Security update for the Linux Kernel SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2026:0411-1 Final 1 1 2026-02-09T14:51:43Z current 2026-02-09T14:51:43Z 2026-02-09T14:51:43Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for the Linux Kernel The SUSE Linux Enterprise 15 SP4 RT kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785). - CVE-2022-50697: mrp: introduce active flags to prevent UAF when applicant uninit (bsc#1255594). - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576). - CVE-2023-53215: sched/fair: Don't balance task to its current running CPU (bsc#1250397). - CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871). - CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751). - CVE-2023-54142: gtp: Fix use-after-free in __gtp_encap_destroy() (bsc#1256095). - CVE-2023-54243: netfilter: ebtables: fix table blob use-after-free (bsc#1255908). - CVE-2024-28956: x86/its: Enumerate Indirect Target Selection (ITS) bug (bsc#1242006). - CVE-2024-36348: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896). - CVE-2024-36349: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896). - CVE-2024-36350: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896). - CVE-2024-36357: x86/bugs: Add a Transient Scheduler Attacks mitigation (bsc#1238896). - CVE-2024-44987: ipv6: prevent UAF in ip6_send_skb() (bsc#1230185). - CVE-2025-38068: crypto: lzo - Fix compression buffer overrun (bsc#1245210). - CVE-2025-38129: page_pool: fix inconsistency for page_pool_ring_lock() (bsc#1245723). - CVE-2025-38159: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (bsc#1245751). - CVE-2025-38375: virtio-net: ensure the received length does not exceed allocated size (bsc#1247177). - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046). - CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678). - CVE-2025-40139: net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (bsc#1253409). - CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959). - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520). - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813). - CVE-2025-40257: mptcp: fix a race in mptcp_pm_del_add_timer() (bsc#1254842). - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843). - CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894). - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847). - CVE-2025-40300: Documentation/hw-vuln: Add VMSCAPE documentation (bsc#1247483). - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615). - CVE-2025-68183: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (bsc#1255251). - CVE-2025-68284: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() (bsc#1255377). - CVE-2025-68285: libceph: fix potential use-after-free in have_mon_and_osd_map() (bsc#1255401). - CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688). - CVE-2025-68771: ocfs2: fix kernel BUG in ocfs2_find_victim_chain (bsc#1256582). - CVE-2025-68813: ipvs: fix ipv4 null-ptr-deref in route error path (bsc#1256641). - CVE-2025-71089: iommu: disable SVA when CONFIG_X86 is set (bsc#1256612). - CVE-2025-71116: libceph: make decode_pool() more resilient against corrupted osdmaps (bsc#1256744). - CVE-2025-71120: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf (bsc#1256779). The following non security issues were fixed: - x86/CPU/AMD: Add ZenX generations flags (bsc#1238896). - x86: make page fault handling disable interrupts properly (git-fixes). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2026-411,SUSE-SLE-Micro-5.3-2026-411,SUSE-SLE-Micro-5.4-2026-411 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ Link for SUSE-SU-2026:0411-1 https://lists.suse.com/pipermail/sle-security-updates/2026-February/024085.html E-Mail link for SUSE-SU-2026:0411-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1065729 SUSE Bug 1065729 https://bugzilla.suse.com/1193629 SUSE Bug 1193629 https://bugzilla.suse.com/1194869 SUSE Bug 1194869 https://bugzilla.suse.com/1196823 SUSE Bug 1196823 https://bugzilla.suse.com/1204957 SUSE Bug 1204957 https://bugzilla.suse.com/1205567 SUSE Bug 1205567 https://bugzilla.suse.com/1206889 SUSE Bug 1206889 https://bugzilla.suse.com/1207051 SUSE Bug 1207051 https://bugzilla.suse.com/1207088 SUSE Bug 1207088 https://bugzilla.suse.com/1207611 SUSE Bug 1207611 https://bugzilla.suse.com/1207620 SUSE Bug 1207620 https://bugzilla.suse.com/1207622 SUSE Bug 1207622 https://bugzilla.suse.com/1207636 SUSE Bug 1207636 https://bugzilla.suse.com/1207644 SUSE Bug 1207644 https://bugzilla.suse.com/1207646 SUSE Bug 1207646 https://bugzilla.suse.com/1207652 SUSE Bug 1207652 https://bugzilla.suse.com/1207653 SUSE Bug 1207653 https://bugzilla.suse.com/1208570 SUSE Bug 1208570 https://bugzilla.suse.com/1208758 SUSE Bug 1208758 https://bugzilla.suse.com/1209799 SUSE Bug 1209799 https://bugzilla.suse.com/1210817 SUSE Bug 1210817 https://bugzilla.suse.com/1210943 SUSE Bug 1210943 https://bugzilla.suse.com/1211690 SUSE Bug 1211690 https://bugzilla.suse.com/1213025 SUSE Bug 1213025 https://bugzilla.suse.com/1213032 SUSE Bug 1213032 https://bugzilla.suse.com/1213093 SUSE Bug 1213093 https://bugzilla.suse.com/1213105 SUSE Bug 1213105 https://bugzilla.suse.com/1213110 SUSE Bug 1213110 https://bugzilla.suse.com/1213111 SUSE Bug 1213111 https://bugzilla.suse.com/1213653 SUSE Bug 1213653 https://bugzilla.suse.com/1213747 SUSE Bug 1213747 https://bugzilla.suse.com/1213867 SUSE Bug 1213867 https://bugzilla.suse.com/1214635 SUSE Bug 1214635 https://bugzilla.suse.com/1214940 SUSE Bug 1214940 https://bugzilla.suse.com/1214962 SUSE Bug 1214962 https://bugzilla.suse.com/1214986 SUSE Bug 1214986 https://bugzilla.suse.com/1214990 SUSE Bug 1214990 https://bugzilla.suse.com/1216062 SUSE Bug 1216062 https://bugzilla.suse.com/1228015 SUSE Bug 1228015 https://bugzilla.suse.com/1230185 SUSE Bug 1230185 https://bugzilla.suse.com/1238896 SUSE Bug 1238896 https://bugzilla.suse.com/1242006 SUSE Bug 1242006 https://bugzilla.suse.com/1245210 SUSE Bug 1245210 https://bugzilla.suse.com/1245723 SUSE Bug 1245723 https://bugzilla.suse.com/1245751 SUSE Bug 1245751 https://bugzilla.suse.com/1247177 SUSE Bug 1247177 https://bugzilla.suse.com/1247483 SUSE Bug 1247483 https://bugzilla.suse.com/1249871 SUSE Bug 1249871 https://bugzilla.suse.com/1250397 SUSE Bug 1250397 https://bugzilla.suse.com/1252046 SUSE Bug 1252046 https://bugzilla.suse.com/1252678 SUSE Bug 1252678 https://bugzilla.suse.com/1253409 SUSE Bug 1253409 https://bugzilla.suse.com/1253702 SUSE Bug 1253702 https://bugzilla.suse.com/1254520 SUSE Bug 1254520 https://bugzilla.suse.com/1254559 SUSE Bug 1254559 https://bugzilla.suse.com/1254562 SUSE Bug 1254562 https://bugzilla.suse.com/1254572 SUSE Bug 1254572 https://bugzilla.suse.com/1254578 SUSE Bug 1254578 https://bugzilla.suse.com/1254580 SUSE Bug 1254580 https://bugzilla.suse.com/1254592 SUSE Bug 1254592 https://bugzilla.suse.com/1254608 SUSE Bug 1254608 https://bugzilla.suse.com/1254609 SUSE Bug 1254609 https://bugzilla.suse.com/1254614 SUSE Bug 1254614 https://bugzilla.suse.com/1254615 SUSE Bug 1254615 https://bugzilla.suse.com/1254617 SUSE Bug 1254617 https://bugzilla.suse.com/1254625 SUSE Bug 1254625 https://bugzilla.suse.com/1254631 SUSE Bug 1254631 https://bugzilla.suse.com/1254632 SUSE Bug 1254632 https://bugzilla.suse.com/1254634 SUSE Bug 1254634 https://bugzilla.suse.com/1254644 SUSE Bug 1254644 https://bugzilla.suse.com/1254645 SUSE Bug 1254645 https://bugzilla.suse.com/1254649 SUSE Bug 1254649 https://bugzilla.suse.com/1254653 SUSE Bug 1254653 https://bugzilla.suse.com/1254656 SUSE Bug 1254656 https://bugzilla.suse.com/1254658 SUSE Bug 1254658 https://bugzilla.suse.com/1254660 SUSE Bug 1254660 https://bugzilla.suse.com/1254664 SUSE Bug 1254664 https://bugzilla.suse.com/1254671 SUSE Bug 1254671 https://bugzilla.suse.com/1254674 SUSE Bug 1254674 https://bugzilla.suse.com/1254676 SUSE Bug 1254676 https://bugzilla.suse.com/1254677 SUSE Bug 1254677 https://bugzilla.suse.com/1254686 SUSE Bug 1254686 https://bugzilla.suse.com/1254690 SUSE Bug 1254690 https://bugzilla.suse.com/1254692 SUSE Bug 1254692 https://bugzilla.suse.com/1254694 SUSE Bug 1254694 https://bugzilla.suse.com/1254696 SUSE Bug 1254696 https://bugzilla.suse.com/1254698 SUSE Bug 1254698 https://bugzilla.suse.com/1254699 SUSE Bug 1254699 https://bugzilla.suse.com/1254704 SUSE Bug 1254704 https://bugzilla.suse.com/1254706 SUSE Bug 1254706 https://bugzilla.suse.com/1254709 SUSE Bug 1254709 https://bugzilla.suse.com/1254710 SUSE Bug 1254710 https://bugzilla.suse.com/1254711 SUSE Bug 1254711 https://bugzilla.suse.com/1254712 SUSE Bug 1254712 https://bugzilla.suse.com/1254713 SUSE Bug 1254713 https://bugzilla.suse.com/1254714 SUSE Bug 1254714 https://bugzilla.suse.com/1254716 SUSE Bug 1254716 https://bugzilla.suse.com/1254723 SUSE Bug 1254723 https://bugzilla.suse.com/1254725 SUSE Bug 1254725 https://bugzilla.suse.com/1254728 SUSE Bug 1254728 https://bugzilla.suse.com/1254729 SUSE Bug 1254729 https://bugzilla.suse.com/1254743 SUSE Bug 1254743 https://bugzilla.suse.com/1254745 SUSE Bug 1254745 https://bugzilla.suse.com/1254751 SUSE Bug 1254751 https://bugzilla.suse.com/1254756 SUSE Bug 1254756 https://bugzilla.suse.com/1254759 SUSE Bug 1254759 https://bugzilla.suse.com/1254763 SUSE Bug 1254763 https://bugzilla.suse.com/1254775 SUSE Bug 1254775 https://bugzilla.suse.com/1254780 SUSE Bug 1254780 https://bugzilla.suse.com/1254781 SUSE Bug 1254781 https://bugzilla.suse.com/1254782 SUSE Bug 1254782 https://bugzilla.suse.com/1254783 SUSE Bug 1254783 https://bugzilla.suse.com/1254785 SUSE Bug 1254785 https://bugzilla.suse.com/1254788 SUSE Bug 1254788 https://bugzilla.suse.com/1254789 SUSE Bug 1254789 https://bugzilla.suse.com/1254792 SUSE Bug 1254792 https://bugzilla.suse.com/1254813 SUSE Bug 1254813 https://bugzilla.suse.com/1254842 SUSE Bug 1254842 https://bugzilla.suse.com/1254843 SUSE Bug 1254843 https://bugzilla.suse.com/1254847 SUSE Bug 1254847 https://bugzilla.suse.com/1254851 SUSE Bug 1254851 https://bugzilla.suse.com/1254894 SUSE Bug 1254894 https://bugzilla.suse.com/1254902 SUSE Bug 1254902 https://bugzilla.suse.com/1254915 SUSE Bug 1254915 https://bugzilla.suse.com/1254916 SUSE Bug 1254916 https://bugzilla.suse.com/1254917 SUSE Bug 1254917 https://bugzilla.suse.com/1254920 SUSE Bug 1254920 https://bugzilla.suse.com/1254959 SUSE Bug 1254959 https://bugzilla.suse.com/1254974 SUSE Bug 1254974 https://bugzilla.suse.com/1254986 SUSE Bug 1254986 https://bugzilla.suse.com/1254994 SUSE Bug 1254994 https://bugzilla.suse.com/1255002 SUSE Bug 1255002 https://bugzilla.suse.com/1255005 SUSE Bug 1255005 https://bugzilla.suse.com/1255007 SUSE Bug 1255007 https://bugzilla.suse.com/1255049 SUSE Bug 1255049 https://bugzilla.suse.com/1255060 SUSE Bug 1255060 https://bugzilla.suse.com/1255163 SUSE Bug 1255163 https://bugzilla.suse.com/1255165 SUSE Bug 1255165 https://bugzilla.suse.com/1255251 SUSE Bug 1255251 https://bugzilla.suse.com/1255377 SUSE Bug 1255377 https://bugzilla.suse.com/1255401 SUSE Bug 1255401 https://bugzilla.suse.com/1255467 SUSE Bug 1255467 https://bugzilla.suse.com/1255469 SUSE Bug 1255469 https://bugzilla.suse.com/1255521 SUSE Bug 1255521 https://bugzilla.suse.com/1255528 SUSE Bug 1255528 https://bugzilla.suse.com/1255546 SUSE Bug 1255546 https://bugzilla.suse.com/1255549 SUSE Bug 1255549 https://bugzilla.suse.com/1255554 SUSE Bug 1255554 https://bugzilla.suse.com/1255555 SUSE Bug 1255555 https://bugzilla.suse.com/1255558 SUSE Bug 1255558 https://bugzilla.suse.com/1255560 SUSE Bug 1255560 https://bugzilla.suse.com/1255562 SUSE Bug 1255562 https://bugzilla.suse.com/1255565 SUSE Bug 1255565 https://bugzilla.suse.com/1255574 SUSE Bug 1255574 https://bugzilla.suse.com/1255576 SUSE Bug 1255576 https://bugzilla.suse.com/1255578 SUSE Bug 1255578 https://bugzilla.suse.com/1255582 SUSE Bug 1255582 https://bugzilla.suse.com/1255594 SUSE Bug 1255594 https://bugzilla.suse.com/1255600 SUSE Bug 1255600 https://bugzilla.suse.com/1255607 SUSE Bug 1255607 https://bugzilla.suse.com/1255608 SUSE Bug 1255608 https://bugzilla.suse.com/1255609 SUSE Bug 1255609 https://bugzilla.suse.com/1255618 SUSE Bug 1255618 https://bugzilla.suse.com/1255619 SUSE Bug 1255619 https://bugzilla.suse.com/1255620 SUSE Bug 1255620 https://bugzilla.suse.com/1255623 SUSE Bug 1255623 https://bugzilla.suse.com/1255624 SUSE Bug 1255624 https://bugzilla.suse.com/1255626 SUSE Bug 1255626 https://bugzilla.suse.com/1255627 SUSE Bug 1255627 https://bugzilla.suse.com/1255628 SUSE Bug 1255628 https://bugzilla.suse.com/1255636 SUSE Bug 1255636 https://bugzilla.suse.com/1255688 SUSE Bug 1255688 https://bugzilla.suse.com/1255690 SUSE Bug 1255690 https://bugzilla.suse.com/1255697 SUSE Bug 1255697 https://bugzilla.suse.com/1255702 SUSE Bug 1255702 https://bugzilla.suse.com/1255704 SUSE Bug 1255704 https://bugzilla.suse.com/1255749 SUSE Bug 1255749 https://bugzilla.suse.com/1255750 SUSE Bug 1255750 https://bugzilla.suse.com/1255757 SUSE Bug 1255757 https://bugzilla.suse.com/1255758 SUSE Bug 1255758 https://bugzilla.suse.com/1255760 SUSE Bug 1255760 https://bugzilla.suse.com/1255762 SUSE Bug 1255762 https://bugzilla.suse.com/1255769 SUSE Bug 1255769 https://bugzilla.suse.com/1255771 SUSE Bug 1255771 https://bugzilla.suse.com/1255773 SUSE Bug 1255773 https://bugzilla.suse.com/1255780 SUSE Bug 1255780 https://bugzilla.suse.com/1255786 SUSE Bug 1255786 https://bugzilla.suse.com/1255787 SUSE Bug 1255787 https://bugzilla.suse.com/1255789 SUSE Bug 1255789 https://bugzilla.suse.com/1255790 SUSE Bug 1255790 https://bugzilla.suse.com/1255791 SUSE Bug 1255791 https://bugzilla.suse.com/1255792 SUSE Bug 1255792 https://bugzilla.suse.com/1255796 SUSE Bug 1255796 https://bugzilla.suse.com/1255797 SUSE Bug 1255797 https://bugzilla.suse.com/1255800 SUSE Bug 1255800 https://bugzilla.suse.com/1255801 SUSE Bug 1255801 https://bugzilla.suse.com/1255802 SUSE Bug 1255802 https://bugzilla.suse.com/1255803 SUSE Bug 1255803 https://bugzilla.suse.com/1255804 SUSE Bug 1255804 https://bugzilla.suse.com/1255806 SUSE Bug 1255806 https://bugzilla.suse.com/1255808 SUSE Bug 1255808 https://bugzilla.suse.com/1255819 SUSE Bug 1255819 https://bugzilla.suse.com/1255839 SUSE Bug 1255839 https://bugzilla.suse.com/1255843 SUSE Bug 1255843 https://bugzilla.suse.com/1255844 SUSE Bug 1255844 https://bugzilla.suse.com/1255872 SUSE Bug 1255872 https://bugzilla.suse.com/1255875 SUSE Bug 1255875 https://bugzilla.suse.com/1255876 SUSE Bug 1255876 https://bugzilla.suse.com/1255877 SUSE Bug 1255877 https://bugzilla.suse.com/1255878 SUSE Bug 1255878 https://bugzilla.suse.com/1255880 SUSE Bug 1255880 https://bugzilla.suse.com/1255889 SUSE Bug 1255889 https://bugzilla.suse.com/1255901 SUSE Bug 1255901 https://bugzilla.suse.com/1255902 SUSE Bug 1255902 https://bugzilla.suse.com/1255905 SUSE Bug 1255905 https://bugzilla.suse.com/1255906 SUSE Bug 1255906 https://bugzilla.suse.com/1255908 SUSE Bug 1255908 https://bugzilla.suse.com/1255909 SUSE Bug 1255909 https://bugzilla.suse.com/1255910 SUSE Bug 1255910 https://bugzilla.suse.com/1255912 SUSE Bug 1255912 https://bugzilla.suse.com/1255919 SUSE Bug 1255919 https://bugzilla.suse.com/1255922 SUSE Bug 1255922 https://bugzilla.suse.com/1255925 SUSE Bug 1255925 https://bugzilla.suse.com/1255939 SUSE Bug 1255939 https://bugzilla.suse.com/1255950 SUSE Bug 1255950 https://bugzilla.suse.com/1255953 SUSE Bug 1255953 https://bugzilla.suse.com/1255954 SUSE Bug 1255954 https://bugzilla.suse.com/1255962 SUSE Bug 1255962 https://bugzilla.suse.com/1255964 SUSE Bug 1255964 https://bugzilla.suse.com/1255968 SUSE Bug 1255968 https://bugzilla.suse.com/1255969 SUSE Bug 1255969 https://bugzilla.suse.com/1255970 SUSE Bug 1255970 https://bugzilla.suse.com/1255971 SUSE Bug 1255971 https://bugzilla.suse.com/1255978 SUSE Bug 1255978 https://bugzilla.suse.com/1255979 SUSE Bug 1255979 https://bugzilla.suse.com/1255983 SUSE Bug 1255983 https://bugzilla.suse.com/1255985 SUSE Bug 1255985 https://bugzilla.suse.com/1255990 SUSE Bug 1255990 https://bugzilla.suse.com/1255993 SUSE Bug 1255993 https://bugzilla.suse.com/1255994 SUSE Bug 1255994 https://bugzilla.suse.com/1255996 SUSE Bug 1255996 https://bugzilla.suse.com/1256034 SUSE Bug 1256034 https://bugzilla.suse.com/1256040 SUSE Bug 1256040 https://bugzilla.suse.com/1256042 SUSE Bug 1256042 https://bugzilla.suse.com/1256045 SUSE Bug 1256045 https://bugzilla.suse.com/1256046 SUSE Bug 1256046 https://bugzilla.suse.com/1256048 SUSE Bug 1256048 https://bugzilla.suse.com/1256049 SUSE Bug 1256049 https://bugzilla.suse.com/1256053 SUSE Bug 1256053 https://bugzilla.suse.com/1256056 SUSE Bug 1256056 https://bugzilla.suse.com/1256057 SUSE Bug 1256057 https://bugzilla.suse.com/1256062 SUSE Bug 1256062 https://bugzilla.suse.com/1256063 SUSE Bug 1256063 https://bugzilla.suse.com/1256064 SUSE Bug 1256064 https://bugzilla.suse.com/1256065 SUSE Bug 1256065 https://bugzilla.suse.com/1256074 SUSE Bug 1256074 https://bugzilla.suse.com/1256081 SUSE Bug 1256081 https://bugzilla.suse.com/1256086 SUSE Bug 1256086 https://bugzilla.suse.com/1256091 SUSE Bug 1256091 https://bugzilla.suse.com/1256093 SUSE Bug 1256093 https://bugzilla.suse.com/1256095 SUSE Bug 1256095 https://bugzilla.suse.com/1256099 SUSE Bug 1256099 https://bugzilla.suse.com/1256114 SUSE Bug 1256114 https://bugzilla.suse.com/1256115 SUSE Bug 1256115 https://bugzilla.suse.com/1256118 SUSE Bug 1256118 https://bugzilla.suse.com/1256119 SUSE Bug 1256119 https://bugzilla.suse.com/1256121 SUSE Bug 1256121 https://bugzilla.suse.com/1256122 SUSE Bug 1256122 https://bugzilla.suse.com/1256124 SUSE Bug 1256124 https://bugzilla.suse.com/1256125 SUSE Bug 1256125 https://bugzilla.suse.com/1256126 SUSE Bug 1256126 https://bugzilla.suse.com/1256127 SUSE Bug 1256127 https://bugzilla.suse.com/1256130 SUSE Bug 1256130 https://bugzilla.suse.com/1256131 SUSE Bug 1256131 https://bugzilla.suse.com/1256132 SUSE Bug 1256132 https://bugzilla.suse.com/1256133 SUSE Bug 1256133 https://bugzilla.suse.com/1256136 SUSE Bug 1256136 https://bugzilla.suse.com/1256137 SUSE Bug 1256137 https://bugzilla.suse.com/1256140 SUSE Bug 1256140 https://bugzilla.suse.com/1256141 SUSE Bug 1256141 https://bugzilla.suse.com/1256142 SUSE Bug 1256142 https://bugzilla.suse.com/1256143 SUSE Bug 1256143 https://bugzilla.suse.com/1256145 SUSE Bug 1256145 https://bugzilla.suse.com/1256149 SUSE Bug 1256149 https://bugzilla.suse.com/1256152 SUSE Bug 1256152 https://bugzilla.suse.com/1256154 SUSE Bug 1256154 https://bugzilla.suse.com/1256155 SUSE Bug 1256155 https://bugzilla.suse.com/1256157 SUSE Bug 1256157 https://bugzilla.suse.com/1256158 SUSE Bug 1256158 https://bugzilla.suse.com/1256162 SUSE Bug 1256162 https://bugzilla.suse.com/1256165 SUSE Bug 1256165 https://bugzilla.suse.com/1256167 SUSE Bug 1256167 https://bugzilla.suse.com/1256172 SUSE Bug 1256172 https://bugzilla.suse.com/1256173 SUSE Bug 1256173 https://bugzilla.suse.com/1256174 SUSE Bug 1256174 https://bugzilla.suse.com/1256177 SUSE Bug 1256177 https://bugzilla.suse.com/1256178 SUSE Bug 1256178 https://bugzilla.suse.com/1256179 SUSE Bug 1256179 https://bugzilla.suse.com/1256182 SUSE Bug 1256182 https://bugzilla.suse.com/1256184 SUSE Bug 1256184 https://bugzilla.suse.com/1256185 SUSE Bug 1256185 https://bugzilla.suse.com/1256186 SUSE Bug 1256186 https://bugzilla.suse.com/1256188 SUSE Bug 1256188 https://bugzilla.suse.com/1256189 SUSE Bug 1256189 https://bugzilla.suse.com/1256191 SUSE Bug 1256191 https://bugzilla.suse.com/1256192 SUSE Bug 1256192 https://bugzilla.suse.com/1256193 SUSE Bug 1256193 https://bugzilla.suse.com/1256194 SUSE Bug 1256194 https://bugzilla.suse.com/1256196 SUSE Bug 1256196 https://bugzilla.suse.com/1256199 SUSE Bug 1256199 https://bugzilla.suse.com/1256200 SUSE Bug 1256200 https://bugzilla.suse.com/1256202 SUSE Bug 1256202 https://bugzilla.suse.com/1256203 SUSE Bug 1256203 https://bugzilla.suse.com/1256204 SUSE Bug 1256204 https://bugzilla.suse.com/1256205 SUSE Bug 1256205 https://bugzilla.suse.com/1256206 SUSE Bug 1256206 https://bugzilla.suse.com/1256207 SUSE Bug 1256207 https://bugzilla.suse.com/1256208 SUSE Bug 1256208 https://bugzilla.suse.com/1256211 SUSE Bug 1256211 https://bugzilla.suse.com/1256215 SUSE Bug 1256215 https://bugzilla.suse.com/1256216 SUSE Bug 1256216 https://bugzilla.suse.com/1256219 SUSE Bug 1256219 https://bugzilla.suse.com/1256220 SUSE Bug 1256220 https://bugzilla.suse.com/1256221 SUSE Bug 1256221 https://bugzilla.suse.com/1256223 SUSE Bug 1256223 https://bugzilla.suse.com/1256228 SUSE Bug 1256228 https://bugzilla.suse.com/1256230 SUSE Bug 1256230 https://bugzilla.suse.com/1256231 SUSE Bug 1256231 https://bugzilla.suse.com/1256235 SUSE Bug 1256235 https://bugzilla.suse.com/1256241 SUSE Bug 1256241 https://bugzilla.suse.com/1256242 SUSE Bug 1256242 https://bugzilla.suse.com/1256245 SUSE Bug 1256245 https://bugzilla.suse.com/1256248 SUSE Bug 1256248 https://bugzilla.suse.com/1256250 SUSE Bug 1256250 https://bugzilla.suse.com/1256254 SUSE Bug 1256254 https://bugzilla.suse.com/1256260 SUSE Bug 1256260 https://bugzilla.suse.com/1256265 SUSE Bug 1256265 https://bugzilla.suse.com/1256269 SUSE Bug 1256269 https://bugzilla.suse.com/1256271 SUSE Bug 1256271 https://bugzilla.suse.com/1256274 SUSE Bug 1256274 https://bugzilla.suse.com/1256282 SUSE Bug 1256282 https://bugzilla.suse.com/1256285 SUSE Bug 1256285 https://bugzilla.suse.com/1256291 SUSE Bug 1256291 https://bugzilla.suse.com/1256295 SUSE Bug 1256295 https://bugzilla.suse.com/1256300 SUSE Bug 1256300 https://bugzilla.suse.com/1256306 SUSE Bug 1256306 https://bugzilla.suse.com/1256317 SUSE Bug 1256317 https://bugzilla.suse.com/1256320 SUSE Bug 1256320 https://bugzilla.suse.com/1256323 SUSE Bug 1256323 https://bugzilla.suse.com/1256326 SUSE Bug 1256326 https://bugzilla.suse.com/1256328 SUSE Bug 1256328 https://bugzilla.suse.com/1256333 SUSE Bug 1256333 https://bugzilla.suse.com/1256334 SUSE Bug 1256334 https://bugzilla.suse.com/1256335 SUSE Bug 1256335 https://bugzilla.suse.com/1256337 SUSE Bug 1256337 https://bugzilla.suse.com/1256338 SUSE Bug 1256338 https://bugzilla.suse.com/1256344 SUSE Bug 1256344 https://bugzilla.suse.com/1256346 SUSE Bug 1256346 https://bugzilla.suse.com/1256349 SUSE Bug 1256349 https://bugzilla.suse.com/1256353 SUSE Bug 1256353 https://bugzilla.suse.com/1256355 SUSE Bug 1256355 https://bugzilla.suse.com/1256368 SUSE Bug 1256368 https://bugzilla.suse.com/1256370 SUSE Bug 1256370 https://bugzilla.suse.com/1256375 SUSE Bug 1256375 https://bugzilla.suse.com/1256382 SUSE Bug 1256382 https://bugzilla.suse.com/1256383 SUSE Bug 1256383 https://bugzilla.suse.com/1256384 SUSE Bug 1256384 https://bugzilla.suse.com/1256386 SUSE Bug 1256386 https://bugzilla.suse.com/1256388 SUSE Bug 1256388 https://bugzilla.suse.com/1256391 SUSE Bug 1256391 https://bugzilla.suse.com/1256394 SUSE Bug 1256394 https://bugzilla.suse.com/1256395 SUSE Bug 1256395 https://bugzilla.suse.com/1256396 SUSE Bug 1256396 https://bugzilla.suse.com/1256397 SUSE Bug 1256397 https://bugzilla.suse.com/1256423 SUSE Bug 1256423 https://bugzilla.suse.com/1256426 SUSE Bug 1256426 https://bugzilla.suse.com/1256432 SUSE Bug 1256432 https://bugzilla.suse.com/1256582 SUSE Bug 1256582 https://bugzilla.suse.com/1256612 SUSE Bug 1256612 https://bugzilla.suse.com/1256641 SUSE Bug 1256641 https://bugzilla.suse.com/1256744 SUSE Bug 1256744 https://bugzilla.suse.com/1256779 SUSE Bug 1256779 https://www.suse.com/security/cve/CVE-2022-0854/ SUSE CVE CVE-2022-0854 page https://www.suse.com/security/cve/CVE-2022-48853/ SUSE CVE CVE-2022-48853 page https://www.suse.com/security/cve/CVE-2022-50614/ SUSE CVE CVE-2022-50614 page https://www.suse.com/security/cve/CVE-2022-50615/ SUSE CVE CVE-2022-50615 page https://www.suse.com/security/cve/CVE-2022-50617/ SUSE CVE CVE-2022-50617 page https://www.suse.com/security/cve/CVE-2022-50618/ SUSE CVE CVE-2022-50618 page https://www.suse.com/security/cve/CVE-2022-50619/ SUSE CVE CVE-2022-50619 page https://www.suse.com/security/cve/CVE-2022-50622/ SUSE CVE CVE-2022-50622 page https://www.suse.com/security/cve/CVE-2022-50623/ SUSE CVE CVE-2022-50623 page https://www.suse.com/security/cve/CVE-2022-50625/ SUSE CVE CVE-2022-50625 page https://www.suse.com/security/cve/CVE-2022-50626/ SUSE CVE CVE-2022-50626 page https://www.suse.com/security/cve/CVE-2022-50629/ SUSE CVE CVE-2022-50629 page https://www.suse.com/security/cve/CVE-2022-50630/ SUSE CVE CVE-2022-50630 page https://www.suse.com/security/cve/CVE-2022-50633/ SUSE CVE CVE-2022-50633 page https://www.suse.com/security/cve/CVE-2022-50635/ SUSE CVE CVE-2022-50635 page https://www.suse.com/security/cve/CVE-2022-50636/ SUSE CVE CVE-2022-50636 page https://www.suse.com/security/cve/CVE-2022-50638/ SUSE CVE CVE-2022-50638 page https://www.suse.com/security/cve/CVE-2022-50640/ SUSE CVE CVE-2022-50640 page https://www.suse.com/security/cve/CVE-2022-50641/ SUSE CVE CVE-2022-50641 page https://www.suse.com/security/cve/CVE-2022-50643/ SUSE CVE CVE-2022-50643 page https://www.suse.com/security/cve/CVE-2022-50644/ SUSE CVE CVE-2022-50644 page https://www.suse.com/security/cve/CVE-2022-50646/ SUSE CVE CVE-2022-50646 page https://www.suse.com/security/cve/CVE-2022-50649/ SUSE CVE CVE-2022-50649 page https://www.suse.com/security/cve/CVE-2022-50652/ SUSE CVE CVE-2022-50652 page https://www.suse.com/security/cve/CVE-2022-50653/ SUSE CVE CVE-2022-50653 page https://www.suse.com/security/cve/CVE-2022-50656/ SUSE CVE CVE-2022-50656 page https://www.suse.com/security/cve/CVE-2022-50658/ SUSE CVE CVE-2022-50658 page https://www.suse.com/security/cve/CVE-2022-50660/ SUSE CVE CVE-2022-50660 page https://www.suse.com/security/cve/CVE-2022-50661/ SUSE CVE CVE-2022-50661 page https://www.suse.com/security/cve/CVE-2022-50662/ SUSE CVE CVE-2022-50662 page https://www.suse.com/security/cve/CVE-2022-50664/ SUSE CVE CVE-2022-50664 page https://www.suse.com/security/cve/CVE-2022-50666/ SUSE CVE CVE-2022-50666 page https://www.suse.com/security/cve/CVE-2022-50668/ SUSE CVE CVE-2022-50668 page https://www.suse.com/security/cve/CVE-2022-50669/ SUSE CVE CVE-2022-50669 page https://www.suse.com/security/cve/CVE-2022-50670/ SUSE CVE CVE-2022-50670 page https://www.suse.com/security/cve/CVE-2022-50671/ SUSE CVE CVE-2022-50671 page https://www.suse.com/security/cve/CVE-2022-50672/ SUSE CVE CVE-2022-50672 page https://www.suse.com/security/cve/CVE-2022-50673/ SUSE CVE CVE-2022-50673 page https://www.suse.com/security/cve/CVE-2022-50675/ SUSE CVE CVE-2022-50675 page https://www.suse.com/security/cve/CVE-2022-50677/ SUSE CVE CVE-2022-50677 page https://www.suse.com/security/cve/CVE-2022-50678/ SUSE CVE CVE-2022-50678 page https://www.suse.com/security/cve/CVE-2022-50679/ SUSE CVE CVE-2022-50679 page https://www.suse.com/security/cve/CVE-2022-50697/ SUSE CVE CVE-2022-50697 page https://www.suse.com/security/cve/CVE-2022-50698/ SUSE CVE CVE-2022-50698 page https://www.suse.com/security/cve/CVE-2022-50699/ SUSE CVE CVE-2022-50699 page https://www.suse.com/security/cve/CVE-2022-50700/ SUSE CVE CVE-2022-50700 page https://www.suse.com/security/cve/CVE-2022-50702/ SUSE CVE CVE-2022-50702 page https://www.suse.com/security/cve/CVE-2022-50703/ SUSE CVE CVE-2022-50703 page https://www.suse.com/security/cve/CVE-2022-50704/ SUSE CVE CVE-2022-50704 page https://www.suse.com/security/cve/CVE-2022-50709/ SUSE CVE CVE-2022-50709 page https://www.suse.com/security/cve/CVE-2022-50715/ SUSE CVE CVE-2022-50715 page https://www.suse.com/security/cve/CVE-2022-50716/ SUSE CVE CVE-2022-50716 page https://www.suse.com/security/cve/CVE-2022-50717/ SUSE CVE CVE-2022-50717 page https://www.suse.com/security/cve/CVE-2022-50718/ SUSE CVE CVE-2022-50718 page https://www.suse.com/security/cve/CVE-2022-50719/ SUSE CVE CVE-2022-50719 page https://www.suse.com/security/cve/CVE-2022-50722/ SUSE CVE CVE-2022-50722 page https://www.suse.com/security/cve/CVE-2022-50724/ SUSE CVE CVE-2022-50724 page https://www.suse.com/security/cve/CVE-2022-50726/ SUSE CVE CVE-2022-50726 page https://www.suse.com/security/cve/CVE-2022-50727/ SUSE CVE CVE-2022-50727 page https://www.suse.com/security/cve/CVE-2022-50728/ SUSE CVE CVE-2022-50728 page https://www.suse.com/security/cve/CVE-2022-50730/ SUSE CVE CVE-2022-50730 page https://www.suse.com/security/cve/CVE-2022-50731/ SUSE CVE CVE-2022-50731 page https://www.suse.com/security/cve/CVE-2022-50732/ SUSE CVE CVE-2022-50732 page https://www.suse.com/security/cve/CVE-2022-50733/ SUSE CVE CVE-2022-50733 page https://www.suse.com/security/cve/CVE-2022-50735/ SUSE CVE CVE-2022-50735 page https://www.suse.com/security/cve/CVE-2022-50736/ SUSE CVE CVE-2022-50736 page https://www.suse.com/security/cve/CVE-2022-50740/ SUSE CVE CVE-2022-50740 page https://www.suse.com/security/cve/CVE-2022-50742/ SUSE CVE CVE-2022-50742 page https://www.suse.com/security/cve/CVE-2022-50744/ SUSE CVE CVE-2022-50744 page https://www.suse.com/security/cve/CVE-2022-50745/ SUSE CVE CVE-2022-50745 page https://www.suse.com/security/cve/CVE-2022-50747/ SUSE CVE CVE-2022-50747 page https://www.suse.com/security/cve/CVE-2022-50749/ SUSE CVE CVE-2022-50749 page https://www.suse.com/security/cve/CVE-2022-50750/ SUSE CVE CVE-2022-50750 page https://www.suse.com/security/cve/CVE-2022-50751/ SUSE CVE CVE-2022-50751 page https://www.suse.com/security/cve/CVE-2022-50752/ SUSE CVE CVE-2022-50752 page https://www.suse.com/security/cve/CVE-2022-50754/ SUSE CVE CVE-2022-50754 page https://www.suse.com/security/cve/CVE-2022-50755/ SUSE CVE CVE-2022-50755 page https://www.suse.com/security/cve/CVE-2022-50756/ SUSE CVE CVE-2022-50756 page https://www.suse.com/security/cve/CVE-2022-50757/ SUSE CVE CVE-2022-50757 page https://www.suse.com/security/cve/CVE-2022-50758/ SUSE CVE CVE-2022-50758 page https://www.suse.com/security/cve/CVE-2022-50760/ SUSE CVE CVE-2022-50760 page https://www.suse.com/security/cve/CVE-2022-50761/ SUSE CVE CVE-2022-50761 page https://www.suse.com/security/cve/CVE-2022-50763/ SUSE CVE CVE-2022-50763 page https://www.suse.com/security/cve/CVE-2022-50767/ SUSE CVE CVE-2022-50767 page https://www.suse.com/security/cve/CVE-2022-50769/ SUSE CVE CVE-2022-50769 page https://www.suse.com/security/cve/CVE-2022-50770/ SUSE CVE CVE-2022-50770 page https://www.suse.com/security/cve/CVE-2022-50773/ SUSE CVE CVE-2022-50773 page https://www.suse.com/security/cve/CVE-2022-50774/ SUSE CVE CVE-2022-50774 page https://www.suse.com/security/cve/CVE-2022-50776/ SUSE CVE CVE-2022-50776 page https://www.suse.com/security/cve/CVE-2022-50777/ SUSE CVE CVE-2022-50777 page https://www.suse.com/security/cve/CVE-2022-50779/ SUSE CVE CVE-2022-50779 page https://www.suse.com/security/cve/CVE-2022-50781/ SUSE CVE CVE-2022-50781 page https://www.suse.com/security/cve/CVE-2022-50782/ SUSE CVE CVE-2022-50782 page https://www.suse.com/security/cve/CVE-2022-50809/ SUSE CVE CVE-2022-50809 page https://www.suse.com/security/cve/CVE-2022-50814/ SUSE CVE CVE-2022-50814 page https://www.suse.com/security/cve/CVE-2022-50819/ SUSE CVE CVE-2022-50819 page https://www.suse.com/security/cve/CVE-2022-50821/ SUSE CVE CVE-2022-50821 page https://www.suse.com/security/cve/CVE-2022-50822/ SUSE CVE CVE-2022-50822 page https://www.suse.com/security/cve/CVE-2022-50823/ SUSE CVE CVE-2022-50823 page https://www.suse.com/security/cve/CVE-2022-50824/ SUSE CVE CVE-2022-50824 page https://www.suse.com/security/cve/CVE-2022-50826/ SUSE CVE CVE-2022-50826 page https://www.suse.com/security/cve/CVE-2022-50827/ SUSE CVE CVE-2022-50827 page https://www.suse.com/security/cve/CVE-2022-50828/ SUSE CVE CVE-2022-50828 page https://www.suse.com/security/cve/CVE-2022-50829/ SUSE CVE CVE-2022-50829 page https://www.suse.com/security/cve/CVE-2022-50830/ SUSE CVE CVE-2022-50830 page https://www.suse.com/security/cve/CVE-2022-50832/ SUSE CVE CVE-2022-50832 page https://www.suse.com/security/cve/CVE-2022-50834/ SUSE CVE CVE-2022-50834 page https://www.suse.com/security/cve/CVE-2022-50835/ SUSE CVE CVE-2022-50835 page https://www.suse.com/security/cve/CVE-2022-50836/ SUSE CVE CVE-2022-50836 page https://www.suse.com/security/cve/CVE-2022-50839/ SUSE CVE CVE-2022-50839 page https://www.suse.com/security/cve/CVE-2022-50840/ SUSE CVE CVE-2022-50840 page https://www.suse.com/security/cve/CVE-2022-50842/ SUSE CVE CVE-2022-50842 page https://www.suse.com/security/cve/CVE-2022-50843/ SUSE CVE CVE-2022-50843 page https://www.suse.com/security/cve/CVE-2022-50844/ SUSE CVE CVE-2022-50844 page https://www.suse.com/security/cve/CVE-2022-50845/ SUSE CVE CVE-2022-50845 page https://www.suse.com/security/cve/CVE-2022-50846/ SUSE CVE CVE-2022-50846 page https://www.suse.com/security/cve/CVE-2022-50848/ SUSE CVE CVE-2022-50848 page https://www.suse.com/security/cve/CVE-2022-50849/ SUSE CVE CVE-2022-50849 page https://www.suse.com/security/cve/CVE-2022-50850/ SUSE CVE CVE-2022-50850 page https://www.suse.com/security/cve/CVE-2022-50851/ SUSE CVE CVE-2022-50851 page https://www.suse.com/security/cve/CVE-2022-50853/ SUSE CVE CVE-2022-50853 page https://www.suse.com/security/cve/CVE-2022-50856/ SUSE CVE CVE-2022-50856 page https://www.suse.com/security/cve/CVE-2022-50858/ SUSE CVE CVE-2022-50858 page https://www.suse.com/security/cve/CVE-2022-50859/ SUSE CVE CVE-2022-50859 page https://www.suse.com/security/cve/CVE-2022-50860/ SUSE CVE CVE-2022-50860 page https://www.suse.com/security/cve/CVE-2022-50861/ SUSE CVE CVE-2022-50861 page https://www.suse.com/security/cve/CVE-2022-50864/ SUSE CVE CVE-2022-50864 page https://www.suse.com/security/cve/CVE-2022-50866/ SUSE CVE CVE-2022-50866 page https://www.suse.com/security/cve/CVE-2022-50868/ SUSE CVE CVE-2022-50868 page https://www.suse.com/security/cve/CVE-2022-50870/ SUSE CVE CVE-2022-50870 page https://www.suse.com/security/cve/CVE-2022-50872/ SUSE CVE CVE-2022-50872 page https://www.suse.com/security/cve/CVE-2022-50876/ SUSE CVE CVE-2022-50876 page https://www.suse.com/security/cve/CVE-2022-50878/ SUSE CVE CVE-2022-50878 page https://www.suse.com/security/cve/CVE-2022-50880/ SUSE CVE CVE-2022-50880 page https://www.suse.com/security/cve/CVE-2022-50881/ SUSE CVE CVE-2022-50881 page https://www.suse.com/security/cve/CVE-2022-50882/ SUSE CVE CVE-2022-50882 page https://www.suse.com/security/cve/CVE-2022-50884/ SUSE CVE CVE-2022-50884 page https://www.suse.com/security/cve/CVE-2022-50885/ SUSE CVE CVE-2022-50885 page https://www.suse.com/security/cve/CVE-2022-50886/ SUSE CVE CVE-2022-50886 page https://www.suse.com/security/cve/CVE-2022-50887/ SUSE CVE CVE-2022-50887 page https://www.suse.com/security/cve/CVE-2022-50888/ SUSE CVE CVE-2022-50888 page https://www.suse.com/security/cve/CVE-2022-50889/ SUSE CVE CVE-2022-50889 page https://www.suse.com/security/cve/CVE-2023-23559/ SUSE CVE CVE-2023-23559 page https://www.suse.com/security/cve/CVE-2023-53215/ SUSE CVE CVE-2023-53215 page https://www.suse.com/security/cve/CVE-2023-53254/ SUSE CVE CVE-2023-53254 page https://www.suse.com/security/cve/CVE-2023-53743/ SUSE CVE CVE-2023-53743 page https://www.suse.com/security/cve/CVE-2023-53744/ SUSE CVE CVE-2023-53744 page https://www.suse.com/security/cve/CVE-2023-53746/ SUSE CVE CVE-2023-53746 page https://www.suse.com/security/cve/CVE-2023-53747/ SUSE CVE CVE-2023-53747 page https://www.suse.com/security/cve/CVE-2023-53751/ SUSE CVE CVE-2023-53751 page https://www.suse.com/security/cve/CVE-2023-53754/ SUSE CVE CVE-2023-53754 page https://www.suse.com/security/cve/CVE-2023-53755/ SUSE CVE CVE-2023-53755 page https://www.suse.com/security/cve/CVE-2023-53761/ SUSE CVE CVE-2023-53761 page https://www.suse.com/security/cve/CVE-2023-53766/ SUSE CVE CVE-2023-53766 page https://www.suse.com/security/cve/CVE-2023-53781/ SUSE CVE CVE-2023-53781 page https://www.suse.com/security/cve/CVE-2023-53783/ SUSE CVE CVE-2023-53783 page https://www.suse.com/security/cve/CVE-2023-53786/ SUSE CVE CVE-2023-53786 page https://www.suse.com/security/cve/CVE-2023-53788/ SUSE CVE CVE-2023-53788 page https://www.suse.com/security/cve/CVE-2023-53792/ SUSE CVE CVE-2023-53792 page https://www.suse.com/security/cve/CVE-2023-53794/ SUSE CVE CVE-2023-53794 page https://www.suse.com/security/cve/CVE-2023-53802/ SUSE CVE CVE-2023-53802 page https://www.suse.com/security/cve/CVE-2023-53803/ SUSE CVE CVE-2023-53803 page https://www.suse.com/security/cve/CVE-2023-53804/ SUSE CVE CVE-2023-53804 page https://www.suse.com/security/cve/CVE-2023-53808/ SUSE CVE CVE-2023-53808 page https://www.suse.com/security/cve/CVE-2023-53811/ SUSE CVE CVE-2023-53811 page https://www.suse.com/security/cve/CVE-2023-53814/ SUSE CVE CVE-2023-53814 page https://www.suse.com/security/cve/CVE-2023-53818/ SUSE CVE CVE-2023-53818 page https://www.suse.com/security/cve/CVE-2023-53819/ SUSE CVE CVE-2023-53819 page https://www.suse.com/security/cve/CVE-2023-53820/ SUSE CVE CVE-2023-53820 page https://www.suse.com/security/cve/CVE-2023-53827/ SUSE CVE CVE-2023-53827 page https://www.suse.com/security/cve/CVE-2023-53830/ SUSE CVE CVE-2023-53830 page https://www.suse.com/security/cve/CVE-2023-53832/ SUSE CVE CVE-2023-53832 page https://www.suse.com/security/cve/CVE-2023-53834/ SUSE CVE CVE-2023-53834 page https://www.suse.com/security/cve/CVE-2023-53837/ SUSE CVE CVE-2023-53837 page https://www.suse.com/security/cve/CVE-2023-53840/ SUSE CVE CVE-2023-53840 page https://www.suse.com/security/cve/CVE-2023-53842/ SUSE CVE CVE-2023-53842 page https://www.suse.com/security/cve/CVE-2023-53844/ SUSE CVE CVE-2023-53844 page https://www.suse.com/security/cve/CVE-2023-53845/ SUSE CVE CVE-2023-53845 page https://www.suse.com/security/cve/CVE-2023-53847/ SUSE CVE CVE-2023-53847 page https://www.suse.com/security/cve/CVE-2023-53850/ SUSE CVE CVE-2023-53850 page https://www.suse.com/security/cve/CVE-2023-53852/ SUSE CVE CVE-2023-53852 page https://www.suse.com/security/cve/CVE-2023-53858/ SUSE CVE CVE-2023-53858 page https://www.suse.com/security/cve/CVE-2023-53862/ SUSE CVE CVE-2023-53862 page https://www.suse.com/security/cve/CVE-2023-53866/ SUSE CVE CVE-2023-53866 page https://www.suse.com/security/cve/CVE-2023-53990/ SUSE CVE CVE-2023-53990 page https://www.suse.com/security/cve/CVE-2023-53991/ SUSE CVE CVE-2023-53991 page https://www.suse.com/security/cve/CVE-2023-53996/ SUSE CVE CVE-2023-53996 page https://www.suse.com/security/cve/CVE-2023-53998/ SUSE CVE CVE-2023-53998 page https://www.suse.com/security/cve/CVE-2023-54001/ SUSE CVE CVE-2023-54001 page https://www.suse.com/security/cve/CVE-2023-54003/ SUSE CVE CVE-2023-54003 page https://www.suse.com/security/cve/CVE-2023-54007/ SUSE CVE CVE-2023-54007 page https://www.suse.com/security/cve/CVE-2023-54009/ SUSE CVE CVE-2023-54009 page https://www.suse.com/security/cve/CVE-2023-54010/ SUSE CVE CVE-2023-54010 page https://www.suse.com/security/cve/CVE-2023-54014/ SUSE CVE CVE-2023-54014 page https://www.suse.com/security/cve/CVE-2023-54015/ SUSE CVE CVE-2023-54015 page https://www.suse.com/security/cve/CVE-2023-54018/ SUSE CVE CVE-2023-54018 page https://www.suse.com/security/cve/CVE-2023-54019/ SUSE CVE CVE-2023-54019 page https://www.suse.com/security/cve/CVE-2023-54020/ SUSE CVE CVE-2023-54020 page https://www.suse.com/security/cve/CVE-2023-54021/ SUSE CVE CVE-2023-54021 page https://www.suse.com/security/cve/CVE-2023-54024/ SUSE CVE CVE-2023-54024 page https://www.suse.com/security/cve/CVE-2023-54025/ SUSE CVE CVE-2023-54025 page https://www.suse.com/security/cve/CVE-2023-54026/ SUSE CVE CVE-2023-54026 page https://www.suse.com/security/cve/CVE-2023-54028/ SUSE CVE CVE-2023-54028 page https://www.suse.com/security/cve/CVE-2023-54036/ SUSE CVE CVE-2023-54036 page https://www.suse.com/security/cve/CVE-2023-54039/ SUSE CVE CVE-2023-54039 page https://www.suse.com/security/cve/CVE-2023-54040/ SUSE CVE CVE-2023-54040 page https://www.suse.com/security/cve/CVE-2023-54042/ SUSE CVE CVE-2023-54042 page https://www.suse.com/security/cve/CVE-2023-54045/ SUSE CVE CVE-2023-54045 page https://www.suse.com/security/cve/CVE-2023-54046/ SUSE CVE CVE-2023-54046 page https://www.suse.com/security/cve/CVE-2023-54048/ SUSE CVE CVE-2023-54048 page https://www.suse.com/security/cve/CVE-2023-54049/ SUSE CVE CVE-2023-54049 page https://www.suse.com/security/cve/CVE-2023-54050/ SUSE CVE CVE-2023-54050 page https://www.suse.com/security/cve/CVE-2023-54051/ SUSE CVE CVE-2023-54051 page https://www.suse.com/security/cve/CVE-2023-54053/ SUSE CVE CVE-2023-54053 page https://www.suse.com/security/cve/CVE-2023-54055/ SUSE CVE CVE-2023-54055 page https://www.suse.com/security/cve/CVE-2023-54058/ SUSE CVE CVE-2023-54058 page https://www.suse.com/security/cve/CVE-2023-54064/ SUSE CVE CVE-2023-54064 page https://www.suse.com/security/cve/CVE-2023-54072/ SUSE CVE CVE-2023-54072 page https://www.suse.com/security/cve/CVE-2023-54076/ SUSE CVE CVE-2023-54076 page https://www.suse.com/security/cve/CVE-2023-54078/ SUSE CVE CVE-2023-54078 page https://www.suse.com/security/cve/CVE-2023-54079/ SUSE CVE CVE-2023-54079 page https://www.suse.com/security/cve/CVE-2023-54083/ SUSE CVE CVE-2023-54083 page https://www.suse.com/security/cve/CVE-2023-54084/ SUSE CVE CVE-2023-54084 page https://www.suse.com/security/cve/CVE-2023-54090/ SUSE CVE CVE-2023-54090 