_buffer_a; // 2. cpu_buffer has swapped here. rb_start_commit(cpu_buffer); if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) { // 3. This check passed due to 'cpu_buffer->buffer' [...] // has not changed here. return NULL; } cpu_buffer_b->buffer = buffer_a; cpu_buffer_a->buffer = buffer_b; [...] // 4. Reserve event from 'cpu_buffer_a'. ring_buffer_unlock_commit() [...] cpu_buffer = buffer->buffers[cpu]; // 5. Now find 'cpu_buffer_b' !!! rb_commit(cpu_buffer) rb_end_commit() // 6. WARN for the wrong 'committing' state !!! Based on above analysis, we can easily reproduce by following testcase: ``` bash #!/bin/bash dmesg -n 7 sysctl -w kernel.panic_on_warn=1 TR=/sys/kernel/tracing echo 7 > ${TR}/buffer_size_kb echo "sched:sched_switch" > ${TR}/set_event while [ true ]; do echo 1 > ${TR}/per_cpu/cpu0/snapshot done & while [ true ]; do echo 1 > ${TR}/per_cpu/cpu0/snapshot done & while [ true ]; do echo 1 > ${TR}/per_cpu/cpu0/snapshot done & ``` To fix it, IIUC, we can use smp_call_function_single() to do the swap on the target cpu where the buffer is located, so that above race would be avoided. CVE-2023-53368 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53368.html CVE-2023-53368 https://bugzilla.suse.com/1249979 SUSE Bug 1249979 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix memory leak in mes self test The fences associated with mes queue have to be freed up during amdgpu_ring_fini. CVE-2023-53370 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53370.html CVE-2023-53370 https://bugzilla.suse.com/1250208 SUSE Bug 1250208 In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create The memory pointed to by the fs->any pointer is not freed in the error path of mlx5e_fs_tt_redirect_any_create, which can lead to a memory leak. Fix by freeing the memory in the error path, thereby making the error path identical to mlx5e_fs_tt_redirect_any_destroy(). CVE-2023-53371 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53371.html CVE-2023-53371 https://bugzilla.suse.com/1250112 SUSE Bug 1250112 In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of seqiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free. CVE-2023-53373 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53373.html CVE-2023-53373 https://bugzilla.suse.com/1250137 SUSE Bug 1250137 In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a memory leak: # cd /sys/kernel/tracing # mkdir instances/foo # echo 'hist:keys=x' > instances/foo/events/sched/sched_switch/trigger # cat instances/foo/error_log [ 117.404795] hist:sched:sched_switch: error: Couldn't find field Command: hist:keys=x ^ # rmdir instances/foo Then check for memory leaks: # echo scan > /sys/kernel/debug/kmemleak # cat /sys/kernel/debug/kmemleak unreferenced object 0xffff88810d8ec700 (size 192): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 60 dd 68 61 81 88 ff ff 60 dd 68 61 81 88 ff ff `.ha....`.ha.... a0 30 8c 83 ff ff ff ff 26 00 0a 00 00 00 00 00 .0......&....... backtrace: [<00000000dae26536>] kmalloc_trace+0x2a/0xa0 [<00000000b2938940>] tracing_log_err+0x277/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff888170c35a00 (size 32): comm "bash", pid 869, jiffies 4294950577 (age 215.752s) hex dump (first 32 bytes): 0a 20 20 43 6f 6d 6d 61 6e 64 3a 20 68 69 73 74 . Command: hist 3a 6b 65 79 73 3d 78 0a 00 00 00 00 00 00 00 00 :keys=x......... backtrace: [<000000006a747de5>] __kmalloc+0x4d/0x160 [<000000000039df5f>] tracing_log_err+0x29b/0x2e0 [<000000004a0e1b07>] parse_atom+0x966/0xb40 [<0000000023b24337>] parse_expr+0x5f3/0xdb0 [<00000000594ad074>] event_hist_trigger_parse+0x27f8/0x3560 [<00000000293a9645>] trigger_process_regex+0x135/0x1a0 [<000000005c22b4f2>] event_trigger_write+0x87/0xf0 [<000000002cadc509>] vfs_write+0x162/0x670 [<0000000059c3b9be>] ksys_write+0xca/0x170 [<00000000f1cddc00>] do_syscall_64+0x3e/0xc0 [<00000000868ac68c>] entry_SYSCALL_64_after_hwframe+0x72/0xdc The problem is that the error log needs to be freed when the instance is removed. CVE-2023-53375 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53375.html CVE-2023-53375 https://bugzilla.suse.com/1250197 SUSE Bug 1250197 In the Linux kernel, the following vulnerability has been resolved: cifs: prevent use-after-free by freeing the cfile later In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on. This was revealed during stress testing with KASAN enabled kernel. Fixing it by moving the cfile free call to a few lines below, after the usage. CVE-2023-53377 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53377.html CVE-2023-53377 https://bugzilla.suse.com/1250161 SUSE Bug 1250161 In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Treat the DPT BO as a framebuffer Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that the shrinker can evict the DPT BO while leaving the actual FB BO bound, when the DPT is allocated from regular shmem. That causes an immediate oops during hibernate as we try to rewrite the PTEs inside the already evicted DPT obj. TODO: presumably this might also be the reason for the DPT related display faults under heavy memory pressure, but I'm still not sure how that would happen as the object should be pinned by intel_dpt_pin() while in active use by the display engine... (cherry picked from commit 779cb5ba64ec7df80675a956c9022929514f517a) CVE-2023-53378 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53378.html CVE-2023-53378 https://bugzilla.suse.com/1250134 SUSE Bug 1250134 In the Linux kernel, the following vulnerability has been resolved: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() Smatch reports: drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe() warn: missing unwind goto? After geting irq, if ret < 0, it will return without error handling to free memory. Just add error handling to fix this problem. CVE-2023-53379 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53379.html CVE-2023-53379 https://bugzilla.suse.com/1250128 SUSE Bug 1250128 In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request There are two check of 'mreplace' in raid10_sync_request(). In the first check, 'need_replace' will be set and 'mreplace' will be used later if no-Faulty 'mreplace' exists, In the second check, 'mreplace' will be set to NULL if it is Faulty, but 'need_replace' will not be changed accordingly. null-ptr-deref occurs if Faulty is set between two check. Fix it by merging two checks into one. And replace 'need_replace' with 'mreplace' because their values are always the same. CVE-2023-53380 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53380.html CVE-2023-53380 https://bugzilla.suse.com/1250198 SUSE Bug 1250198 In the Linux kernel, the following vulnerability has been resolved: NFSD: fix leaked reference count of nfsd4_ssc_umount_item The reference count of nfsd4_ssc_umount_item is not decremented on error conditions. This prevents the laundromat from unmounting the vfsmount of the source file. This patch decrements the reference count of nfsd4_ssc_umount_item on error. CVE-2023-53381 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53381.html CVE-2023-53381 https://bugzilla.suse.com/1250118 SUSE Bug 1250118 In the Linux kernel, the following vulnerability has been resolved: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 The T241 platform suffers from the T241-FABRIC-4 erratum which causes unexpected behavior in the GIC when multiple transactions are received simultaneously from different sources. This hardware issue impacts NVIDIA server platforms that use more than two T241 chips interconnected. Each chip has support for 320 {E}SPIs. This issue occurs when multiple packets from different GICs are incorrectly interleaved at the target chip. The erratum text below specifies exactly what can cause multiple transfer packets susceptible to interleaving and GIC state corruption. GIC state corruption can lead to a range of problems, including kernel panics, and unexpected behavior. >From the erratum text: "In some cases, inter-socket AXI4 Stream packets with multiple transfers, may be interleaved by the fabric when presented to ARM Generic Interrupt Controller. GIC expects all transfers of a packet to be delivered without any interleaving. The following GICv3 commands may result in multiple transfer packets over inter-socket AXI4 Stream interface: - Register reads from GICD_I* and GICD_N* - Register writes to 64-bit GICD registers other than GICD_IROUTERn* - ITS command MOVALL Multiple commands in GICv4+ utilize multiple transfer packets, including VMOVP, VMOVI, VMAPP, and 64-bit register accesses." This issue impacts system configurations with more than 2 sockets, that require multi-transfer packets to be sent over inter-socket AXI4 Stream interface between GIC instances on different sockets. GICv4 cannot be supported. GICv3 SW model can only be supported with the workaround. Single and Dual socket configurations are not impacted by this issue and support GICv3 and GICv4." Writing to the chip alias region of the GICD_In{E} registers except GICD_ICENABLERn has an equivalent effect as writing to the global distributor. The SPI interrupt deactivate path is not impacted by the erratum. To fix this problem, implement a workaround that ensures read accesses to the GICD_In{E} registers are directed to the chip that owns the SPI, and disable GICv4.x features. To simplify code changes, the gic_configure_irq() function uses the same alias region for both read and write operations to GICD_ICFGR. CVE-2023-53383 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53383.html CVE-2023-53383 https://bugzilla.suse.com/1250327 SUSE Bug 1250327 In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: avoid possible NULL skb pointer dereference In 'mwifiex_handle_uap_rx_forward()', always check the value returned by 'skb_copy()' to avoid potential NULL pointer dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop original skb in case of copying failure. Found by Linux Verification Center (linuxtesting.org) with SVACE. CVE-2023-53384 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53384.html CVE-2023-53384 https://bugzilla.suse.com/1250127 SUSE Bug 1250127 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after-free when clear keys Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu() call. CVE-2023-53386 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53386.html CVE-2023-53386 https://bugzilla.suse.com/1250106 SUSE Bug 1250106 In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Clean dangling pointer on bind error path mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still being held in the private object, and that pointer would be passed along to DRM in mtk_drm_sys_prepare() if a suspend were triggered at that point, resulting in a panic. Clean the pointer when destroying the object in the error path to prevent this from happening. CVE-2023-53388 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53388.html CVE-2023-53388 https://bugzilla.suse.com/1250191 SUSE Bug 1250191 In the Linux kernel, the following vulnerability has been resolved: drivers: base: dd: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53390 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53390.html CVE-2023-53390 https://bugzilla.suse.com/1250453 SUSE Bug 1250453 In the Linux kernel, the following vulnerability has been resolved: shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs As the ramfs-based tmpfs uses ramfs_init_fs_context() for the init_fs_context method, which allocates fc->s_fs_info, use ramfs_kill_sb() to free it and avoid a memory leak. CVE-2023-53391 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53391.html CVE-2023-53391 https://bugzilla.suse.com/1250117 SUSE Bug 1250117 In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device Currently, when mlx5_ib_get_hw_stats() is used for device (port_num = 0), there is a special handling in order to use the correct counters, but, port_num is being passed down the stack without any change. Also, some functions assume that port_num >=1. As a result, the following oops can occur. BUG: unable to handle page fault for address: ffff89510294f1a8 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP CPU: 8 PID: 1382 Comm: devlink Tainted: G W 6.1.0-rc4_for_upstream_base_2022_11_10_16_12 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 RIP: 0010:_raw_spin_lock+0xc/0x20 Call Trace: <TASK> mlx5_ib_get_native_port_mdev+0x73/0xe0 [mlx5_ib] do_get_hw_stats.constprop.0+0x109/0x160 [mlx5_ib] mlx5_ib_get_hw_stats+0xad/0x180 [mlx5_ib] ib_setup_device_attrs+0xf0/0x290 [ib_core] ib_register_device+0x3bb/0x510 [ib_core] ? atomic_notifier_chain_register+0x67/0x80 __mlx5_ib_add+0x2b/0x80 [mlx5_ib] mlx5r_probe+0xb8/0x150 [mlx5_ib] ? auxiliary_match_id+0x6a/0x90 auxiliary_bus_probe+0x3c/0x70 ? driver_sysfs_add+0x6b/0x90 really_probe+0xcd/0x380 __driver_probe_device+0x80/0x170 driver_probe_device+0x1e/0x90 __device_attach_driver+0x7d/0x100 ? driver_allows_async_probing+0x60/0x60 ? driver_allows_async_probing+0x60/0x60 bus_for_each_drv+0x7b/0xc0 __device_attach+0xbc/0x200 bus_probe_device+0x87/0xa0 device_add+0x404/0x940 ? dev_set_name+0x53/0x70 __auxiliary_device_add+0x43/0x60 add_adev+0x99/0xe0 [mlx5_core] mlx5_attach_device+0xc8/0x120 [mlx5_core] mlx5_load_one_devl_locked+0xb2/0xe0 [mlx5_core] devlink_reload+0x133/0x250 devlink_nl_cmd_reload+0x480/0x570 ? devlink_nl_pre_doit+0x44/0x2b0 genl_family_rcv_msg_doit.isra.0+0xc2/0x110 genl_rcv_msg+0x180/0x2b0 ? devlink_nl_cmd_region_read_dumpit+0x540/0x540 ? devlink_reload+0x250/0x250 ? devlink_put+0x50/0x50 ? genl_family_rcv_msg_doit.isra.0+0x110/0x110 netlink_rcv_skb+0x54/0x100 genl_rcv+0x24/0x40 netlink_unicast+0x1f6/0x2c0 netlink_sendmsg+0x237/0x490 sock_sendmsg+0x33/0x40 __sys_sendto+0x103/0x160 ? handle_mm_fault+0x10e/0x290 ? do_user_addr_fault+0x1c0/0x5f0 __x64_sys_sendto+0x25/0x30 do_syscall_64+0x3d/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Fix it by setting port_num to 1 in order to get device status and remove unused variable. CVE-2023-53393 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53393.html CVE-2023-53393 https://bugzilla.suse.com/1250114 SUSE Bug 1250114 In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5 According to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AML_NO_OPERAND_RESOLVE flag is added to ASL Timer instruction opcode. When ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AML_NO_OPERAND_RESOLVE flag to ASL Timer instruction opcode, issue is not observed. ============================================================= UBSAN: array-index-out-of-bounds in acpica/dswexec.c:401:12 index -1 is out of range for type 'union acpi_operand_object *[9]' CPU: 37 PID: 1678 Comm: cat Not tainted 6.0.0-dev-th500-6.0.y-1+bcf8c46459e407-generic-64k HW name: NVIDIA BIOS v1.1.1-d7acbfc-dirty 12/19/2022 Call trace: dump_backtrace+0xe0/0x130 show_stack+0x20/0x60 dump_stack_lvl+0x68/0x84 dump_stack+0x18/0x34 ubsan_epilogue+0x10/0x50 __ubsan_handle_out_of_bounds+0x80/0x90 acpi_ds_exec_end_op+0x1bc/0x6d8 acpi_ps_parse_loop+0x57c/0x618 acpi_ps_parse_aml+0x1e0/0x4b4 acpi_ps_execute_method+0x24c/0x2b8 acpi_ns_evaluate+0x3a8/0x4bc acpi_evaluate_object+0x15c/0x37c acpi_evaluate_integer+0x54/0x15c show_power+0x8c/0x12c [acpi_power_meter] CVE-2023-53395 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53395.html CVE-2023-53395 https://bugzilla.suse.com/1250358 SUSE Bug 1250358 https://bugzilla.suse.com/1250359 SUSE Bug 1250359 In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memory leak in do_rename If renaming a file in an encrypted directory, function fscrypt_setup_filename allocates memory for a file name. This name is never used, and before returning to the caller the memory for it is not freed. When running kmemleak on it we see that it is registered as a leak. The report below is