page https://www.suse.com/security/cve/CVE-2023-54091/ SUSE CVE CVE-2023-54091 page https://www.suse.com/security/cve/CVE-2023-54092/ SUSE CVE CVE-2023-54092 page https://www.suse.com/security/cve/CVE-2023-54095/ SUSE CVE CVE-2023-54095 page https://www.suse.com/security/cve/CVE-2023-54096/ SUSE CVE CVE-2023-54096 page https://www.suse.com/security/cve/CVE-2023-54097/ SUSE CVE CVE-2023-54097 page https://www.suse.com/security/cve/CVE-2023-54098/ SUSE CVE CVE-2023-54098 page https://www.suse.com/security/cve/CVE-2023-54100/ SUSE CVE CVE-2023-54100 page https://www.suse.com/security/cve/CVE-2023-54102/ SUSE CVE CVE-2023-54102 page https://www.suse.com/security/cve/CVE-2023-54104/ SUSE CVE CVE-2023-54104 page https://www.suse.com/security/cve/CVE-2023-54108/ SUSE CVE CVE-2023-54108 page https://www.suse.com/security/cve/CVE-2023-54110/ SUSE CVE CVE-2023-54110 page https://www.suse.com/security/cve/CVE-2023-54111/ SUSE CVE CVE-2023-54111 page https://www.suse.com/security/cve/CVE-2023-54115/ SUSE CVE CVE-2023-54115 page https://www.suse.com/security/cve/CVE-2023-54118/ SUSE CVE CVE-2023-54118 page https://www.suse.com/security/cve/CVE-2023-54119/ SUSE CVE CVE-2023-54119 page https://www.suse.com/security/cve/CVE-2023-54120/ SUSE CVE CVE-2023-54120 page https://www.suse.com/security/cve/CVE-2023-54122/ SUSE CVE CVE-2023-54122 page https://www.suse.com/security/cve/CVE-2023-54123/ SUSE CVE CVE-2023-54123 page https://www.suse.com/security/cve/CVE-2023-54126/ SUSE CVE CVE-2023-54126 page https://www.suse.com/security/cve/CVE-2023-54127/ SUSE CVE CVE-2023-54127 page https://www.suse.com/security/cve/CVE-2023-54130/ SUSE CVE CVE-2023-54130 page https://www.suse.com/security/cve/CVE-2023-54131/ SUSE CVE CVE-2023-54131 page https://www.suse.com/security/cve/CVE-2023-54136/ SUSE CVE CVE-2023-54136 page https://www.suse.com/security/cve/CVE-2023-54140/ SUSE CVE CVE-2023-54140 page https://www.suse.com/security/cve/CVE-2023-54142/ SUSE CVE CVE-2023-54142 page https://www.suse.com/security/cve/CVE-2023-54146/ SUSE CVE CVE-2023-54146 page https://www.suse.com/security/cve/CVE-2023-54150/ SUSE CVE CVE-2023-54150 page https://www.suse.com/security/cve/CVE-2023-54153/ SUSE CVE CVE-2023-54153 page https://www.suse.com/security/cve/CVE-2023-54156/ SUSE CVE CVE-2023-54156 page https://www.suse.com/security/cve/CVE-2023-54159/ SUSE CVE CVE-2023-54159 page https://www.suse.com/security/cve/CVE-2023-54166/ SUSE CVE CVE-2023-54166 page https://www.suse.com/security/cve/CVE-2023-54168/ SUSE CVE CVE-2023-54168 page https://www.suse.com/security/cve/CVE-2023-54170/ SUSE CVE CVE-2023-54170 page https://www.suse.com/security/cve/CVE-2023-54171/ SUSE CVE CVE-2023-54171 page https://www.suse.com/security/cve/CVE-2023-54173/ SUSE CVE CVE-2023-54173 page https://www.suse.com/security/cve/CVE-2023-54177/ SUSE CVE CVE-2023-54177 page https://www.suse.com/security/cve/CVE-2023-54179/ SUSE CVE CVE-2023-54179 page https://www.suse.com/security/cve/CVE-2023-54183/ SUSE CVE CVE-2023-54183 page https://www.suse.com/security/cve/CVE-2023-54186/ SUSE CVE CVE-2023-54186 page https://www.suse.com/security/cve/CVE-2023-54189/ SUSE CVE CVE-2023-54189 page https://www.suse.com/security/cve/CVE-2023-54190/ SUSE CVE CVE-2023-54190 page https://www.suse.com/security/cve/CVE-2023-54197/ SUSE CVE CVE-2023-54197 page https://www.suse.com/security/cve/CVE-2023-54198/ SUSE CVE CVE-2023-54198 page https://www.suse.com/security/cve/CVE-2023-54199/ SUSE CVE CVE-2023-54199 page https://www.suse.com/security/cve/CVE-2023-54201/ SUSE CVE CVE-2023-54201 page https://www.suse.com/security/cve/CVE-2023-54202/ SUSE CVE CVE-2023-54202 page https://www.suse.com/security/cve/CVE-2023-54205/ SUSE CVE CVE-2023-54205 page https://www.suse.com/security/cve/CVE-2023-54208/ SUSE CVE CVE-2023-54208 page https://www.suse.com/security/cve/CVE-2023-54211/ SUSE CVE CVE-2023-54211 page https://www.suse.com/security/cve/CVE-2023-54213/ SUSE CVE CVE-2023-54213 page https://www.suse.com/security/cve/CVE-2023-54214/ SUSE CVE CVE-2023-54214 page https://www.suse.com/security/cve/CVE-2023-54219/ SUSE CVE CVE-2023-54219 page https://www.suse.com/security/cve/CVE-2023-54230/ SUSE CVE CVE-2023-54230 page https://www.suse.com/security/cve/CVE-2023-54236/ SUSE CVE CVE-2023-54236 page https://www.suse.com/security/cve/CVE-2023-54242/ SUSE CVE CVE-2023-54242 page https://www.suse.com/security/cve/CVE-2023-54243/ SUSE CVE CVE-2023-54243 page https://www.suse.com/security/cve/CVE-2023-54244/ SUSE CVE CVE-2023-54244 page https://www.suse.com/security/cve/CVE-2023-54245/ SUSE CVE CVE-2023-54245 page https://www.suse.com/security/cve/CVE-2023-54252/ SUSE CVE CVE-2023-54252 page https://www.suse.com/security/cve/CVE-2023-54260/ SUSE CVE CVE-2023-54260 page https://www.suse.com/security/cve/CVE-2023-54264/ SUSE CVE CVE-2023-54264 page https://www.suse.com/security/cve/CVE-2023-54266/ SUSE CVE CVE-2023-54266 page https://www.suse.com/security/cve/CVE-2023-54269/ SUSE CVE CVE-2023-54269 page https://www.suse.com/security/cve/CVE-2023-54270/ SUSE CVE CVE-2023-54270 page https://www.suse.com/security/cve/CVE-2023-54271/ SUSE CVE CVE-2023-54271 page https://www.suse.com/security/cve/CVE-2023-54274/ SUSE CVE CVE-2023-54274 page https://www.suse.com/security/cve/CVE-2023-54275/ SUSE CVE CVE-2023-54275 page https://www.suse.com/security/cve/CVE-2023-54277/ SUSE CVE CVE-2023-54277 page https://www.suse.com/security/cve/CVE-2023-54280/ SUSE CVE CVE-2023-54280 page https://www.suse.com/security/cve/CVE-2023-54284/ SUSE CVE CVE-2023-54284 page https://www.suse.com/security/cve/CVE-2023-54286/ SUSE CVE CVE-2023-54286 page https://www.suse.com/security/cve/CVE-2023-54287/ SUSE CVE CVE-2023-54287 page https://www.suse.com/security/cve/CVE-2023-54289/ SUSE CVE CVE-2023-54289 page https://www.suse.com/security/cve/CVE-2023-54292/ SUSE CVE CVE-2023-54292 page https://www.suse.com/security/cve/CVE-2023-54293/ SUSE CVE CVE-2023-54293 page https://www.suse.com/security/cve/CVE-2023-54294/ SUSE CVE CVE-2023-54294 page https://www.suse.com/security/cve/CVE-2023-54295/ SUSE CVE CVE-2023-54295 page https://www.suse.com/security/cve/CVE-2023-54298/ SUSE CVE CVE-2023-54298 page https://www.suse.com/security/cve/CVE-2023-54299/ SUSE CVE CVE-2023-54299 page https://www.suse.com/security/cve/CVE-2023-54300/ SUSE CVE CVE-2023-54300 page https://www.suse.com/security/cve/CVE-2023-54301/ SUSE CVE CVE-2023-54301 page https://www.suse.com/security/cve/CVE-2023-54302/ SUSE CVE CVE-2023-54302 page https://www.suse.com/security/cve/CVE-2023-54304/ SUSE CVE CVE-2023-54304 page https://www.suse.com/security/cve/CVE-2023-54305/ SUSE CVE CVE-2023-54305 page https://www.suse.com/security/cve/CVE-2023-54309/ SUSE CVE CVE-2023-54309 page https://www.suse.com/security/cve/CVE-2023-54311/ SUSE CVE CVE-2023-54311 page https://www.suse.com/security/cve/CVE-2023-54315/ SUSE CVE CVE-2023-54315 page https://www.suse.com/security/cve/CVE-2023-54317/ SUSE CVE CVE-2023-54317 page https://www.suse.com/security/cve/CVE-2023-54319/ SUSE CVE CVE-2023-54319 page https://www.suse.com/security/cve/CVE-2023-54321/ SUSE CVE CVE-2023-54321 page https://www.suse.com/security/cve/CVE-2023-54325/ SUSE CVE CVE-2023-54325 page https://www.suse.com/security/cve/CVE-2023-54326/ SUSE CVE CVE-2023-54326 page https://www.suse.com/security/cve/CVE-2024-28956/ SUSE CVE CVE-2024-28956 page https://www.suse.com/security/cve/CVE-2024-36348/ SUSE CVE CVE-2024-36348 page https://www.suse.com/security/cve/CVE-2024-36349/ SUSE CVE CVE-2024-36349 page https://www.suse.com/security/cve/CVE-2024-36350/ SUSE CVE CVE-2024-36350 page https://www.suse.com/security/cve/CVE-2024-36357/ SUSE CVE CVE-2024-36357 page https://www.suse.com/security/cve/CVE-2024-44987/ SUSE CVE CVE-2024-44987 page https://www.suse.com/security/cve/CVE-2025-38068/ SUSE CVE CVE-2025-38068 page https://www.suse.com/security/cve/CVE-2025-38129/ SUSE CVE CVE-2025-38129 page https://www.suse.com/security/cve/CVE-2025-38159/ SUSE CVE CVE-2025-38159 page https://www.suse.com/security/cve/CVE-2025-38375/ SUSE CVE CVE-2025-38375 page https://www.suse.com/security/cve/CVE-2025-39977/ SUSE CVE CVE-2025-39977 page https://www.suse.com/security/cve/CVE-2025-40019/ SUSE CVE CVE-2025-40019 page https://www.suse.com/security/cve/CVE-2025-40139/ SUSE CVE CVE-2025-40139 page https://www.suse.com/security/cve/CVE-2025-40215/ SUSE CVE CVE-2025-40215 page https://www.suse.com/security/cve/CVE-2025-40220/ SUSE CVE CVE-2025-40220 page https://www.suse.com/security/cve/CVE-2025-40233/ SUSE CVE CVE-2025-40233 page https://www.suse.com/security/cve/CVE-2025-40256/ SUSE CVE CVE-2025-40256 page https://www.suse.com/security/cve/CVE-2025-40257/ SUSE CVE CVE-2025-40257 page https://www.suse.com/security/cve/CVE-2025-40258/ SUSE CVE CVE-2025-40258 page https://www.suse.com/security/cve/CVE-2025-40277/ SUSE CVE CVE-2025-40277 page https://www.suse.com/security/cve/CVE-2025-40280/ SUSE CVE CVE-2025-40280 page https://www.suse.com/security/cve/CVE-2025-40300/ SUSE CVE CVE-2025-40300 page https://www.suse.com/security/cve/CVE-2025-40331/ SUSE CVE CVE-2025-40331 page https://www.suse.com/security/cve/CVE-2025-68183/ SUSE CVE CVE-2025-68183 page https://www.suse.com/security/cve/CVE-2025-68284/ SUSE CVE CVE-2025-68284 page https://www.suse.com/security/cve/CVE-2025-68285/ SUSE CVE CVE-2025-68285 page https://www.suse.com/security/cve/CVE-2025-68732/ SUSE CVE CVE-2025-68732 page https://www.suse.com/security/cve/CVE-2025-68771/ SUSE CVE CVE-2025-68771 page https://www.suse.com/security/cve/CVE-2025-68813/ SUSE CVE CVE-2025-68813 page https://www.suse.com/security/cve/CVE-2025-71089/ SUSE CVE CVE-2025-71089 page https://www.suse.com/security/cve/CVE-2025-71116/ SUSE CVE CVE-2025-71116 page https://www.suse.com/security/cve/CVE-2025-71120/ SUSE CVE CVE-2025-71120 page SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 cluster-md-kmp-rt-5.14.21-150400.15.142.1 dlm-kmp-rt-5.14.21-150400.15.142.1 gfs2-kmp-rt-5.14.21-150400.15.142.1 kernel-devel-rt-5.14.21-150400.15.142.1 kernel-rt-5.14.21-150400.15.142.1 kernel-rt-devel-5.14.21-150400.15.142.1 kernel-rt-extra-5.14.21-150400.15.142.1 kernel-rt-livepatch-5.14.21-150400.15.142.1 kernel-rt-livepatch-devel-5.14.21-150400.15.142.1 kernel-rt-optional-5.14.21-150400.15.142.1 kernel-rt_debug-5.14.21-150400.15.142.1 kernel-rt_debug-devel-5.14.21-150400.15.142.1 kernel-source-rt-5.14.21-150400.15.142.1 kernel-syms-rt-5.14.21-150400.15.142.1 kselftests-kmp-rt-5.14.21-150400.15.142.1 ocfs2-kmp-rt-5.14.21-150400.15.142.1 reiserfs-kmp-rt-5.14.21-150400.15.142.1 kernel-rt-5.14.21-150400.15.142.1 as a component of SUSE Linux Enterprise Micro 5.3 kernel-source-rt-5.14.21-150400.15.142.1 as a component of SUSE Linux Enterprise Micro 5.3 kernel-rt-5.14.21-150400.15.142.1 as a component of SUSE Linux Enterprise Micro 5.4 kernel-source-rt-5.14.21-150400.15.142.1 as a component of SUSE Linux Enterprise Micro 5.4 A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space. CVE-2022-0854 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-0854.html CVE-2022-0854 https://bugzilla.suse.com/1196823 SUSE Bug 1196823 In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO interface with: dxfer_len == 524288, dxdfer_dir == SG_DXFER_FROM_DEV and a corresponding dxferp. The peculiar thing about this is that TUR is not reading from the device. 2) In sg_start_req() the invocation of blk_rq_map_user() effectively bounces the user-space buffer. As if the device was to transfer into it. Since commit a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()") we make sure this first bounce buffer is allocated with GFP_ZERO. 3) For the rest of the story we keep ignoring that we have a TUR, so the device won't touch the buffer we prepare as if the we had a DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device and the buffer allocated by SG is mapped by the function virtqueue_add_split() which uses DMA_FROM_DEVICE for the "in" sgs (here scatter-gather and not scsi generics). This mapping involves bouncing via the swiotlb (we need swiotlb to do virtio in protected guest like s390 Secure Execution, or AMD SEV). 4) When the SCSI TUR is done, we first copy back the content of the second (that is swiotlb) bounce buffer (which most likely contains some previous IO data), to the first bounce buffer, which contains all zeros. Then we copy back the content of the first bounce buffer to the user-space buffer. 5) The test case detects that the buffer, which it zero-initialized, ain't all zeros and fails. One can argue that this is an swiotlb problem, because without swiotlb we leak all zeros, and the swiotlb should be transparent in a sense that it does not affect the outcome (if all other participants are well behaved). Copying the content of the original buffer into the swiotlb buffer is the only way I can think of to make swiotlb transparent in such scenarios. So let's do just that if in doubt, but allow the driver to tell us that the whole mapped buffer is going to be overwritten, in which case we can preserve the old behavior and avoid the performance impact of the extra bounce. CVE-2022-48853 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-48853.html CVE-2022-48853 https://bugzilla.suse.com/1228015 SUSE Bug 1228015 In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Fix pci_endpoint_test_{copy,write,read}() panic The dma_map_single() doesn't permit zero length mapping. It causes a follow panic. A panic was reported on arm64: [ 60.137988] ------------[ cut here ]------------ [ 60.142630] kernel BUG at kernel/dma/swiotlb.c:624! [ 60.147508] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP [ 60.152992] Modules linked in: dw_hdmi_cec crct10dif_ce simple_bridge rcar_fdp1 vsp1 rcar_vin videobuf2_vmalloc rcar_csi2 v4l 2_mem2mem videobuf2_dma_contig videobuf2_memops pci_endpoint_test videobuf2_v4l2 videobuf2_common rcar_fcp v4l2_fwnode v4l2_asyn c videodev mc gpio_bd9571mwv max9611 pwm_rcar ccree at24 authenc libdes phy_rcar_gen3_usb3 usb_dmac display_connector pwm_bl [ 60.186252] CPU: 0 PID: 508 Comm: pcitest Not tainted 6.0.0-rc1rpci-dev+ #237 [ 60.193387] Hardware name: Renesas Salvator-X 2nd version board based on r8a77951 (DT) [ 60.201302] pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 60.208263] pc : swiotlb_tbl_map_single+0x2c0/0x590 [ 60.213149] lr : swiotlb_map+0x88/0x1f0 [ 60.216982] sp : ffff80000a883bc0 [ 60.220292] x29: ffff80000a883bc0 x28: 0000000000000000 x27: 0000000000000000 [ 60.227430] x26: 0000000000000000 x25: ffff0004c0da20d0 x24: ffff80000a1f77c0 [ 60.234567] x23: 0000000000000002 x22: 0001000040000010 x21: 000000007a000000 [ 60.241703] x20: 0000000000200000 x19: 0000000000000000 x18: 0000000000000000 [ 60.248840] x17: 0000000000000000 x16: 0000000000000000 x15: ffff0006ff7b9180 [ 60.255977] x14: ffff0006ff7b9180 x13: 0000000000000000 x12: 0000000000000000 [ 60.263113] x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 [ 60.270249] x8 : 0001000000000010 x7 : ffff0004c6754b20 x6 : 0000000000000000 [ 60.277385] x5 : ffff0004c0da2090 x4 : 0000000000000000 x3 : 0000000000000001 [ 60.284521] x2 : 0000000040000000 x1 : 0000000000000000 x0 : 0000000040000010 [ 60.291658] Call trace: [ 60.294100] swiotlb_tbl_map_single+0x2c0/0x590 [ 60.298629] swiotlb_map+0x88/0x1f0 [ 60.302115] dma_map_page_attrs+0x188/0x230 [ 60.306299] pci_endpoint_test_ioctl+0x5e4/0xd90 [pci_endpoint_test] [ 60.312660] __arm64_sys_ioctl+0xa8/0xf0 [ 60.316583] invoke_syscall+0x44/0x108 [ 60.320334] el0_svc_common.constprop.0+0xcc/0xf0 [ 60.325038] do_el0_svc+0x2c/0xb8 [ 60.328351] el0_svc+0x2c/0x88 [ 60.331406] el0t_64_sync_handler+0xb8/0xc0 [ 60.335587] el0t_64_sync+0x18c/0x190 [ 60.339251] Code: 52800013 d2e00414 35fff45c d503201f (d4210000) [ 60.345344] ---[ end trace 0000000000000000 ]--- To fix it, this patch adds a checking the payload length if it is zero. CVE-2022-50614 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50614.html CVE-2022-50614 https://bugzilla.suse.com/1254578 SUSE Bug 1254578 https://bugzilla.suse.com/1254647 SUSE Bug 1254647 In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() pci_get_device() will increase the reference count for the returned pci_dev, so snr_uncore_get_mc_dev() will return a pci_dev with its reference count increased. We need to call pci_dev_put() to decrease the reference count. Let's add the missing pci_dev_put(). CVE-2022-50615 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50615.html CVE-2022-50615 https://bugzilla.suse.com/1254580 SUSE Bug 1254580 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/powerplay/psm: Fix memory leak in power state init Commit 902bc65de0b3 ("drm/amdgpu/powerplay/psm: return an error in power state init") made the power state init function return early in case of failure to get an entry from the powerplay table, but it missed to clean up the allocated memory for the current power state before returning. CVE-2022-50617 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50617.html CVE-2022-50617 https://bugzilla.suse.com/1254780 SUSE Bug 1254780 In the Linux kernel, the following vulnerability has been resolved: mmc: meson-gx: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). Fix this by checking the return value and goto error path which will call mmc_free_host(). CVE-2022-50618 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50618.html CVE-2022-50618 https://bugzilla.suse.com/1254788 SUSE Bug 1254788 In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr() If the number of pages from the userptr BO differs from the SG BO then the allocated memory for the SG table doesn't get freed before returning -EINVAL, which may lead to a memory leak in some error paths. Fix this by checking the number of pages before allocating memory for the SG table. CVE-2022-50619 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50619.html CVE-2022-50619 https://bugzilla.suse.com/1254789 SUSE Bug 1254789 In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential memory leak in ext4_fc_record_modified_inode() As krealloc may return NULL, in this case 'state->fc_modified_inodes' may not be freed by krealloc, but 'state->fc_modified_inodes' already set NULL. Then will lead to 'state->fc_modified_inodes' memory leak. CVE-2022-50622 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50622.html CVE-2022-50622 https://bugzilla.suse.com/1255467 SUSE Bug 1255467 In the Linux kernel, the following vulnerability has been resolved: fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that. CVE-2022-50623 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50623.html CVE-2022-50623 https://bugzilla.suse.com/1254792 SUSE Bug 1254792 In the Linux kernel, the following vulnerability has been resolved: serial: amba-pl011: avoid SBSA UART accessing DMACR register Chapter "B Generic UART" in "ARM Server Base System Architecture" [1] documentation describes a generic UART interface. Such generic UART does not support DMA. In current code, sbsa_uart_pops and amba_pl011_pops share the same stop_rx operation, which will invoke pl011_dma_rx_stop, leading to an access of the DMACR register. This commit adds a using_rx_dma check in pl011_dma_rx_stop to avoid the access to DMACR register for SBSA UARTs which does not support DMA. When the kernel enables DMA engine with "CONFIG_DMA_ENGINE=y", Linux SBSA PL011 driver will access PL011 DMACR register in some functions. For most real SBSA Pl011 hardware implementations, the DMACR write behaviour will be ignored. So these DMACR operations will not cause obvious problems. But for some virtual SBSA PL011 hardware, like Xen virtual SBSA PL011 (vpl011) device, the behaviour might be different. Xen vpl011 emulation will inject a data abort to guest, when guest is accessing an unimplemented UART register. As Xen VPL011 is SBSA compatible, it will not implement DMACR register. So when Linux SBSA PL011 driver access DMACR register, it will get an unhandled data abort fault and the application will get a segmentation fault: Unhandled fault at 0xffffffc00944d048 Mem abort info: ESR = 0x96000000 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x00: ttbr address size fault Data abort info: ISV = 0, ISS = 0x00000000 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000020e2e000 [ffffffc00944d048] pgd=100000003ffff803, p4d=100000003ffff803, pud=100000003ffff803, pmd=100000003fffa803, pte=006800009c090f13 Internal error: ttbr address size fault: 96000000 [#1] PREEMPT SMP ... Call trace: pl011_stop_rx+0x70/0x80 tty_port_shutdown+0x7c/0xb4 tty_port_close+0x60/0xcc uart_close+0x34/0x8c tty_release+0x144/0x4c0 __fput+0x78/0x220 ____fput+0x1c/0x30 task_work_run+0x88/0xc0 do_notify_resume+0x8d0/0x123c el0_svc+0xa8/0xc0 el0t_64_sync_handler+0xa4/0x130 el0t_64_sync+0x1a0/0x1a4 Code: b9000083 b901f001 794038a0 8b000042 (b9000041) ---[ end trace 83dd93df15c3216f ]--- note: bootlogd[132] exited with preempt_count 1 /etc/rcS.d/S07bootlogd: line 47: 132 Segmentation fault start-stop-daemon This has been discussed in the Xen community, and we think it should fix this in Linux. See [2] for more information. [1] https://developer.arm.com/documentation/den0094/c/?lang=en [2] https://lists.xenproject.org/archives/html/xen-devel/2022-11/msg00543.html CVE-2022-50625 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50625.html CVE-2022-50625 https://bugzilla.suse.com/1254559 SUSE Bug 1254559 In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: fix memory leak in dvb_usb_adapter_init() Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapter->priv in case of an error. Currently if an error occurs, it will exit before incrementing "num_adapters_initalized", which is used as a reference counter to free all adap->priv in "dvb_usb_adapter_exit()". There are multiple error paths that can exit from before incrementing the counter. Including the error handling paths for "dvb_usb_adapter_stream_init()", "dvb_usb_adapter_dvb_init()" and "dvb_usb_adapter_frontend_init()" within "dvb_usb_adapter_init()". This means that in case of an error in any of these functions the current iteration is not accounted for and the current iteration's adap->priv is not freed. Fix this by freeing the current iteration's adap->priv in the "stream_init_err:" label in the error path. The rest of the (accounted for) adap->priv objects are freed in dvb_usb_adapter_exit() as expected using the num_adapters_initalized variable. Syzbot report: BUG: memory leak unreferenced object 0xffff8881172f1a00 (size 512): comm "kworker/0:2", pid 139, jiffies 4294994873 (age 10.960s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff844af012>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:75 [inline] [<ffffffff844af012>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:184 [inline] [<ffffffff844af012>] dvb_usb_device_init.cold+0x4e5/0x79e drivers/media/usb/dvb-usb/dvb-usb-init.c:308 [<ffffffff830db21d>] dib0700_probe+0x8d/0x1b0 drivers/media/usb/dvb-usb/dib0700_core.c:883 [<ffffffff82d3fdc7>] usb_probe_interface+0x177/0x370 drivers/usb/core/driver.c:396 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 [<ffffffff8274af6a>] driver_probe_device+0x2a/0x120 drivers/base/dd.c:782 [<ffffffff8274b786>] __device_attach_driver+0xf6/0x140 drivers/base/dd.c:899 [<ffffffff82747c87>] bus_for_each_drv+0xb7/0x100 drivers/base/bus.c:427 [<ffffffff8274b352>] __device_attach+0x122/0x260 drivers/base/dd.c:970 [<ffffffff827498f6>] bus_probe_device+0xc6/0xe0 drivers/base/bus.c:487 [<ffffffff82745cdb>] device_add+0x5fb/0xdf0 drivers/base/core.c:3405 [<ffffffff82d3d202>] usb_set_configuration+0x8f2/0xb80 drivers/usb/core/message.c:2170 [<ffffffff82d4dbfc>] usb_generic_driver_probe+0x8c/0xc0 drivers/usb/core/generic.c:238 [<ffffffff82d3f49c>] usb_probe_device+0x5c/0x140 drivers/usb/core/driver.c:293 [<ffffffff8274ab37>] call_driver_probe drivers/base/dd.c:542 [inline] [<ffffffff8274ab37>] really_probe.part.0+0xe7/0x310 drivers/base/dd.c:621 [<ffffffff8274ae6c>] really_probe drivers/base/dd.c:583 [inline] [<ffffffff8274ae6c>] __driver_probe_device+0x10c/0x1e0 drivers/base/dd.c:752 CVE-2022-50626 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50626.html CVE-2022-50626 https://bugzilla.suse.com/1254562 SUSE Bug 1254562 In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Fix memory leak in rsi_coex_attach() The coex_cb needs to be freed when rsi_create_kthread() failed in rsi_coex_attach(). CVE-2022-50629 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50629.html CVE-2022-50629 https://bugzilla.suse.com/1254783 SUSE Bug 1254783 In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: fix UAF in hugetlb_handle_userfault The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire the vma_lock could lead to UAF[1,2] due to the following race, hugetlb_fault hugetlb_no_page /*unlock vma_lock */ hugetlb_handle_userfault handle_userfault /* unlock mm->mmap_lock*/ vm_mmap_pgoff do_mmap mmap_region munmap_vma_range /* clean old vma */ /* lock vma_lock again <--- UAF */ /* unlock vma_lock */ Since the vma_lock will unlock immediately after hugetlb_handle_userfault(), let's drop the unneeded lock and unlock in hugetlb_handle_userfault() to fix the issue. [1] https://lore.kernel.org/linux-mm/000000000000d5e00a05e834962e@google.com/ [2] https://lore.kernel.org/linux-mm/20220921014457.1668-1-liuzixian4@huawei.com/ CVE-2022-50630 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50630.html CVE-2022-50630 https://bugzilla.suse.com/1254785 SUSE Bug 1254785 In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init of_icc_get() alloc resources for path handle, we should release it when not need anymore. Like the release in dwc3_qcom_interconnect_exit() function. Add icc_put() in error handling to fix this. CVE-2022-50633 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50633.html CVE-2022-50633 https://bugzilla.suse.com/1254644 SUSE Bug 1254644 In the Linux kernel, the following vulnerability has been resolved: powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() I found a null pointer reference in arch_prepare_kprobe(): # echo 'p cmdline_proc_show' > kprobe_events # echo 'p cmdline_proc_show+16' >> kprobe_events Kernel attempted to read user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000000 Faulting instruction address: 0xc000000000050bfc Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA PowerNV Modules linked in: CPU: 0 PID: 122 Comm: sh Not tainted 6.0.0-rc3-00007-gdcf8e5633e2e #10 NIP: c000000000050bfc LR: c000000000050bec CTR: 0000000000005bdc REGS: c0000000348475b0 TRAP: 0300 Not tainted (6.0.0-rc3-00007-gdcf8e5633e2e) MSR: 9000000000009033 <SF,HV,EE,ME,IR,DR,RI,LE> CR: 88002444 XER: 20040006 CFAR: c00000000022d100 DAR: 0000000000000000 DSISR: 40000000 IRQMASK: 0 ... NIP arch_prepare_kprobe+0x10c/0x2d0 LR arch_prepare_kprobe+0xfc/0x2d0 Call Trace: 0xc0000000012f77a0 (unreliable) register_kprobe+0x3c0/0x7a0 __register_trace_kprobe+0x140/0x1a0 __trace_kprobe_create+0x794/0x1040 trace_probe_create+0xc4/0xe0 create_or_delete_trace_kprobe+0x2c/0x80 trace_parse_run_command+0xf0/0x210 probes_write+0x20/0x40 vfs_write+0xfc/0x450 ksys_write+0x84/0x140 system_call_exception+0x17c/0x3a0 system_call_vectored_common+0xe8/0x278 --- interrupt: 3000 at 0x7fffa5682de0 NIP: 00007fffa5682de0 LR: 0000000000000000 CTR: 0000000000000000 REGS: c000000034847e80 TRAP: 3000 Not tainted (6.0.0-rc3-00007-gdcf8e5633e2e) MSR: 900000000280f033 <SF,HV,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 44002408 XER: 00000000 The address being probed has some special: cmdline_proc_show: Probe based on ftrace cmdline_proc_show+16: Probe for the next instruction at the ftrace location The ftrace-based kprobe does not generate kprobe::ainsn::insn, it gets set to NULL. In arch_prepare_kprobe() it will check for: ... prev = get_kprobe(p->addr - 1); preempt_enable_no_resched(); if (prev && ppc_inst_prefixed(ppc_inst_read(prev->ainsn.insn))) { ... If prev is based on ftrace, 'ppc_inst_read(prev->ainsn.insn)' will occur with a null pointer reference. At this point prev->addr will not be a prefixed instruction, so the check can be skipped. Check if prev is ftrace-based kprobe before reading 'prev->ainsn.insn' to fix this problem. [mpe: Trim oops] CVE-2022-50635 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50635.html CVE-2022-50635 https://bugzilla.suse.com/1254592 SUSE Bug 1254592 In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_device_is_present() for VFs by checking PF pci_device_is_present() previously didn't work for VFs because it reads the Vendor and Device ID, which are 0xffff for VFs, which looks like they aren't present. Check the PF instead. Wei Gong reported that if virtio I/O is in progress when the driver is unbound or "0" is written to /sys/.../sriov_numvfs, the virtio I/O operation hangs, which may result in output like this: task:bash state:D stack: 0 pid: 1773 ppid: 1241 flags:0x00004002 Call Trace: schedule+0x4f/0xc0 blk_mq_freeze_queue_wait+0x69/0xa0 blk_mq_freeze_queue+0x1b/0x20 blk_cleanup_queue+0x3d/0xd0 virtblk_remove+0x3c/0xb0 [virtio_blk] virtio_dev_remove+0x4b/0x80 ... device_unregister+0x1b/0x60 unregister_virtio_device+0x18/0x30 virtio_pci_remove+0x41/0x80 pci_device_remove+0x3e/0xb0 This happened because pci_device_is_present(VF) returned "false" in virtio_pci_remove(), so it called virtio_break_device(). The broken vq meant that vring_interrupt() skipped the vq.callback() that would have completed the virtio I/O operation via virtblk_done(). [bhelgaas: commit log, simplify to always use pci_physfn(), add stable tag] CVE-2022-50636 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50636.html CVE-2022-50636 https://bugzilla.suse.com/1254645 SUSE Bug 1254645 In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search caused by bad boot loader inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_status.c:203! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 945 Comm: cat Not tainted 6.0.0-next-20221007-dirty #349 RIP: 0010:ext4_es_end.isra.0+0x34/0x42 RSP: 0018:ffffc9000143b768 EFLAGS: 00010203 RAX: 0000000000000000 RBX: ffff8881769cd0b8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8fc27cf7 RDI: 00000000ffffffff RBP: ffff8881769cd0bc R08: 0000000000000000 R09: ffffc9000143b5f8 R10: 0000000000000001 R11: 0000000000000001 R12: ffff8881769cd0a0 R13: ffff8881768e5668 R14: 00000000768e52f0 R15: 0000000000000000 FS: 00007f359f7f05c0(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f359f5a2000 CR3: 000000017130c000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> __es_tree_search.isra.0+0x6d/0xf5 ext4_es_cache_extent+0xfa/0x230 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_mpage_readpages+0x48e/0xe40 ext4_readahead+0x47/0x50 read_pages+0x82/0x530 page_cache_ra_unbounded+0x199/0x2a0 do_page_cache_ra+0x47/0x70 page_cache_ra_order+0x242/0x400 ondemand_readahead+0x1e8/0x4b0 page_cache_sync_ra+0xf4/0x110 filemap_get_pages+0x131/0xb20 filemap_read+0xda/0x4b0 generic_file_read_iter+0x13a/0x250 ext4_file_read_iter+0x59/0x1d0 vfs_read+0x28f/0x460 ksys_read+0x73/0x160 __x64_sys_read+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> ================================================================== In the above issue, ioctl invokes the swap_inode_boot_loader function to swap inode<5> and inode<12>. However, inode<5> contain incorrect imode and disordered extents, and i_nlink is set to 1. The extents check for inode in the ext4_iget function can be bypassed bacause 5 is EXT4_BOOT_LOADER_INO. While links_count is set to 1, the extents are not initialized in swap_inode_boot_loader. After the ioctl command is executed successfully, the extents are swapped to inode<12>, in this case, run the `cat` command to view inode<12>. And Bug_ON is triggered due to the incorrect extents. When the boot loader inode is not initialized, its imode can be one of the following: 1) the imode is a bad type, which is marked as bad_inode in ext4_iget and set to S_IFREG. 2) the imode is good type but not S_IFREG. 3) the imode is S_IFREG. The BUG_ON may be triggered by bypassing the check in cases 1 and 2. Therefore, when the boot loader inode is bad_inode or its imode is not S_IFREG, initialize the inode to avoid triggering the BUG. CVE-2022-50638 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50638.html CVE-2022-50638 https://bugzilla.suse.com/1255469 SUSE Bug 1255469 In the Linux kernel, the following vulnerability has been resolved: mmc: core: Fix kernel panic when remove non-standard SDIO card SDIO tuple is only allocated for standard SDIO card, especially it causes memory corruption issues when the non-standard SDIO card has removed, which is because the card device's reference counter does not increase for it at sdio_init_func(), but all SDIO card device reference counter gets decreased at sdio_release_func(). CVE-2022-50640 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50640.html CVE-2022-50640 https://bugzilla.suse.com/1254686 SUSE Bug 1254686 In the Linux kernel, the following vulnerability has been resolved: HSI: omap_ssi: Fix refcount leak in ssi_probe When returning or breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node to possibly release the node. CVE-2022-50641 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50641.html CVE-2022-50641 https://bugzilla.suse.com/1254614 SUSE Bug 1254614 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_copy_file_range() If the file is used by swap, before return -EOPNOTSUPP, should free the xid, otherwise, the xid will be leaked. CVE-2022-50643 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50643.html CVE-2022-50643 https://bugzilla.suse.com/1254631 SUSE Bug 1254631 In the Linux kernel, the following vulnerability has been resolved: clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe pm_runtime_get_sync() will increment pm usage counter. Forgetting to putting operation will result in reference leak. Add missing pm_runtime_put_sync in some error paths. CVE-2022-50644 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50644.html CVE-2022-50644 https://bugzilla.suse.com/1254632 SUSE Bug 1254632 In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix possible memory leak in hpsa_init_one() The hpda_alloc_ctlr_info() allocates h and its field reply_map. However, in hpsa_init_one(), if alloc_percpu() failed, the hpsa_init_one() jumps to clean1 directly, which frees h and leaks the h->reply_map. Fix by calling hpda_free_ctlr_info() to release h->replay_map and h instead free h directly. CVE-2022-50646 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50646.html CVE-2022-50646 https://bugzilla.suse.com/1254634 SUSE Bug 1254634 In the Linux kernel, the following vulnerability has been resolved: power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements beyond the end of the adp5061_chg_type[] array. CVE-2022-50649 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50649.html CVE-2022-50649 https://bugzilla.suse.com/1254775 SUSE Bug 1254775 In the Linux kernel, the following vulnerability has been resolved: uio: uio_dmem_genirq: Fix missing unlock in irq configuration Commit b74351287d4b ("uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()") started calling disable_irq() without holding the spinlock because it can sleep. However, that fix introduced another bug: if interrupt is already disabled and a new disable request comes in, then the spinlock is not unlocked: root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0 root@localhost:~# printf '\x00\x00\x00\x00' > /dev/uio0 root@localhost:~# [ 14.851538] BUG: scheduling while atomic: bash/223/0x00000002 [ 14.851991] Modules linked in: uio_dmem_genirq uio myfpga(OE) bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper drm snd_pcm ppdev joydev psmouse snd_timer snd e1000fb_sys_fops syscopyarea parport sysfillrect soundcore sysimgblt input_leds pcspkr i2c_piix4 serio_raw floppy evbug qemu_fw_cfg mac_hid pata_acpi ip_tables x_tables autofs4 [last unloaded: parport_pc] [ 14.854206] CPU: 0 PID: 223 Comm: bash Tainted: G OE 6.0.0-rc7 #21 [ 14.854786] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 14.855664] Call Trace: [ 14.855861] <TASK> [ 14.856025] dump_stack_lvl+0x4d/0x67 [ 14.856325] dump_stack+0x14/0x1a [ 14.856583] __schedule_bug.cold+0x4b/0x5c [ 14.856915] __schedule+0xe81/0x13d0 [ 14.857199] ? idr_find+0x13/0x20 [ 14.857456] ? get_work_pool+0x2d/0x50 [ 14.857756] ? __flush_work+0x233/0x280 [ 14.858068] ? __schedule+0xa95/0x13d0 [ 14.858307] ? idr_find+0x13/0x20 [ 14.858519] ? get_work_pool+0x2d/0x50 [ 14.858798] schedule+0x6c/0x100 [ 14.859009] schedule_hrtimeout_range_clock+0xff/0x110 [ 14.859335] ? tty_write_room+0x1f/0x30 [ 14.859598] ? n_tty_poll+0x1ec/0x220 [ 14.859830] ? tty_ldisc_deref+0x1a/0x20 [ 14.860090] schedule_hrtimeout_range+0x17/0x20 [ 14.860373] do_select+0x596/0x840 [ 14.860627] ? __kernel_text_address+0x16/0x50 [ 14.860954] ? poll_freewait+0xb0/0xb0 [ 14.861235] ? poll_freewait+0xb0/0xb0 [ 14.861517] ? rpm_resume+0x49d/0x780 [ 14.861798] ? common_interrupt+0x59/0xa0 [ 14.862127] ? asm_common_interrupt+0x2b/0x40 [ 14.862511] ? __uart_start.isra.0+0x61/0x70 [ 14.862902] ? __check_object_size+0x61/0x280 [ 14.863255] core_sys_select+0x1c6/0x400 [ 14.863575] ? vfs_write+0x1c9/0x3d0 [ 14.863853] ? vfs_write+0x1c9/0x3d0 [ 14.864121] ? _copy_from_user+0x45/0x70 [ 14.864526] do_pselect.constprop.0+0xb3/0xf0 [ 14.864893] ? do_syscall_64+0x6d/0x90 [ 14.865228] ? do_syscall_64+0x6d/0x90 [ 14.865556] __x64_sys_pselect6+0x76/0xa0 [ 14.865906] do_syscall_64+0x60/0x90 [ 14.866214] ? syscall_exit_to_user_mode+0x2a/0x50 [ 14.866640] ? do_syscall_64+0x6d/0x90 [ 14.866972] ? do_syscall_64+0x6d/0x90 [ 14.867286] ? do_syscall_64+0x6d/0x90 [ 14.867626] entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] stripped [ 14.872959] </TASK> ('myfpga' is a simple 'uio_dmem_genirq' driver I wrote to test this) The implementation of "uio_dmem_genirq" was based on "uio_pdrv_genirq" and it is used in a similar manner to the "uio_pdrv_genirq" driver with respect to interrupt configuration and handling. At the time "uio_dmem_genirq" was introduced, both had the same implementation of the 'uio_info' handlers irqcontrol() and handler(). Then commit 34cb27528398 ("UIO: Fix concurrency issue"), which was only applied to "uio_pdrv_genirq", ended up making them a little different. That commit, among other things, changed disable_irq() to disable_irq_nosync() in the implementation of irqcontrol(). The motivation there was to avoid a deadlock between irqcontrol() and handler(), since it added a spinlock in the irq handler, and disable_irq() waits for the completion of the irq handler. By changing disable_irq() to disable_irq_nosync() in irqcontrol(), we also avoid the sleeping-whil ---truncated--- CVE-2022-50652 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50652.html CVE-2022-50652 https://bugzilla.suse.com/1254728 SUSE Bug 1254728 In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). So fix this by checking the return value and calling mmc_free_host() in the error path. CVE-2022-50653 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50653.html CVE-2022-50653 https://bugzilla.suse.com/1254729 SUSE Bug 1254729 In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Clear nfc_target before being used Fix a slab-out-of-bounds read that occurs in nla_put() called from nfc_genl_send_target() when target->sensb_res_len, which is duplicated from an nfc_target in pn533, is too large as the nfc_target is not properly initialized and retains garbage values. Clear nfc_targets with memset() before they are used. Found by a modified version of syzkaller. BUG: KASAN: slab-out-of-bounds in nla_put Call Trace: memcpy nla_put nfc_genl_dump_targets genl_lock_dumpit netlink_dump __netlink_dump_start genl_family_rcv_msg_dumpit genl_rcv_msg netlink_rcv_skb genl_rcv netlink_unicast netlink_sendmsg sock_sendmsg ____sys_sendmsg ___sys_sendmsg __sys_sendmsg do_syscall_64 CVE-2022-50656 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50656.html CVE-2022-50656 https://bugzilla.suse.com/1254745 SUSE Bug 1254745 In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fix memory leak in error path If for some reason the speedbin length is incorrect, then there is a memory leak in the error path because we never free the speedbin buffer. This commit fixes the error path to always free the speedbin buffer. CVE-2022-50658 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50658.html CVE-2022-50658 https://bugzilla.suse.com/1254756 SUSE Bug 1254756 In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2200: fix memory leak in ipw_wdev_init() In the error path of ipw_wdev_init(), exception value is returned, and the memory applied for in the function is not released. Also the memory is not released in ipw_pci_probe(). As a result, memory leakage occurs. So memory release needs to be added to the error path of ipw_wdev_init(). CVE-2022-50660 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50660.html CVE-2022-50660 https://bugzilla.suse.com/1254676 SUSE Bug 1254676 In the Linux kernel, the following vulnerability has been resolved: seccomp: Move copy_seccomp() to no failure path. Our syzbot instance reported memory leaks in do_seccomp() [0], similar to the report [1]. It shows that we miss freeing struct seccomp_filter and some objects included in it. We can reproduce the issue with the program below [2] which calls one seccomp() and two clone() syscalls. The first clone()d child exits earlier than its parent and sends a signal to kill it during the second clone(), more precisely before the fatal_signal_pending() test in copy_process(). When the parent receives the signal, it has to destroy the embryonic process and return -EINTR to user space. In the failure path, we have to call seccomp_filter_release() to decrement the filter's refcount. Initially, we called it in free_task() called from the failure path, but the commit 3a15fb6ed92c ("seccomp: release filter after task is fully dead") moved it to release_task() to notify user space as early as possible that the filter is no longer used. To keep the change and current seccomp refcount semantics, let's move copy_seccomp() just after the signal check and add a WARN_ON_ONCE() in free_task() for future debugging. [0]: unreferenced object 0xffff8880063add00 (size 256): comm "repro_seccomp", pid 230, jiffies 4294687090 (age 9.914s) hex dump (first 32 bytes): 01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ................ ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................ backtrace: do_seccomp (./include/linux/slab.h:600 ./include/linux/slab.h:733 kernel/seccomp.c:666 kernel/seccomp.c:708 kernel/seccomp.c:1871 kernel/seccomp.c:1991) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) unreferenced object 0xffffc90000035000 (size 4096): comm "repro_seccomp", pid 230, jiffies 4294687090 (age 9.915s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 05 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: __vmalloc_node_range (mm/vmalloc.c:3226) __vmalloc_node (mm/vmalloc.c:3261 (discriminator 4)) bpf_prog_alloc_no_stats (kernel/bpf/core.c:91) bpf_prog_alloc (kernel/bpf/core.c:129) bpf_prog_create_from_user (net/core/filter.c:1414) do_seccomp (kernel/seccomp.c:671 kernel/seccomp.c:708 kernel/seccomp.c:1871 kernel/seccomp.c:1991) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) unreferenced object 0xffff888003fa1000 (size 1024): comm "repro_seccomp", pid 230, jiffies 4294687090 (age 9.915s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: bpf_prog_alloc_no_stats (./include/linux/slab.h:600 ./include/linux/slab.h:733 kernel/bpf/core.c:95) bpf_prog_alloc (kernel/bpf/core.c:129) bpf_prog_create_from_user (net/core/filter.c:1414) do_seccomp (kernel/seccomp.c:671 kernel/seccomp.c:708 kernel/seccomp.c:1871 kernel/seccomp.c:1991) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) unreferenced object 0xffff888006360240 (size 16): comm "repro_seccomp", pid 230, jiffies 4294687090 (age 9.915s) hex dump (first 16 bytes): 01 00 37 00 76 65 72 6c e0 83 01 06 80 88 ff ff ..7.verl........ backtrace: bpf_prog_store_orig_filter (net/core/filter.c:1137) bpf_prog_create_from_user (net/core/filter.c:1428) do_seccomp (kernel/seccomp.c:671 kernel/seccomp.c:708 kernel/seccomp.c:1871 kernel/seccomp.c:1991) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) unreferenced object 0xffff888 ---truncated--- CVE-2022-50661 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50661.html CVE-2022-50661 https://bugzilla.suse.com/1254759 SUSE Bug 1254759 In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: fix memory leak in hns_roce_alloc_mr() When hns_roce_mr_enable() failed in hns_roce_alloc_mr(), mr_key is not released. Compiled test only. CVE-2022-50662 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50662.html CVE-2022-50662 https://bugzilla.suse.com/1254625 SUSE Bug 1254625 In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: fix leak of memory fw CVE-2022-50664 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50664.html CVE-2022-50664 https://bugzilla.suse.com/1254974 SUSE Bug 1254974 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siw_qp_destroy() call, so siw must not hold any remaining reference to the QP upon return. A use-after-free was encountered in xfstest generic/460, while testing NFSoRDMA. Here, after a TCP connection drop by peer, the triggered siw_cm_work_handler got delayed until after QP destroy call, referencing a QP which has already freed. CVE-2022-50666 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50666.html CVE-2022-50666 https://bugzilla.suse.com/1254674 SUSE Bug 1254674 In the Linux kernel, the following vulnerability has been resolved: ext4: fix deadlock due to mbcache entry corruption When manipulating xattr blocks, we can deadlock infinitely looping inside ext4_xattr_block_set() where we constantly keep finding xattr block for reuse in mbcache but we are unable to reuse it because its reference count is too big. This happens because cache entry for the xattr block is marked as reusable (e_reusable set) although its reference count is too big. When this inconsistency happens, this inconsistent state is kept indefinitely and so ext4_xattr_block_set() keeps retrying indefinitely. The inconsistent state is caused by non-atomic update of e_reusable bit. e_reusable is part of a bitfield and e_reusable update can race with update of e_referenced bit in the same bitfield resulting in loss of one of the updates. Fix the problem by using atomic bitops instead. This bug has been around for many years, but it became *much* easier to hit after commit 65f8b80053a1 ("ext4: fix race when reusing xattr blocks"). CVE-2022-50668 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50668.html CVE-2022-50668 https://bugzilla.suse.com/1254763 SUSE Bug 1254763 In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible name leak in ocxl_file_register_afu() If device_register() returns error in ocxl_file_register_afu(), the name allocated by dev_set_name() need be freed. As comment of device_register() says, it should use put_device() to give up the reference in the error path. So fix this by calling put_device(), then the name can be freed in kobject_cleanup(), and info is freed in info_release(). CVE-2022-50669 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50669.html CVE-2022-50669 https://bugzilla.suse.com/1254710 SUSE Bug 1254710 In the Linux kernel, the following vulnerability has been resolved: mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). Fix this by checking the return value and goto error path wihch will call mmc_free_host(). CVE-2022-50670 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50670.html CVE-2022-50670 https://bugzilla.suse.com/1254699 SUSE Bug 1254699 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix "kernel NULL pointer dereference" error When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized. Because of creation of qp fails, the function rxe_create_qp will call rxe_qp_do_cleanup to handle allocated resource. Before calling __rxe_do_task, both qp->req.task.func and qp->req.task.arg should be checked. CVE-2022-50671 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50671.html CVE-2022-50671 https://bugzilla.suse.com/1254711 SUSE Bug 1254711 In the Linux kernel, the following vulnerability has been resolved: mailbox: zynq-ipi: fix error handling while device_register() fails If device_register() fails, it has two issues: 1. The name allocated by dev_set_name() is leaked. 2. The parent of device is not NULL, device_unregister() is called in zynqmp_ipi_free_mboxes(), it will lead a kernel crash because of removing not added device. Call put_device() to give up the reference, so the name is freed in kobject_cleanup(). Add device registered check in zynqmp_ipi_free_mboxes() to avoid null-ptr-deref. CVE-2022-50672 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50672.html CVE-2022-50672 https://bugzilla.suse.com/1254696 SUSE Bug 1254696 In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+0x28/0x1a0 Read of size 8 at addr ffff88814b13f378 by task mount/710 CPU: 1 PID: 710 Comm: mount Not tainted 6.1.0-rc3-next #370 Call Trace: <TASK> dump_stack_lvl+0x73/0x9f print_report+0x25d/0x759 kasan_report+0xc0/0x120 __asan_load8+0x99/0x140 __list_add_valid+0x28/0x1a0 ext4_orphan_cleanup+0x564/0x9d0 [ext4] __ext4_fill_super+0x48e2/0x5300 [ext4] ext4_fill_super+0x19f/0x3a0 [ext4] get_tree_bdev+0x27b/0x450 ext4_get_tree+0x19/0x30 [ext4] vfs_get_tree+0x49/0x150 path_mount+0xaae/0x1350 do_mount+0xe2/0x110 __x64_sys_mount+0xf0/0x190 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> [...] ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup --- loop1: assume last_orphan is 12 --- list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan) ext4_truncate --> return 0 ext4_inode_attach_jinode --> return -ENOMEM iput(inode) --> free inode<12> --- loop2: last_orphan is still 12 --- list_add(&EXT4_I(inode)->i_orphan, &EXT4_SB(sb)->s_orphan); // use inode<12> and trigger UAF To solve this issue, we need to propagate the return value of ext4_inode_attach_jinode() appropriately. CVE-2022-50673 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50673.html CVE-2022-50673 https://bugzilla.suse.com/1255521 SUSE Bug 1255521 https://bugzilla.suse.com/1255522 SUSE Bug 1255522 In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored Prior to commit 69e3b846d8a7 ("arm64: mte: Sync tags for pages where PTE is untagged"), mte_sync_tags() was only called for pte_tagged() entries (those mapped with PROT_MTE). Therefore mte_sync_tags() could safely use test_and_set_bit(PG_mte_tagged, &page->flags) without inadvertently setting PG_mte_tagged on an untagged page. The above commit was required as guests may enable MTE without any control at the stage 2 mapping, nor a PROT_MTE mapping in the VMM. However, the side-effect was that any page with a PTE that looked like swap (or migration) was getting PG_mte_tagged set automatically. A subsequent page copy (e.g. migration) copied the tags to the destination page even if the tags were owned by KASAN. This issue was masked by the page_kasan_tag_reset() call introduced in commit e5b8d9218951 ("arm64: mte: reset the page tag in page->flags"). When this commit was reverted (20794545c146), KASAN started reporting access faults because the overriding tags in a page did not match the original page->flags (with CONFIG_KASAN_HW_TAGS=y): BUG: KASAN: invalid-access in copy_page+0x10/0xd0 arch/arm64/lib/copy_page.S:26 Read at addr f5ff000017f2e000 by task syz-executor.1/2218 Pointer tag: [f5], memory tag: [f2] Move the PG_mte_tagged bit setting from mte_sync_tags() to the actual place where tags are cleared (mte_sync_page_tags()) or restored (mte_restore_tags()). CVE-2022-50675 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50675.html CVE-2022-50675 https://bugzilla.suse.com/1254664 SUSE Bug 1254664 In the Linux kernel, the following vulnerability has been resolved: ipmi: fix use after free in _ipmi_destroy_user() The intf_free() function frees the "intf" pointer so we cannot dereference it again on the next line. CVE-2022-50677 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50677.html CVE-2022-50677 https://bugzilla.suse.com/1254692 SUSE Bug 1254692 In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variable i is changed when setting random MAC address and causes invalid address access when printing the value of pi->reqs[i]->reqid. We replace reqs index with ri to fix the issue. [ 136.726473] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000 [ 136.737365] Mem abort info: [ 136.740172] ESR = 0x96000004 [ 136.743359] Exception class = DABT (current EL), IL = 32 bits [ 136.749294] SET = 0, FnV = 0 [ 136.752481] EA = 0, S1PTW = 0 [ 136.755635] Data abort info: [ 136.758514] ISV = 0, ISS = 0x00000004 [ 136.762487] CM = 0, WnR = 0 [ 136.765522] user pgtable: 4k pages, 48-bit VAs, pgdp = 000000005c4e2577 [ 136.772265] [0000000000000000] pgd=0000000000000000 [ 136.777160] Internal error: Oops: 96000004 [#1] PREEMPT SMP [ 136.782732] Modules linked in: brcmfmac(O) brcmutil(O) cfg80211(O) compat(O) [ 136.789788] Process wificond (pid: 3175, stack limit = 0x00000000053048fb) [ 136.796664] CPU: 3 PID: 3175 Comm: wificond Tainted: G O 4.19.42-00001-g531a5f5 #1 [ 136.805532] Hardware name: Freescale i.MX8MQ EVK (DT) [ 136.810584] pstate: 60400005 (nZCv daif +PAN -UAO) [ 136.815429] pc : brcmf_pno_config_sched_scans+0x6cc/0xa80 [brcmfmac] [ 136.821811] lr : brcmf_pno_config_sched_scans+0x67c/0xa80 [brcmfmac] [ 136.828162] sp : ffff00000e9a3880 [ 136.831475] x29: ffff00000e9a3890 x28: ffff800020543400 [ 136.836786] x27: ffff8000b1008880 x26: ffff0000012bf6a0 [ 136.842098] x25: ffff80002054345c x24: ffff800088d22400 [ 136.847409] x23: ffff0000012bf638 x22: ffff0000012bf6d8 [ 136.852721] x21: ffff8000aced8fc0 x20: ffff8000ac164400 [ 136.858032] x19: ffff00000e9a3946 x18: 0000000000000000 [ 136.863343] x17: 0000000000000000 x16: 0000000000000000 [ 136.868655] x15: ffff0000093f3b37 x14: 0000000000000050 [ 136.873966] x13: 0000000000003135 x12: 0000000000000000 [ 136.879277] x11: 0000000000000000 x10: ffff000009a61888 [ 136.884589] x9 : 000000000000000f x8 : 0000000000000008 [ 136.889900] x7 : 303a32303d726464 x6 : ffff00000a1f957d [ 136.895211] x5 : 0000000000000000 x4 : ffff00000e9a3942 [ 136.900523] x3 : 0000000000000000 x2 : ffff0000012cead8 [ 136.905834] x1 : ffff0000012bf6d8 x0 : 0000000000000000 [ 136.911146] Call trace: [ 136.913623] brcmf_pno_config_sched_scans+0x6cc/0xa80 [brcmfmac] [ 136.919658] brcmf_pno_start_sched_scan+0xa4/0x118 [brcmfmac] [ 136.925430] brcmf_cfg80211_sched_scan_start+0x80/0xe0 [brcmfmac] [ 136.931636] nl80211_start_sched_scan+0x140/0x308 [cfg80211] [ 136.937298] genl_rcv_msg+0x358/0x3f4 [ 136.940960] netlink_rcv_skb+0xb4/0x118 [ 136.944795] genl_rcv+0x34/0x48 [ 136.947935] netlink_unicast+0x264/0x300 [ 136.951856] netlink_sendmsg+0x2e4/0x33c [ 136.955781] __sys_sendto+0x120/0x19c CVE-2022-50678 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50678.html CVE-2022-50678 https://bugzilla.suse.com/1254902 SUSE Bug 1254902 In the Linux kernel, the following vulnerability has been resolved: i40e: Fix DMA mappings leak During reallocation of RX buffers, new DMA mappings are created for those buffers. steps for reproduction: while : do for ((i=0; i<=8160; i=i+32)) do ethtool -G enp130s0f0 rx $i tx $i sleep 0.5 ethtool -g enp130s0f0 done done This resulted in crash: i40e 0000:01:00.1: Unable to allocate memory for the Rx descriptor ring, size=65536 Driver BUG WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:141 xdp_rxq_info_unreg+0x43/0x50 Call Trace: i40e_free_rx_resources+0x70/0x80 [i40e] i40e_set_ringparam+0x27c/0x800 [i40e] ethnl_set_rings+0x1b2/0x290 genl_family_rcv_msg_doit.isra.15+0x10f/0x150 genl_family_rcv_msg+0xb3/0x160 ? rings_fill_reply+0x1a0/0x1a0 genl_rcv_msg+0x47/0x90 ? genl_family_rcv_msg+0x160/0x160 netlink_rcv_skb+0x4c/0x120 genl_rcv+0x24/0x40 netlink_unicast+0x196/0x230 netlink_sendmsg+0x204/0x3d0 sock_sendmsg+0x4c/0x50 __sys_sendto+0xee/0x160 ? handle_mm_fault+0xbe/0x1e0 ? syscall_trace_enter+0x1d3/0x2c0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca RIP: 0033:0x7f5eac8b035b Missing register, driver bug WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:119 xdp_rxq_info_unreg_mem_model+0x69/0x140 Call Trace: xdp_rxq_info_unreg+0x1e/0x50 i40e_free_rx_resources+0x70/0x80 [i40e] i40e_set_ringparam+0x27c/0x800 [i40e] ethnl_set_rings+0x1b2/0x290 genl_family_rcv_msg_doit.isra.15+0x10f/0x150 genl_family_rcv_msg+0xb3/0x160 ? rings_fill_reply+0x1a0/0x1a0 genl_rcv_msg+0x47/0x90 ? genl_family_rcv_msg+0x160/0x160 netlink_rcv_skb+0x4c/0x120 genl_rcv+0x24/0x40 netlink_unicast+0x196/0x230 netlink_sendmsg+0x204/0x3d0 sock_sendmsg+0x4c/0x50 __sys_sendto+0xee/0x160 ? handle_mm_fault+0xbe/0x1e0 ? syscall_trace_enter+0x1d3/0x2c0 __x64_sys_sendto+0x24/0x30 do_syscall_64+0x5b/0x1a0 entry_SYSCALL_64_after_hwframe+0x65/0xca RIP: 0033:0x7f5eac8b035b This was caused because of new buffers with different RX ring count should substitute older ones, but those buffers were freed in i40e_configure_rx_ring and reallocated again with i40e_alloc_rx_bi, thus kfree on rx_bi caused leak of already mapped DMA. Fix this by reallocating ZC with rx_bi_zc struct when BPF program loads. Additionally reallocate back to rx_bi when BPF program unloads. If BPF program is loaded/unloaded and XSK pools are created, reallocate RX queues accordingly in XSP_SETUP_XSK_POOL handler. CVE-2022-50679 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50679.html CVE-2022-50679 https://bugzilla.suse.com/1254656 SUSE Bug 1254656 In the Linux kernel, the following vulnerability has been resolved: mrp: introduce active flags to prevent UAF when applicant uninit The caller of del_timer_sync must prevent restarting of the timer, If we have no this synchronization, there is a small probability that the cancellation will not be successful. And syzbot report the fellowing crash: ================================================================== BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:929 [inline] BUG: KASAN: use-after-free in enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 Write at addr f9ff000024df6058 by task syz-fuzzer/2256 Pointer tag: [f9], memory tag: [fe] CPU: 1 PID: 2256 Comm: syz-fuzzer Not tainted 6.1.0-rc5-syzkaller-00008- ge01d50cbd6ee #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 arch/arm64/kernel/stacktrace.c:156 dump_backtrace arch/arm64/kernel/stacktrace.c:162 [inline] show_stack+0x18/0x40 arch/arm64/kernel/stacktrace.c:163 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x68/0x84 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x1a8/0x4a0 mm/kasan/report.c:395 kasan_report+0x94/0xb4 mm/kasan/report.c:495 __do_kernel_fault+0x164/0x1e0 arch/arm64/mm/fault.c:320 do_bad_area arch/arm64/mm/fault.c:473 [inline] do_tag_check_fault+0x78/0x8c arch/arm64/mm/fault.c:749 do_mem_abort+0x44/0x94 arch/arm64/mm/fault.c:825 el1_abort+0x40/0x60 arch/arm64/kernel/entry-common.c:367 el1h_64_sync_handler+0xd8/0xe4 arch/arm64/kernel/entry-common.c:427 el1h_64_sync+0x64/0x68 arch/arm64/kernel/entry.S:576 hlist_add_head include/linux/list.h:929 [inline] enqueue_timer+0x18/0xa4 kernel/time/timer.c:605 mod_timer+0x14/0x20 kernel/time/timer.c:1161 mrp_periodic_timer_arm net/802/mrp.c:614 [inline] mrp_periodic_timer+0xa0/0xc0 net/802/mrp.c:627 call_timer_fn.constprop.0+0x24/0x80 kernel/time/timer.c:1474 expire_timers+0x98/0xc4 kernel/time/timer.c:1519 To fix it, we can introduce a new active flags to make sure the timer will not restart. CVE-2022-50697 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50697.html CVE-2022-50697 https://bugzilla.suse.com/1255594 SUSE Bug 1255594 https://bugzilla.suse.com/1255595 SUSE Bug 1255595 In the Linux kernel, the following vulnerability has been resolved: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() If clk_hw_register() fails, the corresponding clk should not be unregistered. To handle errors from loops, clean up partial iterations before doing the goto. So add a clk_hw_unregister(). Then use a while (--i >= 0) loop in the unwind section. CVE-2022-50698 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50698.html CVE-2022-50698 https://bugzilla.suse.com/1255608 SUSE Bug 1255608 In the Linux kernel, the following vulnerability has been resolved: selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() The following warning was triggered on a hardware environment: SELinux: Converting 162 SID table entries... BUG: sleeping function called from invalid context at __might_sleep+0x60/0x74 0x0 in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 5943, name: tar CPU: 7 PID: 5943 Comm: tar Tainted: P O 5.10.0 #1 Call trace: dump_backtrace+0x0/0x1c8 show_stack+0x18/0x28 dump_stack+0xe8/0x15c ___might_sleep+0x168/0x17c __might_sleep+0x60/0x74 __kmalloc_track_caller+0xa0/0x7dc kstrdup+0x54/0xac convert_context+0x48/0x2e4 sidtab_context_to_sid+0x1c4/0x36c security_context_to_sid_core+0x168/0x238 security_context_to_sid_default+0x14/0x24 inode_doinit_use_xattr+0x164/0x1e4 inode_doinit_with_dentry+0x1c0/0x488 selinux_d_instantiate+0x20/0x34 security_d_instantiate+0x70/0xbc d_splice_alias+0x4c/0x3c0 ext4_lookup+0x1d8/0x200 [ext4] __lookup_slow+0x12c/0x1e4 walk_component+0x100/0x200 path_lookupat+0x88/0x118 filename_lookup+0x98/0x130 user_path_at_empty+0x48/0x60 vfs_statx+0x84/0x140 vfs_fstatat+0x20/0x30 __se_sys_newfstatat+0x30/0x74 __arm64_sys_newfstatat+0x1c/0x2c el0_svc_common.constprop.0+0x100/0x184 do_el0_svc+0x1c/0x2c el0_svc+0x20/0x34 el0_sync_handler+0x80/0x17c el0_sync+0x13c/0x140 SELinux: Context system_u:object_r:pssp_rsyslog_log_t:s0:c0 is not valid (left unmapped). It was found that within a critical section of spin_lock_irqsave in sidtab_context_to_sid(), convert_context() (hooked by sidtab_convert_params.func) might cause the process to sleep via allocating memory with GFP_KERNEL, which is problematic. As Ondrej pointed out [1], convert_context()/sidtab_convert_params.func has another caller sidtab_convert_tree(), which is okay with GFP_KERNEL. Therefore, fix this problem by adding a gfp_t argument for convert_context()/sidtab_convert_params.func and pass GFP_KERNEL/_ATOMIC properly in individual callers. [PM: wrap long BUG() output lines, tweak subject line] CVE-2022-50699 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50699.html CVE-2022-50699 https://bugzilla.suse.com/1255582 SUSE Bug 1255582 In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has sent, this is leading into an SMMU fault triggering kernel panic. This is happening on copy engine channel 3 (CE3) where the driver normally enqueues WMI commands to the firmware. Upon receiving a copy complete interrupt, host driver will immediately unmap and frees the buffer presuming that hardware has processed the buffer. In the issue case, upon receiving copy complete interrupt, host driver will unmap and free the buffer but since hardware is still accessing the buffer (which in this case got unmapped in parallel), SMMU hardware will trigger an SMMU fault resulting in a kernel panic. In order to avoid this, as a work around, add a delay before unmapping the copy engine source DMA buffer. This is conditionally done for WCN3990 and only for the CE3 channel where issue is seen. Below is the crash signature: wifi smmu error: kernel: [ 10.120965] arm-smmu 15000000.iommu: Unhandled context fault: fsr=0x402, iova=0x7fdfd8ac0, fsynr=0x500003,cbfrsynra=0xc1, cb=6 arm-smmu 15000000.iommu: Unhandled context fault:fsr=0x402, iova=0x7fe06fdc0, fsynr=0x710003, cbfrsynra=0xc1, cb=6 qcom-q6v5-mss 4080000.remoteproc: fatal error received: err_qdi.c:1040:EF:wlan_process:0x1:WLAN RT:0x2091: cmnos_thread.c:3998:Asserted in copy_engine.c:AXI_ERROR_DETECTED:2149 remoteproc remoteproc0: crash detected in 4080000.remoteproc: type fatal error <3> remoteproc remoteproc0: handling crash #1 in 4080000.remoteproc pc : __arm_lpae_unmap+0x500/0x514 lr : __arm_lpae_unmap+0x4bc/0x514 sp : ffffffc011ffb530 x29: ffffffc011ffb590 x28: 0000000000000000 x27: 0000000000000000 x26: 0000000000000004 x25: 0000000000000003 x24: ffffffc011ffb890 x23: ffffffa762ef9be0 x22: ffffffa77244ef00 x21: 0000000000000009 x20: 00000007fff7c000 x19: 0000000000000003 x18: 0000000000000000 x17: 0000000000000004 x16: ffffffd7a357d9f0 x15: 0000000000000000 x14: 00fd5d4fa7ffffff x13: 000000000000000e x12: 0000000000000000 x11: 00000000ffffffff x10: 00000000fffffe00 x9 : 000000000000017c x8 : 000000000000000c x7 : 0000000000000000 x6 : ffffffa762ef9000 x5 : 0000000000000003 x4 : 0000000000000004 x3 : 0000000000001000 x2 : 00000007fff7c000 x1 : ffffffc011ffb890 x0 : 0000000000000000 Call trace: __arm_lpae_unmap+0x500/0x514 __arm_lpae_unmap+0x4bc/0x514 __arm_lpae_unmap+0x4bc/0x514 arm_lpae_unmap_pages+0x78/0xa4 arm_smmu_unmap_pages+0x78/0x104 __iommu_unmap+0xc8/0x1e4 iommu_unmap_fast+0x38/0x48 __iommu_dma_unmap+0x84/0x104 iommu_dma_free+0x34/0x50 dma_free_attrs+0xa4/0xd0 ath10k_htt_rx_free+0xc4/0xf4 [ath10k_core] ath10k_core_stop+0x64/0x7c [ath10k_core] ath10k_halt+0x11c/0x180 [ath10k_core] ath10k_stop+0x54/0x94 [ath10k_core] drv_stop+0x48/0x1c8 [mac80211] ieee80211_do_open+0x638/0x77c [mac80211] ieee80211_open+0x48/0x5c [mac80211] __dev_open+0xb4/0x174 __dev_change_flags+0xc4/0x1dc dev_change_flags+0x3c/0x7c devinet_ioctl+0x2b4/0x580 inet_ioctl+0xb0/0x1b4 sock_do_ioctl+0x4c/0x16c compat_ifreq_ioctl+0x1cc/0x35c compat_sock_ioctl+0x110/0x2ac __arm64_compat_sys_ioctl+0xf4/0x3e0 el0_svc_common+0xb4/0x17c el0_svc_compat_handler+0x2c/0x58 el0_svc_compat+0x8/0x2c Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.2.0-01387-QCAHLSWMTPLZ-1 CVE-2022-50700 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50700.html CVE-2022-50700 https://bugzilla.suse.com/1255576 SUSE Bug 1255576 https://bugzilla.suse.com/1255577 SUSE Bug 1255577 In the Linux kernel, the following vulnerability has been resolved: vdpa_sim: fix possible memory leak in vdpasim_net_init() and vdpasim_blk_init() Inject fault while probing module, if device_register() fails in vdpasim_net_init() or vdpasim_blk_init(), but the refcount of kobject is not decreased to 0, the name allocated in dev_set_name() is leaked. Fix this by calling put_device(), so that name can be freed in callback function kobject_cleanup(). (vdpa_sim_net) unreferenced object 0xffff88807eebc370 (size 16): comm "modprobe", pid 3848, jiffies 4362982860 (age 18.153s) hex dump (first 16 bytes): 76 64 70 61 73 69 6d 5f 6e 65 74 00 6b 6b 6b a5 vdpasim_net.kkk. backtrace: [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150 [<ffffffff81731d53>] kstrdup+0x33/0x60 [<ffffffff83a5d421>] kobject_set_name_vargs+0x41/0x110 [<ffffffff82d87aab>] dev_set_name+0xab/0xe0 [<ffffffff82d91a23>] device_add+0xe3/0x1a80 [<ffffffffa0270013>] 0xffffffffa0270013 [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0 [<ffffffff813739cb>] do_init_module+0x1ab/0x640 [<ffffffff81379d20>] load_module+0x5d00/0x77f0 [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0 [<ffffffff83c4d505>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 (vdpa_sim_blk) unreferenced object 0xffff8881070c1250 (size 16): comm "modprobe", pid 6844, jiffies 4364069319 (age 17.572s) hex dump (first 16 bytes): 76 64 70 61 73 69 6d 5f 62 6c 6b 00 6b 6b 6b a5 vdpasim_blk.kkk. backtrace: [<ffffffff8174f19e>] __kmalloc_node_track_caller+0x4e/0x150 [<ffffffff81731d53>] kstrdup+0x33/0x60 [<ffffffff83a5d421>] kobject_set_name_vargs+0x41/0x110 [<ffffffff82d87aab>] dev_set_name+0xab/0xe0 [<ffffffff82d91a23>] device_add+0xe3/0x1a80 [<ffffffffa0220013>] 0xffffffffa0220013 [<ffffffff81001c27>] do_one_initcall+0x87/0x2e0 [<ffffffff813739cb>] do_init_module+0x1ab/0x640 [<ffffffff81379d20>] load_module+0x5d00/0x77f0 [<ffffffff8137bc40>] __do_sys_finit_module+0x110/0x1b0 [<ffffffff83c4d505>] do_syscall_64+0x35/0x80 [<ffffffff83e0006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 CVE-2022-50702 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50702.html CVE-2022-50702 https://bugzilla.suse.com/1255624 SUSE Bug 1255624 In the Linux kernel, the following vulnerability has been resolved: soc: qcom: smsm: Fix refcount leak bugs in qcom_smsm_probe() There are two refcount leak bugs in qcom_smsm_probe(): (1) The 'local_node' is escaped out from for_each_child_of_node() as the break of iteration, we should call of_node_put() for it in error path or when it is not used anymore. (2) The 'node' is escaped out from for_each_available_child_of_node() as the 'goto', we should call of_node_put() for it in goto target. CVE-2022-50703 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50703.html CVE-2022-50703 https://bugzilla.suse.com/1255607 SUSE Bug 1255607 In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free during usb config switch In the process of switching USB config from rndis to other config, if the hardware does not support the ->pullup callback, or the hardware encounters a low probability fault, both of them may cause the ->pullup callback to fail, which will then cause a system panic (use after free). The gadget drivers sometimes need to be unloaded regardless of the hardware's behavior. Analysis as follows: ======================================================================= (1) write /config/usb_gadget/g1/UDC "none" gether_disconnect+0x2c/0x1f8 rndis_disable+0x4c/0x74 composite_disconnect+0x74/0xb0 configfs_composite_disconnect+0x60/0x7c usb_gadget_disconnect+0x70/0x124 usb_gadget_unregister_driver+0xc8/0x1d8 gadget_dev_desc_UDC_store+0xec/0x1e4 (2) rm /config/usb_gadget/g1/configs/b.1/f1 rndis_deregister+0x28/0x54 rndis_free+0x44/0x7c usb_put_function+0x14/0x1c config_usb_cfg_unlink+0xc4/0xe0 configfs_unlink+0x124/0x1c8 vfs_unlink+0x114/0x1dc (3) rmdir /config/usb_gadget/g1/functions/rndis.gs4 panic+0x1fc/0x3d0 do_page_fault+0xa8/0x46c do_mem_abort+0x3c/0xac el1_sync_handler+0x40/0x78 0xffffff801138f880 rndis_close+0x28/0x34 eth_stop+0x74/0x110 dev_close_many+0x48/0x194 rollback_registered_many+0x118/0x814 unregister_netdev+0x20/0x30 gether_cleanup+0x1c/0x38 rndis_attr_release+0xc/0x14 kref_put+0x74/0xb8 configfs_rmdir+0x314/0x374 If gadget->ops->pullup() return an error, function rndis_close() will be called, then it will causes a use-after-free problem. ======================================================================= CVE-2022-50704 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50704.html CVE-2022-50704 https://bugzilla.suse.com/1255623 SUSE Bug 1255623 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg() syzbot is reporting uninit value at ath9k_htc_rx_msg() [1], for ioctl(USB_RAW_IOCTL_EP_WRITE) can call ath9k_hif_usb_rx_stream() with pkt_len = 0 but ath9k_hif_usb_rx_stream() uses __dev_alloc_skb(pkt_len + 32, GFP_ATOMIC) based on an assumption that pkt_len is valid. As a result, ath9k_hif_usb_rx_stream() allocates skb with uninitialized memory and ath9k_htc_rx_msg() is reading from uninitialized memory. Since bytes accessed by ath9k_htc_rx_msg() is not known until ath9k_htc_rx_msg() is called, it would be difficult to check minimal valid pkt_len at "if (pkt_len > 2 * MAX_RX_BUF_SIZE) {" line in ath9k_hif_usb_rx_stream(). We have two choices. One is to workaround by adding __GFP_ZERO so that ath9k_htc_rx_msg() sees 0 if pkt_len is invalid. The other is to let ath9k_htc_rx_msg() validate pkt_len before accessing. This patch chose the latter. Note that I'm not sure threshold condition is correct, for I can't find details on possible packet length used by this protocol. CVE-2022-50709 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50709.html CVE-2022-50709 https://bugzilla.suse.com/1255565 SUSE Bug 1255565 In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdx_raid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdx_raid1 thread were not stop, Even if the associated resources have been released. it will caused a NULL dereference when we do poweroff. This causes the following Oops: [ 287.587787] BUG: kernel NULL pointer dereference, address: 0000000000000070 [ 287.594762] #PF: supervisor read access in kernel mode [ 287.599912] #PF: error_code(0x0000) - not-present page [ 287.605061] PGD 0 P4D 0 [ 287.607612] Oops: 0000 [#1] SMP NOPTI [ 287.611287] CPU: 3 PID: 5265 Comm: md0_raid1 Tainted: G U 5.10.146 #0 [ 287.619029] Hardware name: xxxxxxx/To be filled by O.E.M, BIOS 5.19 06/16/2022 [ 287.626775] RIP: 0010:md_check_recovery+0x57/0x500 [md_mod] [ 287.632357] Code: fe 01 00 00 48 83 bb 10 03 00 00 00 74 08 48 89 ...... [ 287.651118] RSP: 0018:ffffc90000433d78 EFLAGS: 00010202 [ 287.656347] RAX: 0000000000000000 RBX: ffff888105986800 RCX: 0000000000000000 [ 287.663491] RDX: ffffc90000433bb0 RSI: 00000000ffffefff RDI: ffff888105986800 [ 287.670634] RBP: ffffc90000433da0 R08: 0000000000000000 R09: c0000000ffffefff [ 287.677771] R10: 0000000000000001 R11: ffffc90000433ba8 R12: ffff888105986800 [ 287.684907] R13: 0000000000000000 R14: fffffffffffffe00 R15: ffff888100b6b500 [ 287.692052] FS: 0000000000000000(0000) GS:ffff888277f80000(0000) knlGS:0000000000000000 [ 287.700149] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 287.705897] CR2: 0000000000000070 CR3: 000000000320a000 CR4: 0000000000350ee0 [ 287.713033] Call Trace: [ 287.715498] raid1d+0x6c/0xbbb [raid1] [ 287.719256] ? __schedule+0x1ff/0x760 [ 287.722930] ? schedule+0x3b/0xb0 [ 287.726260] ? schedule_timeout+0x1ed/0x290 [ 287.730456] ? __switch_to+0x11f/0x400 [ 287.734219] md_thread+0xe9/0x140 [md_mod] [ 287.738328] ? md_thread+0xe9/0x140 [md_mod] [ 287.742601] ? wait_woken+0x80/0x80 [ 287.746097] ? md_register_thread+0xe0/0xe0 [md_mod] [ 287.751064] kthread+0x11a/0x140 [ 287.754300] ? kthread_park+0x90/0x90 [ 287.757974] ret_from_fork+0x1f/0x30 In fact, when raid1 array run fail, we need to do md_unregister_thread() before raid1_free(). CVE-2022-50715 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50715.html CVE-2022-50715 https://bugzilla.suse.com/1255749 SUSE Bug 1255749 In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out syzkaller reported use-after-free with the stack trace like below [1]: [ 38.960489][ C3] ================================================================== [ 38.963216][ C3] BUG: KASAN: use-after-free in ar5523_cmd_tx_cb+0x220/0x240 [ 38.964950][ C3] Read of size 8 at addr ffff888048e03450 by task swapper/3/0 [ 38.966363][ C3] [ 38.967053][ C3] CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.0.0-09039-ga6afa4199d3d-dirty #18 [ 38.968464][ C3] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014 [ 38.969959][ C3] Call Trace: [ 38.970841][ C3] <IRQ> [ 38.971663][ C3] dump_stack_lvl+0xfc/0x174 [ 38.972620][ C3] print_report.cold+0x2c3/0x752 [ 38.973626][ C3] ? ar5523_cmd_tx_cb+0x220/0x240 [ 38.974644][ C3] kasan_report+0xb1/0x1d0 [ 38.975720][ C3] ? ar5523_cmd_tx_cb+0x220/0x240 [ 38.976831][ C3] ar5523_cmd_tx_cb+0x220/0x240 [ 38.978412][ C3] __usb_hcd_giveback_urb+0x353/0x5b0 [ 38.979755][ C3] usb_hcd_giveback_urb+0x385/0x430 [ 38.981266][ C3] dummy_timer+0x140c/0x34e0 [ 38.982925][ C3] ? notifier_call_chain+0xb5/0x1e0 [ 38.984761][ C3] ? rcu_read_lock_sched_held+0xb/0x60 [ 38.986242][ C3] ? lock_release+0x51c/0x790 [ 38.987323][ C3] ? _raw_read_unlock_irqrestore+0x37/0x70 [ 38.988483][ C3] ? __wake_up_common_lock+0xde/0x130 [ 38.989621][ C3] ? reacquire_held_locks+0x4a0/0x4a0 [ 38.990777][ C3] ? lock_acquire+0x472/0x550 [ 38.991919][ C3] ? rcu_read_lock_sched_held+0xb/0x60 [ 38.993138][ C3] ? lock_acquire+0x472/0x550 [ 38.994890][ C3] ? dummy_urb_enqueue+0x860/0x860 [ 38.996266][ C3] ? do_raw_spin_unlock+0x16f/0x230 [ 38.997670][ C3] ? dummy_urb_enqueue+0x860/0x860 [ 38.999116][ C3] call_timer_fn+0x1a0/0x6a0 [ 39.000668][ C3] ? add_timer_on+0x4a0/0x4a0 [ 39.002137][ C3] ? reacquire_held_locks+0x4a0/0x4a0 [ 39.003809][ C3] ? __next_timer_interrupt+0x226/0x2a0 [ 39.005509][ C3] __run_timers.part.0+0x69a/0xac0 [ 39.007025][ C3] ? dummy_urb_enqueue+0x860/0x860 [ 39.008716][ C3] ? call_timer_fn+0x6a0/0x6a0 [ 39.010254][ C3] ? cpuacct_percpu_seq_show+0x10/0x10 [ 39.011795][ C3] ? kvm_sched_clock_read+0x14/0x40 [ 39.013277][ C3] ? sched_clock_cpu+0x69/0x2b0 [ 39.014724][ C3] run_timer_softirq+0xb6/0x1d0 [ 39.016196][ C3] __do_softirq+0x1d2/0x9be [ 39.017616][ C3] __irq_exit_rcu+0xeb/0x190 [ 39.019004][ C3] irq_exit_rcu+0x5/0x20 [ 39.020361][ C3] sysvec_apic_timer_interrupt+0x8f/0xb0 [ 39.021965][ C3] </IRQ> [ 39.023237][ C3] <TASK> In ar5523_probe(), ar5523_host_available() calls ar5523_cmd() as below (there are other functions which finally call ar5523_cmd()): ar5523_probe() -> ar5523_host_available() -> ar5523_cmd_read() -> ar5523_cmd() If ar5523_cmd() timed out, then ar5523_host_available() failed and ar5523_probe() freed the device structure. So, ar5523_cmd_tx_cb() might touch the freed structure. This patch fixes this issue by canceling in-flight tx cmd if submitted urb timed out. CVE-2022-50716 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50716.html CVE-2022-50716 https://bugzilla.suse.com/1255839 SUSE Bug 1255839 In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(), add a bounds check to avoid out-of-bounds access. CVE-2022-50717 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50717.html CVE-2022-50717 https://bugzilla.suse.com/1255844 SUSE Bug 1255844 https://bugzilla.suse.com/1255845 SUSE Bug 1255845 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix pci device refcount leak As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the reference count by calling pci_dev_put(). So before returning from amdgpu_device_resume|suspend_display_audio(), pci_dev_put() is called to avoid refcount leak. CVE-2022-50718 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50718.html CVE-2022-50718 https://bugzilla.suse.com/1255750 SUSE Bug 1255750 In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: fix stack overflow in line6_midi_transmit Correctly calculate available space including the size of the chunk buffer. This fixes a buffer overflow when multiple MIDI sysex messages are sent to a PODxt device. CVE-2022-50719 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50719.html CVE-2022-50719 https://bugzilla.suse.com/1255939 SUSE Bug 1255939 In the Linux kernel, the following vulnerability has been resolved: media: ipu3-imgu: Fix NULL pointer dereference in active selection access What the IMGU driver did was that it first acquired the pointers to active and try V4L2 subdev state, and only then figured out which one to use. The problem with that approach and a later patch (see Fixes: tag) is that as sd_state argument to v4l2_subdev_get_try_crop() et al is NULL, there is now an attempt to dereference that. Fix this. Also rewrap lines a little. CVE-2022-50722 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50722.html CVE-2022-50722 https://bugzilla.suse.com/1255877 SUSE Bug 1255877 In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix resource leak in regulator_register() I got some resource leak reports while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 100, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@64/regulators/buck1 unreferenced object 0xffff88810deea000 (size 512): comm "490-i2c-rt5190a", pid 253, jiffies 4294859840 (age 5061.046s) hex dump (first 32 bytes): 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... ff ff ff ff ff ff ff ff a0 1e 00 a1 ff ff ff ff ................ backtrace: [<00000000d78541e2>] kmalloc_trace+0x21/0x110 [<00000000b343d153>] device_private_init+0x32/0xd0 [<00000000be1f0c70>] device_add+0xb2d/0x1030 [<00000000e3e6344d>] regulator_register+0xaf2/0x12a0 [<00000000e2f5e754>] devm_regulator_register+0x57/0xb0 [<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator] unreferenced object 0xffff88810b617b80 (size 32): comm "490-i2c-rt5190a", pid 253, jiffies 4294859904 (age 5060.983s) hex dump (first 32 bytes): 72 65 67 75 6c 61 74 6f 72 2e 32 38 36 38 2d 53 regulator.2868-S 55 50 50 4c 59 00 ff ff 29 00 00 00 2b 00 00 00 UPPLY...)...+... backtrace: [<000000009da9280d>] __kmalloc_node_track_caller+0x44/0x1b0 [<0000000025c6a4e5>] kstrdup+0x3a/0x70 [<00000000790efb69>] create_regulator+0xc0/0x4e0 [<0000000005ed203a>] regulator_resolve_supply+0x2d4/0x440 [<0000000045796214>] regulator_register+0x10b3/0x12a0 [<00000000e2f5e754>] devm_regulator_register+0x57/0xb0 [<000000008b898197>] rt5190a_probe+0x52a/0x861 [rt5190a_regulator] After calling regulator_resolve_supply(), the 'rdev->supply' is set by set_supply(), after this set, in the error path, the resources need be released, so call regulator_put() to avoid the leaks. CVE-2022-50724 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50724.html CVE-2022-50724 https://bugzilla.suse.com/1255950 SUSE Bug 1255950 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_async_ctx should return only after all its callback handlers were completed. Before this patch, the below race between mlx5_cmd_cleanup_async_ctx and mlx5_cmd_exec_cb_handler was possible and lead to a use-after-free: 1. mlx5_cmd_cleanup_async_ctx is called while num_inflight is 2 (i.e. elevated by 1, a single inflight callback). 2. mlx5_cmd_cleanup_async_ctx decreases num_inflight to 1. 3. mlx5_cmd_exec_cb_handler is called, decreases num_inflight to 0 and is about to call wake_up(). 4. mlx5_cmd_cleanup_async_ctx calls wait_event, which returns immediately as the condition (num_inflight == 0) holds. 5. mlx5_cmd_cleanup_async_ctx returns. 6. The caller of mlx5_cmd_cleanup_async_ctx frees the mlx5_async_ctx object. 