triggered by a simple program 'rename' that renames a file in an encrypted directory: unreferenced object 0xffff888101502840 (size 32): comm "rename", pid 9404, jiffies 4302582475 (age 435.735s) backtrace: __kmem_cache_alloc_node __kmalloc fscrypt_setup_filename do_rename ubifs_rename vfs_rename do_renameat2 To fix this we can remove the call to fscrypt_setup_filename as it's not needed. CVE-2023-53396 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53396.html CVE-2023-53396 https://bugzilla.suse.com/1250200 SUSE Bug 1250200 In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possible during re-sync action. WARN_ON_ONCE covers future cases. There were out-of-order cqe spotted which lead to drain of the queue and use-after-free because of lack of fifo pointers check. Special check and counter are added to avoid resync operation if SKB could not exist in the fifo because of OOO cqe (skb_id must be between consumer and producer index). CVE-2023-53398 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53398.html CVE-2023-53398 https://bugzilla.suse.com/1250144 SUSE Bug 1250144 In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with Cirrus codec. As a workaround, extend for the 9.1 channels and also fix the potential Oops by unifying the code paths accessing the same array with the proper size check. CVE-2023-53400 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53400.html CVE-2023-53400 https://bugzilla.suse.com/1250328 SUSE Bug 1250328 In the Linux kernel, the following vulnerability has been resolved: USB: fotg210: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53404 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53404.html CVE-2023-53404 https://bugzilla.suse.com/1250331 SUSE Bug 1250331 In the Linux kernel, the following vulnerability has been resolved: USB: gadget: gr_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53405 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53405.html CVE-2023-53405 https://bugzilla.suse.com/1250454 SUSE Bug 1250454 In the Linux kernel, the following vulnerability has been resolved: USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53406 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53406.html CVE-2023-53406 https://bugzilla.suse.com/1250362 SUSE Bug 1250362 In the Linux kernel, the following vulnerability has been resolved: drivers: base: component: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53409 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53409.html CVE-2023-53409 https://bugzilla.suse.com/1250418 SUSE Bug 1250418 In the Linux kernel, the following vulnerability has been resolved: USB: isp116x: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53413 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53413.html CVE-2023-53413 https://bugzilla.suse.com/1250370 SUSE Bug 1250370 In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53414 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53414.html CVE-2023-53414 https://bugzilla.suse.com/1250425 SUSE Bug 1250425 In the Linux kernel, the following vulnerability has been resolved: USB: dwc3: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. Note, the root dentry for the debugfs directory for the device needs to be saved so we don't have to keep looking it up, which required a bit more refactoring to properly create and remove it when needed. CVE-2023-53415 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53415.html CVE-2023-53415 https://bugzilla.suse.com/1250412 SUSE Bug 1250412 In the Linux kernel, the following vulnerability has been resolved: USB: isp1362: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. CVE-2023-53416 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53416.html CVE-2023-53416 https://bugzilla.suse.com/1250428 SUSE Bug 1250428 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fw: fix memory leak in debugfs Fix a memory leak that occurs when reading the fw_info file all the way, since we return NULL indicating no more data, but don't free the status tracking object. CVE-2023-53422 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53422.html CVE-2023-53422 https://bugzilla.suse.com/1250182 SUSE Bug 1250182 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix warning and UAF when destroy the MR list If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR: WARNING: CPU: 4 PID: 824 at kernel/workqueue.c:3066 __flush_work.isra.0+0xf7/0x110 CPU: 4 PID: 824 Comm: mount.cifs Not tainted 6.1.0-rc5+ #82 RIP: 0010:__flush_work.isra.0+0xf7/0x110 Call Trace: <TASK> __cancel_work_timer+0x2ba/0x2e0 smbd_destroy+0x4e1/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 BUG: KASAN: use-after-free in smbd_destroy+0x4fc/0x990 Read of size 8 at addr ffff88810b156a08 by task mount.cifs/824 CPU: 4 PID: 824 Comm: mount.cifs Tainted: G W 6.1.0-rc5+ #82 Call Trace: dump_stack_lvl+0x34/0x44 print_report+0x171/0x472 kasan_report+0xad/0x130 smbd_destroy+0x4fc/0x990 _smbd_get_connection+0x1cbd/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Allocated by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x7a/0x90 _smbd_get_connection+0x1b6f/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Freed by task 824: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x2a/0x40 ____kasan_slab_free+0x143/0x1b0 __kmem_cache_free+0xc8/0x330 _smbd_get_connection+0x1c6a/0x2110 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Let's initialize the MR recovery work before MR allocate to prevent the warning, remove the MRs from the list to prevent the UAF. CVE-2023-53427 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53427.html CVE-2023-53427 https://bugzilla.suse.com/1250168 SUSE Bug 1250168 In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling of case where there are no detected secondary components, but primary component (enumerated in num_enclosures) does exist. That fix was originally proposed by Ding Hui <dinghui@sangfor.com.cn>. Completely ignoring devices that have one primary enclosure and no secondary one results in ses_intf_add() bailing completely scsi 2:0:0:254: enclosure has no enumerated components scsi 2:0:0:254: Failed to bind enclosure -12ven in valid configurations such even on valid configurations with 1 primary and 0 secondary enclosures as below: # sg_ses /dev/sg0 3PARdata SES 3321 Supported diagnostic pages: Supported Diagnostic Pages [sdp] [0x0] Configuration (SES) [cf] [0x1] Short Enclosure Status (SES) [ses] [0x8] # sg_ses -p cf /dev/sg0 3PARdata SES 3321 Configuration diagnostic page: number of secondary subenclosures: 0 generation code: 0x0 enclosure descriptor list Subenclosure identifier: 0 [primary] relative ES process id: 0, number of ES processes: 1 number of type descriptor headers: 1 enclosure logical identifier (hex): 20000002ac02068d enclosure vendor: 3PARdata product: VV rev: 3321 type descriptor header and text list Element type: Unspecified, subenclosure id: 0 number of possible elements: 1 The changelog for the original fix follows ===== We can get a crash when disconnecting the iSCSI session, the call trace like this: [ffff00002a00fb70] kfree at ffff00000830e224 [ffff00002a00fba0] ses_intf_remove at ffff000001f200e4 [ffff00002a00fbd0] device_del at ffff0000086b6a98 [ffff00002a00fc50] device_unregister at ffff0000086b6d58 [ffff00002a00fc70] __scsi_remove_device at ffff00000870608c [ffff00002a00fca0] scsi_remove_device at ffff000008706134 [ffff00002a00fcc0] __scsi_remove_target at ffff0000087062e4 [ffff00002a00fd10] scsi_remove_target at ffff0000087064c0 [ffff00002a00fd70] __iscsi_unbind_session at ffff000001c872c4 [ffff00002a00fdb0] process_one_work at ffff00000810f35c [ffff00002a00fe00] worker_thread at ffff00000810f648 [ffff00002a00fe70] kthread at ffff000008116e98 In ses_intf_add, components count could be 0, and kcalloc 0 size scomp, but not saved in edev->component[i].scratch In this situation, edev->component[0].scratch is an invalid pointer, when kfree it in ses_intf_remove_enclosure, a crash like above would happen The call trace also could be other random cases when kfree cannot catch the invalid pointer We should not use edev->component[] array when the components count is 0 We also need check index when use edev->component[] array in ses_enclosure_data_process ===== CVE-2023-53431 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53431.html CVE-2023-53431 https://bugzilla.suse.com/1250374 SUSE Bug 1250374 In the Linux kernel, the following vulnerability has been resolved: cassini: Fix a memory leak in the error handling path of cas_init_one() cas_saturn_firmware_init() allocates some memory using vmalloc(). This memory is freed in the .remove() function but not it the error handling path of the probe. Add the missing vfree() to avoid a memory leak, should an error occur. CVE-2023-53435 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53435.html CVE-2023-53435 https://bugzilla.suse.com/1250159 SUSE Bug 1250159 In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible memory leak if device_add() fails If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device() should be used to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanp(). CVE-2023-53436 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53436.html CVE-2023-53436 https://bugzilla.suse.com/1250156 SUSE Bug 1250156 In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Handle cameras with invalid descriptors If the source entity does not contain any pads, do not create a link. CVE-2023-53437 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53437.html CVE-2023-53437 https://bugzilla.suse.com/1250178 SUSE Bug 1250178 https://bugzilla.suse.com/1250710 SUSE Bug 1250710 In the Linux kernel, the following vulnerability has been resolved: x86/MCE: Always save CS register on AMD Zen IF Poison errors The Instruction Fetch (IF) units on current AMD Zen-based systems do not guarantee a synchronous #MC is delivered for poison consumption errors. Therefore, MCG_STATUS[EIPV|RIPV] will not be set. However, the microarchitecture does guarantee that the exception is delivered within the same context. In other words, the exact rIP is not known, but the context is known to not have changed. There is no architecturally-defined method to determine this behavior. The Code Segment (CS) register is always valid on such IF unit poison errors regardless of the value of MCG_STATUS[EIPV|RIPV]. Add a quirk to save the CS register for poison consumption from the IF unit banks. This is needed to properly determine the context of the error. Otherwise, the severity grading function will assume the context is IN_KERNEL due to the m->cs value being 0 (the initialized value). This leads to unnecessary kernel panics on data poison errors due to the kernel believing the poison consumption occurred in kernel context. CVE-2023-53438 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53438.html CVE-2023-53438 https://bugzilla.suse.com/1250180 SUSE Bug 1250180 https://bugzilla.suse.com/1250708 SUSE Bug 1250708 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix sysfs interface lifetime The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, use-after-free, and lockdep warnings. Some of the sysfs attributes for nilfs2 per-filesystem instance refer to metadata file "cpfile", "sufile", or "dat", but nilfs_sysfs_create_device_group that creates those attributes is executed before the inodes for these metadata files are loaded, and nilfs_sysfs_delete_device_group which deletes these sysfs entries is called after releasing their metadata file inodes. Therefore, access to some of these sysfs attributes may occur outside of the lifetime of these metadata files, resulting in inode NULL pointer dereferences or use-after-free. In addition, the call to nilfs_sysfs_create_device_group() is made during the locking period of the semaphore "ns_sem" of nilfs object, so the shrinker call caused by the memory allocation for the sysfs entries, may derive lock dependencies "ns_sem" -> (shrinker) -> "locks acquired in nilfs_evict_inode()". Since nilfs2 may acquire "ns_sem" deep in the call stack holding other locks via its error handler __nilfs_error(), this causes lockdep to report circular locking. This is a false positive and no circular locking actually occurs as no inodes exist yet when nilfs_sysfs_create_device_group() is called. Fortunately, the lockdep warnings can be resolved by simply moving the call to nilfs_sysfs_create_device_group() out of "ns_sem". This fixes these sysfs issues by revising where the device's sysfs interface is created/deleted and keeping its lifetime within the lifetime of the metadata files above. CVE-2023-53440 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53440.html CVE-2023-53440 https://bugzilla.suse.com/1250151 SUSE Bug 1250151 In the Linux kernel, the following vulnerability has been resolved: ice: Block switchdev mode when ADQ is active and vice versa ADQ and switchdev are not supported simultaneously. Enabling both at the same time can result in nullptr dereference. To prevent this, check if ADQ is active when changing devlink mode to switchdev mode, and check if switchdev is active when enabling ADQ. CVE-2023-53442 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53442.html CVE-2023-53442 https://bugzilla.suse.com/1250201 SUSE Bug 1250201 In the Linux kernel, the following vulnerability has been resolved: mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak In arizona_clk32k_enable(), we should use pm_runtime_resume_and_get() as pm_runtime_get_sync() will increase the refcnt even when it returns an error. CVE-2023-53443 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53443.html CVE-2023-53443 https://bugzilla.suse.com/1250457 SUSE Bug 1250457 In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulk_move corruption when adding a entry When the resource is the first in the bulk_move range, adding it again (thus moving it to the tail) will corrupt the list since the first pointer is not moved. This eventually lead to null pointer deref in ttm_lru_bulk_move_del() CVE-2023-53444 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53444.html CVE-2023-53444 https://bugzilla.suse.com/1250157 SUSE Bug 1250157 In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free Struct pcie_link_state->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when removing function 0, and subsequent ASPM policy changes dereferenced it, resulting in a use-after-free warning from KASAN, e.g.: # echo 1 > /sys/bus/pci/devices/0000:03:00.0/remove # echo powersave > /sys/module/pcie_aspm/parameters/policy BUG: KASAN: slab-use-after-free in pcie_config_aspm_link+0x42d/0x500 Call Trace: kasan_report+0xae/0xe0 pcie_config_aspm_link+0x42d/0x500 pcie_aspm_set_policy+0x8e/0x1a0 param_attr_store+0x162/0x2c0 module_attr_store+0x3e/0x80 PCIe spec r6.0, sec 7.5.3.7, recommends that software program the same ASPM Control value in all functions of multi-function devices. Disable ASPM and free the pcie_link_state when any child function is removed so we can discard the dangling pcie_link_state->downstream pointer and maintain the same ASPM Control configuration for all functions. [bhelgaas: commit log and comment] CVE-2023-53446 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53446.html CVE-2023-53446 https://bugzilla.suse.com/1250145 SUSE Bug 1250145 In the Linux kernel, the following vulnerability has been resolved: fbdev: imxfb: Removed unneeded release_mem_region Remove unnecessary release_mem_region from the error path to prevent mem region from being released twice, which could avoid resource leak or other unexpected issues. CVE-2023-53448 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53448.html CVE-2023-53448 https://bugzilla.suse.com/1250873 SUSE Bug 1250873 In the Linux kernel, the following vulnerability has been resolved: s390/dasd: Fix potential memleak in dasd_eckd_init() `dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it also needs to be freed before the error returns, just like the other cases in this function. CVE-2023-53449 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53449.html CVE-2023-53449 https://bugzilla.suse.com/1250874 SUSE Bug 1250874 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix potential NULL pointer dereference Klocwork tool reported 'cur_dsd' may be dereferenced. Add fix to validate pointer before dereferencing the pointer. CVE-2023-53451 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53451.html CVE-2023-53451 https://bugzilla.suse.com/1250831 SUSE Bug 1250831 In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix potential race condition between napi_init and napi_enable A race condition can happen if netdev is registered, but NAPI isn't initialized yet, and meanwhile user space starts the netdev that will enable NAPI. Then, it hits BUG_ON(): kernel BUG at net/core/dev.c:6423! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 417 Comm: iwd Not tainted 6.2.7-slab-dirty #3 eb0f5a8a9d91 Hardware name: LENOVO 21DL/LNVNB161216, BIOS JPCN20WW(V1.06) 09/20/2022 RIP: 0010:napi_enable+0x3f/0x50 Code: 48 89 c2 48 83 e2 f6 f6 81 89 08 00 00 02 74 0d 48 83 ... RSP: 0018:ffffada1414f3548 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffffa01425802080 RCX: 0000000000000000 RDX: 00000000000002ff RSI: ffffada14e50c614 RDI: ffffa01425808dc0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000100 R12: ffffa01425808f58 R13: 0000000000000000 R14: ffffa01423498940 R15: 0000000000000001 FS: 00007f5577c0a740(0000) GS:ffffa0169fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5577a19972 CR3: 0000000125a7a000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: <TASK> rtw89_pci_ops_start+0x1c/0x70 [rtw89_pci 6cbc75429515c181cbc386478d5cfb32ffc5a0f8] rtw89_core_start+0xbe/0x160 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22] rtw89_ops_start+0x26/0x40 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22] drv_start+0x42/0x100 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] ieee80211_do_open+0x311/0x7d0 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] ieee80211_open+0x6a/0x90 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2] __dev_open+0xe0/0x180 __dev_change_flags+0x1da/0x250 dev_change_flags+0x26/0x70 do_setlink+0x37c/0x12c0 ? ep_poll_callback+0x246/0x290 ? __nla_validate_parse+0x61/0xd00 ? __wake_up_common_lock+0x8f/0xd0 To fix this, follow Jonas' suggestion to switch the order of these functions and move register netdev to be the last step of PCI probe. Also, correct the error handling of rtw89_core_register_hw(). CVE-2023-53452 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53452.html CVE-2023-53452 https://bugzilla.suse.com/1250762 SUSE Bug 1250762 In the Linux kernel, the following vulnerability has been resolved: drm/radeon: free iio for atombios when driver shutdown Fix below kmemleak when unload radeon driver: unreferenced object 0xffff9f8608ede200 (size 512): comm "systemd-udevd", pid 326, jiffies 4294682822 (age 716.338s) hex dump (first 32 bytes): 00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000062fadebe>] kmem_cache_alloc_trace+0x2f1/0x500 [<00000000b6883cea>] atom_parse+0x117/0x230 [radeon] [<00000000158c23fd>] radeon_atombios_init+0xab/0x170 [radeon] [<00000000683f672e>] si_init+0x57/0x750 [radeon] [<00000000566cc31f>] radeon_device_init+0x559/0x9c0 [radeon] [<0000000046efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon] [<00000000b5155064>] drm_dev_register+0xdd/0x1d0 [<0000000045fec835>] radeon_pci_probe+0xbd/0x100 [radeon] [<00000000e69ecca3>] pci_device_probe+0xe1/0x160 [<0000000019484b76>] really_probe.part.0+0xc1/0x2c0 [<000000003f2649da>] __driver_probe_device+0x96/0x130 [<00000000231c5bb1>] driver_probe_device+0x24/0xf0 [<0000000000a42377>] __driver_attach+0x77/0x190 [<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0 [<00000000633166d2>] driver_attach+0x1e/0x30 [<00000000313b05b8>] bus_add_driver+0x12c/0x1e0 iio was allocated in atom_index_iio() called by atom_parse(), but it doesn't got released when the dirver is shutdown. Fix this kmemleak by free it in radeon_atombios_fini(). CVE-2023-53453 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53453.html CVE-2023-53453 https://bugzilla.suse.com/1250761 SUSE Bug 1250761 In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string. CVE-2023-53454 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53454.html CVE-2023-53454 https://bugzilla.suse.com/1250759 SUSE Bug 1250759 In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Add length check when parsing nlattrs There are three places that qla4xxx parses nlattrs: - qla4xxx_set_chap_entry() - qla4xxx_iface_set_param() - qla4xxx_sysfs_ddb_set_param() and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data. Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails. CVE-2023-53456 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53456.html CVE-2023-53456 https://bugzilla.suse.com/1250765 SUSE Bug 1250765 In the Linux kernel, the following vulnerability has been resolved: FS: JFS: Fix null-ptr-deref Read in txBegin Syzkaller reported an issue where txBegin may be called on a superblock in a read-only mounted filesystem which leads to NULL pointer deref. This could be solved by checking if the filesystem is read-only before calling txBegin, and returning with appropiate error code. CVE-2023-53457 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53457.html CVE-2023-53457 https://bugzilla.suse.com/1250763 SUSE Bug 1250763 In the Linux kernel, the following vulnerability has been resolved: media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish() When the driver calls cx23885_risc_buffer() to prepare the buffer, the function call dma_alloc_coherent may fail, resulting in a empty buffer risc->cpu. Later when we free the buffer or access the buffer, null ptr deref is triggered. This bug is similar to the following one: https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71. We believe the bug can be also dynamically triggered from user side. Similarly, we fix this by checking the return value of cx23885_risc_buffer() and the value of risc->cpu before buffer free. CVE-2023-53458 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53458.html CVE-2023-53458 https://bugzilla.suse.com/1250864 SUSE Bug 1250864 In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Do not reset dql stats on NON_FATAL err All ibmvnic resets, make a call to netdev_tx_reset_queue() when re-opening the device. netdev_tx_reset_queue() resets the num_queued and num_completed byte counters. These stats are used in Byte Queue Limit (BQL) algorithms. The difference between these two stats tracks the number of bytes currently sitting on the physical NIC. ibmvnic increases the number of queued bytes though calls to netdev_tx_sent_queue() in the drivers xmit function. When, VIOS reports that it is done transmitting bytes, the ibmvnic device increases the number of completed bytes through calls to netdev_tx_completed_queue(). It is important to note that the driver batches its transmit calls and num_queued is increased every time that an skb is added to the next batch, not necessarily when the batch is sent to VIOS for transmission. Unlike other reset types, a NON FATAL reset will not flush the sub crq tx buffers. Therefore, it is possible for the batched skb array to be partially full. So if there is call to netdev_tx_reset_queue() when re-opening the device, the value of num_queued (0) would not account for the skb's that are currently batched. Eventually, when the batch is sent to VIOS, the call to netdev_tx_completed_queue() would increase num_completed to a value greater than the num_queued. This causes a BUG_ON crash: ibmvnic 30000002: Firmware reports error, cause: adapter problem. Starting recovery... ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ibmvnic 30000002: tx error 600 ------------[ cut here ]------------ kernel BUG at lib/dynamic_queue_limits.c:27! Oops: Exception in kernel mode, sig: 5 [....] NIP dql_completed+0x28/0x1c0 LR ibmvnic_complete_tx.isra.0+0x23c/0x420 [ibmvnic] Call Trace: ibmvnic_complete_tx.isra.0+0x3f8/0x420 [ibmvnic] (unreliable) ibmvnic_interrupt_tx+0x40/0x70 [ibmvnic] __handle_irq_event_percpu+0x98/0x270 ---[ end trace ]--- Therefore, do not reset the dql stats when performing a NON_FATAL reset. CVE-2023-53463 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53463.html CVE-2023-53463 https://bugzilla.suse.com/1250867 SUSE Bug 1250867 In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() The validity of sock should be checked before assignment to avoid incorrect values. Commit 57569c37f0ad ("scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()") introduced this change which may lead to inconsistent values of tcp_sw_conn->sendpage and conn->datadgst_en. Fix the issue by moving the position of the assignment. CVE-2023-53464 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53464.html CVE-2023-53464 https://bugzilla.suse.com/1250868 SUSE Bug 1250868 In the Linux kernel, the following vulnerability has been resolved: soundwire: qcom: fix storing port config out-of-bounds The 'qcom_swrm_ctrl->pconfig' has size of QCOM_SDW_MAX_PORTS (14), however we index it starting from 1, not 0, to match real port numbers. This can lead to writing port config past 'pconfig' bounds and overwriting next member of 'qcom_swrm_ctrl' struct. Reported also by smatch: drivers/soundwire/qcom.c:1269 qcom_swrm_get_port_config() error: buffer overflow 'ctrl->pconfig' 14 <= 14 CVE-2023-53465 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53465.html CVE-2023-53465 https://bugzilla.suse.com/1250863 SUSE Bug 1250863 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit Always purge mcu skb queues in mt7915_mcu_exit routine even if mt7915_firmware_state fails. CVE-2023-53466 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53466.html CVE-2023-53466 https://bugzilla.suse.com/1250862 SUSE Bug 1250862 In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memory leak in alloc_wbufs() kmemleak reported a sequence of memory leaks, and show them as following: unreferenced object 0xffff8881575f8400 (size 1024): comm "mount", pid 19625, jiffies 4297119604 (age 20.383s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8176cecd>] __kmalloc+0x4d/0x150 [<ffffffffa0406b2b>] ubifs_mount+0x307b/0x7170 [ubifs] [<ffffffff819fa8fd>] legacy_get_tree+0xed/0x1d0 [<ffffffff81936f2d>] vfs_get_tree+0x7d/0x230 [<ffffffff819b2bd4>] path_mount+0xdd4/0x17b0 [<ffffffff819b37aa>] __x64_sys_mount+0x1fa/0x270 [<ffffffff83c14295>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 unreferenced object 0xffff8881798a6e00 (size 512): comm "mount", pid 19677, jiffies 4297121912 (age 37.816s) hex dump (first 32 bytes): 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b kkkkkkkkkkkkkkkk backtrace: [<ffffffff8176cecd>] __kmalloc+0x4d/0x150 [<ffffffffa0418342>] ubifs_wbuf_init+0x52/0x480 [ubifs] [<ffffffffa0406ca5>] ubifs_mount+0x31f5/0x7170 [ubifs] [<ffffffff819fa8fd>] legacy_get_tree+0xed/0x1d0 [<ffffffff81936f2d>] vfs_get_tree+0x7d/0x230 [<ffffffff819b2bd4>] path_mount+0xdd4/0x17b0 [<ffffffff819b37aa>] __x64_sys_mount+0x1fa/0x270 [<ffffffff83c14295>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 The problem is that the ubifs_wbuf_init() returns an error in the loop which in the alloc_wbufs(), then the wbuf->buf and wbuf->inodes that were successfully alloced before are not freed. Fix it by adding error hanging path in alloc_wbufs() which frees the memory alloced before when ubifs_wbuf_init() returns an error. CVE-2023-53468 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53468.html CVE-2023-53468 https://bugzilla.suse.com/1250888 SUSE Bug 1250888 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras gfx9 cp_ecc_error_irq is only enabled when legacy gfx ras is assert. So in gfx_v9_0_hw_fini, interrupt disablement for cp_ecc_error_irq should be executed under such condition, otherwise, an amdgpu_irq_put calltrace will occur. [ 7283.170322] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu] [ 7283.170964] RSP: 0018:ffff9a5fc3967d00 EFLAGS: 00010246 [ 7283.170967] RAX: ffff98d88afd3040 RBX: ffff98d89da20000 RCX: 0000000000000000 [ 7283.170969] RDX: 0000000000000000 RSI: ffff98d89da2bef8 RDI: ffff98d89da20000 [ 7283.170971] RBP: ffff98d89da20000 R08: ffff98d89da2ca18 R09: 0000000000000006 [ 7283.170973] R10: ffffd5764243c008 R11: 0000000000000000 R12: 0000000000001050 [ 7283.170975] R13: ffff98d89da38978 R14: ffffffff999ae15a R15: ffff98d880130105 [ 7283.170978] FS: 0000000000000000(0000) GS:ffff98d996f00000(0000) knlGS:0000000000000000 [ 7283.170981] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7283.170983] CR2: 00000000f7a9d178 CR3: 00000001c42ea000 CR4: 00000000003506e0 [ 7283.170986] Call Trace: [ 7283.170988] <TASK> [ 7283.170989] gfx_v9_0_hw_fini+0x1c/0x6d0 [amdgpu] [ 7283.171655] amdgpu_device_ip_suspend_phase2+0x101/0x1a0 [amdgpu] [ 7283.172245] amdgpu_device_suspend+0x103/0x180 [amdgpu] [ 7283.172823] amdgpu_pmops_freeze+0x21/0x60 [amdgpu] [ 7283.173412] pci_pm_freeze+0x54/0xc0 [ 7283.173419] ? __pfx_pci_pm_freeze+0x10/0x10 [ 7283.173425] dpm_run_callback+0x98/0x200 [ 7283.173430] __device_suspend+0x164/0x5f0 v2: drop gfx11 as it's fixed in a different solution by retiring cp_ecc_irq funcs(Hawking) CVE-2023-53471 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53471.html CVE-2023-53471 https://bugzilla.suse.com/1250866 SUSE Bug 1250866 In the Linux kernel, the following vulnerability has been resolved: pwm: lpc32xx: Remove handling of PWM channels Because LPC32xx PWM controllers have only a single output which is registered as the only PWM device/channel per controller, it is known in advance that pwm->hwpwm value is always 0. On basis of this fact simplify the code by removing operations with pwm->hwpwm, there is no controls which require channel number as input. Even though I wasn't aware at the time when I forward ported that patch, this fixes a null pointer dereference as lpc32xx->chip.pwms is NULL before devm_pwmchip_add() is called. CVE-2023-53472 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53472.html CVE-2023-53472 https://bugzilla.suse.com/1250841 SUSE Bug 1250841 In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from ext4_dirhash() The ext4_dirhash() will *almost* never fail, especially when the hash tree feature was first introduced. However, with the addition of support of encrypted, casefolded file names, that function can most certainly fail today. So make sure the callers of ext4_dirhash() properly check for failures, and reflect the errors back up to their callers. CVE-2023-53473 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53473.html CVE-2023-53473 https://bugzilla.suse.com/1250848 SUSE Bug 1250848 In the Linux kernel, the following vulnerability has been resolved: x86/MCE/AMD: Use an u64 for bank_map Thee maximum number of MCA banks is 64 (MAX_NR_BANKS), see a0bc32b3cacf ("x86/mce: Increase maximum number of banks to 64"). However, the bank_map which contains a bitfield of which banks to initialize is of type unsigned int and that overflows when those bit numbers are >= 32, leading to UBSAN complaining correctly: UBSAN: shift-out-of-bounds in arch/x86/kernel/cpu/mce/amd.c:1365:38 shift exponent 32 is too large for 32-bit type 'int' Change the bank_map to a u64 and use the proper BIT_ULL() macro when modifying bits in there. [ bp: Rewrite commit message. ] CVE-2023-53474 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53474.html CVE-2023-53474 https://bugzilla.suse.com/1250842 SUSE Bug 1250842 In the Linux kernel, the following vulnerability has been resolved: usb: xhci: tegra: fix