7. mlx5_cmd_exec_cb_handler goes on and calls wake_up() on the freed object. Fix it by syncing using a completion object. Mark it completed when num_inflight reaches 0. Trace: BUG: KASAN: use-after-free in do_raw_spin_lock+0x23d/0x270 Read of size 4 at addr ffff888139cd12f4 by task swapper/5/0 CPU: 5 PID: 0 Comm: swapper/5 Not tainted 6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 Call Trace: <IRQ> dump_stack_lvl+0x57/0x7d print_report.cold+0x2d5/0x684 ? do_raw_spin_lock+0x23d/0x270 kasan_report+0xb1/0x1a0 ? do_raw_spin_lock+0x23d/0x270 do_raw_spin_lock+0x23d/0x270 ? rwlock_bug.part.0+0x90/0x90 ? __delete_object+0xb8/0x100 ? lock_downgrade+0x6e0/0x6e0 _raw_spin_lock_irqsave+0x43/0x60 ? __wake_up_common_lock+0xb9/0x140 __wake_up_common_lock+0xb9/0x140 ? __wake_up_common+0x650/0x650 ? destroy_tis_callback+0x53/0x70 [mlx5_core] ? kasan_set_track+0x21/0x30 ? destroy_tis_callback+0x53/0x70 [mlx5_core] ? kfree+0x1ba/0x520 ? do_raw_spin_unlock+0x54/0x220 mlx5_cmd_exec_cb_handler+0x136/0x1a0 [mlx5_core] ? mlx5_cmd_cleanup_async_ctx+0x220/0x220 [mlx5_core] ? mlx5_cmd_cleanup_async_ctx+0x220/0x220 [mlx5_core] mlx5_cmd_comp_handler+0x65a/0x12b0 [mlx5_core] ? dump_command+0xcc0/0xcc0 [mlx5_core] ? lockdep_hardirqs_on_prepare+0x400/0x400 ? cmd_comp_notifier+0x7e/0xb0 [mlx5_core] cmd_comp_notifier+0x7e/0xb0 [mlx5_core] atomic_notifier_call_chain+0xd7/0x1d0 mlx5_eq_async_int+0x3ce/0xa20 [mlx5_core] atomic_notifier_call_chain+0xd7/0x1d0 ? irq_release+0x140/0x140 [mlx5_core] irq_int_handler+0x19/0x30 [mlx5_core] __handle_irq_event_percpu+0x1f2/0x620 handle_irq_event+0xb2/0x1d0 handle_edge_irq+0x21e/0xb00 __common_interrupt+0x79/0x1a0 common_interrupt+0x78/0xa0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP: 0010:default_idle+0x42/0x60 Code: c1 83 e0 07 48 c1 e9 03 83 c0 03 0f b6 14 11 38 d0 7c 04 84 d2 75 14 8b 05 eb 47 22 02 85 c0 7e 07 0f 00 2d e0 9f 48 00 fb f4 <c3> 48 c7 c7 80 08 7f 85 e8 d1 d3 3e fe eb de 66 66 2e 0f 1f 84 00 RSP: 0018:ffff888100dbfdf0 EFLAGS: 00000242 RAX: 0000000000000001 RBX: ffffffff84ecbd48 RCX: 1ffffffff0afe110 RDX: 0000000000000004 RSI: 0000000000000000 RDI: ffffffff835cc9bc RBP: 0000000000000005 R08: 0000000000000001 R09: ffff88881dec4ac3 R10: ffffed1103bd8958 R11: 0000017d0ca571c9 R12: 0000000000000005 R13: ffffffff84f024e0 R14: 0000000000000000 R15: dffffc0000000000 ? default_idle_call+0xcc/0x450 default_idle_call+0xec/0x450 do_idle+0x394/0x450 ? arch_cpu_idle_exit+0x40/0x40 ? do_idle+0x17/0x450 cpu_startup_entry+0x19/0x20 start_secondary+0x221/0x2b0 ? set_cpu_sibling_map+0x2070/0x2070 secondary_startup_64_no_verify+0xcd/0xdb </TASK> Allocated by task 49502: kasan_save_stack+0x1e/0x40 __kasan_kmalloc+0x81/0xa0 kvmalloc_node+0x48/0xe0 mlx5e_bulk_async_init+0x35/0x110 [mlx5_core] mlx5e_tls_priv_tx_list_cleanup+0x84/0x3e0 [mlx5_core] mlx5e_ktls_cleanup_tx+0x38f/0x760 [mlx5_core] mlx5e_cleanup_nic_tx+0xa7/0x100 [mlx5_core] mlx5e_detach_netdev+0x1c ---truncated--- CVE-2022-50726 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50726.html CVE-2022-50726 https://bugzilla.suse.com/1256040 SUSE Bug 1256040 https://bugzilla.suse.com/1256255 SUSE Bug 1256255 In the Linux kernel, the following vulnerability has been resolved: scsi: efct: Fix possible memleak in efct_device_init() In efct_device_init(), when efct_scsi_reg_fc_transport() fails, efct_scsi_tgt_driver_exit() is not called to release memory for efct_scsi_tgt_driver_init() and causes memleak: unreferenced object 0xffff8881020ce000 (size 2048): comm "modprobe", pid 465, jiffies 4294928222 (age 55.872s) backtrace: [<0000000021a1ef1b>] kmalloc_trace+0x27/0x110 [<000000004c3ed51c>] target_register_template+0x4fd/0x7b0 [target_core_mod] [<00000000f3393296>] efct_scsi_tgt_driver_init+0x18/0x50 [efct] [<00000000115de533>] 0xffffffffc0d90011 [<00000000d608f646>] do_one_initcall+0xd0/0x4e0 [<0000000067828cf1>] do_init_module+0x1cc/0x6a0 ... CVE-2022-50727 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50727.html CVE-2022-50727 https://bugzilla.suse.com/1256042 SUSE Bug 1256042 In the Linux kernel, the following vulnerability has been resolved: s390/lcs: Fix return type of lcs_start_xmit() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals: drivers/s390/net/lcs.c:2090:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] .ndo_start_xmit = lcs_start_xmit, ^~~~~~~~~~~~~~ drivers/s390/net/lcs.c:2097:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict] .ndo_start_xmit = lcs_start_xmit, ^~~~~~~~~~~~~~ ->ndo_start_xmit() in 'struct net_device_ops' expects a return type of 'netdev_tx_t', not 'int'. Adjust the return type of lcs_start_xmit() to match the prototype's to resolve the warning and potential CFI failure, should s390 select ARCH_SUPPORTS_CFI_CLANG in the future. CVE-2022-50728 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50728.html CVE-2022-50728 https://bugzilla.suse.com/1256046 SUSE Bug 1256046 In the Linux kernel, the following vulnerability has been resolved: ext4: silence the warning when evicting inode with dioread_nolock When evicting an inode with default dioread_nolock, it could be raced by the unwritten extents converting kworker after writeback some new allocated dirty blocks. It convert unwritten extents to written, the extents could be merged to upper level and free extent blocks, so it could mark the inode dirty again even this inode has been marked I_FREEING. But the inode->i_io_list check and warning in ext4_evict_inode() missing this corner case. Fortunately, ext4_evict_inode() will wait all extents converting finished before this check, so it will not lead to inode use-after-free problem, every thing is OK besides this warning. The WARN_ON_ONCE was originally designed for finding inode use-after-free issues in advance, but if we add current dioread_nolock case in, it will become not quite useful, so fix this warning by just remove this check. ====== WARNING: CPU: 7 PID: 1092 at fs/ext4/inode.c:227 ext4_evict_inode+0x875/0xc60 ... RIP: 0010:ext4_evict_inode+0x875/0xc60 ... Call Trace: <TASK> evict+0x11c/0x2b0 iput+0x236/0x3a0 do_unlinkat+0x1b4/0x490 __x64_sys_unlinkat+0x4c/0xb0 do_syscall_64+0x3b/0x90 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fa933c1115b ====== rm kworker ext4_end_io_end() vfs_unlink() ext4_unlink() ext4_convert_unwritten_io_end_vec() ext4_convert_unwritten_extents() ext4_map_blocks() ext4_ext_map_blocks() ext4_ext_try_to_merge_up() __mark_inode_dirty() check !I_FREEING locked_inode_to_wb_and_lock_list() iput() iput_final() evict() ext4_evict_inode() truncate_inode_pages_final() //wait release io_end inode_io_list_move_locked() ext4_release_io_end() trigger WARN_ON_ONCE() CVE-2022-50730 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50730.html CVE-2022-50730 https://bugzilla.suse.com/1256048 SUSE Bug 1256048 In the Linux kernel, the following vulnerability has been resolved: crypto: akcipher - default implementation for setting a private key Changes from v1: * removed the default implementation from set_pub_key: it is assumed that an implementation must always have this callback defined as there are no use case for an algorithm, which doesn't need a public key Many akcipher implementations (like ECDSA) support only signature verifications, so they don't have all callbacks defined. Commit 78a0324f4a53 ("crypto: akcipher - default implementations for request callbacks") introduced default callbacks for sign/verify operations, which just return an error code. However, these are not enough, because before calling sign the caller would likely call set_priv_key first on the instantiated transform (as the in-kernel testmgr does). This function does not have a default stub, so the kernel crashes, when trying to set a private key on an akcipher, which doesn't support signature generation. I've noticed this, when trying to add a KAT vector for ECDSA signature to the testmgr. With this patch the testmgr returns an error in dmesg (as it should) instead of crashing the kernel NULL ptr dereference. CVE-2022-50731 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50731.html CVE-2022-50731 https://bugzilla.suse.com/1256049 SUSE Bug 1256049 In the Linux kernel, the following vulnerability has been resolved: staging: rtl8192u: Fix use after free in ieee80211_rx() We cannot dereference the "skb" pointer after calling ieee80211_monitor_rx(), because it is a use after free. CVE-2022-50732 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50732.html CVE-2022-50732 https://bugzilla.suse.com/1256063 SUSE Bug 1256063 In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..IMGSIZE] uninitialized. And the check for valid image incurs an uninitialized dereference. Fix this by moving the check before reset label since this check only be valid if the data after bulk_in_buffer[HEADER] has concrete data. Note that this is found by KMSAN, so only kernel compilation is tested. CVE-2022-50733 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50733.html CVE-2022-50733 https://bugzilla.suse.com/1256064 SUSE Bug 1256064 In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: do not run mt76u_status_worker if the device is not running Fix the following NULL pointer dereference avoiding to run mt76u_status_worker thread if the device is not running yet. KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 98 Comm: kworker/u2:2 Not tainted 5.14.0+ #78 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: mt76 mt76u_tx_status_data RIP: 0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554 Call Trace: mt76x02_send_tx_status+0x1d2/0xeb0 mt76x02_tx_status_data+0x8e/0xd0 mt76u_tx_status_data+0xe1/0x240 process_one_work+0x92b/0x1460 worker_thread+0x95/0xe00 kthread+0x3a1/0x480 ret_from_fork+0x1f/0x30 Modules linked in: --[ end trace 8df5d20fc5040f65 ]-- RIP: 0010:mt76x02_mac_fill_tx_status.isra.0+0x82c/0x9e0 Code: c5 48 b8 00 00 00 00 00 fc ff df 80 3c 02 00 0f 85 94 01 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 34 24 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 89 01 00 00 41 8b 16 41 0f b7 RSP: 0018:ffffc900005af988 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffc900005afae8 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff832fc661 RDI: ffffc900005afc2a RBP: ffffc900005afae0 R08: 0000000000000001 R09: fffff520000b5f3c R10: 0000000000000003 R11: fffff520000b5f3b R12: ffff88810b6132d8 R13: 000000000000ffff R14: 0000000000000000 R15: ffffc900005afc28 FS: 0000000000000000(0000) GS:ffff88811aa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa0eda6a000 CR3: 0000000118f17000 CR4: 0000000000750ef0 PKRU: 55555554 Moreover move stat_work schedule out of the for loop. CVE-2022-50735 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50735.html CVE-2022-50735 https://bugzilla.suse.com/1256141 SUSE Bug 1256141 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix immediate work request flush to completion queue Correctly set send queue element opcode during immediate work request flushing in post sendqueue operation, if the QP is in ERROR state. An undefined ocode value results in out-of-bounds access to an array for mapping the opcode between siw internal and RDMA core representation in work completion generation. It resulted in a KASAN BUG report of type 'global-out-of-bounds' during NFSoRDMA testing. This patch further fixes a potential case of a malicious user which may write undefined values for completion queue elements status or opcode, if the CQ is memory mapped to user land. It avoids the same out-of-bounds access to arrays for status and opcode mapping as described above. CVE-2022-50736 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50736.html CVE-2022-50736 https://bugzilla.suse.com/1256137 SUSE Bug 1256137 https://bugzilla.suse.com/1256138 SUSE Bug 1256138 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that usb_get_urb() is called but usb_free_urb() (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or urb->ep fields have not been initialized and usb_kill_urb() returns immediately. The patch removes trying to kill urbs located in hif_dev->tx.tx_buf because hif_dev->tx.tx_buf is not supposed to contain urbs which are in pending state (the pending urbs are stored in hif_dev->tx.tx_pending). The tx.tx_lock is acquired so there should not be any changes in the list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. CVE-2022-50740 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50740.html CVE-2022-50740 https://bugzilla.suse.com/1256155 SUSE Bug 1256155 In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible refcount leak in afu_ioctl() eventfd_ctx_put need to be called to put the refcount that gotten by eventfd_ctx_fdget when ocxl_irq_set_handler fails. CVE-2022-50742 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50742.html CVE-2022-50742 https://bugzilla.suse.com/1256143 SUSE Bug 1256143 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs During I/O and simultaneous cat of /sys/kernel/debug/lpfc/fnX/rx_monitor, a hard lockup similar to the call trace below may occur. The spin_lock_bh in lpfc_rx_monitor_report is not protecting from timer interrupts as expected, so change the strength of the spin lock to _irq. Kernel panic - not syncing: Hard LOCKUP CPU: 3 PID: 110402 Comm: cat Kdump: loaded exception RIP: native_queued_spin_lock_slowpath+91 [IRQ stack] native_queued_spin_lock_slowpath at ffffffffb814e30b _raw_spin_lock at ffffffffb89a667a lpfc_rx_monitor_record at ffffffffc0a73a36 [lpfc] lpfc_cmf_timer at ffffffffc0abbc67 [lpfc] __hrtimer_run_queues at ffffffffb8184250 hrtimer_interrupt at ffffffffb8184ab0 smp_apic_timer_interrupt at ffffffffb8a026ba apic_timer_interrupt at ffffffffb8a01c4f [End of IRQ stack] apic_timer_interrupt at ffffffffb8a01c4f lpfc_rx_monitor_report at ffffffffc0a73c80 [lpfc] lpfc_rx_monitor_read at ffffffffc0addde1 [lpfc] full_proxy_read at ffffffffb83e7fc3 vfs_read at ffffffffb833fe71 ksys_read at ffffffffb83402af do_syscall_64 at ffffffffb800430b entry_SYSCALL_64_after_hwframe at ffffffffb8a000ad CVE-2022-50744 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50744.html CVE-2022-50744 https://bugzilla.suse.com/1256165 SUSE Bug 1256165 In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix device_node use after free At probe time this code path is followed: * tegra_csi_init * tegra_csi_channels_alloc * for_each_child_of_node(node, channel) -- iterates over channels * automatically gets 'channel' * tegra_csi_channel_alloc() * saves into chan->of_node a pointer to the channel OF node * automatically gets and puts 'channel' * now the node saved in chan->of_node has refcount 0, can disappear * tegra_csi_channels_init * iterates over channels * tegra_csi_channel_init -- uses chan->of_node After that, chan->of_node keeps storing the node until the device is removed. of_node_get() the node and of_node_put() it during teardown to avoid any risk. CVE-2022-50745 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50745.html CVE-2022-50745 https://bugzilla.suse.com/1256158 SUSE Bug 1256158 https://bugzilla.suse.com/1256159 SUSE Bug 1256159 In the Linux kernel, the following vulnerability has been resolved: hfs: Fix OOB Write in hfs_asc2mac Syzbot reported a OOB Write bug: loop0: detected capacity change from 0 to 64 ================================================================== BUG: KASAN: slab-out-of-bounds in hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 Write of size 1 at addr ffff88801848314e by task syz-executor391/3632 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:284 print_report+0x107/0x1f0 mm/kasan/report.c:395 kasan_report+0xcd/0x100 mm/kasan/report.c:495 hfs_asc2mac+0x467/0x9a0 fs/hfs/trans.c:133 hfs_cat_build_key+0x92/0x170 fs/hfs/catalog.c:28 hfs_lookup+0x1ab/0x2c0 fs/hfs/dir.c:31 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3710 do_filp_open+0x264/0x4f0 fs/namei.c:3740 If in->len is much larger than HFS_NAMELEN(31) which is the maximum length of an HFS filename, a OOB write could occur in hfs_asc2mac(). In that case, when the dst reaches the boundary, the srclen is still greater than 0, which causes a OOB write. Fix this by adding a check on dstlen in while() before writing to dst address. CVE-2022-50747 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50747.html CVE-2022-50747 https://bugzilla.suse.com/1256432 SUSE Bug 1256432 In the Linux kernel, the following vulnerability has been resolved: acct: fix potential integer overflow in encode_comp_t() The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; ...... > 341 exp <<= MANTSIZE; > 342 exp += value; > 343 return exp; > 344 } Currently comp_t is defined as type of '__u16', but the variable 'exp' is type of 'int', so overflow would happen when variable 'exp' in line 343 is greater than 65535. CVE-2022-50749 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50749.html CVE-2022-50749 https://bugzilla.suse.com/1256191 SUSE Bug 1256191 In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure In case mipi_dsi_attach() fails, call drm_panel_remove() to avoid memory leak. CVE-2022-50750 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50750.html CVE-2022-50750 https://bugzilla.suse.com/1256188 SUSE Bug 1256188 In the Linux kernel, the following vulnerability has been resolved: configfs: fix possible memory leak in configfs_create_dir() kmemleak reported memory leaks in configfs_create_dir(): unreferenced object 0xffff888009f6af00 (size 192): comm "modprobe", pid 3777, jiffies 4295537735 (age 233.784s) backtrace: kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) new_fragment (./include/linux/slab.h:600 fs/configfs/dir.c:163) configfs_register_subsystem (fs/configfs/dir.c:1857) basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... unreferenced object 0xffff888003ba7180 (size 96): comm "modprobe", pid 3777, jiffies 4295537735 (age 233.784s) backtrace: kmem_cache_alloc (mm/slub.c:3250 mm/slub.c:3256 mm/slub.c:3263 mm/slub.c:3273) configfs_new_dirent (./include/linux/slab.h:723 fs/configfs/dir.c:194) configfs_make_dirent (fs/configfs/dir.c:248) configfs_create_dir (fs/configfs/dir.c:296) configfs_attach_group.isra.28 (fs/configfs/dir.c:816 fs/configfs/dir.c:852) configfs_register_subsystem (fs/configfs/dir.c:1881) basic_write (drivers/hwtracing/stm/p_basic.c:14) stm_p_basic do_one_initcall (init/main.c:1296) do_init_module (kernel/module/main.c:2455) ... This is because the refcount is not correct in configfs_make_dirent(). For normal stage, the refcount is changing as: configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() configfs_new_dirent() # set s_count = 1 dentry->d_fsdata = configfs_get(sd); # s_count = 2 ... configfs_unregister_subsystem() configfs_remove_dir() remove_dir() configfs_remove_dirent() # s_count = 1 dput() ... *dentry_unlink_inode()* configfs_d_iput() # s_count = 0, release However, if we failed in configfs_create(): configfs_register_subsystem() configfs_create_dir() configfs_make_dirent() # s_count = 2 ... configfs_create() # fail ->out_remove: configfs_remove_dirent(dentry) configfs_put(sd) # s_count = 1 return PTR_ERR(inode); There is no inode in the error path, so the configfs_d_iput() is lost and makes sd and fragment memory leaked. To fix this, when we failed in configfs_create(), manually call configfs_put(sd) to keep the refcount correct. CVE-2022-50751 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50751.html CVE-2022-50751 https://bugzilla.suse.com/1256184 SUSE Bug 1256184 In the Linux kernel, the following vulnerability has been resolved: md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed: ============================================================================= BUG bio-200 (Not tainted): Object already free ----------------------------------------------------------------------------- Allocated in mempool_alloc_slab+0x17/0x20 age=3 cpu=2 pid=7504 __slab_alloc.constprop.0+0x5a/0xb0 kmem_cache_alloc+0x31e/0x330 mempool_alloc_slab+0x17/0x20 mempool_alloc+0x100/0x2b0 bio_alloc_bioset+0x181/0x460 do_mpage_readpage+0x776/0xd00 mpage_readahead+0x166/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 force_page_cache_ra+0x181/0x1c0 page_cache_sync_ra+0x65/0xb0 filemap_get_pages+0x1df/0xaf0 filemap_read+0x1e1/0x700 blkdev_read_iter+0x1e5/0x330 vfs_read+0x42a/0x570 Freed in mempool_free_slab+0x17/0x20 age=3 cpu=2 pid=7504 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 raid5_make_request+0x2259/0x2450 md_handle_request+0x402/0x600 md_submit_bio+0xd9/0x120 __submit_bio+0x11f/0x1b0 submit_bio_noacct_nocheck+0x204/0x480 submit_bio_noacct+0x32e/0xc70 submit_bio+0x98/0x1a0 mpage_readahead+0x250/0x320 blkdev_readahead+0x15/0x20 read_pages+0x13f/0x5f0 page_cache_ra_unbounded+0x18d/0x220 Slab 0xffffea000481b600 objects=21 used=0 fp=0xffff8881206d8940 flags=0x17ffffc0010201(locked|slab|head|node=0|zone=2|lastcpupid=0x1fffff) CPU: 0 PID: 34525 Comm: kworker/u24:2 Not tainted 6.0.0-rc2-localyes-265166-gf11c5343fa3f #143 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Workqueue: raid5wq raid5_do_work Call Trace: <TASK> dump_stack_lvl+0x5a/0x78 dump_stack+0x10/0x16 print_trailer+0x158/0x165 object_err+0x35/0x50 free_debug_processing.cold+0xb7/0xbe __slab_free+0x1ae/0x330 kmem_cache_free+0x46d/0x490 mempool_free_slab+0x17/0x20 mempool_free+0x66/0x190 bio_free+0x78/0x90 bio_put+0x100/0x1a0 mpage_end_io+0x36/0x150 bio_endio+0x2fd/0x360 md_end_io_acct+0x7e/0x90 bio_endio+0x2fd/0x360 handle_failed_stripe+0x960/0xb80 handle_stripe+0x1348/0x3760 handle_active_stripes.constprop.0+0x72a/0xaf0 raid5_do_work+0x177/0x330 process_one_work+0x616/0xb20 worker_thread+0x2bd/0x6f0 kthread+0x179/0x1b0 ret_from_fork+0x22/0x30 </TASK> The double free is caused by an unnecessary bio_put() in the if(is_badblock(...)) error path in raid5_read_one_chunk(). The error path was moved ahead of bio_alloc_clone() in c82aa1b76787c ("md/raid5: move checking badblock before clone bio in raid5_read_one_chunk"). The previous code checked and freed align_bio which required a bio_put. After the move that is no longer needed as raid_bio is returned to the control of the common io path which performs its own endio resulting in a double free on bad device blocks. CVE-2022-50752 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50752.html CVE-2022-50752 https://bugzilla.suse.com/1256204 SUSE Bug 1256204 In the Linux kernel, the following vulnerability has been resolved: apparmor: fix a memleak in multi_transaction_new() In multi_transaction_new(), the variable t is not freed or passed out on the failure of copy_from_user(t->data, buf, size), which could lead to a memleak. Fix this bug by adding a put_multi_transaction(t) in the error path. CVE-2022-50754 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50754.html CVE-2022-50754 https://bugzilla.suse.com/1256065 SUSE Bug 1256065 In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double brelse() in udf_rename() syzbot reported a warning like below [1]: VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0 ... Call Trace: <TASK> invalidate_bh_lru+0x99/0x150 smp_call_function_many_cond+0xe2a/0x10c0 ? generic_remap_file_range_prep+0x50/0x50 ? __brelse+0xa0/0xa0 ? __mutex_lock+0x21c/0x12d0 ? smp_call_on_cpu+0x250/0x250 ? rcu_read_lock_sched_held+0xb/0x60 ? lock_release+0x587/0x810 ? __brelse+0xa0/0xa0 ? generic_remap_file_range_prep+0x50/0x50 on_each_cpu_cond_mask+0x3c/0x80 blkdev_flush_mapping+0x13a/0x2f0 blkdev_put_whole+0xd3/0xf0 blkdev_put+0x222/0x760 deactivate_locked_super+0x96/0x160 deactivate_super+0xda/0x100 cleanup_mnt+0x222/0x3d0 task_work_run+0x149/0x240 ? task_work_cancel+0x30/0x30 do_exit+0xb29/0x2a40 ? reacquire_held_locks+0x4a0/0x4a0 ? do_raw_spin_lock+0x12a/0x2b0 ? mm_update_next_owner+0x7c0/0x7c0 ? rwlock_bug.part.0+0x90/0x90 ? zap_other_threads+0x234/0x2d0 do_group_exit+0xd0/0x2a0 __x64_sys_exit_group+0x3a/0x50 do_syscall_64+0x34/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd The cause of the issue is that brelse() is called on both ofibh.sbh and ofibh.ebh by udf_find_entry() when it returns NULL. However, brelse() is called by udf_rename(), too. So, b_count on buffer_head becomes unbalanced. This patch fixes the issue by not calling brelse() by udf_rename() when udf_find_entry() returns NULL. CVE-2022-50755 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50755.html CVE-2022-50755 https://bugzilla.suse.com/1256199 SUSE Bug 1256199 In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix mempool alloc size Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many PRP Lists are required. The code was previously rounding this to 1 list, but we can require 2 in the worst case. In that scenario, the driver would corrupt memory beyond the size provided by the mempool. While unlikely to occur (you'd need a 4MB in exactly 127 phys segments on a queue that doesn't support SGLs), this memory corruption has been observed by kfence. CVE-2022-50756 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50756.html CVE-2022-50756 https://bugzilla.suse.com/1256216 SUSE Bug 1256216 https://bugzilla.suse.com/1256217 SUSE Bug 1256217 In the Linux kernel, the following vulnerability has been resolved: media: camss: Clean up received buffers on failed start of streaming It is required to return the received buffers, if streaming can not be started. For instance media_pipeline_start() may fail with EPIPE, if a link validation between entities is not passed, and in such a case a user gets a kernel warning: WARNING: CPU: 1 PID: 520 at drivers/media/common/videobuf2/videobuf2-core.c:1592 vb2_start_streaming+0xec/0x160 <snip> Call trace: vb2_start_streaming+0xec/0x160 vb2_core_streamon+0x9c/0x1a0 vb2_ioctl_streamon+0x68/0xbc v4l_streamon+0x30/0x3c __video_do_ioctl+0x184/0x3e0 video_usercopy+0x37c/0x7b0 video_ioctl2+0x24/0x40 v4l2_ioctl+0x4c/0x70 The fix is to correct the error path in video_start_streaming() of camss. CVE-2022-50757 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50757.html CVE-2022-50757 https://bugzilla.suse.com/1256215 SUSE Bug 1256215 In the Linux kernel, the following vulnerability has been resolved: staging: vt6655: fix potential memory leak In function device_init_td0_ring, memory is allocated for member td_info of priv->apTD0Rings[i], with i increasing from 0. In case of allocation failure, the memory is freed in reversed order, with i decreasing to 0. However, the case i=0 is left out and thus memory is leaked. Modify the memory freeing loop to include the case i=0. CVE-2022-50758 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50758.html CVE-2022-50758 https://bugzilla.suse.com/1256207 SUSE Bug 1256207 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the input parameter @from if it is not NULL. If we break the loop in amdgpu_atrm_get_bios() with 'pdev' not NULL, we need to call pci_dev_put() to decrease the refcount. Add the missing pci_dev_put() to avoid refcount leak. CVE-2022-50760 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50760.html CVE-2022-50760 https://bugzilla.suse.com/1255983 SUSE Bug 1255983 In the Linux kernel, the following vulnerability has been resolved: x86/xen: Fix memory leak in xen_init_lock_cpu() In xen_init_lock_cpu(), the @name has allocated new string by kasprintf(), if bind_ipi_to_irqhandler() fails, it should be freed, otherwise may lead to a memory leak issue, fix it. CVE-2022-50761 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50761.html CVE-2022-50761 https://bugzilla.suse.com/1256062 SUSE Bug 1256062 In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - prevent integer overflows The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "code_length * 2" can overflow. The round_up(ucode_size, 16) + sizeof() expression can overflow too. Prevent these overflows. CVE-2022-50763 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50763.html CVE-2022-50763 https://bugzilla.suse.com/1256317 SUSE Bug 1256317 https://bugzilla.suse.com/1256319 SUSE Bug 1256319 In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: Fix several use-after-free bugs Several types of UAFs can occur when physically removing a USB device. Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and in this function, there is kref_put() that finally calls ufx_free(). This fix prevents multiple UAFs. CVE-2022-50767 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50767.html CVE-2022-50767 https://bugzilla.suse.com/1256426 SUSE Bug 1256426 In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(). CVE-2022-50769 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50769.html CVE-2022-50769 https://bugzilla.suse.com/1256383 SUSE Bug 1256383 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2_mount_volume() There is a memory leak reported by kmemleak: unreferenced object 0xffff88810cc65e60 (size 32): comm "mount.ocfs2", pid 23753, jiffies 4302528942 (age 34735.105s) hex dump (first 32 bytes): 10 00 00 00 00 00 00 00 00 01 01 01 01 01 01 01 ................ 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 ................ backtrace: [<ffffffff8170f73d>] __kmalloc+0x4d/0x150 [<ffffffffa0ac3f51>] ocfs2_compute_replay_slots+0x121/0x330 [ocfs2] [<ffffffffa0b65165>] ocfs2_check_volume+0x485/0x900 [ocfs2] [<ffffffffa0b68129>] ocfs2_mount_volume.isra.0+0x1e9/0x650 [ocfs2] [<ffffffffa0b7160b>] ocfs2_fill_super+0xe0b/0x1740 [ocfs2] [<ffffffff818e1fe2>] mount_bdev+0x312/0x400 [<ffffffff819a086d>] legacy_get_tree+0xed/0x1d0 [<ffffffff818de82d>] vfs_get_tree+0x7d/0x230 [<ffffffff81957f92>] path_mount+0xd62/0x1760 [<ffffffff81958a5a>] do_mount+0xca/0xe0 [<ffffffff81958d3c>] __x64_sys_mount+0x12c/0x1a0 [<ffffffff82f26f15>] do_syscall_64+0x35/0x80 [<ffffffff8300006a>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 This call stack is related to two problems. Firstly, the ocfs2 super uses "replay_map" to trace online/offline slots, in order to recover offline slots during recovery and mount. But when ocfs2_truncate_log_init() returns an error in ocfs2_mount_volume(), the memory of "replay_map" will not be freed in error handling path. Secondly, the memory of "replay_map" will not be freed if d_make_root() returns an error in ocfs2_fill_super(). But the memory of "replay_map" will be freed normally when completing recovery and mount in ocfs2_complete_mount_recovery(). Fix the first problem by adding error handling path to free "replay_map" when ocfs2_truncate_log_init() fails. And fix the second problem by calling ocfs2_free_replay_slots(osb) in the error handling path "out_dismount". In addition, since ocfs2_free_replay_slots() is static, it is necessary to remove its static attribute and declare it in header file. CVE-2022-50770 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50770.html CVE-2022-50770 https://bugzilla.suse.com/1256221 SUSE Bug 1256221 In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt I got a null-ptr-defer error report when I do the following tests on the qemu platform: make defconfig and CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m, CONFIG_SND_MTS64=m Then making test scripts: cat>test_mod1.sh<<EOF modprobe snd-mts64 modprobe snd-mts64 EOF Executing the script, perhaps several times, we will get a null-ptr-defer report, as follow: syzkaller:~# ./test_mod.sh snd_mts64: probe of snd_mts64.0 failed with error -5 modprobe: ERROR: could not insert 'snd_mts64': No such device BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 0 PID: 205 Comm: modprobe Not tainted 6.1.0-rc8-00588-g76dcd734eca2 #6 Call Trace: <IRQ> snd_mts64_interrupt+0x24/0xa0 [snd_mts64] parport_irq_handler+0x37/0x50 [parport] __handle_irq_event_percpu+0x39/0x190 handle_irq_event_percpu+0xa/0x30 handle_irq_event+0x2f/0x50 handle_edge_irq+0x99/0x1b0 __common_interrupt+0x5d/0x100 common_interrupt+0xa0/0xc0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP: 0010:_raw_write_unlock_irqrestore+0x11/0x30 parport_claim+0xbd/0x230 [parport] snd_mts64_probe+0x14a/0x465 [snd_mts64] platform_probe+0x3f/0xa0 really_probe+0x129/0x2c0 __driver_probe_device+0x6d/0xc0 driver_probe_device+0x1a/0xa0 __device_attach_driver+0x7a/0xb0 bus_for_each_drv+0x62/0xb0 __device_attach+0xe4/0x180 bus_probe_device+0x82/0xa0 device_add+0x550/0x920 platform_device_add+0x106/0x220 snd_mts64_attach+0x2e/0x80 [snd_mts64] port_check+0x14/0x20 [parport] bus_for_each_dev+0x6e/0xc0 __parport_register_driver+0x7c/0xb0 [parport] snd_mts64_module_init+0x31/0x1000 [snd_mts64] do_one_initcall+0x3c/0x1f0 do_init_module+0x46/0x1c6 load_module+0x1d8d/0x1e10 __do_sys_finit_module+0xa2/0xf0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Kernel panic - not syncing: Fatal exception in interrupt Rebooting in 1 seconds.. The mts wa not initialized during interrupt, we add check for mts to fix this bug. CVE-2022-50773 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50773.html CVE-2022-50773 https://bugzilla.suse.com/1256245 SUSE Bug 1256245 In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix DMA transfer direction When CONFIG_DMA_API_DEBUG is selected, while running the crypto self test on the QAT crypto algorithms, the function add_dma_entry() reports a warning similar to the one below, saying that overlapping mappings are not supported. This occurs in tests where the input and the output scatter list point to the same buffers (i.e. two different scatter lists which point to the same chunks of memory). The logic that implements the mapping uses the flag DMA_BIDIRECTIONAL for both the input and the output scatter lists which leads to overlapped write mappings. These are not supported by the DMA layer. Fix by specifying the correct DMA transfer directions when mapping buffers. For in-place operations where the input scatter list matches the output scatter list, buffers are mapped once with DMA_BIDIRECTIONAL, otherwise input buffers are mapped using the flag DMA_TO_DEVICE and output buffers are mapped with DMA_FROM_DEVICE. Overlapping a read mapping with a write mapping is a valid case in dma-coherent devices like QAT. The function that frees and unmaps the buffers, qat_alg_free_bufl() has been changed accordingly to the changes to the mapping function. DMA-API: 4xxx 0000:06:00.0: cacheline tracking EEXIST, overlapping mappings aren't supported WARNING: CPU: 53 PID: 4362 at kernel/dma/debug.c:570 add_dma_entry+0x1e9/0x270 ... Call Trace: dma_map_page_attrs+0x82/0x2d0 ? preempt_count_add+0x6a/0xa0 qat_alg_sgl_to_bufl+0x45b/0x990 [intel_qat] qat_alg_aead_dec+0x71/0x250 [intel_qat] crypto_aead_decrypt+0x3d/0x70 test_aead_vec_cfg+0x649/0x810 ? number+0x310/0x3a0 ? vsnprintf+0x2a3/0x550 ? scnprintf+0x42/0x70 ? valid_sg_divisions.constprop.0+0x86/0xa0 ? test_aead_vec+0xdf/0x120 test_aead_vec+0xdf/0x120 alg_test_aead+0x185/0x400 alg_test+0x3d8/0x500 ? crypto_acomp_scomp_free_ctx+0x30/0x30 ? __schedule+0x32a/0x12a0 ? ttwu_queue_wakelist+0xbf/0x110 ? _raw_spin_unlock_irqrestore+0x23/0x40 ? try_to_wake_up+0x83/0x570 ? _raw_spin_unlock_irqrestore+0x23/0x40 ? __set_cpus_allowed_ptr_locked+0xea/0x1b0 ? crypto_acomp_scomp_free_ctx+0x30/0x30 cryptomgr_test+0x27/0x50 kthread+0xe6/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 CVE-2022-50774 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50774.html CVE-2022-50774 https://bugzilla.suse.com/1256323 SUSE Bug 1256323 https://bugzilla.suse.com/1256324 SUSE Bug 1256324 In the Linux kernel, the following vulnerability has been resolved: clk: st: Fix memory leak in st_of_quadfs_setup() If st_clk_register_quadfs_pll() fails, @lock should be freed before goto @err_exit, otherwise will cause meory leak issue, fix it. CVE-2022-50776 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50776.html CVE-2022-50776 https://bugzilla.suse.com/1256254 SUSE Bug 1256254 In the Linux kernel, the following vulnerability has been resolved: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe of_phy_find_device() return device node with refcount incremented. Call put_device() to relese it when not needed anymore. CVE-2022-50777 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50777.html CVE-2022-50777 https://bugzilla.suse.com/1256320 SUSE Bug 1256320 In the Linux kernel, the following vulnerability has been resolved: orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() When insert and remove the orangefs module, then debug_help_string will be leaked: unreferenced object 0xffff8881652ba000 (size 4096): comm "insmod", pid 1701, jiffies 4294893639 (age 13218.530s) hex dump (first 32 bytes): 43 6c 69 65 6e 74 20 44 65 62 75 67 20 4b 65 79 Client Debug Key 77 6f 72 64 73 20 61 72 65 20 75 6e 6b 6e 6f 77 words are unknow backtrace: [<0000000004e6f8e3>] kmalloc_trace+0x27/0xa0 [<0000000006f75d85>] orangefs_prepare_debugfs_help_string+0x5e/0x480 [orangefs] [<0000000091270a2a>] _sub_I_65535_1+0x57/0xf70 [crc_itu_t] [<000000004b1ee1a3>] do_one_initcall+0x87/0x2a0 [<000000001d0614ae>] do_init_module+0xdf/0x320 [<00000000efef068c>] load_module+0x2f98/0x3330 [<000000006533b44d>] __do_sys_finit_module+0x113/0x1b0 [<00000000a0da6f99>] do_syscall_64+0x35/0x80 [<000000007790b19b>] entry_SYSCALL_64_after_hwframe+0x46/0xb0 When remove the module, should always free debug_help_string. Should always free the allocated buffer when change the free_debug_help_string. CVE-2022-50779 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50779.html CVE-2022-50779 https://bugzilla.suse.com/1256423 SUSE Bug 1256423 In the Linux kernel, the following vulnerability has been resolved: amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() In the PP_OD_EDIT_VDDC_CURVE case the "input_index" variable is capped at 2 but not checked for negative values so it results in an out of bounds read. This value comes from the user via sysfs. CVE-2022-50781 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50781.html CVE-2022-50781 https://bugzilla.suse.com/1256306 SUSE Bug 1256306 In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search caused by bad quota inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_status.c:202! invalid opcode: 0000 [#1] PREEMPT SMP CPU: 1 PID: 810 Comm: mount Not tainted 6.1.0-rc1-next-g9631525255e3 #352 RIP: 0010:__es_tree_search.isra.0+0xb8/0xe0 RSP: 0018:ffffc90001227900 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 0000000077512a0f RCX: 0000000000000000 RDX: 0000000000000002 RSI: 0000000000002a10 RDI: ffff8881004cd0c8 RBP: ffff888177512ac8 R08: 47ffffffffffffff R09: 0000000000000001 R10: 0000000000000001 R11: 00000000000679af R12: 0000000000002a10 R13: ffff888177512d88 R14: 0000000077512a10 R15: 0000000000000000 FS: 00007f4bd76dbc40(0000)GS:ffff88842fd00000(0000)knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005653bf993cf8 CR3: 000000017bfdf000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ext4_es_cache_extent+0xe2/0x210 ext4_cache_extents+0xd2/0x110 ext4_find_extent+0x5d5/0x8c0 ext4_ext_map_blocks+0x9c/0x1d30 ext4_map_blocks+0x431/0xa50 ext4_getblk+0x82/0x340 ext4_bread+0x14/0x110 ext4_quota_read+0xf0/0x180 v2_read_header+0x24/0x90 v2_check_quota_file+0x2f/0xa0 dquot_load_quota_sb+0x26c/0x760 dquot_load_quota_inode+0xa5/0x190 ext4_enable_quotas+0x14c/0x300 __ext4_fill_super+0x31cc/0x32c0 ext4_fill_super+0x115/0x2d0 get_tree_bdev+0x1d2/0x360 ext4_get_tree+0x19/0x30 vfs_get_tree+0x26/0xe0 path_mount+0x81d/0xfc0 do_mount+0x8d/0xc0 __x64_sys_mount+0xc0/0x160 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> ================================================================== Above issue may happen as follows: ------------------------------------- ext4_fill_super ext4_orphan_cleanup ext4_enable_quotas ext4_quota_enable ext4_iget --> get error inode <5> ext4_ext_check_inode --> Wrong imode makes it escape inspection make_bad_inode(inode) --> EXT4_BOOT_LOADER_INO set imode dquot_load_quota_inode vfs_setup_quota_inode --> check pass dquot_load_quota_sb v2_check_quota_file v2_read_header ext4_quota_read ext4_bread ext4_getblk ext4_map_blocks ext4_ext_map_blocks ext4_find_extent ext4_cache_extents ext4_es_cache_extent __es_tree_search.isra.0 ext4_es_end --> Wrong extents trigger BUG_ON In the above issue, s_usr_quota_inum is set to 5, but inode<5> contains incorrect imode and disordered extents. Because 5 is EXT4_BOOT_LOADER_INO, the ext4_ext_check_inode check in the ext4_iget function can be bypassed, finally, the extents that are not checked trigger the BUG_ON in the __es_tree_search function. To solve this issue, check whether the inode is bad_inode in vfs_setup_quota_inode(). CVE-2022-50782 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50782.html CVE-2022-50782 https://bugzilla.suse.com/1256282 SUSE Bug 1256282 In the Linux kernel, the following vulnerability has been resolved: xhci: dbc: Fix memory leak in xhci_alloc_dbc() If DbC is already in use, then the allocated memory for the xhci_dbc struct doesn't get freed before returning NULL, which leads to a memleak. CVE-2022-50809 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50809.html CVE-2022-50809 https://bugzilla.suse.com/1256250 SUSE Bug 1256250 In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/zip - fix mismatch in get/set sgl_sge_nr KASAN reported this Bug: [17619.659757] BUG: KASAN: global-out-of-bounds in param_get_int+0x34/0x60 [17619.673193] Read of size 4 at addr fffff01332d7ed00 by task read_all/1507958 ... [17619.698934] The buggy address belongs to the variable: [17619.708371] sgl_sge_nr+0x0/0xffffffffffffa300 [hisi_zip] There is a mismatch in hisi_zip when get/set the variable sgl_sge_nr. The type of sgl_sge_nr is