sleep in atomic call When we set the dual-role port to Host mode, we observed the following splat: [ 167.057718] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:229 [ 167.057872] Workqueue: events tegra_xusb_usb_phy_work [ 167.057954] Call trace: [ 167.057962] dump_backtrace+0x0/0x210 [ 167.057996] show_stack+0x30/0x50 [ 167.058020] dump_stack_lvl+0x64/0x84 [ 167.058065] dump_stack+0x14/0x34 [ 167.058100] __might_resched+0x144/0x180 [ 167.058140] __might_sleep+0x64/0xd0 [ 167.058171] slab_pre_alloc_hook.constprop.0+0xa8/0x110 [ 167.058202] __kmalloc_track_caller+0x74/0x2b0 [ 167.058233] kvasprintf+0xa4/0x190 [ 167.058261] kasprintf+0x58/0x90 [ 167.058285] tegra_xusb_find_port_node.isra.0+0x58/0xd0 [ 167.058334] tegra_xusb_find_port+0x38/0xa0 [ 167.058380] tegra_xusb_padctl_get_usb3_companion+0x38/0xd0 [ 167.058430] tegra_xhci_id_notify+0x8c/0x1e0 [ 167.058473] notifier_call_chain+0x88/0x100 [ 167.058506] atomic_notifier_call_chain+0x44/0x70 [ 167.058537] tegra_xusb_usb_phy_work+0x60/0xd0 [ 167.058581] process_one_work+0x1dc/0x4c0 [ 167.058618] worker_thread+0x54/0x410 [ 167.058650] kthread+0x188/0x1b0 [ 167.058672] ret_from_fork+0x10/0x20 The function tegra_xusb_padctl_get_usb3_companion eventually calls tegra_xusb_find_port and this in turn calls kasprintf which might sleep and so cannot be called from an atomic context. Fix this by moving the call to tegra_xusb_padctl_get_usb3_companion to the tegra_xhci_id_work function where it is really needed. CVE-2023-53475 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53475.html CVE-2023-53475 https://bugzilla.suse.com/1250843 SUSE Bug 1250843 In the Linux kernel, the following vulnerability has been resolved: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() This condition needs to match the previous "if (epcp->state == LISTEN) {" exactly to avoid a NULL dereference of either "listen_ep" or "ep". The problem is that "epcp" has been re-assigned so just testing "if (epcp->state == LISTEN) {" a second time is not sufficient. CVE-2023-53476 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53476.html CVE-2023-53476 https://bugzilla.suse.com/1250839 SUSE Bug 1250839 In the Linux kernel, the following vulnerability has been resolved: kobject: Add sanity check for kset->kobj.ktype in kset_register() When I register a kset in the following way: static struct kset my_kset; kobject_set_name(&my_kset.kobj, "my_kset"); ret = kset_register(&my_kset); A null pointer dereference exception is occurred: [ 4453.568337] Unable to handle kernel NULL pointer dereference at \ virtual address 0000000000000028 ... ... [ 4453.810361] Call trace: [ 4453.813062] kobject_get_ownership+0xc/0x34 [ 4453.817493] kobject_add_internal+0x98/0x274 [ 4453.822005] kset_register+0x5c/0xb4 [ 4453.825820] my_kobj_init+0x44/0x1000 [my_kset] ... ... Because I didn't initialize my_kset.kobj.ktype. According to the description in Documentation/core-api/kobject.rst: - A ktype is the type of object that embeds a kobject. Every structure that embeds a kobject needs a corresponding ktype. So add sanity check to make sure kset->kobj.ktype is not NULL. CVE-2023-53480 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53480.html CVE-2023-53480 https://bugzilla.suse.com/1250861 SUSE Bug 1250861 In the Linux kernel, the following vulnerability has been resolved: iommu: Fix error unwind in iommu_group_alloc() If either iommu_group_grate_file() fails then the iommu_group is leaked. Destroy it on these error paths. Found by kselftest/iommu/iommufd_fail_nth CVE-2023-53482 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53482.html CVE-2023-53482 https://bugzilla.suse.com/1250832 SUSE Bug 1250832 In the Linux kernel, the following vulnerability has been resolved: fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:1965:6 index -84 is out of range for type 's8[341]' (aka 'signed char[341]') CPU: 1 PID: 4995 Comm: syz-executor146 Not tainted 6.4.0-rc6-syzkaller-00037-gb6dad5178cea #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 dbAllocDmapLev+0x3e5/0x430 fs/jfs/jfs_dmap.c:1965 dbAllocCtl+0x113/0x920 fs/jfs/jfs_dmap.c:1809 dbAllocAG+0x28f/0x10b0 fs/jfs/jfs_dmap.c:1350 dbAlloc+0x658/0xca0 fs/jfs/jfs_dmap.c:874 dtSplitUp fs/jfs/jfs_dtree.c:974 [inline] dtInsert+0xda7/0x6b00 fs/jfs/jfs_dtree.c:863 jfs_create+0x7b6/0xbb0 fs/jfs/namei.c:137 lookup_open fs/namei.c:3492 [inline] open_last_lookups fs/namei.c:3560 [inline] path_openat+0x13df/0x3170 fs/namei.c:3788 do_filp_open+0x234/0x490 fs/namei.c:3818 do_sys_openat2+0x13f/0x500 fs/open.c:1356 do_sys_open fs/open.c:1372 [inline] __do_sys_openat fs/open.c:1388 [inline] __se_sys_openat fs/open.c:1383 [inline] __x64_sys_openat+0x247/0x290 fs/open.c:1383 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f1f4e33f7e9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 14 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc21129578 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1f4e33f7e9 RDX: 000000000000275a RSI: 0000000020000040 RDI: 00000000ffffff9c RBP: 00007f1f4e2ff080 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1f4e2ff110 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 </TASK> The bug occurs when the dbAllocDmapLev()function attempts to access dp->tree.stree[leafidx + LEAFIND] while the leafidx value is negative. To rectify this, the patch introduces a safeguard within the dbAllocDmapLev() function. A check has been added to verify if leafidx is negative. If it is, the function immediately returns an I/O error, preventing any further execution that could potentially cause harm. Tested via syzbot. CVE-2023-53485 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53485.html CVE-2023-53485 https://bugzilla.suse.com/1250872 SUSE Bug 1250872 In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas_flash: allow user copy to flash block cache objects With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare a system firmware update yields a BUG(): kernel BUG at mm/usercopy.c:102! Oops: Exception in kernel mode, sig: 5 [#1] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 0 PID: 2232 Comm: dd Not tainted 6.5.0-rc3+ #2 Hardware name: IBM,8408-E8E POWER8E (raw) 0x4b0201 0xf000004 of:IBM,FW860.50 (SV860_146) hv:phyp pSeries NIP: c0000000005991d0 LR: c0000000005991cc CTR: 0000000000000000 REGS: c0000000148c76a0 TRAP: 0700 Not tainted (6.5.0-rc3+) MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 24002242 XER: 0000000c CFAR: c0000000001fbd34 IRQMASK: 0 [ ... GPRs omitted ... ] NIP usercopy_abort+0xa0/0xb0 LR usercopy_abort+0x9c/0xb0 Call Trace: usercopy_abort+0x9c/0xb0 (unreliable) __check_heap_object+0x1b4/0x1d0 __check_object_size+0x2d0/0x380 rtas_flash_write+0xe4/0x250 proc_reg_write+0xfc/0x160 vfs_write+0xfc/0x4e0 ksys_write+0x90/0x160 system_call_exception+0x178/0x320 system_call_common+0x160/0x2c4 The blocks of the firmware image are copied directly from user memory to objects allocated from flash_block_cache, so flash_block_cache must be created using kmem_cache_create_usercopy() to mark it safe for user access. [mpe: Trim and indent oops] CVE-2023-53487 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53487.html CVE-2023-53487 https://bugzilla.suse.com/1250830 SUSE Bug 1250830 In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix possible panic during hotplug remove During hotplug remove it is possible that the update counters work might be pending, and may run after memory has been freed. Cancel the update counters work before freeing memory. CVE-2023-53488 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53488.html CVE-2023-53488 https://bugzilla.suse.com/1250825 SUSE Bug 1250825 In the Linux kernel, the following vulnerability has been resolved: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY skbs. We can reproduce the problem with these sequences: sk = socket(AF_INET, SOCK_DGRAM, 0) sk.setsockopt(SOL_SOCKET, SO_TIMESTAMPING, SOF_TIMESTAMPING_TX_SOFTWARE) sk.setsockopt(SOL_SOCKET, SO_ZEROCOPY, 1) sk.sendto(b'', MSG_ZEROCOPY, ('127.0.0.1', 53)) sk.close() sendmsg() calls msg_zerocopy_alloc(), which allocates a skb, sets skb->cb->ubuf.refcnt to 1, and calls sock_hold(). Here, struct ubuf_info_msgzc indirectly holds a refcnt of the socket. When the skb is sent, __skb_tstamp_tx() clones it and puts the clone into the socket's error queue with the TX timestamp. When the original skb is received locally, skb_copy_ubufs() calls skb_unclone(), and pskb_expand_head() increments skb->cb->ubuf.refcnt. This additional count is decremented while freeing the skb, but struct ubuf_info_msgzc still has a refcnt, so __msg_zerocopy_callback() is not called. The last refcnt is not released unless we retrieve the TX timestamped skb by recvmsg(). Since we clear the error queue in inet_sock_destruct() after the socket's refcnt reaches 0, there is a circular dependency. If we close() the socket holding such skbs, we never call sock_put() and leak the count, sk, and skb. TCP has the same problem, and commit e0c8bccd40fc ("net: stream: purge sk_error_queue in sk_stream_kill_queues()") tried to fix it by calling skb_queue_purge() during close(). However, there is a small chance that skb queued in a qdisc or device could be put into the error queue after the skb_queue_purge() call. In __skb_tstamp_tx(), the cloned skb should not have a reference to the ubuf to remove the circular dependency, but skb_clone() does not call skb_copy_ubufs() for zerocopy skb. So, we need to call skb_orphan_frags_rx() for the cloned skb to call skb_copy_ubufs(). [0]: BUG: memory leak unreferenced object 0xffff88800c6d2d00 (size 1152): comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 cd af e8 81 00 00 00 00 ................ 02 00 07 40 00 00 00 00 00 00 00 00 00 00 00 00 ...@............ backtrace: [<0000000055636812>] sk_prot_alloc+0x64/0x2a0 net/core/sock.c:2024 [<0000000054d77b7a>] sk_alloc+0x3b/0x800 net/core/sock.c:2083 [<0000000066f3c7e0>] inet_create net/ipv4/af_inet.c:319 [inline] [<0000000066f3c7e0>] inet_create+0x31e/0xe40 net/ipv4/af_inet.c:245 [<000000009b83af97>] __sock_create+0x2ab/0x550 net/socket.c:1515 [<00000000b9b11231>] sock_create net/socket.c:1566 [inline] [<00000000b9b11231>] __sys_socket_create net/socket.c:1603 [inline] [<00000000b9b11231>] __sys_socket_create net/socket.c:1588 [inline] [<00000000b9b11231>] __sys_socket+0x138/0x250 net/socket.c:1636 [<000000004fb45142>] __do_sys_socket net/socket.c:1649 [inline] [<000000004fb45142>] __se_sys_socket net/socket.c:1647 [inline] [<000000004fb45142>] __x64_sys_socket+0x73/0xb0 net/socket.c:1647 [<0000000066999e0e>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<0000000066999e0e>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<0000000017f238c1>] entry_SYSCALL_64_after_hwframe+0x63/0xcd BUG: memory leak unreferenced object 0xffff888017633a00 (size 240): comm "syz-executor392", pid 264, jiffies 4294785440 (age 13.044s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 2d 6d 0c 80 88 ff ff .........-m..... backtrace: [<000000002b1c4368>] __alloc_skb+0x229/0x320 net/core/skbuff.c:497 [<00000000143579a6>] alloc_skb include/linux/skbuff.h:1265 [inline] [<00000000143579a6>] sock_omalloc+0xaa/0x190 net/core/sock.c:2596 [<00000000be626478>] msg_zerocopy_alloc net/core/skbuff.c:1294 [inline] [<00000000be626478>] ---truncated--- CVE-2023-53489 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53489.html CVE-2023-53489 https://bugzilla.suse.com/1250829 SUSE Bug 1250829 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not ignore genmask when looking up chain by id When adding a rule to a chain referring to its ID, if that chain had been deleted on the same batch, the rule might end up referring to a deleted chain. This will lead to a WARNING like following: [ 33.098431] ------------[ cut here ]------------ [ 33.098678] WARNING: CPU: 5 PID: 69 at net/netfilter/nf_tables_api.c:2037 nf_tables_chain_destroy+0x23d/0x260 [ 33.099217] Modules linked in: [ 33.099388] CPU: 5 PID: 69 Comm: kworker/5:1 Not tainted 6.4.0+ #409 [ 33.099726] Workqueue: events nf_tables_trans_destroy_work [ 33.100018] RIP: 0010:nf_tables_chain_destroy+0x23d/0x260 [ 33.100306] Code: 8b 7c 24 68 e8 64 9c ed fe 4c 89 e7 e8 5c 9c ed fe 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 c3 cc cc cc cc <0f> 0b 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d 31 c0 89 c6 89 c7 [ 33.101271] RSP: 0018:ffffc900004ffc48 EFLAGS: 00010202 [ 33.101546] RAX: 0000000000000001 RBX: ffff888006fc0a28 RCX: 0000000000000000 [ 33.101920] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 33.102649] RBP: ffffc900004ffc78 R08: 0000000000000000 R09: 0000000000000000 [ 33.103018] R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880135ef500 [ 33.103385] R13: 0000000000000000 R14: dead000000000122 R15: ffff888006fc0a10 [ 33.103762] FS: 0000000000000000(0000) GS:ffff888024c80000(0000) knlGS:0000000000000000 [ 33.104184] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 33.104493] CR2: 00007fe863b56a50 CR3: 00000000124b0001 CR4: 0000000000770ee0 [ 33.104872] PKRU: 55555554 [ 33.104999] Call Trace: [ 33.105113] <TASK> [ 33.105214] ? show_regs+0x72/0x90 [ 33.105371] ? __warn+0xa5/0x210 [ 33.105520] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.105732] ? report_bug+0x1f2/0x200 [ 33.105902] ? handle_bug+0x46/0x90 [ 33.106546] ? exc_invalid_op+0x19/0x50 [ 33.106762] ? asm_exc_invalid_op+0x1b/0x20 [ 33.106995] ? nf_tables_chain_destroy+0x23d/0x260 [ 33.107249] ? nf_tables_chain_destroy+0x30/0x260 [ 33.107506] nf_tables_trans_destroy_work+0x669/0x680 [ 33.107782] ? mark_held_locks+0x28/0xa0 [ 33.107996] ? __pfx_nf_tables_trans_destroy_work+0x10/0x10 [ 33.108294] ? _raw_spin_unlock_irq+0x28/0x70 [ 33.108538] process_one_work+0x68c/0xb70 [ 33.108755] ? lock_acquire+0x17f/0x420 [ 33.108977] ? __pfx_process_one_work+0x10/0x10 [ 33.109218] ? do_raw_spin_lock+0x128/0x1d0 [ 33.109435] ? _raw_spin_lock_irq+0x71/0x80 [ 33.109634] worker_thread+0x2bd/0x700 [ 33.109817] ? __pfx_worker_thread+0x10/0x10 [ 33.110254] kthread+0x18b/0x1d0 [ 33.110410] ? __pfx_kthread+0x10/0x10 [ 33.110581] ret_from_fork+0x29/0x50 [ 33.110757] </TASK> [ 33.110866] irq event stamp: 1651 [ 33.111017] hardirqs last enabled at (1659): [<ffffffffa206a209>] __up_console_sem+0x79/0xa0 [ 33.111379] hardirqs last disabled at (1666): [<ffffffffa206a1ee>] __up_console_sem+0x5e/0xa0 [ 33.111740] softirqs last enabled at (1616): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0 [ 33.112094] softirqs last disabled at (1367): [<ffffffffa1f5d40e>] __irq_exit_rcu+0x9e/0xe0 [ 33.112453] ---[ end trace 0000000000000000 ]--- This is due to the nft_chain_lookup_byid ignoring the genmask. After this change, adding the new rule will fail as it will not find the chain. CVE-2023-53492 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53492.html CVE-2023-53492 https://bugzilla.suse.com/1250823 SUSE Bug 1250823 In the Linux kernel, the following vulnerability has been resolved: crypto: xts - Handle EBUSY correctly As it is xts only handles the special return value of EINPROGRESS, which means that in all other cases it will free data related to the request. However, as the caller of xts may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free. CVE-2023-53494 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53494.html CVE-2023-53494 https://bugzilla.suse.com/1250822 SUSE Bug 1250822 In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Use alternate source for socket to node data The UV code attempts to build a set of tables to allow it to do bidirectional socket<=>node lookups. But when nr_cpus is set to a smaller number than actually present, the cpu_to_node() mapping information for unused CPUs is not available to build_socket_tables(). This results in skipping some nodes or sockets when creating the tables and leaving some -1's for later code to trip. over, causing oopses. The problem is that the socket<=>node lookups are created by doing a loop over all CPUs, then looking up the CPU's APICID and socket. But if a CPU is not present, there is no way to start this lookup. Instead of looping over all CPUs, take CPUs out of the equation entirely. Loop over all APICIDs which are mapped to a valid NUMA node. Then just extract the socket-id from the APICID. This avoid tripping over disabled CPUs. CVE-2023-53496 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53496.html CVE-2023-53496 https://bugzilla.suse.com/1250905 SUSE Bug 1250905 In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential null dereference The adev->dm.dc pointer can be NULL and dereferenced in amdgpu_dm_fini() without checking. Add a NULL pointer check before calling dc_dmub_srv_destroy(). Found by Linux Verification Center (linuxtesting.org) with SVACE. CVE-2023-53498 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53498.html CVE-2023-53498 https://bugzilla.suse.com/1250819 SUSE Bug 1250819 In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rqs have already initialized XDP and enabled NAPI, which is not the expected behavior. Need to roll back the previous rq initialization to avoid leaks in error unwinding of init code. Also extract helper functions of disable and enable queue pairs. Use newly introduced disable helper function in error unwinding and virtnet_close. Use enable helper function in virtnet_open. CVE-2023-53499 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53499.html CVE-2023-53499 https://bugzilla.suse.com/1250818 SUSE Bug 1250818 In the Linux kernel, the following vulnerability has been resolved: clk: tegra: tegra124-emc: Fix potential memory leak The tegra and tegra needs to be freed in the error handling path, otherwise it will be leaked. CVE-2023-53505 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53505.html CVE-2023-53505 https://bugzilla.suse.com/1250807 SUSE Bug 1250807 In the Linux kernel, the following vulnerability has been resolved: udf: Do not bother merging very long extents When merging very long extents we try to push as much length as possible to the first extent. However this is unnecessarily complicated and not really worth the trouble. Furthermore there was a bug in the logic resulting in corrupting extents in the file as syzbot reproducer shows. So just don't bother with the merging of extents that are too long together. CVE-2023-53506 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53506.html CVE-2023-53506 https://bugzilla.suse.com/1250963 SUSE Bug 1250963 In the Linux kernel, the following vulnerability has been resolved: qed: allow sleep in qed_mcp_trace_dump() By default, qed_mcp_cmd_and_union() delays 10us at a time in a loop that can run 500K times, so calls to qed_mcp_nvm_rd_cmd() may block the current thread for over 5s. We observed thread scheduling delays over 700ms in production, with stacktraces pointing to this code as the culprit. qed_mcp_trace_dump() is called from ethtool, so sleeping is permitted. It already can sleep in qed_mcp_halt(), which calls qed_mcp_cmd(). Add a "can sleep" parameter to qed_find_nvram_image() and qed_nvram_read() so they can sleep during qed_mcp_trace_dump(). qed_mcp_trace_get_meta_info() and qed_mcp_trace_read_meta(), called only by qed_mcp_trace_dump(), allow these functions to sleep. I can't tell if the other caller (qed_grc_dump_mcp_hw_dump()) can sleep, so keep b_can_sleep set to false when it calls these functions. An example stacktrace from a custom warning we added to the kernel showing a thread that has not scheduled despite long needing resched: [ 2745.362925,17] ------------[ cut here ]------------ [ 2745.362941,17] WARNING: CPU: 23 PID: 5640 at arch/x86/kernel/irq.c:233 do_IRQ+0x15e/0x1a0() [ 2745.362946,17] Thread not rescheduled for 744 ms after irq 99 [ 2745.362956,17] Modules linked in: ... [ 2745.363339,17] CPU: 23 PID: 5640 Comm: lldpd Tainted: P O 4.4.182+ #202104120910+6d1da174272d.61x [ 2745.363343,17] Hardware name: FOXCONN MercuryB/Quicksilver Controller, BIOS H11P1N09 07/08/2020 [ 2745.363346,17] 0000000000000000 ffff885ec07c3ed8 ffffffff8131eb2f ffff885ec07c3f20 [ 2745.363358,17] ffffffff81d14f64 ffff885ec07c3f10 ffffffff81072ac2 ffff88be98ed0000 [ 2745.363369,17] 0000000000000063 0000000000000174 0000000000000074 0000000000000000 [ 2745.363379,17] Call Trace: [ 2745.363382,17] <IRQ> [<ffffffff8131eb2f>] dump_stack+0x8e/0xcf [ 2745.363393,17] [<ffffffff81072ac2>] warn_slowpath_common+0x82/0xc0 [ 2745.363398,17] [<ffffffff81072b4c>] warn_slowpath_fmt+0x4c/0x50 [ 2745.363404,17] [<ffffffff810d5a8e>] ? rcu_irq_exit+0xae/0xc0 [ 2745.363408,17] [<ffffffff817c99fe>] do_IRQ+0x15e/0x1a0 [ 2745.363413,17] [<ffffffff817c7ac9>] common_interrupt+0x89/0x89 [ 2745.363416,17] <EOI> [<ffffffff8132aa74>] ? delay_tsc+0x24/0x50 [ 2745.363425,17] [<ffffffff8132aa04>] __udelay+0x34/0x40 [ 2745.363457,17] [<ffffffffa04d45ff>] qed_mcp_cmd_and_union+0x36f/0x7d0 [qed] [ 2745.363473,17] [<ffffffffa04d5ced>] qed_mcp_nvm_rd_cmd+0x4d/0x90 [qed] [ 2745.363490,17] [<ffffffffa04e1dc7>] qed_mcp_trace_dump+0x4a7/0x630 [qed] [ 2745.363504,17] [<ffffffffa04e2556>] ? qed_fw_asserts_dump+0x1d6/0x1f0 [qed] [ 2745.363520,17] [<ffffffffa04e4ea7>] qed_dbg_mcp_trace_get_dump_buf_size+0x37/0x80 [qed] [ 2745.363536,17] [<ffffffffa04ea881>] qed_dbg_feature_size+0x61/0xa0 [qed] [ 2745.363551,17] [<ffffffffa04eb427>] qed_dbg_all_data_size+0x247/0x260 [qed] [ 2745.363560,17] [<ffffffffa0482c10>] qede_get_regs_len+0x30/0x40 [qede] [ 2745.363566,17] [<ffffffff816c9783>] ethtool_get_drvinfo+0xe3/0x190 [ 2745.363570,17] [<ffffffff816cc152>] dev_ethtool+0x1362/0x2140 [ 2745.363575,17] [<ffffffff8109bcc6>] ? finish_task_switch+0x76/0x260 [ 2745.363580,17] [<ffffffff817c2116>] ? __schedule+0x3c6/0x9d0 [ 2745.363585,17] [<ffffffff810dbd50>] ? hrtimer_start_range_ns+0x1d0/0x370 [ 2745.363589,17] [<ffffffff816c1e5b>] ? dev_get_by_name_rcu+0x6b/0x90 [ 2745.363594,17] [<ffffffff816de6a8>] dev_ioctl+0xe8/0x710 [ 2745.363599,17] [<ffffffff816a58a8>] sock_do_ioctl+0x48/0x60 [ 2745.363603,17] [<ffffffff816a5d87>] sock_ioctl+0x1c7/0x280 [ 2745.363608,17] [<ffffffff8111f393>] ? seccomp_phase1+0x83/0x220 [ 2745.363612,17] [<ffffffff811e3503>] do_vfs_ioctl+0x2b3/0x4e0 [ 2745.363616,17] [<ffffffff811e3771>] SyS_ioctl+0x41/0x70 [ 2745.363619,17] [<ffffffff817c6ffe>] entry_SYSCALL_64_fastpath+0x1e/0x79 [ 2745.363622,17] ---[ end trace f6954aa440266421 ]--- CVE-2023-53509 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53509.html CVE-2023-53509 https://bugzilla.suse.com/1250810 SUSE Bug 1250810 In the Linux kernel, the following vulnerability has been resolved: io_uring: fix fget leak when fs don't support nowait buffered read Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1] Do the following steps can reproduce this BUG: mount -t ocfs2 /dev/vdc /mnt/ocfs2 cp testfile /mnt/ocfs2/ ./link-cp /mnt/ocfs2/testfile /mnt/ocfs2/testfile.1 umount /mnt/ocfs2 Then umount will fail, and it outputs: umount: /mnt/ocfs2: target is busy. While tracing umount, it blames mnt_get_count() not return as expected. Do a deep investigation for fget()/fput() on related code flow, I've finally found that fget() leaks since ocfs2 doesn't support nowait buffered read. io_issue_sqe |-io_assign_file // do fget() first |-io_read |-io_iter_do_read |-ocfs2_file_read_iter // return -EOPNOTSUPP |-kiocb_done |-io_rw_done |-__io_complete_rw_common // set REQ_F_REISSUE |-io_resubmit_prep |-io_req_prep_async // override req->file, leak happens This was introduced by commit a196c78b5443 in v5.18. Fix it by don't re-assign req->file if it has already been assigned. [1] https://lore.kernel.org/ocfs2-devel/ab580a75-91c8-d68a-3455-40361be1bfa8@linux.alibaba.com/T/#t CVE-2023-53511 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53511.html CVE-2023-53511 https://bugzilla.suse.com/1250913 SUSE Bug 1250913 In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix a memory leak Add a forgotten kfree(). CVE-2023-53512 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53512.html CVE-2023-53512 https://bugzilla.suse.com/1250915 SUSE Bug 1250915 In the Linux kernel, the following vulnerability has been resolved: virtio-mmio: don't break lifecycle of vm_dev vm_dev has a separate lifecycle because it has a 'struct device' embedded. Thus, having a release callback for it is correct. Allocating the vm_dev struct with devres totally breaks this protection, though. Instead of waiting for the vm_dev release callback, the memory is freed when the platform_device is removed. Resulting in a use-after-free when finally the callback is to be called. To easily see the problem, compile the kernel with CONFIG_DEBUG_KOBJECT_RELEASE and unbind with sysfs. The fix is easy, don't use devres in this case. Found during my research about object lifetime problems. CVE-2023-53515 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53515.html CVE-2023-53515 https://bugzilla.suse.com/1250917 SUSE Bug 1250917 In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix leak in devfreq_dev_release() srcu_init_notifier_head() allocates resources that need to be released with a srcu_cleanup_notifier_head() call. Reported by kmemleak. CVE-2023-53518 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53518.html CVE-2023-53518 https://bugzilla.suse.com/1250923 SUSE Bug 1250923 In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: add lock to protect parameter num_rdy Getting below error when using KCSAN to check the driver. Adding lock to protect parameter num_rdy when getting the value with function: v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready. kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue kworker/u16:3: [name:report&] kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7: kworker/u16:3: v4l2_m2m_buf_queue+0xd8/0x10c CVE-2023-53519 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53519.html CVE-2023-53519 https://bugzilla.suse.com/1250964 SUSE Bug 1250964 In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() A fix for: BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013 When edev->components is zero, accessing edev->component[0] members is wrong. CVE-2023-53521 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53521.html CVE-2023-53521 https://bugzilla.suse.com/1250965 SUSE Bug 1250965 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer overflow occurs in the iwl_write_to_user_buf() function, which is called by the iwl_dbgfs_monitor_data_read() function. static bool iwl_write_to_user_buf(char __user *user_buf, ssize_t count, void *buf, ssize_t *size, ssize_t *bytes_copied) { int buf_size_left = count - *bytes_copied; buf_size_left = buf_size_left - (buf_size_left % sizeof(u32)); if (*size > buf_size_left) *size = buf_size_left; If the user passes a SIZE_MAX value to the "ssize_t count" parameter, the ssize_t count parameter is assigned to "int buf_size_left". Then compare "*size" with "buf_size_left" . Here, "buf_size_left" is a negative number, so "*size" is assigned "buf_size_left" and goes into the third argument of the copy_to_user function, causing a heap overflow. This is not a security vulnerability because iwl_dbgfs_monitor_data_read() is a debugfs operation with 0400 privileges. CVE-2023-53524 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53524.html CVE-2023-53524 https://bugzilla.suse.com/1250953 SUSE Bug 1250953 In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Allow UD qp_type to join multicast only As for multicast: - The SIDR is the only mode that makes sense; - Besides PS_UDP, other port spaces like PS_IB is also allowed, as it is UD compatible. In this case qkey also needs to be set [1]. This patch allows only UD qp_type to join multicast, and set qkey to default if it's not set, to fix an uninit-value error: the ib->rec.qkey field is accessed without being initialized. ===================================================== BUG: KMSAN: uninit-value in cma_set_qkey drivers/infiniband/core/cma.c:510 [inline] BUG: KMSAN: uninit-value in cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 cma_set_qkey drivers/infiniband/core/cma.c:510 [inline] cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570 cma_iboe_join_multicast drivers/infiniband/core/cma.c:4782 [inline] rdma_join_multicast+0x2b83/0x30a0 drivers/infiniband/core/cma.c:4814 ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 ucma_join_multicast+0x1e3/0x250 drivers/infiniband/core/ucma.c:1546 ucma_write+0x639/0x6d0 drivers/infiniband/core/ucma.c:1732 vfs_write+0x8ce/0x2030 fs/read_write.c:588 ksys_write+0x28c/0x520 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __ia32_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline] __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c Local variable ib.i created at: cma_iboe_join_multicast drivers/infiniband/core/cma.c:4737 [inline] rdma_join_multicast+0x586/0x30a0 drivers/infiniband/core/cma.c:4814 ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479 CPU: 0 PID: 29874 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ===================================================== [1] https://lore.kernel.org/linux-rdma/20220117183832.GD84788@nvidia.com/ CVE-2023-53525 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53525.html CVE-2023-53525 https://bugzilla.suse.com/1250927 SUSE Bug 1250927 In the Linux kernel, the following vulnerability has been resolved: jbd2: check 'jh->b_transaction' before removing it from checkpoint Following process will corrupt ext4 image: Step 1: jbd2_journal_commit_transaction __jbd2_journal_insert_checkpoint(jh, commit_transaction) // Put jh into trans1->t_checkpoint_list journal->j_checkpoint_transactions = commit_transaction // Put trans1 into journal->j_checkpoint_transactions Step 2: do_get_write_access test_clear_buffer_dirty(bh) // clear buffer dirty，set jbd dirty __jbd2_journal_file_buffer(jh, transaction) // jh belongs to trans2 Step 3: drop_cache journal_shrink_one_cp_list jbd2_journal_try_remove_checkpoint if (!trylock_buffer(bh)) // lock bh, true if (buffer_dirty(bh)) // buffer is not dirty __jbd2_journal_remove_checkpoint(jh) // remove jh from trans1->t_checkpoint_list Step 4: jbd2_log_do_checkpoint trans1 = journal->j_checkpoint_transactions // jh is not in trans1->t_checkpoint_list jbd2_cleanup_journal_tail(journal) // trans1 is done Step 5: Power cut, trans2 is not committed, jh is lost in next mounting. Fix it by checking 'jh->b_transaction' before remove it from checkpoint. CVE-2023-53526 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53526.html CVE-2023-53526 https://bugzilla.suse.com/1250928 SUSE Bug 1250928 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id() The following call trace was observed: localhost kernel: nvme nvme0: NVME-FC{0}: controller connect complete localhost kernel: BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u129:4/75092 localhost kernel: nvme nvme0: NVME-FC{0}: new ctrl: NQN "nqn.1992-08.com.netapp:sn.b42d198afb4d11ecad6d00a098d6abfa:subsystem.PR_Channel2022_RH84_subsystem_291" localhost kernel: caller is qla_nvme_post_cmd+0x216/0x1380 [qla2xxx] localhost kernel: CPU: 6 PID: 75092 Comm: kworker/u129:4 Kdump: loaded Tainted: G B W OE --------- --- 5.14.0-70.22.1.el9_0.x86_64+debug #1 localhost kernel: Hardware name: HPE ProLiant XL420 Gen10/ProLiant XL420 Gen10, BIOS U39 01/13/2022 localhost kernel: Workqueue: nvme-wq nvme_async_event_work [nvme_core] localhost kernel: Call Trace: localhost kernel: dump_stack_lvl+0x57/0x7d localhost kernel: check_preemption_disabled+0xc8/0xd0 localhost kernel: qla_nvme_post_cmd+0x216/0x1380 [qla2xxx] Use raw_smp_processor_id() instead of smp_processor_id(). Also use queue_work() across the driver instead of queue_work_on() thus avoiding usage of smp_processor_id() when CONFIG_DEBUG_PREEMPT is enabled. CVE-2023-53530 