u16, and get/set sgl_sge_nr by param_get/set_int. Replacing param_get/set_int to param_get/set_ushort can fix this bug. CVE-2022-50814 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50814.html CVE-2022-50814 https://bugzilla.suse.com/1256248 SUSE Bug 1256248 In the Linux kernel, the following vulnerability has been resolved: udmabuf: Set ubuf->sg = NULL if the creation of sg table fails When userspace tries to map the dmabuf and if for some reason (e.g. OOM) the creation of the sg table fails, ubuf->sg needs to be set to NULL. Otherwise, when the userspace subsequently closes the dmabuf fd, we'd try to erroneously free the invalid sg table from release_udmabuf resulting in the following crash reported by syzbot: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 PID: 3609 Comm: syz-executor487 Not tainted 5.19.0-syzkaller-13930-g7ebfc85e2cd7 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 RIP: 0010:dma_unmap_sgtable include/linux/dma-mapping.h:378 [inline] RIP: 0010:put_sg_table drivers/dma-buf/udmabuf.c:89 [inline] RIP: 0010:release_udmabuf+0xcb/0x4f0 drivers/dma-buf/udmabuf.c:114 Code: 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 2b 04 00 00 48 8d 7d 0c 4c 8b 63 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 e2 RSP: 0018:ffffc900037efd30 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: ffffffff8cb67800 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff84ad27e0 RDI: 0000000000000000 RBP: fffffffffffffff4 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 000000000008c07c R12: ffff88801fa05000 R13: ffff888073db07e8 R14: ffff888025c25440 R15: 0000000000000000 FS: 0000555555fc4300(0000) GS:ffff8880b9a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc1c0ce06e4 CR3: 00000000715e6000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> dma_buf_release+0x157/0x2d0 drivers/dma-buf/dma-buf.c:78 __dentry_kill+0x42b/0x640 fs/dcache.c:612 dentry_kill fs/dcache.c:733 [inline] dput+0x806/0xdb0 fs/dcache.c:913 __fput+0x39c/0x9d0 fs/file_table.c:333 task_work_run+0xdd/0x1a0 kernel/task_work.c:177 ptrace_notify+0x114/0x140 kernel/signal.c:2353 ptrace_report_syscall include/linux/ptrace.h:420 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:482 [inline] syscall_exit_work kernel/entry/common.c:249 [inline] syscall_exit_to_user_mode_prepare+0x129/0x280 kernel/entry/common.c:276 __syscall_exit_to_user_mode_work kernel/entry/common.c:281 [inline] syscall_exit_to_user_mode+0x9/0x50 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fc1c0c35b6b Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44 RSP: 002b:00007ffd78a06090 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000007 RCX: 00007fc1c0c35b6b RDX: 0000000020000280 RSI: 0000000040086200 RDI: 0000000000000006 RBP: 0000000000000007 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000293 R12: 000000000000000c R13: 0000000000000003 R14: 00007fc1c0cfe4a0 R15: 00007ffd78a06140 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:dma_unmap_sgtable include/linux/dma-mapping.h:378 [inline] RIP: 0010:put_sg_table drivers/dma-buf/udmabuf.c:89 [inline] RIP: 0010:release_udmabuf+0xcb/0x4f0 drivers/dma-buf/udmabuf.c:114 CVE-2022-50819 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50819.html CVE-2022-50819 https://bugzilla.suse.com/1256241 SUSE Bug 1256241 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails CVE-2022-50821 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50821.html CVE-2022-50821 https://bugzilla.suse.com/1256242 SUSE Bug 1256242 In the Linux kernel, the following vulnerability has been resolved: RDMA/restrack: Release MR restrack when delete The MR restrack also needs to be released when delete it, otherwise it cause memory leak as the task struct won't be released. CVE-2022-50822 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50822.html CVE-2022-50822 https://bugzilla.suse.com/1256260 SUSE Bug 1256260 In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra114_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. CVE-2022-50823 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50823.html CVE-2022-50823 https://bugzilla.suse.com/1256333 SUSE Bug 1256333 In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak In check_acpi_tpm2(), we get the TPM2 table just to make sure the table is there, not used after the init, so the acpi_put_table() should be added to release the ACPI memory. CVE-2022-50824 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50824.html CVE-2022-50824 https://bugzilla.suse.com/1256334 SUSE Bug 1256334 In the Linux kernel, the following vulnerability has been resolved: ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection() Calling v4l2_subdev_get_try_crop() and v4l2_subdev_get_try_compose() with a subdev state of NULL leads to a NULL pointer dereference. This can currently happen in imgu_subdev_set_selection() when the state passed in is NULL, as this method first gets pointers to both the "try" and "active" states and only then decides which to use. The same issue has been addressed for imgu_subdev_get_selection() with commit 30d03a0de650 ("ipu3-imgu: Fix NULL pointer dereference in active selection access"). However the issue still persists in imgu_subdev_set_selection(). Therefore, apply a similar fix as done in the aforementioned commit to imgu_subdev_set_selection(). To keep things a bit cleaner, introduce helper functions for "crop" and "compose" access and use them in both imgu_subdev_set_selection() and imgu_subdev_get_selection(). CVE-2022-50826 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50826.html CVE-2022-50826 https://bugzilla.suse.com/1256265 SUSE Bug 1256265 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfc_create_port() Commit 5e633302ace1 ("scsi: lpfc: vmid: Add support for VMID in mailbox command") introduced allocations for the VMID resources in lpfc_create_port() after the call to scsi_host_alloc(). Upon failure on the VMID allocations, the new code would branch to the 'out' label, which returns NULL without unwinding anything, thus skipping the call to scsi_host_put(). Fix the problem by creating a separate label 'out_free_vmid' to unwind the VMID resources and make the 'out_put_shost' label call only scsi_host_put(), as was done before the introduction of allocations for VMID. CVE-2022-50827 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50827.html CVE-2022-50827 https://bugzilla.suse.com/1256344 SUSE Bug 1256344 In the Linux kernel, the following vulnerability has been resolved: clk: zynqmp: Fix stack-out-of-bounds in strncpy` "BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68" Linux-ATF interface is using 16 bytes of SMC payload. In case clock name is longer than 15 bytes, string terminated NULL character will not be received by Linux. Add explicit NULL character at last byte to fix issues when clock name is longer. This fixes below bug reported by KASAN: ================================================================== BUG: KASAN: stack-out-of-bounds in strncpy+0x30/0x68 Read of size 1 at addr ffff0008c89a7410 by task swapper/0/1 CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.4.0-00396-g81ef9e7-dirty #3 Hardware name: Xilinx Versal vck190 Eval board revA (QSPI) (DT) Call trace: dump_backtrace+0x0/0x1e8 show_stack+0x14/0x20 dump_stack+0xd4/0x108 print_address_description.isra.0+0xbc/0x37c __kasan_report+0x144/0x198 kasan_report+0xc/0x18 __asan_load1+0x5c/0x68 strncpy+0x30/0x68 zynqmp_clock_probe+0x238/0x7b8 platform_drv_probe+0x6c/0xc8 really_probe+0x14c/0x418 driver_probe_device+0x74/0x130 __device_attach_driver+0xc4/0xe8 bus_for_each_drv+0xec/0x150 __device_attach+0x160/0x1d8 device_initial_probe+0x10/0x18 bus_probe_device+0xe0/0xf0 device_add+0x528/0x950 of_device_add+0x5c/0x80 of_platform_device_create_pdata+0x120/0x168 of_platform_bus_create+0x244/0x4e0 of_platform_populate+0x50/0xe8 zynqmp_firmware_probe+0x370/0x3a8 platform_drv_probe+0x6c/0xc8 really_probe+0x14c/0x418 driver_probe_device+0x74/0x130 device_driver_attach+0x94/0xa0 __driver_attach+0x70/0x108 bus_for_each_dev+0xe4/0x158 driver_attach+0x30/0x40 bus_add_driver+0x21c/0x2b8 driver_register+0xbc/0x1d0 __platform_driver_register+0x7c/0x88 zynqmp_firmware_driver_init+0x1c/0x24 do_one_initcall+0xa4/0x234 kernel_init_freeable+0x1b0/0x24c kernel_init+0x10/0x110 ret_from_fork+0x10/0x18 The buggy address belongs to the page: page:ffff0008f9be1c88 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 raw: 0008d00000000000 ffff0008f9be1c90 ffff0008f9be1c90 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff page dumped because: kasan: bad access detected addr ffff0008c89a7410 is located in stack of task swapper/0/1 at offset 112 in frame: zynqmp_clock_probe+0x0/0x7b8 this frame has 3 objects: [32, 44) 'response' [64, 80) 'ret_payload' [96, 112) 'name' Memory state around the buggy address: ffff0008c89a7300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0008c89a7380: 00 00 00 00 f1 f1 f1 f1 00 04 f2 f2 00 00 f2 f2 >ffff0008c89a7400: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff0008c89a7480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff0008c89a7500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== CVE-2022-50828 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50828.html CVE-2022-50828 https://bugzilla.suse.com/1256230 SUSE Bug 1256230 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It causes use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes NULL but rx_buf is not freed and there can be a memory leak. The patch removes unnecessary nskb and makes skb processing more clear: it is supposed that ath9k_htc_rx_msg() either frees old skb or passes its managing to another callback function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. CVE-2022-50829 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50829.html CVE-2022-50829 https://bugzilla.suse.com/1256235 SUSE Bug 1256235 In the Linux kernel, the following vulnerability has been resolved: auxdisplay: hd44780: Fix potential memory leak in hd44780_remove() hd44780_probe() allocates a memory chunk for hd with kzalloc() and makes "lcd->drvdata->hd44780" point to it. When we call hd44780_remove(), we should release all relevant memory and resource. But "lcd->drvdata ->hd44780" is not released, which will lead to a memory leak. We should release the "lcd->drvdata->hd44780" in hd44780_remove() to fix the memory leak bug. CVE-2022-50830 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50830.html CVE-2022-50830 https://bugzilla.suse.com/1256328 SUSE Bug 1256328 In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add dev_kfree_skb() to fix it. Compile tested only. CVE-2022-50832 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50832.html CVE-2022-50832 https://bugzilla.suse.com/1256228 SUSE Bug 1256228 In the Linux kernel, the following vulnerability has been resolved: nfc: Fix potential resource leaks nfc_get_device() take reference for the device, add missing nfc_put_device() to release it when not need anymore. Also fix the style warnning by use error EOPNOTSUPP instead of ENOTSUPP. CVE-2022-50834 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50834.html CVE-2022-50834 https://bugzilla.suse.com/1256219 SUSE Bug 1256219 In the Linux kernel, the following vulnerability has been resolved: jbd2: add miss release buffer head in fc_do_one_pass() In fc_do_one_pass() miss release buffer head after use which will lead to reference count leak. CVE-2022-50835 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50835.html CVE-2022-50835 https://bugzilla.suse.com/1256220 SUSE Bug 1256220 In the Linux kernel, the following vulnerability has been resolved: remoteproc: sysmon: fix memory leak in qcom_add_sysmon_subdev() The kfree() should be called when of_irq_get_byname() fails or devm_request_threaded_irq() fails in qcom_add_sysmon_subdev(), otherwise there will be a memory leak, so add kfree() to fix it. CVE-2022-50836 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50836.html CVE-2022-50836 https://bugzilla.suse.com/1256211 SUSE Bug 1256211 In the Linux kernel, the following vulnerability has been resolved: jbd2: fix potential buffer head reference count leak As in 'jbd2_fc_wait_bufs' if buffer isn't uptodate, will return -EIO without update 'journal->j_fc_off'. But 'jbd2_fc_release_bufs' will release buffer head from 'j_fc_off - 1' if 'bh' is NULL will terminal release which will lead to buffer head buffer head reference count leak. To solve above issue, update 'journal->j_fc_off' before return -EIO. CVE-2022-50839 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50839.html CVE-2022-50839 https://bugzilla.suse.com/1256206 SUSE Bug 1256206 In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible UAF in snic_tgt_create() Smatch reports a warning as follows: drivers/scsi/snic/snic_disc.c:307 snic_tgt_create() warn: '&tgt->list' not removed from list If device_add() fails in snic_tgt_create(), tgt will be freed, but tgt->list will not be removed from snic->disc.tgt_list, then list traversal may cause UAF. Remove from snic->disc.tgt_list before free(). CVE-2022-50840 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50840.html CVE-2022-50840 https://bugzilla.suse.com/1256208 SUSE Bug 1256208 In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Check whether transferred 2D BO is shmem Transferred 2D BO always must be a shmem BO. Add check for that to prevent NULL dereference if userspace passes a VRAM BO. CVE-2022-50842 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50842.html CVE-2022-50842 https://bugzilla.suse.com/1256202 SUSE Bug 1256202 In the Linux kernel, the following vulnerability has been resolved: dm clone: Fix UAF in clone_dtr() Dm_clone also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in clone_dtr(). CVE-2022-50843 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50843.html CVE-2022-50843 https://bugzilla.suse.com/1256203 SUSE Bug 1256203 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. A proposed warning in clang aims to catch these at compile time, which reveals: drivers/gpu/drm/amd/amdgpu/../pm/swsmu/amdgpu_smu.c:3008:29: error: incompatible function pointer types initializing 'int (*)(void *, uint32_t, long *, uint32_t)' (aka 'int (*)(void *, unsigned int, long *, unsigned int)') with an expression of type 'int (void *, enum PP_OD_DPM_TABLE_COMMAND, long *, uint32_t)' (aka 'int (void *, enum PP_OD_DPM_TABLE_COMMAND, long *, unsigned int)') [-Werror,-Wincompatible-function-pointer-types-strict] .odn_edit_dpm_table = smu_od_edit_dpm_table, ^~~~~~~~~~~~~~~~~~~~~ 1 error generated. There are only two implementations of ->odn_edit_dpm_table() in 'struct amd_pm_funcs': smu_od_edit_dpm_table() and pp_odn_edit_dpm_table(). One has a second parameter type of 'enum PP_OD_DPM_TABLE_COMMAND' and the other uses 'u32'. Ultimately, smu_od_edit_dpm_table() calls ->od_edit_dpm_table() from 'struct pptable_funcs' and pp_odn_edit_dpm_table() calls ->odn_edit_dpm_table() from 'struct pp_hwmgr_func', which both have a second parameter type of 'enum PP_OD_DPM_TABLE_COMMAND'. Update the type parameter in both the prototype in 'struct amd_pm_funcs' and pp_odn_edit_dpm_table() to 'enum PP_OD_DPM_TABLE_COMMAND', which cleans up the warning. CVE-2022-50844 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50844.html CVE-2022-50844 https://bugzilla.suse.com/1256205 SUSE Bug 1256205 In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue as follows when do setxattr with inject fault: [localhost]# fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 (12-Sep-2022) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Pass 3: Checking directory connectivity Pass 4: Checking reference counts Unattached zero-length inode 15. Clear? no Unattached inode 15 Connect to /lost+found? no Pass 5: Checking group summary information /dev/sda: ********** WARNING: Filesystem still has errors ********** /dev/sda: 15/655360 files (0.0% non-contiguous), 66755/2621440 blocks This occurs in 'ext4_xattr_inode_create()'. If 'ext4_mark_inode_dirty()' fails, dropping i_nlink of the inode is needed. Or will lead to inode leak. CVE-2022-50845 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50845.html CVE-2022-50845 https://bugzilla.suse.com/1256196 SUSE Bug 1256196 In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_host() is leaked. 2. In the remove() path, mmc_remove_host() will be called to delete device, but it's not added yet, it will lead a kernel crash because of null-ptr-deref in device_del(). Fix this by checking the return value and goto error path which will call mmc_free_host(). CVE-2022-50846 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50846.html CVE-2022-50846 https://bugzilla.suse.com/1256200 SUSE Bug 1256200 In the Linux kernel, the following vulnerability has been resolved: drivers: dio: fix possible memory leak in dio_init() If device_register() returns error, the 'dev' and name needs be freed. Add a release function, and then call put_device() in the error path, so the name is freed in kobject_cleanup() and to the 'dev' is freed in release function. CVE-2022-50848 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50848.html CVE-2022-50848 https://bugzilla.suse.com/1256192 SUSE Bug 1256192 In the Linux kernel, the following vulnerability has been resolved: pstore: Avoid kcore oops by vmap()ing with VM_IOREMAP An oops can be induced by running 'cat /proc/kcore > /dev/null' on devices using pstore with the ram backend because kmap_atomic() assumes lowmem pages are accessible with __va(). Unable to handle kernel paging request at virtual address ffffff807ff2b000 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 swapper pgtable: 4k pages, 39-bit VAs, pgdp=0000000081d87000 [ffffff807ff2b000] pgd=180000017fe18003, p4d=180000017fe18003, pud=180000017fe18003, pmd=0000000000000000 Internal error: Oops: 96000006 [#1] PREEMPT SMP Modules linked in: dm_integrity CPU: 7 PID: 21179 Comm: perf Not tainted 5.15.67-10882-ge4eb2eb988cd #1 baa443fb8e8477896a370b31a821eb2009f9bfba Hardware name: Google Lazor (rev3 - 8) (DT) pstate: a0400009 (NzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __memcpy+0x110/0x260 lr : vread+0x194/0x294 sp : ffffffc013ee39d0 x29: ffffffc013ee39f0 x28: 0000000000001000 x27: ffffff807ff2b000 x26: 0000000000001000 x25: ffffffc0085a2000 x24: ffffff802d4b3000 x23: ffffff80f8a60000 x22: ffffff802d4b3000 x21: ffffffc0085a2000 x20: ffffff8080b7bc68 x19: 0000000000001000 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: ffffffd3073f2e60 x14: ffffffffad588000 x13: 0000000000000000 x12: 0000000000000001 x11: 00000000000001a2 x10: 00680000fff2bf0b x9 : 03fffffff807ff2b x8 : 0000000000000001 x7 : 0000000000000000 x6 : 0000000000000000 x5 : ffffff802d4b4000 x4 : ffffff807ff2c000 x3 : ffffffc013ee3a78 x2 : 0000000000001000 x1 : ffffff807ff2b000 x0 : ffffff802d4b3000 Call trace: __memcpy+0x110/0x260 read_kcore+0x584/0x778 proc_reg_read+0xb4/0xe4 During early boot, memblock reserves the pages for the ramoops reserved memory node in DT that would otherwise be part of the direct lowmem mapping. Pstore's ram backend reuses those reserved pages to change the memory type (writeback or non-cached) by passing the pages to vmap() (see pfn_to_page() usage in persistent_ram_vmap() for more details) with specific flags. When read_kcore() starts iterating over the vmalloc region, it runs over the virtual address that vmap() returned for ramoops. In aligned_vread() the virtual address is passed to vmalloc_to_page() which returns the page struct for the reserved lowmem area. That lowmem page is passed to kmap_atomic(), which effectively calls page_to_virt() that assumes a lowmem page struct must be directly accessible with __va() and friends. These pages are mapped via vmap() though, and the lowmem mapping was never made, so accessing them via the lowmem virtual address oopses like above. Let's side-step this problem by passing VM_IOREMAP to vmap(). This will tell vread() to not include the ramoops region in the kcore. Instead the area will look like a bunch of zeros. The alternative is to teach kmap() about vmalloc areas that intersect with lowmem. Presumably such a change isn't a one-liner, and there isn't much interest in inspecting the ramoops region in kcore files anyway, so the most expedient route is taken for now. CVE-2022-50849 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50849.html CVE-2022-50849 https://bugzilla.suse.com/1256193 SUSE Bug 1256193 In the Linux kernel, the following vulnerability has been resolved: scsi: ipr: Fix WARNING in ipr_init() ipr_init() will not call unregister_reboot_notifier() when pci_register_driver() fails, which causes a WARNING. Call unregister_reboot_notifier() when pci_register_driver() fails. notifier callback ipr_halt [ipr] already registered WARNING: CPU: 3 PID: 299 at kernel/notifier.c:29 notifier_chain_register+0x16d/0x230 Modules linked in: ipr(+) xhci_pci_renesas xhci_hcd ehci_hcd usbcore led_class gpu_sched drm_buddy video wmi drm_ttm_helper ttm drm_display_helper drm_kms_helper drm drm_panel_orientation_quirks agpgart cfbft CPU: 3 PID: 299 Comm: modprobe Tainted: G W 6.1.0-rc1-00190-g39508d23b672-dirty #332 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:notifier_chain_register+0x16d/0x230 Call Trace: <TASK> __blocking_notifier_chain_register+0x73/0xb0 ipr_init+0x30/0x1000 [ipr] do_one_initcall+0xdb/0x480 do_init_module+0x1cf/0x680 load_module+0x6a50/0x70a0 __do_sys_finit_module+0x12f/0x1c0 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd CVE-2022-50850 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50850.html CVE-2022-50850 https://bugzilla.suse.com/1256194 SUSE Bug 1256194 In the Linux kernel, the following vulnerability has been resolved: vhost_vdpa: fix the crash in unmap a large memory While testing in vIOMMU, sometimes Guest will unmap very large memory, which will cause the crash. To fix this, add a new function vhost_vdpa_general_unmap(). This function will only unmap the memory that saved in iotlb. Call Trace: [ 647.820144] ------------[ cut here ]------------ [ 647.820848] kernel BUG at drivers/iommu/intel/iommu.c:1174! [ 647.821486] invalid opcode: 0000 [#1] PREEMPT SMP PTI [ 647.822082] CPU: 10 PID: 1181 Comm: qemu-system-x86 Not tainted 6.0.0-rc1home_lulu_2452_lulu7_vhost+ #62 [ 647.823139] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qem4 [ 647.824365] RIP: 0010:domain_unmap+0x48/0x110 [ 647.825424] Code: 48 89 fb 8d 4c f6 1e 39 c1 0f 4f c8 83 e9 0c 83 f9 3f 7f 18 48 89 e8 48 d3 e8 48 85 c0 75 59 [ 647.828064] RSP: 0018:ffffae5340c0bbf0 EFLAGS: 00010202 [ 647.828973] RAX: 0000000000000001 RBX: ffff921793d10540 RCX: 000000000000001b [ 647.830083] RDX: 00000000080000ff RSI: 0000000000000001 RDI: ffff921793d10540 [ 647.831214] RBP: 0000000007fc0100 R08: ffffae5340c0bcd0 R09: 0000000000000003 [ 647.832388] R10: 0000007fc0100000 R11: 0000000000100000 R12: 00000000080000ff [ 647.833668] R13: ffffae5340c0bcd0 R14: ffff921793d10590 R15: 0000008000100000 [ 647.834782] FS: 00007f772ec90640(0000) GS:ffff921ce7a80000(0000) knlGS:0000000000000000 [ 647.836004] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 647.836990] CR2: 00007f02c27a3a20 CR3: 0000000101b0c006 CR4: 0000000000372ee0 [ 647.838107] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 647.839283] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 647.840666] Call Trace: [ 647.841437] <TASK> [ 647.842107] intel_iommu_unmap_pages+0x93/0x140 [ 647.843112] __iommu_unmap+0x91/0x1b0 [ 647.844003] iommu_unmap+0x6a/0x95 [ 647.844885] vhost_vdpa_unmap+0x1de/0x1f0 [vhost_vdpa] [ 647.845985] vhost_vdpa_process_iotlb_msg+0xf0/0x90b [vhost_vdpa] [ 647.847235] ? _raw_spin_unlock+0x15/0x30 [ 647.848181] ? _copy_from_iter+0x8c/0x580 [ 647.849137] vhost_chr_write_iter+0xb3/0x430 [vhost] [ 647.850126] vfs_write+0x1e4/0x3a0 [ 647.850897] ksys_write+0x53/0xd0 [ 647.851688] do_syscall_64+0x3a/0x90 [ 647.852508] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 647.853457] RIP: 0033:0x7f7734ef9f4f [ 647.854408] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 29 76 f8 ff 48 8b 54 24 18 48 8b 74 24 10 41 89 c8 [ 647.857217] RSP: 002b:00007f772ec8f040 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 647.858486] RAX: ffffffffffffffda RBX: 00000000fef00000 RCX: 00007f7734ef9f4f [ 647.859713] RDX: 0000000000000048 RSI: 00007f772ec8f090 RDI: 0000000000000010 [ 647.860942] RBP: 00007f772ec8f1a0 R08: 0000000000000000 R09: 0000000000000000 [ 647.862206] R10: 0000000000000001 R11: 0000000000000293 R12: 0000000000000010 [ 647.863446] R13: 0000000000000002 R14: 0000000000000000 R15: ffffffff01100000 [ 647.864692] </TASK> [ 647.865458] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs v] [ 647.874688] ---[ end trace 0000000000000000 ]--- CVE-2022-50851 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50851.html CVE-2022-50851 https://bugzilla.suse.com/1256186 SUSE Bug 1256186 In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a credential leak in _nfs4_discover_trunking() CVE-2022-50853 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50853.html CVE-2022-50853 https://bugzilla.suse.com/1256189 SUSE Bug 1256189 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_ses_add_channel() Before return, should free the xid, otherwise, the xid will be leaked. CVE-2022-50856 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50856.html CVE-2022-50856 https://bugzilla.suse.com/1256182 SUSE Bug 1256182 In the Linux kernel, the following vulnerability has been resolved: mmc: alcor: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and calling mmc_free_host() in the error path. CVE-2022-50858 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50858.html CVE-2022-50858 https://bugzilla.suse.com/1256391 SUSE Bug 1256391 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the error length of VALIDATE_NEGOTIATE_INFO message Commit d5c7076b772a ("smb3: add smb3.1.1 to default dialect list") extend the dialects from 3 to 4, but forget to decrease the extended length when specific the dialect, then the message length is larger than expected. This maybe leak some info through network because not initialize the message body. After apply this patch, the VALIDATE_NEGOTIATE_INFO message length is reduced from 28 bytes to 26 bytes. CVE-2022-50859 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50859.html CVE-2022-50859 https://bugzilla.suse.com/1256172 SUSE Bug 1256172 In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix memleak in alloc_ns() After changes in commit a1bd627b46d1 ("apparmor: share profile name on replacement"), the hname member of struct aa_policy is not valid slab object, but a subset of that, it can not be freed by kfree_sensitive(), use aa_policy_destroy() to fix it. CVE-2022-50860 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50860.html CVE-2022-50860 https://bugzilla.suse.com/1256174 SUSE Bug 1256174 In the Linux kernel, the following vulnerability has been resolved: NFSD: Finish converting the NFSv2 GETACL result encoder The xdr_stream conversion inadvertently left some code that set the page_len of the send buffer. The XDR stream encoders should handle this automatically now. This oversight adds garbage past the end of the Reply message. Clients typically ignore the garbage, but NFSD does not need to send it, as it leaks stale memory contents onto the wire. CVE-2022-50861 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50861.html CVE-2022-50861 https://bugzilla.suse.com/1256177 SUSE Bug 1256177 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix shift-out-of-bounds due to too large exponent of block size If field s_log_block_size of superblock data is corrupted and too large, init_nilfs() and load_nilfs() still can trigger a shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn is set): shift exponent 38973 is too large for 32-bit type 'int' Call Trace: <TASK> dump_stack_lvl+0xcd/0x134 ubsan_epilogue+0xb/0x50 __ubsan_handle_shift_out_of_bounds.cold.12+0x17b/0x1f5 init_nilfs.cold.11+0x18/0x1d [nilfs2] nilfs_mount+0x9b5/0x12b0 [nilfs2] ... This fixes the issue by adding and using a new helper function for getting block size with sanity check. CVE-2022-50864 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50864.html CVE-2022-50864 https://bugzilla.suse.com/1256167 SUSE Bug 1256167 In the Linux kernel, the following vulnerability has been resolved: ASoC: pxa: fix null-pointer dereference in filter() kasprintf() would return NULL pointer when kmalloc() fail to allocate. Need to check the return pointer before calling strcmp(). CVE-2022-50866 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50866.html CVE-2022-50866 https://bugzilla.suse.com/1256162 SUSE Bug 1256162 In the Linux kernel, the following vulnerability has been resolved: hwrng: amd - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the returned pci_dev and also decrease the reference count for the input pci_dev @from if it is not NULL. If we break for_each_pci_dev() loop with pdev not NULL, we need to call pci_dev_put() to decrease the reference count. Add the missing pci_dev_put() for the normal and error path. CVE-2022-50868 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50868.html CVE-2022-50868 https://bugzilla.suse.com/1256386 SUSE Bug 1256386 In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: avoid device tree lookups in rtas_os_term() rtas_os_term() is called during panic. Its behavior depends on a couple of conditions in the /rtas node of the device tree, the traversal of which entails locking and local IRQ state changes. If the kernel panics while devtree_lock is held, rtas_os_term() as currently written could hang. Instead of discovering the relevant characteristics at panic time, cache them in file-static variables at boot. Note the lookup for "ibm,extended-os-term" is converted to of_property_read_bool() since it is a boolean property, not an RTAS function token. [mpe: Incorporate suggested change from Nick] CVE-2022-50870 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50870.html CVE-2022-50870 https://bugzilla.suse.com/1256154 SUSE Bug 1256154 In the Linux kernel, the following vulnerability has been resolved: ARM: OMAP2+: Fix memory leak in realtime_counter_init() The "sys_clk" resource is malloced by clk_get(), it is not released when the function return. CVE-2022-50872 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50872.html CVE-2022-50872 https://bugzilla.suse.com/1256157 SUSE Bug 1256157 In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fix musb_gadget.c rxstate overflow bug The usb function device call musb_gadget_queue() adds the passed request to musb_ep::req_list,If the (request->length > musb_ep->packet_sz) and (is_buffer_mapped(req) return false),the rxstate() will copy all data in fifo to request->buf which may cause request->buf out of bounds. Fix it by add the length check : fifocnt = min_t(unsigned, request->length - request->actual, fifocnt); CVE-2022-50876 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50876.html CVE-2022-50876 https://bugzilla.suse.com/1256136 SUSE Bug 1256136 In the Linux kernel, the following vulnerability has been resolved: gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() A NULL check for bridge->encoder shows that it may be NULL, but it already been dereferenced on all paths leading to the check. 812 if (!bridge->encoder) { Dereference the pointer bridge->encoder. 810 drm_connector_attach_encoder(&lt9611->connector, bridge->encoder); CVE-2022-50878 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50878.html CVE-2022-50878 https://bugzilla.suse.com/1256140 SUSE Bug 1256140 In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: add peer map clean up for peer delete in ath10k_sta_state() When peer delete failed in a disconnect operation, use-after-free detected by KFENCE in below log. It is because for each vdev_id and address, it has only one struct ath10k_peer, it is allocated in ath10k_peer_map_event(). When connected to an AP, it has more than one HTT_T2H_MSG_TYPE_PEER_MAP reported from firmware, then the array peer_map of struct ath10k will be set muti-elements to the same ath10k_peer in ath10k_peer_map_event(). When peer delete failed in ath10k_sta_state(), the ath10k_peer will be free for the 1st peer id in array peer_map of struct ath10k, and then use-after-free happened for the 2nd peer id because they map to the same ath10k_peer. And clean up all peers in array peer_map for the ath10k_peer, then user-after-free disappeared peer map event log: [ 306.911021] wlan0: authenticate with b0:2a:43:e6:75:0e [ 306.957187] ath10k_pci 0000:01:00.0: mac vdev 0 peer create b0:2a:43:e6:75:0e (new sta) sta 1 / 32 peer 1 / 33 [ 306.957395] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 306.957404] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 306.986924] ath10k_pci 0000:01:00.0: htt peer map vdev 0 peer b0:2a:43:e6:75:0e id 166 peer unmap event log: [ 435.715691] wlan0: deauthenticating from b0:2a:43:e6:75:0e by local choice (Reason: 3=DEAUTH_LEAVING) [ 435.716802] ath10k_pci 0000:01:00.0: mac vdev 0 peer delete b0:2a:43:e6:75:0e sta ffff990e0e9c2b50 (sta gone) [ 435.717177] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 246 [ 435.717186] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 198 [ 435.717193] ath10k_pci 0000:01:00.0: htt peer unmap vdev 0 peer b0:2a:43:e6:75:0e id 166 use-after-free log: [21705.888627] wlan0: deauthenticating from d0:76:8f:82:be:75 by local choice (Reason: 3=DEAUTH_LEAVING) [21713.799910] ath10k_pci 0000:01:00.0: failed to delete peer d0:76:8f:82:be:75 for vdev 0: -110 [21713.799925] ath10k_pci 0000:01:00.0: found sta peer d0:76:8f:82:be:75 (ptr 0000000000000000 id 102) entry on vdev 0 after it was supposedly removed [21713.799968] ================================================================== [21713.799991] BUG: KFENCE: use-after-free read in ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.799991] [21713.799997] Use-after-free read at 0x00000000abe1c75e (in kfence-#69): [21713.800010] ath10k_sta_state+0x265/0xb8a [ath10k_core] [21713.800041] drv_sta_state+0x115/0x677 [mac80211] [21713.800059] __sta_info_destroy_part2+0xb1/0x133 [mac80211] [21713.800076] __sta_info_flush+0x11d/0x162 [mac80211] [21713.800093] ieee80211_set_disassoc+0x12d/0x2f4 [mac80211] [21713.800110] ieee80211_mgd_deauth+0x26c/0x29b [mac80211] [21713.800137] cfg80211_mlme_deauth+0x13f/0x1bb [cfg80211] [21713.800153] nl80211_deauthenticate+0xf8/0x121 [cfg80211] [21713.800161] genl_rcv_msg+0x38e/0x3be [21713.800166] netlink_rcv_skb+0x89/0xf7 [21713.800171] genl_rcv+0x28/0x36 [21713.800176] netlink_unicast+0x179/0x24b [21713.800181] netlink_sendmsg+0x3a0/0x40e [21713.800187] sock_sendmsg+0x72/0x76 [21713.800192] ____sys_sendmsg+0x16d/0x1e3 [21713.800196] ___sys_sendmsg+0x95/0xd1 [21713.800200] __sys_sendmsg+0x85/0xbf [21713.800205] do_syscall_64+0x43/0x55 [21713.800210] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [21713.800213] [21713.800219] kfence-#69: 0x000000009149b0d5-0x000000004c0697fb, size=1064, cache=kmalloc-2k [21713.800219] [21713.800224] allocated by task 13 on cpu 0 at 21705.501373s: [21713.800241] ath10k_peer_map_event+0x7e/0x154 [ath10k_core] [21713.800254] ath10k_htt_t2h_msg_handler+0x586/0x1039 [ath10k_core] [21713.800265] ath10k_htt_htc_t2h_msg_handler+0x12/0x28 [ath10k_core] [21713.800277] ath10k_htc_rx_completion_handler+0x14c/0x1b5 [ath10k_core] [21713.800283] ath10k_pci_process_rx_cb+0x195/0x1d ---truncated--- CVE-2022-50880 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50880.html CVE-2022-50880 https://bugzilla.suse.com/1256132 SUSE Bug 1256132 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() This patch fixes a use-after-free in ath9k that occurs in ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access 'drv_priv' that has already been freed by ieee80211_free_hw(), called by ath9k_htc_hw_deinit(). The patch moves ath9k_destroy_wmi() before ieee80211_free_hw(). Note that urbs from the driver should be killed before freeing 'wmi' with ath9k_destroy_wmi() as their callbacks will access 'wmi'. Found by a modified version of syzkaller. ================================================================== BUG: KASAN: use-after-free in ath9k_destroy_wmi+0x38/0x40 Read of size 8 at addr ffff8881069132a0 by task kworker/0:1/7 CPU: 0 PID: 7 Comm: kworker/0:1 Tainted: G O 5.14.0+ #131 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 Workqueue: usb_hub_wq hub_event Call Trace: dump_stack_lvl+0x8e/0xd1 print_address_description.constprop.0.cold+0x93/0x334 ? ath9k_destroy_wmi+0x38/0x40 ? ath9k_destroy_wmi+0x38/0x40 kasan_report.cold+0x83/0xdf ? ath9k_destroy_wmi+0x38/0x40 ath9k_destroy_wmi+0x38/0x40 ath9k_hif_usb_disconnect+0x329/0x3f0 ? ath9k_hif_usb_suspend+0x120/0x120 ? usb_disable_interface+0xfc/0x180 usb_unbind_interface+0x19b/0x7e0 ? usb_autoresume_device+0x50/0x50 device_release_driver_internal+0x44d/0x520 bus_remove_device+0x2e5/0x5a0 device_del+0x5b2/0xe30 ? __device_link_del+0x370/0x370 ? usb_remove_ep_devs+0x43/0x80 ? remove_intf_ep_devs+0x112/0x1a0 usb_disable_device+0x1e3/0x5a0 usb_disconnect+0x267/0x870 hub_event+0x168d/0x3950 ? rcu_read_lock_sched_held+0xa1/0xd0 ? hub_port_debounce+0x2e0/0x2e0 ? check_irq_usage+0x860/0xf20 ? drain_workqueue+0x281/0x360 ? lock_release+0x640/0x640 ? rcu_read_lock_sched_held+0xa1/0xd0 ? rcu_read_lock_bh_held+0xb0/0xb0 ? lockdep_hardirqs_on_prepare+0x273/0x3e0 process_one_work+0x92b/0x1460 ? pwq_dec_nr_in_flight+0x330/0x330 ? rwlock_bug.part.0+0x90/0x90 worker_thread+0x95/0xe00 ? __kthread_parkme+0x115/0x1e0 ? process_one_work+0x1460/0x1460 kthread+0x3a1/0x480 ? set_kthread_struct+0x120/0x120 ret_from_fork+0x1f/0x30 The buggy address belongs to the page: page:ffffea00041a44c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106913 flags: 0x200000000000000(node=0|zone=2) raw: 0200000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO), pid 7, ts 38347963444, free_ts 41399957635 prep_new_page+0x1aa/0x240 get_page_from_freelist+0x159a/0x27c0 __alloc_pages+0x2da/0x6a0 alloc_pages+0xec/0x1e0 kmalloc_order+0x39/0xf0 kmalloc_order_trace+0x19/0x120 __kmalloc+0x308/0x390 wiphy_new_nm+0x6f5/0x1dd0 ieee80211_alloc_hw_nm+0x36d/0x2230 ath9k_htc_probe_device+0x9d/0x1e10 ath9k_htc_hw_init+0x34/0x50 ath9k_hif_usb_firmware_cb+0x25f/0x4e0 request_firmware_work_func+0x131/0x240 process_one_work+0x92b/0x1460 worker_thread+0x95/0xe00 kthread+0x3a1/0x480 page last free stack trace: free_pcp_prepare+0x3d3/0x7f0 free_unref_page+0x1e/0x3d0 device_release+0xa4/0x240 kobject_put+0x186/0x4c0 put_device+0x20/0x30 ath9k_htc_disconnect_device+0x1cf/0x2c0 ath9k_htc_hw_deinit+0x26/0x30 ath9k_hif_usb_disconnect+0x2d9/0x3f0 usb_unbind_interface+0x19b/0x7e0 device_release_driver_internal+0x44d/0x520 bus_remove_device+0x2e5/0x5a0 device_del+0x5b2/0xe30 usb_disable_device+0x1e3/0x5a0 usb_disconnect+0x267/0x870 hub_event+0x168d/0x3950 process_one_work+0x92b/0x1460 Memory state around the buggy address: ffff888106913180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888106913200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888 ---truncated--- CVE-2022-50881 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50881.html CVE-2022-50881 https://bugzilla.suse.com/1256130 SUSE Bug 1256130 In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix memory leak in uvc_gpio_parse Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked. Allocate the unit buffer after the IRQ to avoid it. Addresses-Coverity-ID: 1474639 ("Resource leak") CVE-2022-50882 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50882.html CVE-2022-50882 https://bugzilla.suse.com/1256126 SUSE Bug 1256126 In the Linux kernel, the following vulnerability has been resolved: drm: Prevent drm_copy_field() to attempt copying a NULL pointer There are some struct drm_driver fields that are required by drivers since drm_copy_field() attempts to copy them to user-space via DRM_IOCTL_VERSION. But it can be possible that a driver has a bug and did not set some of the fields, which leads to drm_copy_field() attempting to copy a NULL pointer: [ +10.395966] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000000 [ +0.010955] Mem abort info: [ +0.002835] ESR = 0x0000000096000004 [ +0.003872] EC = 0x25: DABT (current EL), IL = 32 bits [ +0.005395] SET = 0, FnV = 0 [ +0.003113] EA = 0, S1PTW = 0 [ +0.003182] FSC = 0x04: level 0 translation fault [ +0.004964] Data abort info: [ +0.002919] ISV = 0, ISS = 0x00000004 [ +0.003886] CM = 0, WnR = 0 [ +0.003040] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000115dad000 [ +0.006536] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ +0.006925] Internal error: Oops: 96000004 [#1] SMP ... [ +0.011113] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ +0.007061] pc : __pi_strlen+0x14/0x150 [ +0.003895] lr : drm_copy_field+0x30/0x1a4 [ +0.004156] sp : ffff8000094b3a50 [ +0.003355] x29: ffff8000094b3a50 x28: ffff8000094b3b70 x27: 