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53530.html CVE-2023-53530 https://bugzilla.suse.com/1250949 SUSE Bug 1250949 In the Linux kernel, the following vulnerability has been resolved: null_blk: fix poll request timeout handling When doing io_uring benchmark on /dev/nullb0, it's easy to crash the kernel if poll requests timeout triggered, as reported by David. [1] BUG: kernel NULL pointer dereference, address: 0000000000000008 Workqueue: kblockd blk_mq_timeout_work RIP: 0010:null_timeout_rq+0x4e/0x91 Call Trace: ? null_timeout_rq+0x4e/0x91 blk_mq_handle_expired+0x31/0x4b bt_iter+0x68/0x84 ? bt_tags_iter+0x81/0x81 __sbitmap_for_each_set.constprop.0+0xb0/0xf2 ? __blk_mq_complete_request_remote+0xf/0xf bt_for_each+0x46/0x64 ? __blk_mq_complete_request_remote+0xf/0xf ? percpu_ref_get_many+0xc/0x2a blk_mq_queue_tag_busy_iter+0x14d/0x18e blk_mq_timeout_work+0x95/0x127 process_one_work+0x185/0x263 worker_thread+0x1b5/0x227 This is indeed a race problem between null_timeout_rq() and null_poll(). null_poll() null_timeout_rq() spin_lock(&nq->poll_lock) list_splice_init(&nq->poll_list, &list) spin_unlock(&nq->poll_lock) while (!list_empty(&list)) req = list_first_entry() list_del_init() ... blk_mq_add_to_batch() // req->rq_next = NULL spin_lock(&nq->poll_lock) // rq->queuelist->next == NULL list_del_init(&rq->queuelist) spin_unlock(&nq->poll_lock) Fix these problems by setting requests state to MQ_RQ_COMPLETE under nq->poll_lock protection, in which null_timeout_rq() can safely detect this race and early return. Note this patch just fix the kernel panic when request timeout happen. [1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/ CVE-2023-53531 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53531.html CVE-2023-53531 https://bugzilla.suse.com/1250931 SUSE Bug 1250931 In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in ath11k_ahb_fw_resources_init(), iommu domain mapping is done only for the chipsets having fixed firmware memory. Also, for such chipsets, mapping is done only if it does not have TrustZone support. During deinitialization, only if TrustZone support is not there, iommu is unmapped back. However, for non fixed firmware memory chipsets, TrustZone support is not there and this makes the condition check to true and it tries to unmap the memory which was not mapped during initialization. This leads to the following trace - [ 83.198790] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 [ 83.259537] Modules linked in: ath11k_ahb ath11k qmi_helpers .. snip .. [ 83.280286] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 83.287228] pc : __iommu_unmap+0x30/0x140 [ 83.293907] lr : iommu_unmap+0x5c/0xa4 [ 83.298072] sp : ffff80000b3abad0 .. snip .. [ 83.369175] Call trace: [ 83.376282] __iommu_unmap+0x30/0x140 [ 83.378541] iommu_unmap+0x5c/0xa4 [ 83.382360] ath11k_ahb_fw_resource_deinit.part.12+0x2c/0xac [ath11k_ahb] [ 83.385666] ath11k_ahb_free_resources+0x140/0x17c [ath11k_ahb] [ 83.392521] ath11k_ahb_shutdown+0x34/0x40 [ath11k_ahb] [ 83.398248] platform_shutdown+0x20/0x2c [ 83.403455] device_shutdown+0x16c/0x1c4 [ 83.407621] kernel_restart_prepare+0x34/0x3c [ 83.411529] kernel_restart+0x14/0x74 [ 83.415781] __do_sys_reboot+0x1c4/0x22c [ 83.419427] __arm64_sys_reboot+0x1c/0x24 [ 83.423420] invoke_syscall+0x44/0xfc [ 83.427326] el0_svc_common.constprop.3+0xac/0xe8 [ 83.430974] do_el0_svc+0xa0/0xa8 [ 83.435659] el0_svc+0x1c/0x44 [ 83.438957] el0t_64_sync_handler+0x60/0x144 [ 83.441910] el0t_64_sync+0x15c/0x160 [ 83.446343] Code: aa0103f4 f9400001 f90027a1 d2800001 (f94006a0) [ 83.449903] ---[ end trace 0000000000000000 ]--- This can be reproduced by probing an AHB chipset which is not having a fixed memory region. During reboot (or rmmod) trace can be seen. Fix this issue by adding a condition check on firmware fixed memory hw_param as done in the counter initialization function. Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 CVE-2023-53532 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2023-53532.html CVE-2023-53532 https://bugzilla.suse.com/1250932 SUSE Bug 1250932 In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past that point risks touching already freed data. Try to avoid the locking and extra flags altogether. Have the main thread hold an extra reference, this way we can depend solely on the atomic ref counter for synchronization. Don't futz with reiniting the completion, either, we are now tightly controlling when completion fires. CVE-2024-26583 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2024-26583.html CVE-2024-26583 https://bugzilla.suse.com/1220185 SUSE Bug 1220185 In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY instead of -EINPROGRESS in valid situations. For example, when the cryptd queue for AESNI is full (easy to trigger with an artificially low cryptd.cryptd_max_cpu_qlen), requests will be enqueued to the backlog but still processed. In that case, the async callback will also be called twice: first with err == -EINPROGRESS, which it seems we can just ignore, then with err == 0. Compared to Sabrina's original patch this version uses the new tls_*crypt_async_wait() helpers and converts the EBUSY to EINPROGRESS to avoid having to modify all the error handling paths. The handling is identical. CVE-2024-26584 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2024-26584.html CVE-2024-26584 https://bugzilla.suse.com/1220186 SUSE Bug 1220186 In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simpler. There's no reference counting, we just need to wait for the completion to wake us up and return its result. We should preferably also use a separate crypto_wait. I'm not seeing a UAF as I did in the past, I think aec7961916f3 ("tls: fix race between async notify and socket close") took care of it. This will make the next fix easier. CVE-2024-58240 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2024-58240.html CVE-2024-58240 https://bugzilla.suse.com/1248847 SUSE Bug 1248847 In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry. This fixes the following KASAN reported issue: ================================================================== BUG: KASAN: slab-use-after-free in ext4_xattr_inode_dec_ref_all+0xb8c/0xe90 Read of size 4 at addr ffff888012c120c4 by task repro/2065 CPU: 1 UID: 0 PID: 2065 Comm: repro Not tainted 6.13.0-rc2+ #11 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x1fd/0x300 ? tcp_gro_dev_warn+0x260/0x260 ? _printk+0xc0/0x100 ? read_lock_is_recursive+0x10/0x10 ? irq_work_queue+0x72/0xf0 ? __virt_addr_valid+0x17b/0x4b0 print_address_description+0x78/0x390 print_report+0x107/0x1f0 ? __virt_addr_valid+0x17b/0x4b0 ? __virt_addr_valid+0x3ff/0x4b0 ? __phys_addr+0xb5/0x160 ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90 kasan_report+0xcc/0x100 ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90 ext4_xattr_inode_dec_ref_all+0xb8c/0xe90 ? ext4_xattr_delete_inode+0xd30/0xd30 ? __ext4_journal_ensure_credits+0x5f0/0x5f0 ? __ext4_journal_ensure_credits+0x2b/0x5f0 ? inode_update_timestamps+0x410/0x410 ext4_xattr_delete_inode+0xb64/0xd30 ? ext4_truncate+0xb70/0xdc0 ? ext4_expand_extra_isize_ea+0x1d20/0x1d20 ? __ext4_mark_inode_dirty+0x670/0x670 ? ext4_journal_check_start+0x16f/0x240 ? ext4_inode_is_fast_symlink+0x2f2/0x3a0 ext4_evict_inode+0xc8c/0xff0 ? ext4_inode_is_fast_symlink+0x3a0/0x3a0 ? do_raw_spin_unlock+0x53/0x8a0 ? ext4_inode_is_fast_symlink+0x3a0/0x3a0 evict+0x4ac/0x950 ? proc_nr_inodes+0x310/0x310 ? trace_ext4_drop_inode+0xa2/0x220 ? _raw_spin_unlock+0x1a/0x30 ? iput+0x4cb/0x7e0 do_unlinkat+0x495/0x7c0 ? try_break_deleg+0x120/0x120 ? 0xffffffff81000000 ? __check_object_size+0x15a/0x210 ? strncpy_from_user+0x13e/0x250 ? getname_flags+0x1dc/0x530 __x64_sys_unlinkat+0xc8/0xf0 do_syscall_64+0x65/0x110 entry_SYSCALL_64_after_hwframe+0x67/0x6f RIP: 0033:0x434ffd Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8 RSP: 002b:00007ffc50fa7b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000107 RAX: ffffffffffffffda RBX: 00007ffc50fa7e18 RCX: 0000000000434ffd RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005 RBP: 00007ffc50fa7be0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc50fa7e08 R14: 00000000004bbf30 R15: 0000000000000001 </TASK> The buggy address belongs to the object at ffff888012c12000 which belongs to the cache filp of size 360 The buggy address is located 196 bytes inside of freed 360-byte region [ffff888012c12000, ffff888012c12168) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c12 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x40(head|node=0|zone=0) page_type: f5(slab) raw: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004 raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 head: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004 head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000 head: 0000000000000001 ffffea00004b0481 ffffffffffffffff 0000000000000000 head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888012c11f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888012c12000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ffff888012c12080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888012c12100: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc ffff888012c12180: fc fc fc fc fc fc fc fc fc ---truncated--- CVE-2025-37738 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-37738.html CVE-2025-37738 https://bugzilla.suse.com/1242846 SUSE Bug 1242846 In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix dereferencing invalid pmd migration entry When migrating a THP, concurrent access to the PMD migration entry during a deferred split scan can lead to an invalid address access, as illustrated below. To prevent this invalid access, it is necessary to check the PMD migration entry and return early. In this context, there is no need to use pmd_to_swp_entry and pfn_swap_entry_to_page to verify the equality of the target folio. Since the PMD migration entry is locked, it cannot be served as the target. Mailing list discussion and explanation from Hugh Dickins: "An anon_vma lookup points to a location which may contain the folio of interest, but might instead contain another folio: and weeding out those other folios is precisely what the "folio != pmd_folio((*pmd)" check (and the "risk of replacing the wrong folio" comment a few lines above it) is for." BUG: unable to handle page fault for address: ffffea60001db008 CPU: 0 UID: 0 PID: 2199114 Comm: tee Not tainted 6.14.0+ #4 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:split_huge_pmd_locked+0x3b5/0x2b60 Call Trace: <TASK> try_to_migrate_one+0x28c/0x3730 rmap_walk_anon+0x4f6/0x770 unmap_folio+0x196/0x1f0 split_huge_page_to_list_to_order+0x9f6/0x1560 deferred_split_scan+0xac5/0x12a0 shrinker_debugfs_scan_write+0x376/0x470 full_proxy_write+0x15c/0x220 vfs_write+0x2fc/0xcb0 ksys_write+0x146/0x250 do_syscall_64+0x6a/0x120 entry_SYSCALL_64_after_hwframe+0x76/0x7e The bug is found by syzkaller on an internal kernel, then confirmed on upstream. CVE-2025-37958 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-37958.html CVE-2025-37958 https://bugzilla.suse.com/1243539 SUSE Bug 1243539 In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper The idxd_cleanup() helper cleans up perfmon, interrupts, internals and so on. Refactor remove call with the idxd_cleanup() helper to avoid code duplication. Note, this also fixes the missing put_device() for idxd groups, enginces and wqs. CVE-2025-38014 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38014.html CVE-2025-38014 https://bugzilla.suse.com/1244732 SUSE Bug 1244732 https://bugzilla.suse.com/1244733 SUSE Bug 1244733 In the Linux kernel, the following vulnerability has been resolved: net/mdiobus: Fix potential out-of-bounds read/write access When using publicly available tools like 'mdio-tools' to read/write data from/to network interface and its PHY via mdiobus, there is no verification of parameters passed to the ioctl and it accepts any mdio address. Currently there is support for 32 addresses in kernel via PHY_MAX_ADDR define, but it is possible to pass higher value than that via ioctl. While read/write operation should generally fail in this case, mdiobus provides stats array, where wrong address may allow out-of-bounds read/write. Fix that by adding address verification before read/write operation. While this excludes this access from any statistics, it improves security of read/write operation. CVE-2025-38111 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38111.html CVE-2025-38111 https://bugzilla.suse.com/1245666 SUSE Bug 1245666 https://bugzilla.suse.com/1249455 SUSE Bug 1249455 This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2025-38380 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38380.html CVE-2025-38380 https://bugzilla.suse.com/1247028 SUSE Bug 1247028 https://bugzilla.suse.com/1247029 SUSE Bug 1247029 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-50047 fix removed asynchronous crypto handling from crypt_message(), assuming all crypto operations are synchronous. However, when hardware crypto accelerators are used, this can cause use-after-free crashes: crypt_message() // Allocate the creq buffer containing the req creq = smb2_get_aead_req(..., &req); // Async encryption returns -EINPROGRESS immediately rc = enc ? crypto_aead_encrypt(req) : crypto_aead_decrypt(req); // Free creq while async operation is still in progress kvfree_sensitive(creq, ...); Hardware crypto modules often implement async AEAD operations for performance. When crypto_aead_encrypt/decrypt() returns -EINPROGRESS, the operation completes asynchronously. Without crypto_wait_req(), the function immediately frees the request buffer, leading to crashes when the driver later accesses the freed memory. This results in a use-after-free condition when the hardware crypto driver later accesses the freed request structure, leading to kernel crashes with NULL pointer dereferences. The issue occurs because crypto_alloc_aead() with mask=0 doesn't guarantee synchronous operation. Even without CRYPTO_ALG_ASYNC in the mask, async implementations can be selected. Fix by restoring the async crypto handling: - DECLARE_CRYPTO_WAIT(wait) for completion tracking - aead_request_set_callback() for async completion notification - crypto_wait_req() to wait for operation completion This ensures the request buffer isn't freed until the crypto operation completes, whether synchronous or asynchronous, while preserving the CVE-2024-50047 fix. CVE-2025-38488 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38488.html CVE-2025-38488 https://bugzilla.suse.com/1247239 SUSE Bug 1247239 https://bugzilla.suse.com/1247240 SUSE Bug 1247240 In the Linux kernel, the following vulnerability has been resolved: net/sched: Restrict conditions for adding duplicating netems to qdisc tree netem_enqueue's duplication prevention logic breaks when a netem resides in a qdisc tree with other netems - this can lead to a soft lockup and OOM loop in netem_dequeue, as seen in [1]. Ensure that a duplicating netem cannot exist in a tree with other netems. Previous approaches suggested in discussions in chronological order: 1) Track duplication status or ttl in the sk_buff struct. Considered too specific a use case to extend such a struct, though this would be a resilient fix and address other previous and potential future DOS bugs like the one described in loopy fun [2]. 2) Restrict netem_enqueue recursion depth like in act_mirred with a per cpu variable. However, netem_dequeue can call enqueue on its child, and the depth restriction could be bypassed if the child is a netem. 3) Use the same approach as in 2, but add metadata in netem_skb_cb to handle the netem_dequeue case and track a packet's involvement in duplication. This is an overly complex approach, and Jamal notes that the skb cb can be overwritten to circumvent this safeguard. 4) Prevent the addition of a netem to a qdisc tree if its ancestral path contains a netem. However, filters and actions can cause a packet to change paths when re-enqueued to the root from netem duplication, leading us to the current solution: prevent a duplicating netem from inhabiting the same tree as other netems. [1] https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/ [2] https://lwn.net/Articles/719297/ CVE-2025-38553 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38553.html CVE-2025-38553 https://bugzilla.suse.com/1248255 SUSE Bug 1248255 In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segment() WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 skb_reset_transport_header include/linux/skbuff.h:3032 [inline] WARNING: CPU: 0 PID: 5871 at ./include/linux/skbuff.h:3032 ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Modules linked in: CPU: 0 UID: 0 PID: 5871 Comm: syz-executor211 Not tainted 6.16.0-rc6-syzkaller-g7abc678e3084 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:skb_reset_transport_header include/linux/skbuff.h:3032 [inline] RIP: 0010:ipv6_gso_segment+0x15e2/0x21e0 net/ipv6/ip6_offload.c:151 Call Trace: <TASK> skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 nsh_gso_segment+0x54a/0xe10 net/nsh/nsh.c:110 skb_mac_gso_segment+0x31c/0x640 net/core/gso.c:53 __skb_gso_segment+0x342/0x510 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x857/0x11b0 net/core/dev.c:3950 validate_xmit_skb_list+0x84/0x120 net/core/dev.c:4000 sch_direct_xmit+0xd3/0x4b0 net/sched/sch_generic.c:329 __dev_xmit_skb net/core/dev.c:4102 [inline] __dev_queue_xmit+0x17b6/0x3a70 net/core/dev.c:4679 CVE-2025-38572 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38572.html CVE-2025-38572 https://bugzilla.suse.com/1248399 SUSE Bug 1248399 https://bugzilla.suse.com/1248400 SUSE Bug 1248400 In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw. However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 ("gfs2: Prevent double iput for journal on error") and is a NULL pointer dereference since then. Simply get rid of self recovery to fix that. CVE-2025-38659 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38659.html CVE-2025-38659 https://bugzilla.suse.com/1248639 SUSE Bug 1248639 https://bugzilla.suse.com/1248759 SUSE Bug 1248759 In the Linux kernel, the following vulnerability has been resolved: ice: Fix a null pointer dereference in ice_copy_and_init_pkg() Add check for the return value of devm_kmemdup() to prevent potential null pointer dereference. CVE-2025-38664 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38664.html CVE-2025-38664 https://bugzilla.suse.com/1248628 SUSE Bug 1248628 https://bugzilla.suse.com/1248631 SUSE Bug 1248631 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject duplicate device on updates A chain/flowtable update with duplicated devices in the same batch is possible. Unfortunately, netdev event path only removes the first device that is found, leaving unregistered the hook of the duplicated device. Check if a duplicated device exists in the transaction batch, bail out with EEXIST in such case. WARNING is hit when unregistering the hook: [49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150 [49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full) [...] [49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150 CVE-2025-38678 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38678.html CVE-2025-38678 https://bugzilla.suse.com/1249126 SUSE Bug 1249126 https://bugzilla.suse.com/1249534 SUSE Bug 1249534 In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, default_device_exit_batch() >> default_device_exit_net() is called. When netvsc NIC is moved back and registered to the default namespace, it automatically brings VF NIC back to the default namespace. This will cause the default_device_exit_net() >> for_each_netdev_safe loop unable to detect the list end, and hit NULL ptr: [ 231.449420] mana 7870:00:00.0 enP30832s1: Moved VF to namespace with: eth0 [ 231.449656] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ 231.450246] #PF: supervisor read access in kernel mode [ 231.450579] #PF: error_code(0x0000) - not-present page [ 231.450916] PGD 17b8a8067 P4D 0 [ 231.451163] Oops: Oops: 0000 [#1] SMP NOPTI [ 231.451450] CPU: 82 UID: 0 PID: 1394 Comm: kworker/u768:1 Not tainted 6.16.0-rc4+ #3 VOLUNTARY [ 231.452042] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 11/21/2024 [ 231.452692] Workqueue: netns cleanup_net [ 231.452947] RIP: 0010:default_device_exit_batch+0x16c/0x3f0 [ 231.453326] Code: c0 0c f5 b3 e8 d5 db fe ff 48 85 c0 74 15 48 c7 c2 f8 fd ca b2 be 10 00 00 00 48 8d 7d c0 e8 7b 77 25 00 49 8b 86 28 01 00 00 <48> 8b 50 10 4c 8b 2a 4c 8d 62 f0 49 83 ed 10 4c 39 e0 0f 84 d6 00 [ 231.454294] RSP: 0018:ff75fc7c9bf9fd00 EFLAGS: 00010246 [ 231.454610] RAX: 0000000000000000 RBX: 0000000000000002 RCX: 61c8864680b583eb [ 231.455094] RDX: ff1fa9f71462d800 RSI: ff75fc7c9bf9fd38 RDI: 0000000030766564 [ 231.455686] RBP: ff75fc7c9bf9fd78 R08: 0000000000000000 R09: 0000000000000000 [ 231.456126] R10: 0000000000000001 R11: 0000000000000004 R12: ff1fa9f70088e340 [ 231.456621] R13: ff1fa9f70088e340 R14: ffffffffb3f50c20 R15: ff1fa9f7103e6340 [ 231.457161] FS: 0000000000000000(0000) GS:ff1faa6783a08000(0000) knlGS:0000000000000000 [ 231.457707] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 231.458031] CR2: 0000000000000010 CR3: 0000000179ab2006 CR4: 0000000000b73ef0 [ 231.458434] Call Trace: [ 231.458600] <TASK> [ 231.458777] ops_undo_list+0x100/0x220 [ 231.459015] cleanup_net+0x1b8/0x300 [ 231.459285] process_one_work+0x184/0x340 To fix it, move the ns change to a workqueue, and take rtnl_lock to avoid changing the netdev list when default_device_exit_net() is using it. CVE-2025-38683 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38683.html CVE-2025-38683 https://bugzilla.suse.com/1249159 SUSE Bug 1249159 In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix vmalloc out-of-bounds write in fast_imageblit This issue triggers when a userspace program does an ioctl FBIOPUT_CON2FBMAP by passing console number and frame buffer number. Ideally this maps console to frame buffer and updates the screen if console is visible. As part of mapping it has to do resize of console according to frame buffer info. if this resize fails and returns from vc_do_resize() and continues further. At this point console and new frame buffer are mapped and sets display vars. Despite failure still it continue to proceed updating the screen at later stages where vc_data is related to previous frame buffer and frame buffer info and display vars are mapped to new frame buffer and eventully leading to out-of-bounds write in fast_imageblit(). This bheviour is excepted only when fg_console is equal to requested console which is a visible console and updates screen with invalid struct references in fbcon_putcs(). CVE-2025-38685 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38685.html CVE-2025-38685 https://bugzilla.suse.com/1249220 SUSE Bug 1249220 https://bugzilla.suse.com/1249240 SUSE Bug 1249240 In the Linux kernel, the following vulnerability has been resolved: ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() snd_soc_remove_pcm_runtime() might be called with rtd == NULL which will leads to null pointer dereference. This was reproduced with topology loading and marking a link as ignore due to missing hardware component on the system. On module removal the soc_tplg_remove_link() would call snd_soc_remove_pcm_runtime() with rtd == NULL since the link was ignored, no runtime was created. CVE-2025-38706 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38706.html CVE-2025-38706 https://bugzilla.suse.com/1249195 SUSE Bug 1249195 https://bugzilla.suse.com/1250193 SUSE Bug 1250193 In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() The hfsplus_readdir() method is capable to crash by calling hfsplus_uni2asc(): [ 667.121659][ T9805] ================================================================== [ 667.122651][ T9805] BUG: KASAN: slab-out-of-bounds in hfsplus_uni2asc+0x902/0xa10 [ 667.123627][ T9805] Read of size 2 at addr ffff88802592f40c by task repro/9805 [ 667.124578][ T9805] [ 667.124876][ T9805] CPU: 3 UID: 0 PID: 9805 Comm: repro Not tainted 6.16.0-rc3 #1 PREEMPT(full) [ 667.124886][ T9805] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.124890][ T9805] Call Trace: [ 667.124893][ T9805] <TASK> [ 667.124896][ T9805] dump_stack_lvl+0x10e/0x1f0 [ 667.124911][ T9805] print_report+0xd0/0x660 [ 667.124920][ T9805] ? __virt_addr_valid+0x81/0x610 [ 667.124928][ T9805] ? __phys_addr+0xe8/0x180 [ 667.124934][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124942][ T9805] kasan_report+0xc6/0x100 [ 667.124950][ T9805] ? hfsplus_uni2asc+0x902/0xa10 [ 667.124959][ T9805] hfsplus_uni2asc+0x902/0xa10 [ 667.124966][ T9805] ? hfsplus_bnode_read+0x14b/0x360 [ 667.124974][ T9805] hfsplus_readdir+0x845/0xfc0 [ 667.124984][ T9805] ? __pfx_hfsplus_readdir+0x10/0x10 [ 667.124994][ T9805] ? stack_trace_save+0x8e/0xc0 [ 667.125008][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125015][ T9805] ? trace_lock_acquire+0x85/0xd0 [ 667.125022][ T9805] ? lock_acquire+0x30/0x80 [ 667.125029][ T9805] ? iterate_dir+0x18b/0xb20 [ 667.125037][ T9805] ? down_read_killable+0x1ed/0x4c0 [ 667.125044][ T9805] ? putname+0x154/0x1a0 [ 667.125051][ T9805] ? __pfx_down_read_killable+0x10/0x10 [ 667.125058][ T9805] ? apparmor_file_permission+0x239/0x3e0 [ 667.125069][ T9805] iterate_dir+0x296/0xb20 [ 667.125076][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.125084][ T9805] ? __pfx___x64_sys_getdents64+0x10/0x10 [ 667.125091][ T9805] ? __x64_sys_openat+0x141/0x200 [ 667.125126][ T9805] ? __pfx_filldir64+0x10/0x10 [ 667.125134][ T9805] ? do_user_addr_fault+0x7fe/0x12f0 [ 667.125143][ T9805] do_syscall_64+0xc9/0x480 [ 667.125151][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.125158][ T9805] RIP: 0033:0x7fa8753b2fc9 [ 667.125164][ T9805] Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 48 [ 667.125172][ T9805] RSP: 002b:00007ffe96f8e0f8 EFLAGS: 00000217 ORIG_RAX: 00000000000000d9 [ 667.125181][ T9805] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa8753b2fc9 [ 667.125185][ T9805] RDX: 0000000000000400 RSI: 00002000000063c0 RDI: 0000000000000004 [ 667.125190][ T9805] RBP: 00007ffe96f8e110 R08: 00007ffe96f8e110 R09: 00007ffe96f8e110 [ 667.125195][ T9805] R10: 0000000000000000 R11: 0000000000000217 R12: 0000556b1e3b4260 [ 667.125199][ T9805] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.125207][ T9805] </TASK> [ 667.125210][ T9805] [ 667.145632][ T9805] Allocated by task 9805: [ 667.145991][ T9805] kasan_save_stack+0x20/0x40 [ 667.146352][ T9805] kasan_save_track+0x14/0x30 [ 667.146717][ T9805] __kasan_kmalloc+0xaa/0xb0 [ 667.147065][ T9805] __kmalloc_noprof+0x205/0x550 [ 667.147448][ T9805] hfsplus_find_init+0x95/0x1f0 [ 667.147813][ T9805] hfsplus_readdir+0x220/0xfc0 [ 667.148174][ T9805] iterate_dir+0x296/0xb20 [ 667.148549][ T9805] __x64_sys_getdents64+0x13c/0x2c0 [ 667.148937][ T9805] do_syscall_64+0xc9/0x480 [ 667.149291][ T9805] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 667.149809][ T9805] [ 667.150030][ T9805] The buggy address belongs to the object at ffff88802592f000 [ 667.150030][ T9805] which belongs to the cache kmalloc-2k of size 2048 [ 667.151282][ T9805] The buggy address is located 0 bytes to the right of [ 667.151282][ T9805] allocated 1036-byte region [ffff88802592f000, ffff88802592f40c) [ 667.1 ---truncated--- CVE-2025-38713 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38713.html CVE-2025-38713 https://bugzilla.suse.com/1249200 SUSE Bug 1249200 https://bugzilla.suse.com/1249738 SUSE Bug 1249738 In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on smcsk after smc_listen_out() BPF CI testing report a UAF issue: [ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] <TASK > [ 16.456989] ? __die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ? exc_page_fault+0x68/0x20 0 [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0 [ 16.458389] ? smc_listen_work+0xc02/0x159 0 [ 16.458689] ? smc_listen_work+0xc02/0x159 0 [ 16.458987] ? lock_is_held_type+0x8f/0x10 0 [ 16.459284] process_one_work+0x1ea/0x6d 0 [ 16.459570] worker_thread+0x1c3/0x38 0 [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? __pfx_kthread+0x10/0x1 0 [ 16.460640] ret_from_fork+0x31/0x5 0 [ 16.460896] ? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590 The direct cause of this issue is that after smc_listen_out_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows: smc_listen_work | userspace ----------------------------------------------------------------- lock_sock(sk) | smc_listen_out_connected() | | \- smc_listen_out | | | \- release_sock | | |- sk->sk_data_ready() | | fd = accept(); | close(fd); | \- socket->sk = NULL; /* newclcsock->sk is NULL now */ SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk)) Since smc_listen_out_connected() will not fail, simply swapping the order of the code can easily fix this issue. CVE-2025-38734 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-38734.html CVE-2025-38734 https://bugzilla.suse.com/1249324 SUSE Bug 1249324 In the Linux kernel, the following vulnerability has been resolved: fs/buffer: fix use-after-free when call bh_read() helper There's issue as follows: BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0xe3/0x110 Read of size 8 at addr ffffc9000168f7f8 by task swapper/3/0 CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.16.0-862.14.0.6.x86_64 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) Call Trace: <IRQ> dump_stack_lvl+0x55/0x70 print_address_description.constprop.0+0x2c/0x390 print_report+0xb4/0x270 kasan_report+0xb8/0xf0 end_buffer_read_sync+0xe3/0x110 end_bio_bh_io_sync+0x56/0x80 blk_update_request+0x30a/0x720 scsi_end_request+0x51/0x2b0 scsi_io_completion+0xe3/0x480 ? scsi_device_unbusy+0x11e/0x160 blk_complete_reqs+0x7b/0x90 handle_softirqs+0xef/0x370 irq_exit_rcu+0xa5/0xd0 sysvec_apic_timer_interrupt+0x6e/0x90 </IRQ> Above issue happens when do ntfs3 filesystem mount, issue may happens as follows: mount IRQ ntfs_fill_super read_cache_page do_read_cache_folio filemap_read_folio mpage_read_folio do_mpage_readpage ntfs_get_block_vbo bh_read submit_bh wait_on_buffer(bh); blk_complete_reqs scsi_io_completion scsi_end_request blk_update_request end_bio_bh_io_sync end_buffer_read_sync __end_buffer_read_notouch unlock_buffer wait_on_buffer(bh);--> return will return to caller put_bh --> trigger stack-out-of-bounds In the mpage_read_folio() function, the stack variable 'map_bh' is passed to ntfs_get_block_vbo(). Once unlock_buffer() unlocks and wait_on_buffer() returns to continue processing, the stack variable is likely to be reclaimed. Consequently, during the end_buffer_read_sync() process, calling put_bh() may result in stack overrun. If the bh is not allocated on the stack, it belongs to a folio. Freeing a buffer head which belongs to a folio is done by drop_buffers() which will fail to free buffers which are still locked. So it is safe to call put_bh() before __end_buffer_read_notouch(). CVE-2025-39691 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39691.html CVE-2025-39691 https://bugzilla.suse.com/1249374 SUSE Bug 1249374 https://bugzilla.suse.com/1249392 SUSE Bug 1249392 In the Linux kernel, the following vulnerability has been resolved: net, hsr: reject HSR frame if skb can't hold tag Receiving HSR frame with insufficient space to hold HSR tag in the skb can result in a crash (kernel BUG): [ 45.390915] skbuff: skb_under_panic: text:ffffffff86f32cac len:26 put:14 head:ffff888042418000 data:ffff888042417ff4 tail:0xe end:0x180 dev:bridge_slave_1 [ 45.392559] ------------[ cut here ]------------ [ 45.392912] kernel BUG at net/core/skbuff.c:211! [ 45.393276] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI [ 45.393809] CPU: 1 UID: 0 PID: 2496 Comm: reproducer Not tainted 6.15.0 #12 PREEMPT(undef) [ 45.394433] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 [ 45.395273] RIP: 0010:skb_panic+0x15b/0x1d0 <snip registers, remove unreliable trace> [ 45.402911] Call Trace: [ 45.403105] <IRQ> [ 45.404470] skb_push+0xcd/0xf0 [ 45.404726] br_dev_queue_push_xmit+0x7c/0x6c0 [ 45.406513] br_forward_finish+0x128/0x260 [ 45.408483] __br_forward+0x42d/0x590 [ 45.409464] maybe_deliver+0x2eb/0x420 [ 45.409763] br_flood+0x174/0x4a0 [ 45.410030] br_handle_frame_finish+0xc7c/0x1bc0 [ 45.411618] br_handle_frame+0xac3/0x1230 [ 45.413674] __netif_receive_skb_core.constprop.0+0x808/0x3df0 [ 45.422966] __netif_receive_skb_one_core+0xb4/0x1f0 [ 45.424478] __netif_receive_skb+0x22/0x170 [ 45.424806] process_backlog+0x242/0x6d0 [ 45.425116] __napi_poll+0xbb/0x630 [ 45.425394] net_rx_action+0x4d1/0xcc0 [ 45.427613] handle_softirqs+0x1a4/0x580 [ 45.427926] do_softirq+0x74/0x90 [ 45.428196] </IRQ> This issue was found by syzkaller. The panic happens in br_dev_queue_push_xmit() once it receives a corrupted skb with ETH header already pushed in linear data. When it attempts the skb_push() call, there's not enough headroom and skb_push() panics. The corrupted skb is put on the queue by HSR layer, which makes a sequence of unintended transformations when it receives a specific corrupted HSR frame (with incomplete TAG). Fix it by dropping and consuming frames that are not long enough to contain both ethernet and hsr headers. Alternative fix would be to check for enough headroom before skb_push() in br_dev_queue_push_xmit(). In the reproducer, this is injected via AF_PACKET, but I don't easily see why it couldn't be sent over the wire from adjacent network. Further Details: In the reproducer, the following network interface chain is set up: ────────────────┐ ────────────────┐ | veth0_to_hsr ├───┤ hsr_slave0 ┼───┐ ────────────────┘ ────────────────┘ | | ──────┐ ├─┤ hsr0 ├───┐ | ──────┘ | ────────────────┐ ────────────────┐ | | ────────┐ | veth1_to_hsr ┼───┤ hsr_slave1 ├───┘ ┤ | ────────────────┘ ────────────────┘ ┼ bridge | || | | ────────┘ | ───────┐ | | ... ├──────┘ ───────┘ To trigger the events leading up to crash, reproducer sends a corrupted HSR fr ---truncated--- CVE-2025-39703 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39703.html CVE-2025-39703 https://bugzilla.suse.com/1249315 SUSE Bug 1249315 In the Linux kernel, the following vulnerability has been resolved: s390/ism: fix concurrency management in ism_cmd() The s390x ISM device data sheet clearly states that only one request-response sequence is allowable per ISM function at any point in time. Unfortunately as of today the s390/ism driver in Linux does not honor that requirement. This patch aims to rectify that. This problem was discovered based on Aliaksei's bug report which states that for certain workloads the ISM functions end up entering error state (with PEC 2 as seen from the logs) after a while and as a consequence connections handled by the respective function break, and for future connection requests the ISM device is not considered -- given it is in a dysfunctional state. During further debugging PEC 3A was observed as well. A kernel message like [ 1211.244319] zpci: 061a:00:00.0: Event 0x2 reports an error for PCI function 0x61a is a reliable indicator of the stated function entering error state with PEC 2. Let me also point out that a kernel message like [ 1211.244325] zpci: 061a:00:00.0: The ism driver bound to the device does not support error recovery is a reliable indicator that the ISM function won't be auto-recovered because the ISM driver currently lacks support for it. On a technical level, without this synchronization, commands (inputs to the FW) may be partially or fully overwritten (corrupted) by another CPU trying to issue commands on the same function. There is hard evidence that this can lead to DMB token values being used as DMB IOVAs, leading to PEC 2 PCI events indicating invalid DMA. But this is only one of the failure modes imaginable. In theory even completely losing one command and executing another one twice and then trying to interpret the outputs as if the command we intended to execute was actually executed and not the other one is also possible. Frankly, I don't feel confident about providing an exhaustive list of possible consequences. CVE-2025-39726 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39726.html CVE-2025-39726 https://bugzilla.suse.com/1249266 SUSE Bug 1249266 In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: shutdown driver when hardware is unreliable In rare cases, ath10k may lose connection with the PCIe bus due to some unknown reasons, which could further lead to system crashes during resuming due to watchdog timeout: ath10k_pci 0000:01:00.0: wmi command 20486 timeout, restarting hardware ath10k_pci 0000:01:00.0: already restarting ath10k_pci 0000:01:00.0: failed to stop WMI vdev 0: -11 ath10k_pci 0000:01:00.0: failed to stop vdev 0: -11 ieee80211 phy0: PM: **** DPM device timeout **** Call Trace: panic+0x125/0x315 dpm_watchdog_set+0x54/0x54 dpm_watchdog_handler+0x57/0x57 call_timer_fn+0x31/0x13c At this point, all WMI commands will timeout and attempt to restart device. So set a threshold for consecutive restart failures. If the threshold is exceeded, consider the hardware is unreliable and all ath10k operations should be skipped to avoid system crash. fail_cont_count and pending_recovery are atomic variables, and do not involve complex conditional logic. Therefore, even if recovery check and reconfig complete are executed concurrently, the recovery mechanism will not be broken. Tested-on: QCA6174 hw3.2 PCI WLAN.RM.4.4.1-00288-QCARMSWPZ-1 CVE-2025-39746 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39746.html CVE-2025-39746 https://bugzilla.suse.com/1249516 SUSE Bug 1249516 https://bugzilla.suse.com/1249517 SUSE Bug 1249517 This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. CVE-2025-39751 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39751.html CVE-2025-39751 https://bugzilla.suse.com/1249538 SUSE Bug 1249538 https://bugzilla.suse.com/1249539 SUSE Bug 1249539 In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a single-element transaction with a read pointer that is multiple elements ahead of the host's read pointer. For instance, if the host accesses an event ring while the device is updating it, the pointer inside of the event might still point to an old TRE. If the host uses the channel's xfer_cb() to directly free the buffer pointed to by the TRE, the buffer will be double-freed. This behavior was observed on an ep that used upstream EP stack without 'commit 6f18d174b73d ("bus: mhi: ep: Update read pointer only after buffer is written")'. Where the device updated the events ring pointer before updating the event contents, so it left a window where the host was able to access the stale data the event pointed to, before the device had the chance to update them. The usual pattern was that the host received an event pointing to a TRE that is not immediately after the last processed one, so it got treated as if it was a chained transaction, processing all of the TREs in between the two read pointers. This commit aims to harden the host by ensuring transactions where the event points to a TRE that isn't local_rp + 1 are chained. [mani: added stable tag and reworded commit message] CVE-2025-39790 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39790.html CVE-2025-39790 https://bugzilla.suse.com/1249548 SUSE Bug 1249548 https://bugzilla.suse.com/1249549 SUSE Bug 1249549 In the Linux kernel, the following vulnerability has been resolved: KVM: x86: use array_index_nospec with indices that come from guest min and dest_id are guest-controlled indices. Using array_index_nospec() after the bounds checks clamps these values to mitigate speculative execution side-channels. CVE-2025-39823 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39823.html CVE-2025-39823 https://bugzilla.suse.com/1250002 SUSE Bug 1250002 In the Linux kernel, the following vulnerability has been resolved: HID: asus: fix UAF via HID_CLAIMED_INPUT validation After hid_hw_start() is called hidinput_connect() will eventually be called to set up the device with the input layer since the HID_CONNECT_DEFAULT connect mask is used. During hidinput_connect() all input and output reports are processed and corresponding hid_inputs are allocated and configured via hidinput_configure_usages(). This process involves slot tagging report fields and configuring usages by setting relevant bits in the capability bitmaps. However it is possible that the capability bitmaps are not set at all leading to the subsequent hidinput_has_been_populated() check to fail leading to the freeing of the hid_input and the underlying input device. This becomes problematic because a malicious HID device like a ASUS ROG N-Key keyboard can trigger the above scenario via a specially crafted descriptor which then leads to a user-after-free when the name of the freed input device is written to later on after hid_hw_start(). Below, report 93 intentionally utilises the HID_UP_UNDEFINED Usage Page which is skipped during usage configuration, leading to the frees. 0x05, 0x0D, // Usage Page (Digitizer) 0x09, 0x05, // Usage (Touch Pad) 0xA1, 0x01, // Collection (Application) 0x85, 0x0D, // Report ID (13) 0x06, 0x00, 0xFF, // Usage Page (Vendor Defined 0xFF00) 0x09, 0xC5, // Usage (0xC5) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x04, // Report Count (4) 0xB1, 0x02, // Feature (Data,Var,Abs) 0x85, 0x5D, // Report ID (93) 0x06, 0x00, 0x00, // Usage Page (Undefined) 0x09, 0x01, // Usage (0x01) 0x15, 0x00, // Logical Minimum (0) 0x26, 0xFF, 0x00, // Logical Maximum (255) 0x75, 0x08, // Report Size (8) 0x95, 0x1B, // Report Count (27) 0x81, 0x02, // Input (Data,Var,Abs) 0xC0, // End Collection Below is the KASAN splat after triggering the UAF: [ 21.672709] ================================================================== [ 21.673700] BUG: KASAN: slab-use-after-free in asus_probe+0xeeb/0xf80 [ 21.673700] Write of size 8 at addr ffff88810a0ac000 by task kworker/1:2/54 [ 21.673700] [ 21.673700] CPU: 1 UID: 0 PID: 54 Comm: kworker/1:2 Not tainted 6.16.0-rc4-g9773391cf4dd-dirty #36 PREEMPT(voluntary) [ 21.673700] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 [ 21.673700] Call Trace: [ 21.673700] <TASK> [ 21.673700] dump_stack_lvl+0x5f/0x80 [ 21.673700] print_report+0xd1/0x660 [ 21.673700] kasan_report+0xe5/0x120 [ 21.673700] __asan_report_store8_noabort+0x1b/0x30 [ 21.673700] asus_probe+0xeeb/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Allocated by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_alloc_info+0x3b/0x50 [ 21.673700] __kasan_kmalloc+0x9c/0xa0 [ 21.673700] __kmalloc_cache_noprof+0x139/0x340 [ 21.673700] input_allocate_device+0x44/0x370 [ 21.673700] hidinput_connect+0xcb6/0x2630 [ 21.673700] hid_connect+0xf74/0x1d60 [ 21.673700] hid_hw_start+0x8c/0x110 [ 21.673700] asus_probe+0x5a3/0xf80 [ 21.673700] hid_device_probe+0x2ee/0x700 [ 21.673700] really_probe+0x1c6/0x6b0 [ 21.673700] __driver_probe_device+0x24f/0x310 [ 21.673700] driver_probe_device+0x4e/0x220 [...] [ 21.673700] [ 21.673700] Freed by task 54: [ 21.673700] kasan_save_stack+0x3d/0x60 [ 21.673700] kasan_save_track+0x18/0x40 [ 21.673700] kasan_save_free_info+0x3f/0x60 [ 21.673700] __kasan_slab_free+0x3c/0x50 [ 21.673700] kfre ---truncated--- CVE-2025-39824 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39824.html CVE-2025-39824 https://bugzilla.suse.com/1250007 SUSE Bug 1250007 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() syzbot reported the splat below without a repro. In the splat, a single thread calling bt_accept_dequeue() freed sk and touched it after that. The root cause would be the racy l2cap_sock_cleanup_listen() call added by the cited commit. bt_accept_dequeue() is called under lock_sock() except for l2cap_sock_release(). Two threads could see the same socket during the list iteration in bt_accept_dequeue(): CPU1 CPU2 (close()) ---- ---- sock_hold(sk) sock_hold(sk); lock_sock(sk) <-- block close() sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- refcnt by bt_accept_enqueue() release_sock(sk) lock_sock(sk) sock_put(sk) bt_accept_unlink(sk) sock_put(sk) <-- last refcnt bt_accept_unlink(sk) <-- UAF Depending on the timing, the other thread could show up in the "Freed by task" part. Let's call l2cap_sock_cleanup_listen() under lock_sock() in l2cap_sock_release(). [0]: BUG: KASAN: slab-use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 Read of size 4 at addr ffff88803b7eb1c4 by task syz.5.3276/16995 CPU: 3 UID: 0 PID: 16995 Comm: syz.5.3276 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xcd/0x630 mm/kasan/report.c:482 kasan_report+0xe0/0x110 mm/kasan/report.c:595 debug_spin_lock_before kernel/locking/spinlock_debug.c:86 [inline] do_raw_spin_lock+0x26f/0x2b0 kernel/locking/spinlock_debug.c:115 spin_lock_bh include/linux/spinlock.h:356 [inline] release_sock+0x21/0x220 net/core/sock.c:3746 bt_accept_dequeue+0x505/0x600 net/bluetooth/af_bluetooth.c:312 l2cap_sock_cleanup_listen+0x5c/0x2a0 net/bluetooth/l2cap_sock.c:1451 l2cap_sock_release+0x5c/0x210 net/bluetooth/l2cap_sock.c:1425 __sock_release+0xb3/0x270 net/socket.c:649 sock_close+0x1c/0x30 net/socket.c:1439 __fput+0x3ff/0xb70 fs/file_table.c:468 task_work_run+0x14d/0x240 kernel/task_work.c:227 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop+0xeb/0x110 kernel/entry/common.c:43 exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline] do_syscall_64+0x3f6/0x4c0 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2accf8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffdb6cb1378 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00000000000426fb RCX: 00007f2accf8ebe9 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 00007f2acd1b7da0 R08: 0000000000000001 R09: 00000012b6cb166f R10: 0000001b30e20000 R11: 0000000000000246 R12: 00007f2acd1b609c R13: 00007f2acd1b6090 R14: ffffffffffffffff R15: 00007ffdb6cb1490 </TASK> Allocated by task 5326: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4365 [inline] __kmalloc_nopro ---truncated--- CVE-2025-39860 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39860.html CVE-2025-39860 https://bugzilla.suse.com/1250247 SUSE Bug 1250247 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Fix memory allocation size for queue_priority_map Fix a critical memory allocation bug in edma_setup_from_hw() where queue_priority_map was allocated with insufficient memory. The code declared queue_priority_map as s8 (*)[2] (pointer to array of 2 s8), but allocated memory using sizeof(s8) instead of the correct size. This caused out-of-bounds memory writes when accessing: queue_priority_map[i][0] = i; queue_priority_map[i][1] = i; The bug manifested as kernel crashes with "Oops - undefined instruction" on ARM platforms (BeagleBoard-X15) during EDMA driver probe, as the memory corruption triggered kernel hardening features on Clang. Change the allocation to use sizeof(*queue_priority_map) which automatically gets the correct size for the 2D array structure. CVE-2025-39869 Container suse/sle-micro/rt-5.5:latest:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-devel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-rt-5.14.21-150500.13.109.1 SUSE Linux Enterprise Micro 5.5:kernel-source-rt-5.14.21-150500.13.109.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2025/suse-su-20253761-1/ https://www.suse.com/security/cve/CVE-2025-39869.html CVE-2025-39869 https://bugzilla.suse.com/1250406 SUSE Bug 1250406