0000000000000040 [ +0.007242] x26: ffff443743c2ba00 x25: 0000000000000000 x24: 0000000000000040 [ +0.007243] x23: ffff443743c2ba00 x22: ffff8000094b3b70 x21: 0000000000000000 [ +0.007241] x20: 0000000000000000 x19: ffff8000094b3b90 x18: 0000000000000000 [ +0.007241] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaab14b9af40 [ +0.007241] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000000 [ +0.007239] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa524ad67d4d8 [ +0.007242] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : 6c6e6263606e7141 [ +0.007239] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ +0.007241] x2 : 0000000000000000 x1 : ffff8000094b3b90 x0 : 0000000000000000 [ +0.007240] Call trace: [ +0.002475] __pi_strlen+0x14/0x150 [ +0.003537] drm_version+0x84/0xac [ +0.003448] drm_ioctl_kernel+0xa8/0x16c [ +0.003975] drm_ioctl+0x270/0x580 [ +0.003448] __arm64_sys_ioctl+0xb8/0xfc [ +0.003978] invoke_syscall+0x78/0x100 [ +0.003799] el0_svc_common.constprop.0+0x4c/0xf4 [ +0.004767] do_el0_svc+0x38/0x4c [ +0.003357] el0_svc+0x34/0x100 [ +0.003185] el0t_64_sync_handler+0x11c/0x150 [ +0.004418] el0t_64_sync+0x190/0x194 [ +0.003716] Code: 92402c04 b200c3e8 f13fc09f 5400088c (a9400c02) [ +0.006180] ---[ end trace 0000000000000000 ]--- CVE-2022-50884 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50884.html CVE-2022-50884 https://bugzilla.suse.com/1256127 SUSE Bug 1256127 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed There is a null-ptr-deref when mount.cifs over rdma: BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe] Read of size 8 at addr 0000000000000018 by task mount.cifs/3046 CPU: 2 PID: 3046 Comm: mount.cifs Not tainted 6.1.0-rc5+ #62 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-1.fc3 Call Trace: <TASK> dump_stack_lvl+0x34/0x44 kasan_report+0xad/0x130 rxe_qp_do_cleanup+0x2f3/0x360 [rdma_rxe] execute_in_process_context+0x25/0x90 __rxe_cleanup+0x101/0x1d0 [rdma_rxe] rxe_create_qp+0x16a/0x180 [rdma_rxe] create_qp.part.0+0x27d/0x340 ib_create_qp_kernel+0x73/0x160 rdma_create_qp+0x100/0x230 _smbd_get_connection+0x752/0x20f0 smbd_get_connection+0x21/0x40 cifs_get_tcp_session+0x8ef/0xda0 mount_get_conns+0x60/0x750 cifs_mount+0x103/0xd00 cifs_smb3_do_mount+0x1dd/0xcb0 smb3_get_tree+0x1d5/0x300 vfs_get_tree+0x41/0xf0 path_mount+0x9b3/0xdd0 __x64_sys_mount+0x190/0x1d0 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The root cause of the issue is the socket create failed in rxe_qp_init_req(). So move the reset rxe_qp_do_cleanup() after the NULL ptr check. CVE-2022-50885 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50885.html CVE-2022-50885 https://bugzilla.suse.com/1256122 SUSE Bug 1256122 In the Linux kernel, the following vulnerability has been resolved: mmc: toshsd: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will lead a kernel crash because of deleting not added device in the remove path. So fix this by checking the return value and goto error path which will call mmc_free_host(), besides, free_irq() also needs be called. CVE-2022-50886 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50886.html CVE-2022-50886 https://bugzilla.suse.com/1256124 SUSE Bug 1256124 In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix unbalanced of node refcount in regulator_dev_lookup() I got the the following report: OF: ERROR: memory leak, expected refcount 1 instead of 2, of_node_get()/of_node_put() unbalanced - destroy cset entry: attach overlay node /i2c/pmic@62/regulators/exten In of_get_regulator(), the node is returned from of_parse_phandle() with refcount incremented, after using it, of_node_put() need be called. CVE-2022-50887 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50887.html CVE-2022-50887 https://bugzilla.suse.com/1256125 SUSE Bug 1256125 In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom: q6v5: Fix potential null-ptr-deref in q6v5_wcss_init_mmio() q6v5_wcss_init_mmio() will call platform_get_resource_byname() that may fail and return NULL. devm_ioremap() will use res->start as input, which may causes null-ptr-deref. Check the ret value of platform_get_resource_byname() to avoid the null-ptr-deref. CVE-2022-50888 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50888.html CVE-2022-50888 https://bugzilla.suse.com/1256057 SUSE Bug 1256057 In the Linux kernel, the following vulnerability has been resolved: dm integrity: Fix UAF in dm_integrity_dtr() Dm_integrity also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in dm_integrity_dtr(). CVE-2022-50889 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2022-50889.html CVE-2022-50889 https://bugzilla.suse.com/1256056 SUSE Bug 1256056 In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition. CVE-2023-23559 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-23559.html CVE-2023-23559 https://bugzilla.suse.com/1207051 SUSE Bug 1207051 In the Linux kernel, the following vulnerability has been resolved: sched/fair: Don't balance task to its current running CPU We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like below: ------------[ cut here ]------------ WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240 Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip> CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G O 6.1.0-rc4+ #1 Hardware name: Huawei TaiShan 2280 V2/BC82AMDC, BIOS 2280-V2 CS V5.B221.01 12/09/2021 pstate: 604000c9 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : set_task_cpu+0x188/0x240 lr : load_balance+0x5d0/0xc60 sp : ffff80000803bc70 x29: ffff80000803bc70 x28: ffff004089e190e8 x27: ffff004089e19040 x26: ffff007effcabc38 x25: 0000000000000000 x24: 0000000000000001 x23: ffff80000803be84 x22: 000000000000000c x21: ffffb093e79e2a78 x20: 000000000000000c x19: ffff004089e19040 x18: 0000000000000000 x17: 0000000000001fad x16: 0000000000000030 x15: 0000000000000000 x14: 0000000000000003 x13: 0000000000000000 x12: 0000000000000000 x11: 0000000000000001 x10: 0000000000000400 x9 : ffffb093e4cee530 x8 : 00000000fffffffe x7 : 0000000000ce168a x6 : 000000000000013e x5 : 00000000ffffffe1 x4 : 0000000000000001 x3 : 0000000000000b2a x2 : 0000000000000b2a x1 : ffffb093e6d6c510 x0 : 0000000000000001 Call trace: set_task_cpu+0x188/0x240 load_balance+0x5d0/0xc60 rebalance_domains+0x26c/0x380 _nohz_idle_balance.isra.0+0x1e0/0x370 run_rebalance_domains+0x6c/0x80 __do_softirq+0x128/0x3d8 ____do_softirq+0x18/0x24 call_on_irq_stack+0x2c/0x38 do_softirq_own_stack+0x24/0x3c __irq_exit_rcu+0xcc/0xf4 irq_exit_rcu+0x18/0x24 el1_interrupt+0x4c/0xe4 el1h_64_irq_handler+0x18/0x2c el1h_64_irq+0x74/0x78 arch_cpu_idle+0x18/0x4c default_idle_call+0x58/0x194 do_idle+0x244/0x2b0 cpu_startup_entry+0x30/0x3c secondary_start_kernel+0x14c/0x190 __secondary_switched+0xb0/0xb4 ---[ end trace 0000000000000000 ]--- Further investigation shows that the warning is superfluous, the migration disabled task is just going to be migrated to its current running CPU. This is because that on load balance if the dst_cpu is not allowed by the task, we'll re-select a new_dst_cpu as a candidate. If no task can be balanced to dst_cpu we'll try to balance the task to the new_dst_cpu instead. In this case when the migration disabled task is not on CPU it only allows to run on its current CPU, load balance will select its current CPU as new_dst_cpu and later triggers the warning above. The new_dst_cpu is chosen from the env->dst_grpmask. Currently it contains CPUs in sched_group_span() and if we have overlapped groups it's possible to run into this case. This patch makes env->dst_grpmask of group_balance_mask() which exclude any CPUs from the busiest group and solve the issue. For balancing in a domain with no overlapped groups the behaviour keeps same as before. CVE-2023-53215 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53215.html CVE-2023-53215 https://bugzilla.suse.com/1250397 SUSE Bug 1250397 In the Linux kernel, the following vulnerability has been resolved: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels The cacheinfo sets up the shared_cpu_map by checking whether the caches with the same index are shared between CPUs. However, this will trigger slab-out-of-bounds access if the CPUs do not have the same cache hierarchy. Another problem is the mismatched shared_cpu_map when the shared cache does not have the same index between CPUs. CPU0 I D L3 index 0 1 2 x ^ ^ ^ ^ index 0 1 2 3 CPU1 I D L2 L3 This patch checks each cache is shared with all caches on other CPUs. CVE-2023-53254 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53254.html CVE-2023-53254 https://bugzilla.suse.com/1249871 SUSE Bug 1249871 https://bugzilla.suse.com/1250731 SUSE Bug 1250731 In the Linux kernel, the following vulnerability has been resolved: PCI: Free released resource after coalescing release_resource() doesn't actually free the resource or resource list entry so free the resource list entry to avoid a leak. CVE-2023-53743 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53743.html CVE-2023-53743 https://bugzilla.suse.com/1254782 SUSE Bug 1254782 In the Linux kernel, the following vulnerability has been resolved: soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe wkup_m3_ipc_get() takes refcount, which should be freed by wkup_m3_ipc_put(). Add missing refcount release in the error paths. CVE-2023-53744 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53744.html CVE-2023-53744 https://bugzilla.suse.com/1254781 SUSE Bug 1254781 In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfio_ap device driver The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the pointer to the vfio_matrix_dev object in order to free its storage. The problem is, this object is not stored as drvdata with the device; since the kfree function will accept a NULL pointer, the memory for the vfio_matrix_dev object is never freed. Since the device being released is contained within the vfio_matrix_dev object, the container_of macro will be used to retrieve its pointer. CVE-2023-53746 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53746.html CVE-2023-53746 https://bugzilla.suse.com/1254617 SUSE Bug 1254617 In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port_destruct(). Because of that, the struct vc_data pointer must be reloaded in the while loop in vcs_write() after console_lock() to avoid a UAF when vcs_size() is called. Syzkaller reported a UAF in vcs_size(). BUG: KASAN: slab-use-after-free in vcs_size (drivers/tty/vt/vc_screen.c:215) Read of size 4 at addr ffff8880beab89a8 by task repro_vcs_size/4119 Call Trace: <TASK> __asan_report_load4_noabort (mm/kasan/report_generic.c:380) vcs_size (drivers/tty/vt/vc_screen.c:215) vcs_write (drivers/tty/vt/vc_screen.c:664) vfs_write (fs/read_write.c:582 fs/read_write.c:564) ... <TASK> Allocated by task 1213: kmalloc_trace (mm/slab_common.c:1064) vc_allocate (./include/linux/slab.h:559 ./include/linux/slab.h:680 drivers/tty/vt/vt.c:1078 drivers/tty/vt/vt.c:1058) con_install (drivers/tty/vt/vt.c:3334) tty_init_dev (drivers/tty/tty_io.c:1303 drivers/tty/tty_io.c:1415 drivers/tty/tty_io.c:1392) tty_open (drivers/tty/tty_io.c:2082 drivers/tty/tty_io.c:2128) chrdev_open (fs/char_dev.c:415) do_dentry_open (fs/open.c:921) vfs_open (fs/open.c:1052) ... Freed by task 4116: kfree (mm/slab_common.c:1016) vc_port_destruct (drivers/tty/vt/vt.c:1044) tty_port_destructor (drivers/tty/tty_port.c:296) tty_port_put (drivers/tty/tty_port.c:312) vt_disallocate_all (drivers/tty/vt/vt_ioctl.c:662 (discriminator 2)) vt_ioctl (drivers/tty/vt/vt_ioctl.c:903) tty_ioctl (drivers/tty/tty_io.c:2778) ... The buggy address belongs to the object at ffff8880beab8800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 424 bytes inside of freed 1024-byte region [ffff8880beab8800, ffff8880beab8c00) The buggy address belongs to the physical page: page:00000000afc77580 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbeab8 head:00000000afc77580 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfffffc0010200(slab|head|node=0|zone=1|lastcpupid=0x1fffff) page_type: 0xffffffff() raw: 000fffffc0010200 ffff888100042dc0 ffffea000426de00 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880beab8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880beab8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880beab8a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880beab8a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Disabling lock debugging due to kernel taint CVE-2023-53747 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53747.html CVE-2023-53747 https://bugzilla.suse.com/1254572 SUSE Bug 1254572 In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path as well and then prevent any potential use-after-free bugs. CVE-2023-53751 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53751.html CVE-2023-53751 https://bugzilla.suse.com/1254986 SUSE Bug 1254986 https://bugzilla.suse.com/1254988 SUSE Bug 1254988 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup() When if_type equals zero and pci_resource_start(pdev, PCI_64BIT_BAR4) returns false, drbl_regs_memmap_p is not remapped. This passes a NULL pointer to iounmap(), which can trigger a WARN() on certain arches. When if_type equals six and pci_resource_start(pdev, PCI_64BIT_BAR4) returns true, drbl_regs_memmap_p may has been remapped and ctrl_regs_memmap_p is not remapped. This is a resource leak and passes a NULL pointer to iounmap(). To fix these issues, we need to add null checks before iounmap(), and change some goto labels. CVE-2023-53754 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53754.html CVE-2023-53754 https://bugzilla.suse.com/1254609 SUSE Bug 1254609 In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: check for null desc before calling pt_cmd_callback Resolves a panic that can occur on AMD systems, typically during host shutdown, after the PTDMA driver had been exercised. The issue was the pt_issue_pending() function is mistakenly assuming that there will be at least one descriptor in the Submitted queue when the function is called. However, it is possible that both the Submitted and Issued queues could be empty, which could result in pt_cmd_callback() being mistakenly called with a NULL pointer. Ref: Bugzilla Bug 216856. CVE-2023-53755 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53755.html CVE-2023-53755 https://bugzilla.suse.com/1254608 SUSE Bug 1254608 In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver does not check that the direction is set to OUT: ------------[ cut here ]------------ usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41 RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000 RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001 RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528 R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100 FS: 0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline] usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097 To fix this, we must override the direction in the bRequestType field of the control request structure when the length is 0. CVE-2023-53761 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53761.html CVE-2023-53761 https://bugzilla.suse.com/1255002 SUSE Bug 1255002 https://bugzilla.suse.com/1255003 SUSE Bug 1255003 In the Linux kernel, the following vulnerability has been resolved: FS: JFS: Check for read-only mounted filesystem in txBegin This patch adds a check for read-only mounted filesystem in txBegin before starting a transaction potentially saving from NULL pointer deref. CVE-2023-53766 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53766.html CVE-2023-53766 https://bugzilla.suse.com/1255005 SUSE Bug 1255005 https://bugzilla.suse.com/1255006 SUSE Bug 1255006 In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC creates a kernel socket in __smc_create(), the kernel socket is supposed to be freed in smc_clcsock_release() by calling sock_release() when we close() the parent SMC socket. However, at the end of smc_clcsock_release(), the kernel socket's sk_state might not be TCP_CLOSE. This means that we have not called inet_csk_destroy_sock() in __tcp_close() and have not stopped the TCP timers. The kernel socket's TCP timers can be fired later, so we need to hold a refcnt for net as we do for MPTCP subflows in mptcp_subflow_create_socket(). [0]: leaked reference. sk_alloc (./include/net/net_namespace.h:335 net/core/sock.c:2108) inet_create (net/ipv4/af_inet.c:319 net/ipv4/af_inet.c:244) __sock_create (net/socket.c:1546) smc_create (net/smc/af_smc.c:3269 net/smc/af_smc.c:3284) __sock_create (net/socket.c:1546) __sys_socket (net/socket.c:1634 net/socket.c:1618 net/socket.c:1661) __x64_sys_socket (net/socket.c:1672) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) ================================================================== BUG: KASAN: slab-use-after-free in tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) Read of size 1 at addr ffff888052b65e0d by task syzrepro/18091 CPU: 0 PID: 18091 Comm: syzrepro Tainted: G W 6.3.0-rc4-01174-gb5d54eb5899a #7 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.amzn2022.0.1 04/01/2014 Call Trace: <IRQ> dump_stack_lvl (lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) kasan_report (mm/kasan/report.c:538) tcp_write_timer_handler (net/ipv4/tcp_timer.c:378 net/ipv4/tcp_timer.c:624 net/ipv4/tcp_timer.c:594) tcp_write_timer (./include/linux/spinlock.h:390 net/ipv4/tcp_timer.c:643) call_timer_fn (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/timer.h:127 kernel/time/timer.c:1701) __run_timers.part.0 (kernel/time/timer.c:1752 kernel/time/timer.c:2022) run_timer_softirq (kernel/time/timer.c:2037) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:572) __irq_exit_rcu (kernel/softirq.c:445 kernel/softirq.c:650) irq_exit_rcu (kernel/softirq.c:664) sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1107 (discriminator 14)) </IRQ> CVE-2023-53781 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53781.html CVE-2023-53781 https://bugzilla.suse.com/1254751 SUSE Bug 1254751 https://bugzilla.suse.com/1254755 SUSE Bug 1254755 In the Linux kernel, the following vulnerability has been resolved: blk-iocost: fix divide by 0 error in calc_lcoefs() echo max of u64 to cost.model can cause divide by 0 error. # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model divide error: 0000 [#1] PREEMPT SMP RIP: 0010:calc_lcoefs+0x4c/0xc0 Call Trace: <TASK> ioc_refresh_params+0x2b3/0x4f0 ioc_cost_model_write+0x3cb/0x4c0 ? _copy_from_iter+0x6d/0x6c0 ? kernfs_fop_write_iter+0xfc/0x270 cgroup_file_write+0xa0/0x200 kernfs_fop_write_iter+0x17d/0x270 vfs_write+0x414/0x620 ksys_write+0x73/0x160 __x64_sys_write+0x1e/0x30 do_syscall_64+0x35/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd calc_lcoefs() uses the input value of cost.model in DIV_ROUND_UP_ULL, overflow would happen if bps plus IOC_PAGE_SIZE is greater than ULLONG_MAX, it can cause divide by 0 error. Fix the problem by setting basecost CVE-2023-53783 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53783.html CVE-2023-53783 https://bugzilla.suse.com/1254915 SUSE Bug 1254915 In the Linux kernel, the following vulnerability has been resolved: dm flakey: fix a crash with invalid table line This command will crash with NULL pointer dereference: dmsetup create flakey --table \ "0 `blockdev --getsize /dev/ram0` flakey /dev/ram0 0 0 1 2 corrupt_bio_byte 512" Fix the crash by checking if arg_name is non-NULL before comparing it. CVE-2023-53786 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53786.html CVE-2023-53786 https://bugzilla.suse.com/1254916 SUSE Bug 1254916 In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A). static int tuning_ctl_set(...) { for (i = 0; i < TUNING_CTLS_COUNT; i++) (A) if (nid == ca0132_tuning_ctls[i].nid) break; snd_hda_power_up(...); (X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); snd_hda_power_down(...); ^ return 1; } We will get below error by cppcheck sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12 for (i = 0; i < TUNING_CTLS_COUNT; i++) ^ sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20, ^ This patch cares non match case. CVE-2023-53788 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53788.html CVE-2023-53788 https://bugzilla.suse.com/1254917 SUSE Bug 1254917 In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix memory leak in dhchap_ctrl_secret Free dhchap_secret in nvme_ctrl_dhchap_ctrl_secret_store() before we return when nvme_auth_generate_key() returns error. CVE-2023-53792 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53792.html CVE-2023-53792 https://bugzilla.suse.com/1254743 SUSE Bug 1254743 In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting session will stay in server->smb_ses_list until it complete the cifs_free_ipc() and logoff() and then delete itself from the list. CVE-2023-53794 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53794.html CVE-2023-53794 https://bugzilla.suse.com/1255163 SUSE Bug 1255163 https://bugzilla.suse.com/1255235 SUSE Bug 1255235 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function It is stated that ath9k_htc_rx_msg() either frees the provided skb or passes its management to another callback function. However, the skb is not freed in case there is no another callback function, and Syzkaller was able to cause a memory leak. Also minor comment fix. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. CVE-2023-53802 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53802.html CVE-2023-53802 https://bugzilla.suse.com/1254725 SUSE Bug 1254725 In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043a451 by task systemd-udevd/3271 Checking after (and before in next loop) addl_desc_ptr[1] is sufficient, we expect the size to be sanitized before first access to addl_desc_ptr[1]. Make sure we don't walk beyond end of page. CVE-2023-53803 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53803.html CVE-2023-53803 https://bugzilla.suse.com/1255165 SUSE Bug 1255165 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). However, since nilfs_evict_inode() uses nilfs_root for some cleanup operations, it may cause use-after-free read if inodes are left in "garbage_list" and released by nilfs_dispose_list() at the end of nilfs_detach_log_writer(). Fix this issue by modifying nilfs_evict_inode() to only clear inode without additional metadata changes that use nilfs_root if the file system is degraded to read-only or the writer is detached. CVE-2023-53804 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53804.html CVE-2023-53804 https://bugzilla.suse.com/1254920 SUSE Bug 1254920 In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix memory leak in mwifiex_histogram_read() Always free the zeroed page on return from 'mwifiex_histogram_read()'. CVE-2023-53808 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53808.html CVE-2023-53808 https://bugzilla.suse.com/1254723 SUSE Bug 1254723 In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Cap MSIX used to online CPUs + 1 The irdma driver can use a maximum number of msix vectors equal to num_online_cpus() + 1 and the kernel warning stack below is shown if that number is exceeded. The kernel throws a warning as the driver tries to update the affinity hint with a CPU mask greater than the max CPU IDs. Fix this by capping the MSIX vectors to num_online_cpus() + 1. WARNING: CPU: 7 PID: 23655 at include/linux/cpumask.h:106 irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] RIP: 0010:irdma_cfg_ceq_vector+0x34c/0x3f0 [irdma] Call Trace: irdma_rt_init_hw+0xa62/0x1290 [irdma] ? irdma_alloc_local_mac_entry+0x1a0/0x1a0 [irdma] ? __is_kernel_percpu_address+0x63/0x310 ? rcu_read_lock_held_common+0xe/0xb0 ? irdma_lan_unregister_qset+0x280/0x280 [irdma] ? irdma_request_reset+0x80/0x80 [irdma] ? ice_get_qos_params+0x84/0x390 [ice] irdma_probe+0xa40/0xfc0 [irdma] ? rcu_read_lock_bh_held+0xd0/0xd0 ? irdma_remove+0x140/0x140 [irdma] ? rcu_read_lock_sched_held+0x62/0xe0 ? down_write+0x187/0x3d0 ? auxiliary_match_id+0xf0/0x1a0 ? irdma_remove+0x140/0x140 [irdma] auxiliary_bus_probe+0xa6/0x100 __driver_probe_device+0x4a4/0xd50 ? __device_attach_driver+0x2c0/0x2c0 driver_probe_device+0x4a/0x110 __driver_attach+0x1aa/0x350 bus_for_each_dev+0x11d/0x1b0 ? subsys_dev_iter_init+0xe0/0xe0 bus_add_driver+0x3b1/0x610 driver_register+0x18e/0x410 ? 0xffffffffc0b88000 irdma_init_module+0x50/0xaa [irdma] do_one_initcall+0x103/0x5f0 ? perf_trace_initcall_level+0x420/0x420 ? do_init_module+0x4e/0x700 ? __kasan_kmalloc+0x7d/0xa0 ? kmem_cache_alloc_trace+0x188/0x2b0 ? kasan_unpoison+0x21/0x50 do_init_module+0x1d1/0x700 load_module+0x3867/0x5260 ? layout_and_allocate+0x3990/0x3990 ? rcu_read_lock_held_common+0xe/0xb0 ? rcu_read_lock_sched_held+0x62/0xe0 ? rcu_read_lock_bh_held+0xd0/0xd0 ? __vmalloc_node_range+0x46b/0x890 ? lock_release+0x5c8/0xba0 ? alloc_vm_area+0x120/0x120 ? selinux_kernel_module_from_file+0x2a5/0x300 ? __inode_security_revalidate+0xf0/0xf0 ? __do_sys_init_module+0x1db/0x260 __do_sys_init_module+0x1db/0x260 ? load_module+0x5260/0x5260 ? do_syscall_64+0x22/0x450 do_syscall_64+0xa5/0x450 entry_SYSCALL_64_after_hwframe+0x66/0xdb CVE-2023-53811 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53811.html CVE-2023-53811 https://bugzilla.suse.com/1254716 SUSE Bug 1254716 In the Linux kernel, the following vulnerability has been resolved: PCI: Fix dropping valid root bus resources with .end = zero On r8a7791/koelsch: kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unreferenced object 0xc3a34e00 (size 64): comm "swapper/0", pid 1, jiffies 4294937460 (age 199.080s) hex dump (first 32 bytes): b4 5d 81 f0 b4 5d 81 f0 c0 b0 a2 c3 00 00 00 00 .]...].......... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<fe3aa979>] __kmalloc+0xf0/0x140 [<34bd6bc0>] resource_list_create_entry+0x18/0x38 [<767046bc>] pci_add_resource_offset+0x20/0x68 [<b3f3edf2>] devm_of_pci_get_host_bridge_resources.constprop.0+0xb0/0x390 When coalescing two resources for a contiguous aperture, the second resource is enlarged to cover the full contiguous range, while the first resource is marked invalid. This invalidation is done by clearing the flags, start, and end members. When adding the initial resources to the bus later, invalid resources are skipped. Unfortunately, the check for an invalid resource considers only the end member, causing false positives. E.g. on r8a7791/koelsch, root bus resource 0 ("bus 00") is skipped, and no longer registered with pci_bus_insert_busn_res() (causing the memory leak), nor printed: pci-rcar-gen2 ee090000.pci: host bridge /soc/pci@ee090000 ranges: pci-rcar-gen2 ee090000.pci: MEM 0x00ee080000..0x00ee08ffff -> 0x00ee080000 pci-rcar-gen2 ee090000.pci: PCI: revision 11 pci-rcar-gen2 ee090000.pci: PCI host bridge to bus 0000:00 -pci_bus 0000:00: root bus resource [bus 00] pci_bus 0000:00: root bus resource [mem 0xee080000-0xee08ffff] Fix this by only skipping resources where all of the flags, start, and end members are zero. CVE-2023-53814 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53814.html CVE-2023-53814 https://bugzilla.suse.com/1254713 SUSE Bug 1254713 In the Linux kernel, the following vulnerability has been resolved: ARM: zynq: Fix refcount leak in zynq_early_slcr_init of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on error path. Add missing of_node_put() to avoid refcount leak. CVE-2023-53818 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53818.html CVE-2023-53818 https://bugzilla.suse.com/1254714 SUSE Bug 1254714 In the Linux kernel, the following vulnerability has been resolved: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va This is motivated by OOB access in amdgpu_vm_update_range when offset_in_bo+map_size overflows. v2: keep the validations in amdgpu_vm_bo_map v3: add the validations to amdgpu_vm_bo_map/amdgpu_vm_bo_replace_map rather than to amdgpu_gem_va_ioctl CVE-2023-53819 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53819.html CVE-2023-53819 https://bugzilla.suse.com/1254712 SUSE Bug 1254712 In the Linux kernel, the following vulnerability has been resolved: loop: loop_set_status_from_info() check before assignment In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow error occurs, the original correct value will be changed to the wrong value, and it will not be changed back. More, the original patch did not solve the problem, the value was set and ioctl returned an error, but the subsequent io used the value in the loop driver, which still caused an alarm: loop_handle_cmd do_req_filebacked loff_t pos = ((loff_t) blk_rq_pos(rq) << 9) + lo->lo_offset; lo_rw_aio cmd->iocb.ki_pos = pos CVE-2023-53820 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53820.html CVE-2023-53820 https://bugzilla.suse.com/1254706 SUSE Bug 1254706 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"), just use l2cap_chan_hold_unless_zero to prevent referencing a channel that is about to be destroyed. CVE-2023-53827 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53827.html CVE-2023-53827 https://bugzilla.suse.com/1255049 SUSE Bug 1255049 https://bugzilla.suse.com/1255050 SUSE Bug 1255050 In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leak when showing current settings When retriving a item string with tlmi_setting(), the result has to be freed using kfree(). In current_value_show() however, malformed item strings are not freed, causing a memory leak. Fix this by eliminating the early return responsible for this. CVE-2023-53830 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53830.html CVE-2023-53830 https://bugzilla.suse.com/1254658 SUSE Bug 1254658 In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null-ptr-deref in raid10_sync_request init_resync() inits mempool and sets conf->have_replacemnt at the beginning of sync, close_sync() frees the mempool when sync is completed. After [1] recovery might be skipped and init_resync() is called but close_sync() is not. null-ptr-deref occurs with r10bio->dev[i].repl_bio. The following is one way to reproduce the issue. 1) create a array, wait for resync to complete, mddev->recovery_cp is set to MaxSector. 2) recovery is woken and it is skipped. conf->have_replacement is set to 0 in init_resync(). close_sync() not called. 3) some io errors and rdev A is set to WantReplacement. 4) a new device is added and set to A's replacement. 5) recovery is woken, A have replacement, but conf->have_replacemnt is 0. r10bio->dev[i].repl_bio will not be alloced and null-ptr-deref occurs. Fix it by not calling init_resync() if recovery skipped. [1] commit 7e83ccbecd60 ("md/raid10: Allow skipping recovery when clean arrays are assembled") CVE-2023-53832 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53832.html CVE-2023-53832 https://bugzilla.suse.com/1254671 SUSE Bug 1254671 In the Linux kernel, the following vulnerability has been resolved: iio: adc: ina2xx: avoid NULL pointer dereference on OF device match The affected lines were resulting in a NULL pointer dereference on our platform because the device tree contained the following list of compatible strings: power-sensor@40 { compatible = "ti,ina232", "ti,ina231"; ... }; Since the driver doesn't declare a compatible string "ti,ina232", the OF matching succeeds on "ti,ina231". But the I2C device ID info is populated via the first compatible string, cf. modalias population in of_i2c_get_board_info(). Since there is no "ina232" entry in the legacy I2C device ID table either, the struct i2c_device_id *id pointer in the probe function is NULL. Fix this by using the already populated type variable instead, which points to the proper driver data. Since the name is also wanted, add a generic one to the ina2xx_config table. CVE-2023-53834 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53834.html CVE-2023-53834 https://bugzilla.suse.com/1254660 SUSE Bug 1254660 In the Linux kernel, the following vulnerability has been resolved: drm/msm: fix NULL-deref on snapshot tear down In case of early initialisation errors and on platforms that do not use the DPU controller, the deinitilisation code can be called with the kms pointer set to NULL. Patchwork: https://patchwork.freedesktop.org/patch/525099/ CVE-2023-53837 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53837.html CVE-2023-53837 https://bugzilla.suse.com/1254694 SUSE Bug 1254694 In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xdbc_trace() is called. Reserve an extra byte, which will be zeroed automatically because 'buf' is a static variable, in order to avoid troubles, should it happen. CVE-2023-53840 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53840.html CVE-2023-53840 https://bugzilla.suse.com/1254709 SUSE Bug 1254709 In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove The MBHC resources must be released on component probe failure and removal so can not be tied to the lifetime of the component device. This is specifically needed to allow probe deferrals of the sound card which otherwise fails when reprobing the codec component: snd-sc8280xp sound: ASoC: failed to instantiate card -517 genirq: Flags mismatch irq 299. 00002001 (mbhc sw intr) vs. 00002001 (mbhc sw intr) wcd938x_codec audio-codec: Failed to request mbhc interrupts -16 wcd938x_codec audio-codec: mbhc initialization failed wcd938x_codec audio-codec: ASoC: error at snd_soc_component_probe on audio-codec: -16 snd-sc8280xp sound: ASoC: failed to instantiate card -16 CVE-2023-53842 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53842.html CVE-2023-53842 https://bugzilla.suse.com/1254690 SUSE Bug 1254690 In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on swapout move error If moving the bo to system for swapout failed, we were leaking a resource. Fix. CVE-2023-53844 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53844.html CVE-2023-53844 https://bugzilla.suse.com/1254649 SUSE Bug 1254649 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfs_mdt_get_block() If the disk image that nilfs2 mounts is corrupted and a virtual block address obtained by block lookup for a metadata file is invalid, nilfs_bmap_lookup_at_level() may return the same internal return code as -ENOENT, meaning the block does not exist in the metadata file. This duplication of return codes confuses nilfs_mdt_get_block(), causing it to read and create a metadata block indefinitely. In particular, if this happens to the inode metadata file, ifile, semaphore i_rwsem can be left held, causing task hangs in lock_mount. Fix this issue by making nilfs_bmap_lookup_at_level() treat virtual block address translation failures with -ENOENT as metadata corruption instead of returning the error code. CVE-2023-53845 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53845.html CVE-2023-53845 https://bugzilla.suse.com/1255007 SUSE Bug 1255007 In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alauda_check_media() Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage: BUG: KMSAN: uninit-value in alauda_transport+0x462/0x57f0 drivers/usb/storage/alauda.c:1137 CPU: 0 PID: 12279 Comm: usb-storage Not tainted 5.3.0-rc7+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x13a/0x2b0 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:250 alauda_check_media+0x344/0x3310 drivers/usb/storage/alauda.c:460 The problem is that alauda_check_media() doesn't verify that its USB transfer succeeded before trying to use the received data. What should happen if the transfer fails isn't entirely clear, but a reasonably conservative approach is to pretend that no media is present. A similar problem exists in a usb_stor_dbg() call in alauda_get_media_status(). In this case, when an error occurs the call is redundant, because usb_stor_ctrl_transfer() already will print a debugging message. Finally, unrelated to the uninitialized memory access, is the fact that alauda_check_media() performs DMA to a buffer on the stack. Fortunately usb-storage provides a general purpose DMA-able buffer for uses like this. We'll use it instead. CVE-2023-53847 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53847.html CVE-2023-53847 https://bugzilla.suse.com/1254698 SUSE Bug 1254698 In the Linux kernel, the following vulnerability has been resolved: iavf: use internal state to free traffic IRQs If the system tries to close the netdev while iavf_reset_task() is running, __LINK_STATE_START will be cleared and netif_running() will return false in iavf_reinit_interrupt_scheme(). This will result in iavf_free_traffic_irqs() not being called and a leak as follows: [7632.489326] remove_proc_entry: removing non-empty directory 'irq/999', leaking at least 'iavf-enp24s0f0v0-TxRx-0' [7632.490214] WARNING: CPU: 0 PID: 10 at fs/proc/generic.c:718 remove_proc_entry+0x19b/0x1b0 is shown when pci_disable_msix() is later called. Fix by using the internal adapter state. The traffic IRQs will always exist if state == __IAVF_RUNNING. CVE-2023-53850 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53850.html CVE-2023-53850 https://bugzilla.suse.com/1254677 SUSE Bug 1254677 In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix memory leak in dhchap_secret_store Free dhchap_secret in nvme_ctrl_dhchap_secret_store() before we return fix following kmemleack:- unreferenced object 0xffff8886376ea800 (size 64): comm "check", pid 22048, jiffies 4344316705 (age 92.199s) hex dump (first 32 bytes): 44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg 75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL backtrace: [<0000000030ce5d4b>] __kmalloc+0x4b/0x130 [<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core] [<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0 [<00000000437e7ced>] vfs_write+0x2ba/0x3c0 [<00000000f9491baf>] ksys_write+0x5f/0xe0 [<000000001c46513d>] do_syscall_64+0x3b/0x90 [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc unreferenced object 0xffff8886376eaf00 (size 64): comm "check", pid 22048, jiffies 4344316736 (age 92.168s) hex dump (first 32 bytes): 44 48 48 43 2d 31 3a 30 30 3a 6e 78 72 35 4b 67 DHHC-1:00:nxr5Kg 75 58 34 75 6f 41 78 73 4a 61 34 63 2f 68 75 4c uX4uoAxsJa4c/huL backtrace: [<0000000030ce5d4b>] __kmalloc+0x4b/0x130 [<000000009be1cdc1>] nvme_ctrl_dhchap_secret_store+0x8f/0x160 [nvme_core] [<00000000ac06c96a>] kernfs_fop_write_iter+0x12b/0x1c0 [<00000000437e7ced>] vfs_write+0x2ba/0x3c0 [<00000000f9491baf>] ksys_write+0x5f/0xe0 [<000000001c46513d>] do_syscall_64+0x3b/0x90 [<00000000ecf348fe>] entry_SYSCALL_64_after_hwframe+0x72/0xdc CVE-2023-53852 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53852.html CVE-2023-53852 https://bugzilla.suse.com/1254653 SUSE Bug 1254653 In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error If clk_get_rate() fails, the clk that has just been allocated needs to be freed. CVE-2023-53858 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53858.html CVE-2023-53858 https://bugzilla.suse.com/1254704 SUSE Bug 1254704 In the Linux kernel, the following vulnerability has been resolved: hfs: fix missing hfs_bnode_get() in __hfs_bnode_create Syzbot found a kernel BUG in hfs_bnode_put(): kernel BUG at fs/hfs/bnode.c:466! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 3634 Comm: kworker/u4:5 Not tainted 6.1.0-rc7-syzkaller-00190-g97ee9d1c1696 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Workqueue: writeback wb_workfn (flush-7:0) RIP: 0010:hfs_bnode_put+0x46f/0x480 fs/hfs/bnode.c:466 Code: 8a 80 ff e9 73 fe ff ff 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c a0 fe ff ff 48 89 df e8 db 8a 80 ff e9 93 fe ff ff e8 a1 68 2c ff <0f> 0b e8 9a 68 2c ff 0f 0b 0f 1f 84 00 00 00 00 00 55 41 57 41 56 RSP: 0018:ffffc90003b4f258 EFLAGS: 00010293 RAX: ffffffff825e318f RBX: 0000000000000000 RCX: ffff8880739dd7c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90003b4f430 R08: ffffffff825e2d9b R09: ffffed10045157d1 R10: ffffed10045157d1 R11: 1ffff110045157d0 R12: ffff8880228abe80 R13: ffff88807016c000 R14: dffffc0000000000 R15: ffff8880228abe00 FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa6ebe88718 CR3: 000000001e93d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> hfs_write_inode+0x1bc/0xb40 write_inode fs/fs-writeback.c:1440 [inline] __writeback_single_inode+0x4d6/0x670 fs/fs-writeback.c:1652 writeback_sb_inodes+0xb3b/0x18f0 fs/fs-writeback.c:1878 __writeback_inodes_wb+0x125/0x420 fs/fs-writeback.c:1949 wb_writeback+0x440/0x7b0 fs/fs-writeback.c:2054 wb_check_start_all fs/fs-writeback.c:2176 [inline] wb_do_writeback fs/fs-writeback.c:2202 [inline] wb_workfn+0x827/0xef0 fs/fs-writeback.c:2235 process_one_work+0x877/0xdb0 kernel/workqueue.c:2289 worker_thread+0xb14/0x1330 kernel/workqueue.c:2436 kthread+0x266/0x300 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 </TASK> The BUG_ON() is triggered at here: /* Dispose of resources used by a node */ void hfs_bnode_put(struct hfs_bnode *node) { if (node) { <skipped> BUG_ON(!atomic_read(&node->refcnt)); <- we have issue here!!!! <skipped> } } By tracing the refcnt, I found the node is created by hfs_bmap_alloc() with refcnt 1. Then the node is used by hfs_btree_write(). There is a missing of hfs_bnode_get() after find the node. The issue happened in following path: <alloc> hfs_bmap_alloc hfs_bnode_find __hfs_bnode_create <- allocate a new node with refcnt 1. hfs_bnode_put <- decrease the refcnt <write> hfs_btree_write hfs_bnode_find __hfs_bnode_create hfs_bnode_findhash <- find the node without refcnt increased. hfs_bnode_put <- trigger the BUG_ON() since refcnt is 0. CVE-2023-53862 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53862.html CVE-2023-53862 https://bugzilla.suse.com/1254994 SUSE Bug 1254994 In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-compress: Reposition and add pcm_mutex If panic_on_warn is set and compress stream(DPCM) is started, then kernel panic occurred because card->pcm_mutex isn't held appropriately. In the following functions, warning were issued at this line "snd_soc_dpcm_mutex_assert_held". static int dpcm_be_connect(struct snd_soc_pcm_runtime *fe, struct snd_soc_pcm_runtime *be, int stream) { ... snd_soc_dpcm_mutex_assert_held(fe); ... } void dpcm_be_disconnect(struct snd_soc_pcm_runtime *fe, int stream) { ... snd_soc_dpcm_mutex_assert_held(fe); ... } void snd_soc_runtime_action(struct snd_soc_pcm_runtime *rtd, int stream, int action) { ... snd_soc_dpcm_mutex_assert_held(rtd); ... } int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir, int event) { ... snd_soc_dpcm_mutex_assert_held(fe); ... } These functions are called by soc_compr_set_params_fe, soc_compr_open_fe and soc_compr_free_fe without pcm_mutex locking. And this is call stack. [ 414.527841][ T2179] pc : dpcm_process_paths+0x5a4/0x750 [ 414.527848][ T2179] lr : dpcm_process_paths+0x37c/0x750 [ 414.527945][ T2179] Call trace: [ 414.527949][ T2179] dpcm_process_paths+0x5a4/0x750 [ 414.527955][ T2179] soc_compr_open_fe+0xb0/0x2cc [ 414.527972][ T2179] snd_compr_open+0x180/0x248 [ 414.527981][ T2179] snd_open+0x15c/0x194 [ 414.528003][ T2179] chrdev_open+0x1b0/0x220 [ 414.528023][ T2179] do_dentry_open+0x30c/0x594 [ 414.528045][ T2179] vfs_open+0x34/0x44 [ 414.528053][ T2179] path_openat+0x914/0xb08 [ 414.528062][ T2179] do_filp_open+0xc0/0x170 [ 414.528068][ T2179] do_sys_openat2+0x94/0x18c [ 414.528076][ T2179] __arm64_sys_openat+0x78/0xa4 [ 414.528084][ T2179] invoke_syscall+0x48/0x10c [ 414.528094][ T2179] el0_svc_common+0xbc/0x104 [ 414.528099][ T2179] do_el0_svc+0x34/0xd8 [ 414.528103][ T2179] el0_svc+0x34/0xc4 [ 414.528125][ T2179] el0t_64_sync_handler+0x8c/0xfc [ 414.528133][ T2179] el0t_64_sync+0x1a0/0x1a4 [ 414.528142][ T2179] Kernel panic - not syncing: panic_on_warn set ... So, I reposition and add pcm_mutex to resolve lockdep error. CVE-2023-53866 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53866.html CVE-2023-53866 https://bugzilla.suse.com/1255060 SUSE Bug 1255060 In the Linux kernel, the following vulnerability has been resolved: SMB3: Add missing locks to protect deferred close file list cifs_del_deferred_close function has a critical section which modifies the deferred close file list. We must acquire deferred_lock before calling cifs_del_deferred_close function. CVE-2023-53990 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53990.html CVE-2023-53990 https://bugzilla.suse.com/1255560 SUSE Bug 1255560 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Disallow unallocated resources to be returned In the event that the topology requests resources that have not been created by the system (because they are typically not represented in dpu_mdss_cfg ^1), the resource(s) in global_state (in this case DSC blocks, until their allocation/assignment is being sanity-checked in "drm/msm/dpu: Reject topologies for which no DSC blocks are available") remain NULL but will still be returned out of dpu_rm_get_assigned_resources, where the caller expects to get an array containing num_blks valid pointers (but instead gets these NULLs). To prevent this from happening, where null-pointer dereferences typically result in a hard-to-debug platform lockup, num_blks shouldn't increase past NULL blocks and will print an error and break instead. After all, max_blks represents the static size of the maximum number of blocks whereas the actual amount varies per platform. ^1: which can happen after a git rebase ended up moving additions to _dpu_cfg to a different struct which has the same patch context. Patchwork: https://patchwork.freedesktop.org/patch/517636/ CVE-2023-53991 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53991.html CVE-2023-53991 https://bugzilla.suse.com/1255627 SUSE Bug 1255627 In the Linux kernel, the following vulnerability has been resolved: x86/sev: Make enc_dec_hypercall() accept a size instead of npages enc_dec_hypercall() accepted a page count instead of a size, which forced its callers to round up. As a result, non-page aligned vaddrs caused pages to be spuriously marked as decrypted via the encryption status hypercall, which in turn caused consistent corruption of pages during live migration. Live migration requires accurate encryption status information to avoid migrating pages from the wrong perspective. CVE-2023-53996 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53996.html CVE-2023-53996 https://bugzilla.suse.com/1255618 SUSE Bug 1255618 In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio - Fix race on data_avail and actual data The virtio rng device kicks off a new entropy request whenever the data available reaches zero. When a new request occurs at the end of a read operation, that is, when the result of that request is only needed by the next reader, then there is a race between the writing of the new data and the next reader. This is because there is no synchronisation whatsoever between the writer and the reader. Fix this by writing data_avail with smp_store_release and reading it with smp_load_acquire when we first enter read. The subsequent reads are safe because they're either protected by the first load acquire, or by the completion mechanism. Also remove the redundant zeroing of data_idx in random_recv_done (data_idx must already be zero at this point) and data_avail in request_entropy (ditto). CVE-2023-53998 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-53998.html CVE-2023-53998 https://bugzilla.suse.com/1255578 SUSE Bug 1255578 In the Linux kernel, the following vulnerability has been resolved: staging: r8712: Fix memory leak in _r8712_init_xmit_priv() In the above mentioned routine, memory is allocated in several places. If the first succeeds and a later one fails, the routine will leak memory. This patch fixes commit 2865d42c78a9 ("staging: r8712u: Add the new driver to the mainline kernel"). A potential memory leak in r8712_xmit_resource_alloc() is also addressed. CVE-2023-54001 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54001.html CVE-2023-54001 https://bugzilla.suse.com/1255628 SUSE Bug 1255628 In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix GID entry ref leak when create_ah fails If AH create request fails, release sgid_attr to avoid GID entry referrence leak reported while releasing GID table CVE-2023-54003 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54003.html CVE-2023-54003 https://bugzilla.suse.com/1255619 SUSE Bug 1255619 In the Linux kernel, the following vulnerability has been resolved: vmci_host: fix a race condition in vmci_host_poll() causing GPF During fuzzing, a general protection fault is observed in vmci_host_poll(). general protection fault, probably for non-canonical address 0xdffffc0000000019: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf] RIP: 0010:__lock_acquire+0xf3/0x5e00 kernel/locking/lockdep.c:4926 <- omitting registers -> Call Trace: <TASK> lock_acquire+0x1a4/0x4a0 kernel/locking/lockdep.c:5672 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162 add_wait_queue+0x3d/0x260 kernel/sched/wait.c:22 poll_wait include/linux/poll.h:49 [inline] vmci_host_poll+0xf8/0x2b0 drivers/misc/vmw_vmci/vmci_host.c:174 vfs_poll include/linux/poll.h:88 [inline] do_pollfd fs/select.c:873 [inline] do_poll fs/select.c:921 [inline] do_sys_poll+0xc7c/0x1aa0 fs/select.c:1015 __do_sys_ppoll fs/select.c:1121 [inline] __se_sys_ppoll+0x2cc/0x330 fs/select.c:1101 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x4e/0xa0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Example thread interleaving that causes the general protection fault is as follows: CPU1 (vmci_host_poll) CPU2 (vmci_host_do_init_context) ----- ----- // Read uninitialized context context = vmci_host_dev->context; // Initialize context vmci_host_dev->context = vmci_ctx_create(); vmci_host_dev->ct_type = VMCIOBJ_CONTEXT; if (vmci_host_dev->ct_type == VMCIOBJ_CONTEXT) { // Dereferencing the wrong pointer poll_wait(..., &context->host_context); } In this scenario, vmci_host_poll() reads vmci_host_dev->context first, and then reads vmci_host_dev->ct_type to check that vmci_host_dev->context is initialized. However, since these two reads are not atomically executed, there is a chance of a race condition as described above. To fix this race condition, read vmci_host_dev->context after checking the value of vmci_host_dev->ct_type so that vmci_host_poll() always reads an initialized context. CVE-2023-54007 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54007.html CVE-2023-54007 https://bugzilla.suse.com/1255626 SUSE Bug 1255626 In the Linux kernel, the following vulnerability has been resolved: i2c: cadence: cdns_i2c_master_xfer(): Fix runtime PM leak on error path The cdns_i2c_master_xfer() function gets a runtime PM reference when the function is entered. This reference is released when the function is exited. There is currently one error path where the function exits directly, which leads to a leak of the runtime PM reference. Make sure that this error path also releases the runtime PM reference. CVE-2023-54009 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54009.html CVE-2023-54009 https://bugzilla.suse.com/1255620 SUSE Bug 1255620 In the Linux kernel, the following vulnerability has been resolved: ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects ACPICA commit 0d5f467d6a0ba852ea3aad68663cbcbd43300fd4 ACPI_ALLOCATE_ZEROED may fails, object_info might be null and will cause null pointer dereference later. CVE-2023-54010 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54010.html CVE-2023-54010 https://bugzilla.suse.com/1256326 SUSE Bug 1256326 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() Klocwork reported warning of rport maybe NULL and will be dereferenced. rport returned by call to fc_bsg_to_rport() could be NULL and dereferenced. Check valid rport returned by fc_bsg_to_rport(). CVE-2023-54014 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54014.html CVE-2023-54014 https://bugzilla.suse.com/1256300 SUSE Bug 1256300 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device In case devcom allocation is failed, mlx5 is always freeing the priv. However, this priv might have been allocated by a different thread, and freeing it might lead to use-after-free bugs. Fix it by freeing the priv only in case it was allocated by the running thread. CVE-2023-54015 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54015.html CVE-2023-54015 https://bugzilla.suse.com/1255562 SUSE Bug 1255562 In the Linux kernel, the following vulnerability has been resolved: drm/msm/hdmi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference in `hdmi_hdcp.c` and `hdmi_hpd.c`. Patchwork: https://patchwork.freedesktop.org/patch/517211/ CVE-2023-54018 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54018.html CVE-2023-54018 https://bugzilla.suse.com/1255690 SUSE Bug 1255690 In the Linux kernel, the following vulnerability has been resolved: sched/psi: use kernfs polling functions for PSI trigger polling Destroying psi trigger in cgroup_file_release causes UAF issues when a cgroup is removed from under a polling process. This is happening because cgroup removal causes a call to cgroup_file_release while the actual file is still alive. Destroying the trigger at this point would also destroy its waitqueue head and if there is still a polling process on that file accessing the waitqueue, it will step on the freed pointer: do_select vfs_poll do_rmdir cgroup_rmdir kernfs_drain_open_files cgroup_file_release cgroup_pressure_release psi_trigger_destroy wake_up_pollfree(&t->event_wait) // vfs_poll is unblocked synchronize_rcu kfree(t) poll_freewait -> UAF access to the trigger's waitqueue head Patch [1] fixed this issue for epoll() case using wake_up_pollfree(), however the same issue exists for synchronous poll() case. The root cause of this issue is that the lifecycles of the psi trigger's waitqueue and of the file associated with the trigger are different. Fix this by using kernfs_generic_poll function when polling on cgroup-specific psi triggers. It internally uses kernfs_open_node->poll waitqueue head with its lifecycle tied to the file's lifecycle. This also renders the fix in [1] obsolete, so revert it. [1] commit c2dbe32d5db5 ("sched/psi: Fix use-after-free in ep_remove_wait_queue()") CVE-2023-54019 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54019.html CVE-2023-54019 https://bugzilla.suse.com/1255636 SUSE Bug 1255636 In the Linux kernel, the following vulnerability has been resolved: dmaengine: sf-pdma: pdma_desc memory leak fix Commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel") changed sf_pdma_prep_dma_memcpy() to unconditionally allocate a new sf_pdma_desc each time it is called. The driver previously recycled descs, by checking the in_use flag, only allocating additional descs if the existing one was in use. This logic was removed in commit b2cc5c465c2c ("dmaengine: sf-pdma: Add multithread support for a DMA channel"), but sf_pdma_free_desc() was not changed to handle the new behaviour. As a result, each time sf_pdma_prep_dma_memcpy() is called, the previous descriptor is leaked, over time leading to memory starvation: unreferenced object 0xffffffe008447300 (size 192): comm "irq/39-mchp_dsc", pid 343, jiffies 4294906910 (age 981.200s) hex dump (first 32 bytes): 00 00 00 ff 00 00 00 00 b8 c1 00 00 00 00 00 00 ................ 00 00 70 08 10 00 00 00 00 00 00 c0 00 00 00 00 ..p............. backtrace: [<00000000064a04f4>] kmemleak_alloc+0x1e/0x28 [<00000000018927a7>] kmem_cache_alloc+0x11e/0x178 [<000000002aea8d16>] sf_pdma_prep_dma_memcpy+0x40/0x112 Add the missing kfree() to sf_pdma_free_desc(), and remove the redundant in_use flag. CVE-2023-54020 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54020.html CVE-2023-54020 https://bugzilla.suse.com/1255574 SUSE Bug 1255574 In the Linux kernel, the following vulnerability has been resolved: ext4: set goal start correctly in ext4_mb_normalize_request We need to set ac_g_ex to notify the goal start used in ext4_mb_find_by_goal. Set ac_g_ex instead of ac_f_ex in ext4_mb_normalize_request. Besides we should assure goal start is in range [first_data_block, blocks_count) as ext4_mb_initialize_context does. [ Added a check to make sure size is less than ar->pright; otherwise we could end up passing an underflowed value of ar->pright - size to ext4_get_group_no_and_offset(), which will trigger a BUG_ON later on. - TYT ] CVE-2023-54021 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54021.html CVE-2023-54021 https://bugzilla.suse.com/1255600 SUSE Bug 1255600 In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy target device if coalesced MMIO unregistration fails Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bus_unregister_dev() does not destroy the target device. BUG: memory leak unreferenced object 0xffff888112a54880 (size 64): comm "syz-executor.2", pid 5258, jiffies 4297861402 (age 14.129s) hex dump (first 32 bytes): 38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff 8.g.....8.g..... e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff .........0g..... backtrace: [<0000000006995a8a>] kmalloc include/linux/slab.h:556 [inline] [<0000000006995a8a>] kzalloc include/linux/slab.h:690 [inline] [<0000000006995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150 [<00000000022550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323 [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline] [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline] [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696 [<0000000080e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713 [<0000000059ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline] [<0000000059ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline] [<0000000059ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718 [<000000006444fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290 [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe BUG: leak checking failed CVE-2023-54024 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54024.html CVE-2023-54024 https://bugzilla.suse.com/1255609 SUSE Bug 1255609 In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled In case WoWlan was never configured during the operation of the system, the hw->wiphy->wowlan_config will be NULL. rsi_config_wowlan() checks whether wowlan_config is non-NULL and if it is not, then WARNs about it. The warning is valid, as during normal operation the rsi_config_wowlan() should only ever be called with non-NULL wowlan_config. In shutdown this rsi_config_wowlan() should only ever be called if WoWlan was configured before by the user. Add checks for non-NULL wowlan_config into the shutdown hook. While at it, check whether the wiphy is also non-NULL before accessing wowlan_config . Drop the single-use wowlan_config variable, just inline it into function call. CVE-2023-54025 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54025.html CVE-2023-54025 https://bugzilla.suse.com/1255558 SUSE Bug 1255558 In the Linux kernel, the following vulnerability has been resolved: opp: Fix use-after-free in lazy_opp_tables after probe deferral When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns -EPROBE_DEFER, the opp_table is freed again, to wait until all the interconnect paths are available. However, if the OPP table is using required-opps then it may already have been added to the global lazy_opp_tables list. The error path does not remove the opp_table from the list again. This can cause crashes later when the provider of the required-opps is added, since we will iterate over OPP tables that have already been freed. E.g.: Unable to handle kernel NULL pointer dereference when read CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3 PC is at _of_add_opp_table_v2 (include/linux/of.h:949 drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404 drivers/opp/of.c:1032) -> lazy_link_required_opp_table() Fix this by calling _of_clear_opp_table() to remove the opp_table from the list and clear other allocated resources. While at it, also add the missing mutex_destroy() calls in the error path. CVE-2023-54026 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54026.html CVE-2023-54026 https://bugzilla.suse.com/1255549 SUSE Bug 1255549 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task" In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like rxe_init_task are not setup until rxe_qp_init_req(). If an error occurred before this point then the unwind will call rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task() which will oops when trying to access the uninitialized spinlock. If rxe_init_task is not executed, rxe_cleanup_task will not be called. CVE-2023-54028 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54028.html CVE-2023-54028 https://bugzilla.suse.com/1255546 SUSE Bug 1255546 In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?) when it's connected to a bluetooth audio device. The busy bluetooth traffic generates lots of C2H (card to host) messages, which are not freed correctly. To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback() inside the loop where skb_dequeue() is called. The RTL8192EU leaks memory because the C2H messages are added to the queue and left there forever. (This was fine in the past because it probably wasn't sending any C2H messages until commit e542e66b7c2e ("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit it sends a C2H message when the TX rate changes.) To fix this, delete the check for rf_paths > 1 and the goto. Let the function process the C2H messages from RTL8192EU like the ones from the other chips. Theoretically the RTL8188FU could also leak like RTL8723BU, but it most likely doesn't send C2H messages frequently enough. This change was tested with RTL8723BU by Erhard F. I tested it with RTL8188FU and RTL8192EU. CVE-2023-54036 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54036.html CVE-2023-54036 https://bugzilla.suse.com/1255528 SUSE Bug 1255528 In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access could occur during the memcpy() operation if the size of skb->cb is larger than the size of struct j1939_sk_buff_cb. This is because the memcpy() operation uses the size of skb->cb, leading to a read beyond the struct j1939_sk_buff_cb. Updated the memcpy() operation to use the size of struct j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the memcpy() operation only reads the memory within the bounds of struct j1939_sk_buff_cb, preventing out-of-bounds memory access. Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb is greater than or equal to the size of struct j1939_sk_buff_cb. This ensures that the skb->cb buffer is large enough to hold the j1939_sk_buff_cb structure. [mkl: rephrase commit message] CVE-2023-54039 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54039.html CVE-2023-54039 https://bugzilla.suse.com/1255555 SUSE Bug 1255555 In the Linux kernel, the following vulnerability has been resolved: ice: fix wrong fallback logic for FDIR When adding a FDIR filter, if ice_vc_fdir_set_irq_ctx returns failure, the inserted fdir entry will not be removed and if ice_vc_fdir_write_fltr returns failure, the fdir context info for irq handler will not be cleared which may lead to inconsistent or memory leak issue. This patch refines failure cases to resolve this issue. CVE-2023-54040 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54040.html CVE-2023-54040 https://bugzilla.suse.com/1255554 SUSE Bug 1255554 In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix VAS mm use after free The refcount on mm is dropped before the coprocessor is detached. CVE-2023-54042 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54042.html CVE-2023-54042 https://bugzilla.suse.com/1255702 SUSE Bug 1255702 https://bugzilla.suse.com/1257670 SUSE Bug 1257670 In the Linux kernel, the following vulnerability has been resolved: audit: fix possible soft lockup in __audit_inode_child() Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n 2. auditctl -a exit,always -S open -k key 3. sysctl -w kernel.watchdog_thresh=5 4. mkdir /sys/kernel/debug/tracing/instances/test There may be a soft lockup as follows: watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace: dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340 __handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140 __audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Therefore, we add cond_resched() to __audit_inode_child() to fix it. CVE-2023-54045 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54045.html CVE-2023-54045 https://bugzilla.suse.com/1256285 SUSE Bug 1256285 In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of essiv may specify MAY_BACKLOG, we also need to expect EBUSY and treat it in the same way. Otherwise backlogged requests will trigger a use-after-free. CVE-2023-54046 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54046.html CVE-2023-54046 https://bugzilla.suse.com/1256295 SUSE Bug 1256295 In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Prevent handling any completions after qp destroy HW may generate completions that indicates QP is destroyed. Driver should not be scheduling any more completion handlers for this QP, after the QP is destroyed. Since CQs are active during the QP destroy, driver may still schedule completion handlers. This can cause a race where the destroy_cq and poll_cq running simultaneously. Snippet of kernel panic while doing bnxt_re driver load unload in loop. This indicates a poll after the CQ is freed. [77786.481636] Call Trace: [77786.481640] <TASK> [77786.481644] bnxt_re_poll_cq+0x14a/0x620 [bnxt_re] [77786.481658] ? kvm_clock_read+0x14/0x30 [77786.481693] __ib_process_cq+0x57/0x190 [ib_core] [77786.481728] ib_cq_poll_work+0x26/0x80 [ib_core] [77786.481761] process_one_work+0x1e5/0x3f0 [77786.481768] worker_thread+0x50/0x3a0 [77786.481785] ? __pfx_worker_thread+0x10/0x10 [77786.481790] kthread+0xe2/0x110 [77786.481794] ? __pfx_kthread+0x10/0x10 [77786.481797] ret_from_fork+0x2c/0x50 To avoid this, complete all completion handlers before returning the destroy QP. If free_cq is called soon after destroy_qp, IB stack will cancel the CQ work before invoking the destroy_cq verb and this will prevent any race mentioned. CVE-2023-54048 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54048.html CVE-2023-54048 https://bugzilla.suse.com/1256395 SUSE Bug 1256395 In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: Add check for kstrdup Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. CVE-2023-54049 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54049.html CVE-2023-54049 https://bugzilla.suse.com/1256396 SUSE Bug 1256396 In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memleak when insert_old_idx() failed Following process will cause a memleak for copied up znode: dirty_cow_znode zn = copy_znode(c, znode); err = insert_old_idx(c, zbr->lnum, zbr->offs); if (unlikely(err)) return ERR_PTR(err); // No one refers to zn. Fetch a reproducer in [Link]. Function copy_znode() is split into 2 parts: resource allocation and znode replacement, insert_old_idx() is split in similar way, so resource cleanup could be done in error handling path without corrupting metadata(mem & disk). It's okay that old index inserting is put behind of add_idx_dirt(), old index is used in layout_leb_in_gaps(), so the two processes do not depend on each other. CVE-2023-54050 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54050.html CVE-2023-54050 https://bugzilla.suse.com/1256397 SUSE Bug 1256397 In the Linux kernel, the following vulnerability has been resolved: net: do not allow gso_size to be set to GSO_BY_FRAGS One missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again [1] Do not allow gso_size to be set to GSO_BY_FRAGS (0xffff), because this magic value is used by the kernel. [1] general protection fault, probably for non-canonical address 0xdffffc000000000e: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000070-0x0000000000000077] CPU: 0 PID: 5039 Comm: syz-executor401 Not tainted 6.5.0-rc5-next-20230809-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:skb_segment+0x1a52/0x3ef0 net/core/skbuff.c:4500 Code: 00 00 00 e9 ab eb ff ff e8 6b 96 5d f9 48 8b 84 24 00 01 00 00 48 8d 78 70 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e ea 21 00 00 48 8b 84 24 00 01 RSP: 0018:ffffc90003d3f1c8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 000000000001fffe RCX: 0000000000000000 RDX: 000000000000000e RSI: ffffffff882a3115 RDI: 0000000000000070 RBP: ffffc90003d3f378 R08: 0000000000000005 R09: 000000000000ffff R10: 000000000000ffff R11: 5ee4a93e456187d6 R12: 000000000001ffc6 R13: dffffc0000000000 R14: 0000000000000008 R15: 000000000000ffff FS: 00005555563f2380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020020000 CR3: 000000001626d000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> udp6_ufo_fragment+0x9d2/0xd50 net/ipv6/udp_offload.c:109 ipv6_gso_segment+0x5c4/0x17b0 net/ipv6/ip6_offload.c:120 skb_mac_gso_segment+0x292/0x610 net/core/gso.c:53 __skb_gso_segment+0x339/0x710 net/core/gso.c:124 skb_gso_segment include/net/gso.h:83 [inline] validate_xmit_skb+0x3a5/0xf10 net/core/dev.c:3625 __dev_queue_xmit+0x8f0/0x3d60 net/core/dev.c:4329 dev_queue_xmit include/linux/netdevice.h:3082 [inline] packet_xmit+0x257/0x380 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3087 [inline] packet_sendmsg+0x24c7/0x5570 net/packet/af_packet.c:3119 sock_sendmsg_nosec net/socket.c:727 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:750 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2496 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2550 __sys_sendmsg+0x117/0x1e0 net/socket.c:2579 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7ff27cdb34d9 CVE-2023-54051 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54051.html CVE-2023-54051 https://bugzilla.suse.com/1256394 SUSE Bug 1256394 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: fix possible NULL pointer dereference It is possible that iwl_pci_probe() will fail and free the trans, then afterwards iwl_pci_remove() will be called and crash by trying to access trans which is already freed, fix it. iwlwifi 0000:01:00.0: Detected crf-id 0xa5a5a5a2, cnv-id 0xa5a5a5a2 wfpm id 0xa5a5a5a2 iwlwifi 0000:01:00.0: Can't find a correct rfid for crf id 0x5a2 ... BUG: kernel NULL pointer dereference, address: 0000000000000028 ... RIP: 0010:iwl_pci_remove+0x12/0x30 [iwlwifi] pci_device_remove+0x3e/0xb0 device_release_driver_internal+0x103/0x1f0 driver_detach+0x4c/0x90 bus_remove_driver+0x5c/0xd0 driver_unregister+0x31/0x50 pci_unregister_driver+0x40/0x90 iwl_pci_unregister_driver+0x15/0x20 [iwlwifi] __exit_compat+0x9/0x98 [iwlwifi] __x64_sys_delete_module+0x147/0x260 CVE-2023-54053 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54053.html CVE-2023-54053 https://bugzilla.suse.com/1256388 SUSE Bug 1256388 In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix memory leak of PBLE objects On rmmod of irdma, the PBLE object memory is not being freed. PBLE object memory are not statically pre-allocated at function initialization time unlike other HMC objects. PBLEs objects and the Segment Descriptors (SD) for it can be dynamically allocated during scale up and SD's remain allocated till function deinitialization. Fix this leak by adding IRDMA_HMC_IW_PBLE to the iw_hmc_obj_types[] table and skip pbles in irdma_create_hmc_obj but not in irdma_del_hmc_objects(). CVE-2023-54055 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54055.html CVE-2023-54055 https://bugzilla.suse.com/1256384 SUSE Bug 1256384 In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Check if ffa_driver remove is present before executing Currently ffa_drv->remove() is called unconditionally from ffa_device_remove(). Since the driver registration doesn't check for it and allows it to be registered without .remove callback, we need to check for the presence of it before executing it from ffa_device_remove() to above a NULL pointer dereference like the one below: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 | Mem abort info: | ESR = 0x0000000086000004 | EC = 0x21: IABT (current EL), IL = 32 bits | SET = 0, FnV = 0 | EA = 0, S1PTW = 0 | FSC = 0x04: level 0 translation fault | user pgtable: 4k pages, 48-bit VAs, pgdp=0000000881cc8000 | [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 | Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP | CPU: 3 PID: 130 Comm: rmmod Not tainted 6.3.0-rc7 #6 | Hardware name: FVP Base RevC (DT) | pstate: 63402809 (nZCv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=-c) | pc : 0x0 | lr : ffa_device_remove+0x20/0x2c | Call trace: | 0x0 | device_release_driver_internal+0x16c/0x260 | driver_detach+0x90/0xd0 | bus_remove_driver+0xdc/0x11c | driver_unregister+0x30/0x54 | ffa_driver_unregister+0x14/0x20 | cleanup_module+0x18/0xeec | __arm64_sys_delete_module+0x234/0x378 | invoke_syscall+0x40/0x108 | el0_svc_common+0xb4/0xf0 | do_el0_svc+0x30/0xa4 | el0_svc+0x2c/0x7c | el0t_64_sync_handler+0x84/0xf0 | el0t_64_sync+0x190/0x194 CVE-2023-54058 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54058.html CVE-2023-54058 https://bugzilla.suse.com/1256382 SUSE Bug 1256382 In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: Fix a memory leak when scanning for an adapter The adapter scan ssif_info_find() sets info->adapter_name if the adapter info came from SMBIOS, as it's not set in that case. However, this function can be called more than once, and it will leak the adapter name if it had already been set. So check for NULL before setting it. CVE-2023-54064 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54064.html CVE-2023-54064 https://bugzilla.suse.com/1256375 SUSE Bug 1256375 In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential data race at PCM memory allocation helpers The PCM memory allocation helpers have a sanity check against too many buffer allocations. However, the check is performed without a proper lock and the allocation isn't serialized; this allows user to allocate more memories than predefined max size. Practically seen, this isn't really a big problem, as it's more or less some "soft limit" as a sanity check, and it's not possible to allocate unlimitedly. But it's still better to address this for more consistent behavior. The patch covers the size check in do_alloc_pages() with the card->memory_mutex, and increases the allocated size there for preventing the further overflow. When the actual allocation fails, the size is decreased accordingly. CVE-2023-54072 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54072.html CVE-2023-54072 https://bugzilla.suse.com/1256291 SUSE Bug 1256291 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of being put in the next call to cifs_put_smb_ses() and thus potentially causing an use-after-free bug. CVE-2023-54076 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54076.html CVE-2023-54076 https://bugzilla.suse.com/1256335 SUSE Bug 1256335 https://bugzilla.suse.com/1256450 SUSE Bug 1256450 In the Linux kernel, the following vulnerability has been resolved: media: max9286: Free control handler The control handler is leaked in some probe-time error paths, as well as in the remove path. Fix it. CVE-2023-54078 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54078.html CVE-2023-54078 https://bugzilla.suse.com/1256337 SUSE Bug 1256337 In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx: Fix poll_interval handling and races on remove Before this patch bq27xxx_battery_teardown() was setting poll_interval = 0 to avoid bq27xxx_battery_update() requeuing the delayed_work item. There are 2 problems with this: 1. If the driver is unbound through sysfs, rather then the module being rmmod-ed, this changes poll_interval unexpectedly 2. This is racy, after it being set poll_interval could be changed before bq27xxx_battery_update() checks it through /sys/module/bq27xxx_battery/parameters/poll_interval Fix this by added a removed attribute to struct bq27xxx_device_info and using that instead of setting poll_interval to 0. There also is another poll_interval related race on remove(), writing /sys/module/bq27xxx_battery/parameters/poll_interval will requeue the delayed_work item for all devices on the bq27xxx_battery_devices list and the device being removed was only removed from that list after cancelling the delayed_work item. Fix this by moving the removal from the bq27xxx_battery_devices list to before cancelling the delayed_work item. CVE-2023-54079 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54079.html CVE-2023-54079 https://bugzilla.suse.com/1256338 SUSE Bug 1256338 In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Clear the driver reference in usb-phy dev For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy. When we try to destroy the port dev, it will destroy its dev driver as well. But we did not remove the reference from usb-phy dev. This might cause the use-after-free issue in KASAN. CVE-2023-54083 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54083.html CVE-2023-54083 https://bugzilla.suse.com/1256368 SUSE Bug 1256368 In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-digi00x: prevent potential use after free This code was supposed to return an error code if init_stream() failed, but it instead freed dg00x->rx_stream and returned success. This potentially leads to a use after free. CVE-2023-54084 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54084.html CVE-2023-54084 https://bugzilla.suse.com/1256223 SUSE Bug 1256223 https://bugzilla.suse.com/1256225 SUSE Bug 1256225 In the Linux kernel, the following vulnerability has been resolved: ixgbe: Fix panic during XDP_TX with > 64 CPUs Commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus") adds support to allow XDP programs to run on systems with more than 64 CPUs by locking the XDP TX rings and indexing them using cpu % 64 (IXGBE_MAX_XDP_QS). Upon trying this out patch on a system with more than 64 cores, the kernel paniced with an array-index-out-of-bounds at the return in ixgbe_determine_xdp_ring in ixgbe.h, which means ixgbe_determine_xdp_q_idx was just returning the cpu instead of cpu % IXGBE_MAX_XDP_QS. An example splat: ========================================================================== UBSAN: array-index-out-of-bounds in /var/lib/dkms/ixgbe/5.18.6+focal-1/build/src/ixgbe.h:1147:26 index 65 is out of range for type 'ixgbe_ring *[64]' ========================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000058 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU: 65 PID: 408 Comm: ksoftirqd/65 Tainted: G IOE 5.15.0-48-generic #54~20.04.1-Ubuntu Hardware name: Dell Inc. PowerEdge R640/0W23H8, BIOS 2.5.4 01/13/2020 RIP: 0010:ixgbe_xmit_xdp_ring+0x1b/0x1c0 [ixgbe] Code: 3b 52 d4 cf e9 42 f2 ff ff 66 0f 1f 44 00 00 0f 1f 44 00 00 55 b9 00 00 00 00 48 89 e5 41 57 41 56 41 55 41 54 53 48 83 ec 08 <44> 0f b7 47 58 0f b7 47 5a 0f b7 57 54 44 0f b7 76 08 66 41 39 c0 RSP: 0018:ffffbc3fcd88fcb0 EFLAGS: 00010282 RAX: ffff92a253260980 RBX: ffffbc3fe68b00a0 RCX: 0000000000000000 RDX: ffff928b5f659000 RSI: ffff928b5f659000 RDI: 0000000000000000 RBP: ffffbc3fcd88fce0 R08: ffff92b9dfc20580 R09: 0000000000000001 R10: 3d3d3d3d3d3d3d3d R11: 3d3d3d3d3d3d3d3d R12: 0000000000000000 R13: ffff928b2f0fa8c0 R14: ffff928b9be20050 R15: 000000000000003c FS: 0000000000000000(0000) GS:ffff92b9dfc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000058 CR3: 000000011dd6a002 CR4: 00000000007706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 PKRU: 55555554 Call Trace: <TASK> ixgbe_poll+0x103e/0x1280 [ixgbe] ? sched_clock_cpu+0x12/0xe0 __napi_poll+0x30/0x160 net_rx_action+0x11c/0x270 __do_softirq+0xda/0x2ee run_ksoftirqd+0x2f/0x50 smpboot_thread_fn+0xb7/0x150 ? sort_range+0x30/0x30 kthread+0x127/0x150 ? set_kthread_struct+0x50/0x50 ret_from_fork+0x1f/0x30 </TASK> I think this is how it happens: Upon loading the first XDP program on a system with more than 64 CPUs, ixgbe_xdp_locking_key is incremented in ixgbe_xdp_setup. However, immediately after this, the rings are reconfigured by ixgbe_setup_tc. ixgbe_setup_tc calls ixgbe_clear_interrupt_scheme which calls ixgbe_free_q_vectors which calls ixgbe_free_q_vector in a loop. ixgbe_free_q_vector decrements ixgbe_xdp_locking_key once per call if it is non-zero. Commenting out the decrement in ixgbe_free_q_vector stopped my system from panicing. I suspect to make the original patch work, I would need to load an XDP program and then replace it in order to get ixgbe_xdp_locking_key back above 0 since ixgbe_setup_tc is only called when transitioning between XDP and non-XDP ring configurations, while ixgbe_xdp_locking_key is incremented every time ixgbe_xdp_setup is called. Also, ixgbe_setup_tc can be called via ethtool --set-channels, so this becomes another path to decrement ixgbe_xdp_locking_key to 0 on systems with more than 64 CPUs. Since ixgbe_xdp_locking_key only protects the XDP_TX path and is tied to the number of CPUs present, there is no reason to disable it upon unloading an XDP program. To avoid confusion, I have moved enabling ixgbe_xdp_locking_key into ixgbe_sw_init, which is part of the probe path. CVE-2023-54090 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54090.html CVE-2023-54090 https://bugzilla.suse.com/1256269 SUSE Bug 1256269 In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_target_cloned dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup are probably affected. This fixes the following kmemleak report: backtrace: [<00000000b391296d>] drm_mode_duplicate+0x45/0x220 [drm] [<00000000e45bb5b3>] drm_client_target_cloned.constprop.0+0x27b/0x480 [drm] [<00000000ed2d3a37>] drm_client_modeset_probe+0x6bd/0xf50 [drm] [<0000000010e5cc9d>] __drm_fb_helper_initial_config_and_unlock+0xb4/0x2c0 [drm_kms_helper] [<00000000909f82ca>] drm_fbdev_client_hotplug+0x2bc/0x4d0 [drm_kms_helper] [<00000000063a69aa>] drm_client_register+0x169/0x240 [drm] [<00000000a8c61525>] ast_pci_probe+0x142/0x190 [ast] [<00000000987f19bb>] local_pci_probe+0xdc/0x180 [<000000004fca231b>] work_for_cpu_fn+0x4e/0xa0 [<0000000000b85301>] process_one_work+0x8b7/0x1540 [<000000003375b17c>] worker_thread+0x70a/0xed0 [<00000000b0d43cd9>] kthread+0x29f/0x340 [<000000008d770833>] ret_from_fork+0x1f/0x30 unreferenced object 0xff11000333089a00 (size 128): CVE-2023-54091 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54091.html CVE-2023-54091 https://bugzilla.suse.com/1256274 SUSE Bug 1256274 In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the new ASCE should also be set to 0. Having the wrong index might lead to the wrong addresses being passed around when notifying pte invalidations, and eventually to validity intercepts (VM crash) if the prefix gets unmapped and the notifier gets called with the wrong address. CVE-2023-54092 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54092.html CVE-2023-54092 https://bugzilla.suse.com/1256370 SUSE Bug 1256370 In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses fail_iommu_setup() registers the fail_iommu_bus_notifier struct to both PCI and VIO buses. struct notifier_block is a linked list node, so this causes any notifiers later registered to either bus type to also be registered to the other since they share the same node. This causes issues in (at least) the vgaarb code, which registers a notifier for PCI buses. pci_notify() ends up being called on a vio device, converted with to_pci_dev() even though it's not a PCI device, and finally makes a bad access in vga_arbiter_add_pci_device() as discovered with KASAN: BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00 Read of size 4 at addr c000000264c26fdc by task swapper/0/1 Call Trace: dump_stack_lvl+0x1bc/0x2b8 (unreliable) print_report+0x3f4/0xc60 kasan_report+0x244/0x698 __asan_load4+0xe8/0x250 vga_arbiter_add_pci_device+0x60/0xe00 pci_notify+0x88/0x444 notifier_call_chain+0x104/0x320 blocking_notifier_call_chain+0xa0/0x140 device_add+0xac8/0x1d30 device_register+0x58/0x80 vio_register_device_node+0x9ac/0xce0 vio_bus_scan_register_devices+0xc4/0x13c __machine_initcall_pseries_vio_device_init+0x94/0xf0 do_one_initcall+0x12c/0xaa8 kernel_init_freeable+0xa48/0xba8 kernel_init+0x64/0x400 ret_from_kernel_thread+0x5c/0x64 Fix this by creating separate notifier_block structs for each bus type. [mpe: Add #ifdef to fix CONFIG_IBMVIO=n build] CVE-2023-54095 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54095.html CVE-2023-54095 https://bugzilla.suse.com/1256271 SUSE Bug 1256271 https://bugzilla.suse.com/1256272 SUSE Bug 1256272 In the Linux kernel, the following vulnerability has been resolved: soundwire: fix enumeration completion The soundwire subsystem uses two completion structures that allow drivers to wait for soundwire device to become enumerated on the bus and initialised by their drivers, respectively. The code implementing the signalling is currently broken as it does not signal all current and future waiters and also uses the wrong reinitialisation function, which can potentially lead to memory corruption if there are still waiters on the queue. Not signalling future waiters specifically breaks sound card probe deferrals as codec drivers can not tell that the soundwire device is already attached when being reprobed. Some codec runtime PM implementations suffer from similar problems as waiting for enumeration during resume can also timeout despite the device already having been enumerated. CVE-2023-54096 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54096.html CVE-2023-54096 https://bugzilla.suse.com/1256178 SUSE Bug 1256178 In the Linux kernel, the following vulnerability has been resolved: regulator: stm32-pwr: fix of_iomap leak Smatch reports: drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn: 'base' from of_iomap() not released on lines: 151,166. In stm32_pwr_regulator_probe(), base is not released when devm_kzalloc() fails to allocate memory or devm_regulator_register() fails to register a new regulator device, which may cause a leak. To fix this issue, replace of_iomap() with devm_platform_ioremap_resource(). devm_platform_ioremap_resource() is a specialized function for platform devices. It allows 'base' to be automatically released whether the probe function succeeds or fails. Besides, use IS_ERR(base) instead of !base as the return value of devm_platform_ioremap_resource() can either be a pointer to the remapped memory or an ERR_PTR() encoded error code if the operation fails. CVE-2023-54097 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54097.html CVE-2023-54097 https://bugzilla.suse.com/1256179 SUSE Bug 1256179 In the Linux kernel, the following vulnerability has been resolved: drm/i915/gvt: fix gvt debugfs destroy When gvt debug fs is destroyed, need to have a sane check if drm minor's debugfs root is still available or not, otherwise in case like device remove through unbinding, drm minor's debugfs directory has already been removed, then intel_gvt_debugfs_clean() would act upon dangling pointer like below oops. i915 0000:00:02.0: Direct firmware load for i915/gvt/vid_0x8086_did_0x1926_rid_0x0a.golden_hw_state failed with error -2 i915 0000:00:02.0: MDEV: Registered Console: switching to colour dummy device 80x25 i915 0000:00:02.0: MDEV: Unregistering BUG: kernel NULL pointer dereference, address: 00000000000000a0 PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 2 PID: 2486 Comm: gfx-unbind.sh Tainted: G I 6.1.0-rc8+ #15 Hardware name: Dell Inc. XPS 13 9350/0JXC1H, BIOS 1.13.0 02/10/2020 RIP: 0010:down_write+0x1f/0x90 Code: 1d ff ff 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 48 89 fb e8 62 c0 ff ff bf 01 00 00 00 e8 28 5e 31 ff 31 c0 ba 01 00 00 00 <f0> 48 0f b1 13 75 33 65 48 8b 04 25 c0 bd 01 00 48 89 43 08 bf 01 RSP: 0018:ffff9eb3036ffcc8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 00000000000000a0 RCX: ffffff8100000000 RDX: 0000000000000001 RSI: 0000000000000064 RDI: ffffffffa48787a8 RBP: ffff9eb3036ffd30 R08: ffffeb1fc45a0608 R09: ffffeb1fc45a05c0 R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000000000 R13: ffff91acc33fa328 R14: ffff91acc033f080 R15: ffff91acced533e0 FS: 00007f6947bba740(0000) GS:ffff91ae36d00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000a0 CR3: 00000001133a2002 CR4: 00000000003706e0 Call Trace: <TASK> simple_recursive_removal+0x9f/0x2a0 ? start_creating.part.0+0x120/0x120 ? _raw_spin_lock+0x13/0x40 debugfs_remove+0x40/0x60 intel_gvt_debugfs_clean+0x15/0x30 [kvmgt] intel_gvt_clean_device+0x49/0xe0 [kvmgt] intel_gvt_driver_remove+0x2f/0xb0 i915_driver_remove+0xa4/0xf0 i915_pci_remove+0x1a/0x30 pci_device_remove+0x33/0xa0 device_release_driver_internal+0x1b2/0x230 unbind_store+0xe0/0x110 kernfs_fop_write_iter+0x11b/0x1f0 vfs_write+0x203/0x3d0 ksys_write+0x63/0xe0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f6947cb5190 Code: 40 00 48 8b 15 71 9c 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 80 3d 51 24 0e 00 00 74 17 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 58 c3 0f 1f 80 00 00 00 00 48 83 ec 28 48 89 RSP: 002b:00007ffcbac45a28 EFLAGS: 00000202 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007f6947cb5190 RDX: 000000000000000d RSI: 0000555e35c866a0 RDI: 0000000000000001 RBP: 0000555e35c866a0 R08: 0000000000000002 R09: 0000555e358cb97c R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000001 R13: 000000000000000d R14: 0000000000000000 R15: 0000555e358cb8e0 </TASK> Modules linked in: kvmgt CR2: 00000000000000a0 ---[ end trace 0000000000000000 ]--- CVE-2023-54098 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54098.html CVE-2023-54098 https://bugzilla.suse.com/1256185 SUSE Bug 1256185 In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix use after free bug in qedi_remove() In qedi_probe() we call __qedi_probe() which initializes &qedi->recovery_work with qedi_recovery_handler() and &qedi->board_disable_work with qedi_board_disable_work(). When qedi_schedule_recovery_handler() is called, schedule_delayed_work() will finally start the work. In qedi_remove(), which is called to remove the driver, the following sequence may be observed: Fix this by finishing the work before cleanup in qedi_remove(). CPU0 CPU1 |qedi_recovery_handler qedi_remove | __qedi_remove | iscsi_host_free | scsi_host_put | //free shost | |iscsi_host_for_each_session |//use qedi->shost Cancel recovery_work and board_disable_work in __qedi_remove(). CVE-2023-54100 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54100.html CVE-2023-54100 https://bugzilla.suse.com/1256152 SUSE Bug 1256152 In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copy_from_user() for a debugfs entry. Currently, it is possible that copy_from_user() copies more bytes than what would fit in the mybuf char array. Add a min() restriction check between sizeof(mybuf) - 1 and nbytes passed from the userspace buffer to protect against buffer overflow. CVE-2023-54102 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54102.html CVE-2023-54102 https://bugzilla.suse.com/1256173 SUSE Bug 1256173 In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() 'op-cs' is copied in 'fun->mchip_number' which is used to access the 'mchip_offsets' and the 'rnb_gpio' arrays. These arrays have NAND_MAX_CHIPS elements, so the index must be below this limit. Fix the sanity check in order to avoid the NAND_MAX_CHIPS value. This would lead to out-of-bound accesses. CVE-2023-54104 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54104.html CVE-2023-54104 https://bugzilla.suse.com/1256145 SUSE Bug 1256145 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map error [device address=0x00000002a3ff38d8] [size=1024 bytes] [mapped as single] WARNING: CPU: 0 PID: 2930 at kernel/dma/debug.c:1017 check_unmap+0xf42/0x1990 Call Trace: debug_dma_unmap_page+0xc9/0x100 qla_nvme_ls_unmap+0x141/0x210 [qla2xxx] Remove DMA mapping from the driver altogether, as it is already done by FC layer. This prevents the warning. CVE-2023-54108 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54108.html CVE-2023-54108 https://bugzilla.suse.com/1256355 SUSE Bug 1256355 In the Linux kernel, the following vulnerability has been resolved: usb: rndis_host: Secure rndis_query check against int overflow Variables off and len typed as uint32 in rndis_query function are controlled by incoming RNDIS response message thus their value may be manipulated. Setting off to a unexpectetly large value will cause the sum with len and 8 to overflow and pass the implemented validation step. Consequently the response pointer will be referring to a location past the expected buffer boundaries allowing information leakage e.g. via RNDIS_OID_802_3_PERMANENT_ADDRESS OID. CVE-2023-54110 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54110.html CVE-2023-54110 https://bugzilla.suse.com/1256353 SUSE Bug 1256353 In the Linux kernel, the following vulnerability has been resolved: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups of_find_node_by_phandle() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. CVE-2023-54111 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54111.html CVE-2023-54111 https://bugzilla.suse.com/1256149 SUSE Bug 1256149 In the Linux kernel, the following vulnerability has been resolved: pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() When nonstatic_release_resource_db() frees all resources associated with an PCMCIA socket, it forgets to free socket_data too, causing a memory leak observable with kmemleak: unreferenced object 0xc28d1000 (size 64): comm "systemd-udevd", pid 297, jiffies 4294898478 (age 194.484s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 f0 85 0e c3 00 00 00 00 ................ 00 00 00 00 0c 10 8d c2 00 00 00 00 00 00 00 00 ................ backtrace: [<ffda4245>] __kmem_cache_alloc_node+0x2d7/0x4a0 [<7e51f0c8>] kmalloc_trace+0x31/0xa4 [<d52b4ca0>] nonstatic_init+0x24/0x1a4 [pcmcia_rsrc] [<a2f13e08>] pcmcia_register_socket+0x200/0x35c [pcmcia_core] [<a728be1b>] yenta_probe+0x4d8/0xa70 [yenta_socket] [<c48fac39>] pci_device_probe+0x99/0x194 [<84b7c690>] really_probe+0x181/0x45c [<8060fe6e>] __driver_probe_device+0x75/0x1f4 [<b9b76f43>] driver_probe_device+0x28/0xac [<648b766f>] __driver_attach+0xeb/0x1e4 [<6e9659eb>] bus_for_each_dev+0x61/0xb4 [<25a669f3>] driver_attach+0x1e/0x28 [<d8671d6b>] bus_add_driver+0x102/0x20c [<df0d323c>] driver_register+0x5b/0x120 [<942cd8a4>] __pci_register_driver+0x44/0x4c [<e536027e>] __UNIQUE_ID___addressable_cleanup_module188+0x1c/0xfffff000 [iTCO_vendor_support] Fix this by freeing socket_data too. Tested on a Acer Travelmate 4002WLMi by manually binding/unbinding the yenta_cardbus driver (yenta_socket). CVE-2023-54115 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54115.html CVE-2023-54115 https://bugzilla.suse.com/1256121 SUSE Bug 1256121 In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: setup GPIO controller later in probe The GPIO controller component of the sc16is7xx driver is setup too early, which can result in a race condition where another device tries to utilise the GPIO lines before the sc16is7xx device has finished initialising. This issue manifests itself as an Oops when the GPIO lines are configured: Unable to handle kernel read from unreadable memory at virtual address ... pc : sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx] lr : sc16is7xx_gpio_direction_output+0x4c/0x108 [sc16is7xx] ... Call trace: sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx] gpiod_direction_output_raw_commit+0x64/0x318 gpiod_direction_output+0xb0/0x170 create_gpio_led+0xec/0x198 gpio_led_probe+0x16c/0x4f0 platform_drv_probe+0x5c/0xb0 really_probe+0xe8/0x448 driver_probe_device+0xe8/0x138 __device_attach_driver+0x94/0x118 bus_for_each_drv+0x8c/0xe0 __device_attach+0x100/0x1b8 device_initial_probe+0x28/0x38 bus_probe_device+0xa4/0xb0 deferred_probe_work_func+0x90/0xe0 process_one_work+0x1c4/0x480 worker_thread+0x54/0x430 kthread+0x138/0x150 ret_from_fork+0x10/0x1c This patch moves the setup of the GPIO controller functions to later in the probe function, ensuring the sc16is7xx device has already finished initialising by the time other devices try to make use of the GPIO lines. The error handling has also been reordered to reflect the new initialisation order. CVE-2023-54118 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54118.html CVE-2023-54118 https://bugzilla.suse.com/1256131 SUSE Bug 1256131 In the Linux kernel, the following vulnerability has been resolved: inotify: Avoid reporting event with invalid wd When inotify_freeing_mark() races with inotify_handle_inode_event() it can happen that inotify_handle_inode_event() sees that i_mark->wd got already reset to -1 and reports this value to userspace which can confuse the inotify listener. Avoid the problem by validating that wd is sensible (and pretend the mark got removed before the event got generated otherwise). CVE-2023-54119 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54119.html CVE-2023-54119 https://bugzilla.suse.com/1256349 SUSE Bug 1256349 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidp_session_thread There is a potential race condition in hidp_session_thread that may lead to use-after-free. For instance, the timer is active while hidp_del_timer is called in hidp_session_thread(). After hidp_session_put, then 'session' will be freed, causing kernel panic when hidp_idle_timeout is running. The solution is to use del_timer_sync instead of del_timer. Here is the call trace: ? hidp_session_probe+0x780/0x780 call_timer_fn+0x2d/0x1e0 __run_timers.part.0+0x569/0x940 hidp_session_probe+0x780/0x780 call_timer_fn+0x1e0/0x1e0 ktime_get+0x5c/0xf0 lapic_next_deadline+0x2c/0x40 clockevents_program_event+0x205/0x320 run_timer_softirq+0xa9/0x1b0 __do_softirq+0x1b9/0x641 __irq_exit_rcu+0xdc/0x190 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0xa1/0xc0 CVE-2023-54120 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54120.html CVE-2023-54120 https://bugzilla.suse.com/1256133 SUSE Bug 1256133 In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add check for cstate As kzalloc may fail and return NULL pointer, it should be better to check cstate in order to avoid the NULL pointer dereference in __drm_atomic_helper_crtc_reset. Patchwork: https://patchwork.freedesktop.org/patch/514163/ CVE-2023-54122 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54122.html CVE-2023-54122 https://bugzilla.suse.com/1256346 SUSE Bug 1256346 In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak for 'conf->bio_split' In the error path of raid10_run(), 'conf' need be freed, however, 'conf->bio_split' is missed and memory will be leaked. Since there are 3 places to free 'conf', factor out a helper to fix the problem. CVE-2023-54123 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54123.html CVE-2023-54123 https://bugzilla.suse.com/1256142 SUSE Bug 1256142 In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel - Cleanup ring IRQ workqueues on load failure A failure loading the safexcel driver results in the following warning on boot, because the IRQ affinity has not been correctly cleaned up. Ensure we clean up the affinity and workqueues on a failure to load the driver. crypto-safexcel: probe of f2800000.crypto failed with error -2 ------------[ cut here ]------------ WARNING: CPU: 1 PID: 232 at kernel/irq/manage.c:1913 free_irq+0x300/0x340 Modules linked in: hwmon mdio_i2c crypto_safexcel(+) md5 sha256_generic libsha256 authenc libdes omap_rng rng_core nft_masq nft_nat nft_chain_nat nf_nat nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nf_tables libcrc32c nfnetlink fuse autofs4 CPU: 1 PID: 232 Comm: systemd-udevd Tainted: G W 6.1.6-00002-g9d4898824677 #3 Hardware name: MikroTik RB5009 (DT) pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : free_irq+0x300/0x340 lr : free_irq+0x2e0/0x340 sp : ffff800008fa3890 x29: ffff800008fa3890 x28: 0000000000000000 x27: 0000000000000000 x26: ffff8000008e6dc0 x25: ffff000009034cac x24: ffff000009034d50 x23: 0000000000000000 x22: 000000000000004a x21: ffff0000093e0d80 x20: ffff000009034c00 x19: ffff00000615fc00 x18: 0000000000000000 x17: 0000000000000000 x16: 0000000000000000 x15: 000075f5c1584c5e x14: 0000000000000017 x13: 0000000000000000 x12: 0000000000000040 x11: ffff000000579b60 x10: ffff000000579b62 x9 : ffff800008bbe370 x8 : ffff000000579dd0 x7 : 0000000000000000 x6 : ffff000000579e18 x5 : ffff000000579da8 x4 : ffff800008ca0000 x3 : ffff800008ca0188 x2 : 0000000013033204 x1 : ffff000009034c00 x0 : ffff8000087eadf0 Call trace: free_irq+0x300/0x340 devm_irq_release+0x14/0x20 devres_release_all+0xa0/0x100 device_unbind_cleanup+0x14/0x60 really_probe+0x198/0x2d4 __driver_probe_device+0x74/0xdc driver_probe_device+0x3c/0x110 __driver_attach+0x8c/0x190 bus_for_each_dev+0x6c/0xc0 driver_attach+0x20/0x30 bus_add_driver+0x148/0x1fc driver_register+0x74/0x120 __platform_driver_register+0x24/0x30 safexcel_init+0x48/0x1000 [crypto_safexcel] do_one_initcall+0x4c/0x1b0 do_init_module+0x44/0x1cc load_module+0x1724/0x1be4 __do_sys_finit_module+0xbc/0x110 __arm64_sys_finit_module+0x1c/0x24 invoke_syscall+0x44/0x110 el0_svc_common.constprop.0+0xc0/0xe0 do_el0_svc+0x20/0x80 el0_svc+0x14/0x4c el0t_64_sync_handler+0xb0/0xb4 el0t_64_sync+0x148/0x14c ---[ end trace 0000000000000000 ]--- CVE-2023-54126 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54126.html CVE-2023-54126 https://bugzilla.suse.com/1256118 SUSE Bug 1256118 In the Linux kernel, the following vulnerability has been resolved: fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() Syzkaller reported the following issue: ================================================================== BUG: KASAN: double-free in slab_free mm/slub.c:3787 [inline] BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3800 Free of addr ffff888086408000 by task syz-executor.4/12750 [...] Call Trace: <TASK> [...] kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:482 ____kasan_slab_free+0xfb/0x120 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x71/0x110 mm/slub.c:3800 dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264 jfs_umount+0x248/0x3b0 fs/jfs/jfs_umount.c:87 jfs_put_super+0x86/0x190 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x310 fs/super.c:492 kill_block_super+0x79/0xd0 fs/super.c:1386 deactivate_locked_super+0xa7/0xf0 fs/super.c:332 cleanup_mnt+0x494/0x520 fs/namespace.c:1291 task_work_run+0x243/0x300 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop+0x124/0x150 kernel/entry/common.c:171 exit_to_user_mode_prepare+0xb2/0x140 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x26/0x60 kernel/entry/common.c:296 do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] </TASK> Allocated by task 13352: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] __kasan_kmalloc+0x97/0xb0 mm/kasan/common.c:380 kmalloc include/linux/slab.h:580 [inline] dbMount+0x54/0x980 fs/jfs/jfs_dmap.c:164 jfs_mount+0x1dd/0x830 fs/jfs/jfs_mount.c:121 jfs_fill_super+0x590/0xc50 fs/jfs/super.c:556 mount_bdev+0x26c/0x3a0 fs/super.c:1359 legacy_get_tree+0xea/0x180 fs/fs_context.c:610 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 13352: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x3d/0x60 mm/kasan/common.c:52 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518 ____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1781 [inline] slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807 slab_free mm/slub.c:3787 [inline] __kmem_cache_free+0x71/0x110 mm/slub.c:3800 dbUnmount+0xf4/0x110 fs/jfs/jfs_dmap.c:264 jfs_mount_rw+0x545/0x740 fs/jfs/jfs_mount.c:247 jfs_remount+0x3db/0x710 fs/jfs/super.c:454 reconfigure_super+0x3bc/0x7b0 fs/super.c:935 vfs_fsconfig_locked fs/fsopen.c:254 [inline] __do_sys_fsconfig fs/fsopen.c:439 [inline] __se_sys_fsconfig+0xad5/0x1060 fs/fsopen.c:314 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd [...] JFS_SBI(ipbmap->i_sb)->bmap wasn't set to NULL after kfree() in dbUnmount(). Syzkaller uses faultinject to reproduce this KASAN double-free warning. The issue is triggered if either diMount() or dbMount() fail in jfs_remount(), since diUnmount() or dbUnmount() already happened in such a case - they will do double-free on next execution: jfs_umount or jfs_remount. Tested on both upstream and jfs-next by syzkaller. CVE-2023-54127 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54127.html CVE-2023-54127 https://bugzilla.suse.com/1256119 SUSE Bug 1256119 In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling Commit 55d1cbbbb29e ("hfs/hfsplus: use WARN_ON for sanity check") fixed a build warning by turning a comment into a WARN_ON(), but it turns out that syzbot then complains because it can trigger said warning with a corrupted hfs image. The warning actually does warn about a bad situation, but we are much better off just handling it as the error it is. So rather than warn about us doing bad things, stop doing the bad things and return -EIO. While at it, also fix a memory leak that was introduced by an earlier fix for a similar syzbot warning situation, and add a check for one case that historically wasn't handled at all (ie neither comment nor subsequent WARN_ON). CVE-2023-54130 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54130.html CVE-2023-54130 https://bugzilla.suse.com/1256114 SUSE Bug 1256114 In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: Fix memory leak when handling surveys When removing a rt2x00 device, its associated channel surveys are not freed, causing a memory leak observable with kmemleak: unreferenced object 0xffff9620f0881a00 (size 512): comm "systemd-udevd", pid 2290, jiffies 4294906974 (age 33.768s) hex dump (first 32 bytes): 70 44 12 00 00 00 00 00 92 8a 00 00 00 00 00 00 pD.............. 00 00 00 00 00 00 00 00 ab 87 01 00 00 00 00 00 ................ backtrace: [<ffffffffb0ed858b>] __kmalloc+0x4b/0x130 [<ffffffffc1b0f29b>] rt2800_probe_hw+0xc2b/0x1380 [rt2800lib] [<ffffffffc1a9496e>] rt2800usb_probe_hw+0xe/0x60 [rt2800usb] [<ffffffffc1ae491a>] rt2x00lib_probe_dev+0x21a/0x7d0 [rt2x00lib] [<ffffffffc1b3b83e>] rt2x00usb_probe+0x1be/0x980 [rt2x00usb] [<ffffffffc05981e2>] usb_probe_interface+0xe2/0x310 [usbcore] [<ffffffffb13be2d5>] really_probe+0x1a5/0x410 [<ffffffffb13be5c8>] __driver_probe_device+0x78/0x180 [<ffffffffb13be6fe>] driver_probe_device+0x1e/0x90 [<ffffffffb13be972>] __driver_attach+0xd2/0x1c0 [<ffffffffb13bbc57>] bus_for_each_dev+0x77/0xd0 [<ffffffffb13bd2a2>] bus_add_driver+0x112/0x210 [<ffffffffb13bfc6c>] driver_register+0x5c/0x120 [<ffffffffc0596ae8>] usb_register_driver+0x88/0x150 [usbcore] [<ffffffffb0c011c4>] do_one_initcall+0x44/0x220 [<ffffffffb0d6134c>] do_init_module+0x4c/0x220 Fix this by freeing the channel surveys on device removal. Tested with a RT3070 based USB wireless adapter. CVE-2023-54131 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54131.html CVE-2023-54131 https://bugzilla.suse.com/1256115 SUSE Bug 1256115 In the Linux kernel, the following vulnerability has been resolved: serial: sprd: Fix DMA buffer leak issue Release DMA buffer when _probe() returns failure to avoid memory leak. CVE-2023-54136 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54136.html CVE-2023-54136 https://bugzilla.suse.com/1256099 SUSE Bug 1256099 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse A syzbot stress test using a corrupted disk image reported that mark_buffer_dirty() called from __nilfs_mark_inode_dirty() or nilfs_palloc_commit_alloc_entry() may output a kernel warning, and can panic if the kernel is booted with panic_on_warn. This is because nilfs2 keeps buffer pointers in local structures for some metadata and reuses them, but such buffers may be forcibly discarded by nilfs_clear_dirty_page() in some critical situations. This issue is reported to appear after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only"), but the issue has potentially existed before. Fix this issue by checking the uptodate flag when attempting to reuse an internally held buffer, and reloading the metadata instead of reusing the buffer if the flag was lost. CVE-2023-54140 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54140.html CVE-2023-54140 https://bugzilla.suse.com/1256093 SUSE Bug 1256093 In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in __gtp_encap_destroy(). syzkaller reported use-after-free in __gtp_encap_destroy(). [0] It shows the same process freed sk and touched it illegally. Commit e198987e7dd7 ("gtp: fix suspicious RCU usage") added lock_sock() and release_sock() in __gtp_encap_destroy() to protect sk->sk_user_data, but release_sock() is called after sock_put() releases the last refcnt. [0]: BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] BUG: KASAN: slab-use-after-free in queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] BUG: KASAN: slab-use-after-free in do_raw_spin_lock include/linux/spinlock.h:186 [inline] BUG: KASAN: slab-use-after-free in __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 Write of size 4 at addr ffff88800dbef398 by task syz-executor.2/2401 CPU: 1 PID: 2401 Comm: syz-executor.2 Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x72/0xa0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:351 [inline] print_report+0xcc/0x620 mm/kasan/report.c:462 kasan_report+0xb2/0xe0 mm/kasan/report.c:572 check_region_inline mm/kasan/generic.c:181 [inline] kasan_check_range+0x39/0x1c0 mm/kasan/generic.c:187 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] atomic_try_cmpxchg_acquire include/linux/atomic/atomic-instrumented.h:541 [inline] queued_spin_lock include/asm-generic/qspinlock.h:111 [inline] do_raw_spin_lock include/linux/spinlock.h:186 [inline] __raw_spin_lock_bh include/linux/spinlock_api_smp.h:127 [inline] _raw_spin_lock_bh+0x75/0xe0 kernel/locking/spinlock.c:178 spin_lock_bh include/linux/spinlock.h:355 [inline] release_sock+0x1f/0x1a0 net/core/sock.c:3526 gtp_encap_disable_sock drivers/net/gtp.c:651 [inline] gtp_encap_disable+0xb9/0x220 drivers/net/gtp.c:664 gtp_dev_uninit+0x19/0x50 drivers/net/gtp.c:728 unregister_netdevice_many_notify+0x97e/0x1520 net/core/dev.c:10841 rtnl_delete_link net/core/rtnetlink.c:3216 [inline] rtnl_dellink+0x3c0/0xb30 net/core/rtnetlink.c:3268 rtnetlink_rcv_msg+0x450/0xb10 net/core/rtnetlink.c:6423 netlink_rcv_skb+0x15d/0x450 net/netlink/af_netlink.c:2548 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x700/0x930 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x91c/0xe30 net/netlink/af_netlink.c:1913 sock_sendmsg_nosec net/socket.c:724 [inline] sock_sendmsg+0x1b7/0x200 net/socket.c:747 ____sys_sendmsg+0x75a/0x990 net/socket.c:2493 ___sys_sendmsg+0x11d/0x1c0 net/socket.c:2547 __sys_sendmsg+0xfe/0x1d0 net/socket.c:2576 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3f/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f1168b1fe5d Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 73 9f 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007f1167edccc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004bbf80 RCX: 00007f1168b1fe5d RDX: 0000000000000000 RSI: 00000000200002c0 RDI: 0000000000000003 RBP: 00000000004bbf80 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007f1168b80530 R15: 0000000000000000 </TASK> Allocated by task 1483: kasan_save_stack+0x22/0x50 mm/kasan/common.c:45 kasan_set_track+0x25/0x30 mm/kasan/common.c:52 __kasan_slab_alloc+0x ---truncated--- CVE-2023-54142 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54142.html CVE-2023-54142 https://bugzilla.suse.com/1256095 SUSE Bug 1256095 https://bugzilla.suse.com/1256097 SUSE Bug 1256097 In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix double-free of elf header buffer After b3e34a47f989 ("x86/kexec: fix memory leak of elf header buffer"), freeing image->elf_headers in the error path of crash_load_segments() is not needed because kimage_file_post_load_cleanup() will take care of that later. And not clearing it could result in a double-free. Drop the superfluous vfree() call at the error path of crash_load_segments(). CVE-2023-54146 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54146.html CVE-2023-54146 https://bugzilla.suse.com/1256091 SUSE Bug 1256091 In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix an out of bounds error in BIOS parser The array is hardcoded to 8 in atomfirmware.h, but firmware provides a bigger one sometimes. Deferencing the larger array causes an out of bounds error. commit 4fc1ba4aa589 ("drm/amd/display: fix array index out of bound error in bios parser") fixed some of this, but there are two other cases not covered by it. Fix those as well. CVE-2023-54150 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54150.html CVE-2023-54150 https://bugzilla.suse.com/1256086 SUSE Bug 1256086 In the Linux kernel, the following vulnerability has been resolved: ext4: turn quotas off if mount failed after enabling quotas Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() returns an error value, the error handling path does not turn off the enabled quotas, which triggers the following kmemleak: ================================================================ unreferenced object 0xffff8cf68678e7c0 (size 64): comm "mount", pid 746, jiffies 4294871231 (age 11.540s) hex dump (first 32 bytes): 00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00 ............A... c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00 ............H... backtrace: [<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880 [<00000000d4e621d7>] kmalloc_trace+0x39/0x140 [<00000000837eee74>] v2_read_file_info+0x18a/0x3a0 [<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770 [<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0 [<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4] [<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4] [<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4] [<000000004a9489c4>] get_tree_bdev+0x1dc/0x370 [<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4] [<00000000c7cb663d>] vfs_get_tree+0x31/0x160 [<00000000320e1bed>] do_new_mount+0x1d5/0x480 [<00000000c074654c>] path_mount+0x22e/0xbe0 [<0000000003e97a8e>] do_mount+0x95/0xc0 [<000000002f3d3736>] __x64_sys_mount+0xc4/0x160 [<0000000027d2140c>] do_syscall_64+0x3f/0x90 ================================================================ To solve this problem, we add a "failed_mount10" tag, and call ext4_quota_off_umount() in this tag to release the enabled qoutas. CVE-2023-54153 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54153.html CVE-2023-54153 https://bugzilla.suse.com/1256081 SUSE Bug 1256081 In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_stats is NULL as the NIC has been fini'd. In this case do not attempt to fetch the latest stats from the hardware, else we will crash on a NULL dereference: BUG: kernel NULL pointer dereference, address: 0000000000000038 RIP efx_nic_update_stats abridged calltrace: efx_ef10_update_stats_pf efx_net_stats dev_get_stats dev_seq_printf_stats Skipping the read is safe, we will simply give out stale stats. To ensure that the free in efx_ef10_fini_nic() does not race against efx_ef10_update_stats_pf(), which could cause a TOCTTOU bug, take the efx->stats_lock in fini_nic (it is already held across update_stats). CVE-2023-54156 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54156.html CVE-2023-54156 https://bugzilla.suse.com/1255704 SUSE Bug 1255704 In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it may lock @mtu->lock and free qmu ring, then qmu irq hanlder may get a NULL gpd, avoid the KE by checking gpd's value before handling it. e.g. qmu done irq on cpu0 thread running on cpu1 qmu_done_tx() handle gpd [0] mtu3_requ_complete() mtu3_gadget_ep_disable() unlock @mtu->lock give back request lock @mtu->lock mtu3_ep_disable() mtu3_gpd_ring_free() unlock @mtu->lock lock @mtu->lock get next gpd [1] [1]: goto [0] to handle next gpd, and next gpd may be NULL. CVE-2023-54159 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54159.html CVE-2023-54159 https://bugzilla.suse.com/1255697 SUSE Bug 1255697 In the Linux kernel, the following vulnerability has been resolved: igc: Fix Kernel Panic during ndo_tx_timeout callback The Xeon validation group has been carrying out some loaded tests with various HW configurations, and they have seen some transmit queue time out happening during the test. This will cause the reset adapter function to be called by igc_tx_timeout(). Similar race conditions may arise when the interface is being brought down and up in igc_reinit_locked(), an interrupt being generated, and igc_clean_tx_irq() being called to complete the TX. When the igc_tx_timeout() function is invoked, this patch will turn off all TX ring HW queues during igc_down() process. TX ring HW queues will be activated again during the igc_configure_tx_ring() process when performing the igc_up() procedure later. This patch also moved existing igc_disable_tx_ring_hw() to avoid using forward declaration. Kernel trace: [ 7678.747813] ------------[ cut here ]------------ [ 7678.757914] NETDEV WATCHDOG: enp1s0 (igc): transmit queue 2 timed out [ 7678.770117] WARNING: CPU: 0 PID: 13 at net/sched/sch_generic.c:525 dev_watchdog+0x1ae/0x1f0 [ 7678.784459] Modules linked in: xt_conntrack nft_chain_nat xt_MASQUERADE xt_addrtype nft_compat nf_tables nfnetlink br_netfilter bridge stp llc overlay dm_mod emrcha(PO) emriio(PO) rktpm(PO) cegbuf_mod(PO) patch_update(PO) se(PO) sgx_tgts(PO) mktme(PO) keylocker(PO) svtdx(PO) svfs_pci_hotplug(PO) vtd_mod(PO) davemem(PO) svmabort(PO) svindexio(PO) usbx2(PO) ehci_sched(PO) svheartbeat(PO) ioapic(PO) sv8259(PO) svintr(PO) lt(PO) pcierootport(PO) enginefw_mod(PO) ata(PO) smbus(PO) spiflash_cdf(PO) arden(PO) dsa_iax(PO) oobmsm_punit(PO) cpm(PO) svkdb(PO) ebg_pch(PO) pch(PO) sviotargets(PO) svbdf(PO) svmem(PO) svbios(PO) dram(PO) svtsc(PO) targets(PO) superio(PO) svkernel(PO) cswitch(PO) mcf(PO) pentiumIII_mod(PO) fs_svfs(PO) mdevdefdb(PO) svfs_os_services(O) ixgbe mdio mdio_devres libphy emeraldrapids_svdefs(PO) regsupport(O) libnvdimm nls_cp437 snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_intel snd_intel_dspcfg snd_hda_codec snd_hwdep x86_pkg_temp_thermal snd_hda_core snd_pcm snd_timer isst_if_mbox_pci [ 7678.784496] input_leds isst_if_mmio sg snd isst_if_common soundcore wmi button sad9(O) drm fuse backlight configfs efivarfs ip_tables x_tables vmd sdhci led_class rtl8150 r8152 hid_generic pegasus mmc_block usbhid mmc_core hid megaraid_sas ixgb igb i2c_algo_bit ice i40e hpsa scsi_transport_sas e1000e e1000 e100 ax88179_178a usbnet xhci_pci sd_mod xhci_hcd t10_pi crc32c_intel crc64_rocksoft igc crc64 crc_t10dif usbcore crct10dif_generic ptp crct10dif_common usb_common pps_core [ 7679.200403] RIP: 0010:dev_watchdog+0x1ae/0x1f0 [ 7679.210201] Code: 28 e9 53 ff ff ff 4c 89 e7 c6 05 06 42 b9 00 01 e8 17 d1 fb ff 44 89 e9 4c 89 e6 48 c7 c7 40 ad fb 81 48 89 c2 e8 52 62 82 ff <0f> 0b e9 72 ff ff ff 65 8b 05 80 7d 7c 7e 89 c0 48 0f a3 05 0a c1 [ 7679.245438] RSP: 0018:ffa00000001f7d90 EFLAGS: 00010282 [ 7679.256021] RAX: 0000000000000000 RBX: ff11000109938440 RCX: 0000000000000000 [ 7679.268710] RDX: ff11000361e26cd8 RSI: ff11000361e1b880 RDI: ff11000361e1b880 [ 7679.281314] RBP: ffa00000001f7da8 R08: ff1100035f8fffe8 R09: 0000000000027ffb [ 7679.293840] R10: 0000000000001f0a R11: ff1100035f840000 R12: ff11000109938000 [ 7679.306276] R13: 0000000000000002 R14: dead000000000122 R15: ffa00000001f7e18 [ 7679.318648] FS: 0000000000000000(0000) GS:ff11000361e00000(0000) knlGS:0000000000000000 [ 7679.332064] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7679.342757] CR2: 00007ffff7fca168 CR3: 000000013b08a006 CR4: 0000000000471ef8 [ 7679.354984] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 7679.367207] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 [ 7679.379370] PKRU: 55555554 [ 7679.386446] Call Trace: [ 7679.393152] <TASK> [ 7679.399363] ? __pfx_dev_watchdog+0x10/0x10 [ 7679.407870] call_timer_fn+0x31/0x110 [ 7679.415698] e ---truncated--- CVE-2023-54166 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54166.html CVE-2023-54166 https://bugzilla.suse.com/1256074 SUSE Bug 1256074 In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() The ucmd->log_sq_bb_count variable is controlled by the user so this shift can wrap. Fix it by using check_shl_overflow() in the same way that it was done in commit 515f60004ed9 ("RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size()"). CVE-2023-54168 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54168.html CVE-2023-54168 https://bugzilla.suse.com/1256053 SUSE Bug 1256053 https://bugzilla.suse.com/1256054 SUSE Bug 1256054 In the Linux kernel, the following vulnerability has been resolved: keys: Fix linking a duplicate key to a keyring's assoc_array When making a DNS query inside the kernel using dns_query(), the request code can in rare cases end up creating a duplicate index key in the assoc_array of the destination keyring. It is eventually found by a BUG_ON() check in the assoc_array implementation and results in a crash. Example report: [2158499.700025] kernel BUG at ../lib/assoc_array.c:652! [2158499.700039] invalid opcode: 0000 [#1] SMP PTI [2158499.700065] CPU: 3 PID: 31985 Comm: kworker/3:1 Kdump: loaded Not tainted 5.3.18-150300.59.90-default #1 SLE15-SP3 [2158499.700096] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [2158499.700351] Workqueue: cifsiod cifs_resolve_server [cifs] [2158499.700380] RIP: 0010:assoc_array_insert+0x85f/0xa40 [2158499.700401] Code: ff 74 2b 48 8b 3b 49 8b 45 18 4c 89 e6 48 83 e7 fe e8 95 ec 74 00 3b 45 88 7d db 85 c0 79 d4 0f 0b 0f 0b 0f 0b e8 41 f2 be ff <0f> 0b 0f 0b 81 7d 88 ff ff ff 7f 4c 89 eb 4c 8b ad 58 ff ff ff 0f [2158499.700448] RSP: 0018:ffffc0bd6187faf0 EFLAGS: 00010282 [2158499.700470] RAX: ffff9f1ea7da2fe8 RBX: ffff9f1ea7da2fc1 RCX: 0000000000000005 [2158499.700492] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000000 [2158499.700515] RBP: ffffc0bd6187fbb0 R08: ffff9f185faf1100 R09: 0000000000000000 [2158499.700538] R10: ffff9f1ea7da2cc0 R11: 000000005ed8cec8 R12: ffffc0bd6187fc28 [2158499.700561] R13: ffff9f15feb8d000 R14: ffff9f1ea7da2fc0 R15: ffff9f168dc0d740 [2158499.700585] FS: 0000000000000000(0000) GS:ffff9f185fac0000(0000) knlGS:0000000000000000 [2158499.700610] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [2158499.700630] CR2: 00007fdd94fca238 CR3: 0000000809d8c006 CR4: 00000000003706e0 [2158499.700702] Call Trace: [2158499.700741] ? key_alloc+0x447/0x4b0 [2158499.700768] ? __key_link_begin+0x43/0xa0 [2158499.700790] __key_link_begin+0x43/0xa0 [2158499.700814] request_key_and_link+0x2c7/0x730 [2158499.700847] ? dns_resolver_read+0x20/0x20 [dns_resolver] [2158499.700873] ? key_default_cmp+0x20/0x20 [2158499.700898] request_key_tag+0x43/0xa0 [2158499.700926] dns_query+0x114/0x2ca [dns_resolver] [2158499.701127] dns_resolve_server_name_to_ip+0x194/0x310 [cifs] [2158499.701164] ? scnprintf+0x49/0x90 [2158499.701190] ? __switch_to_asm+0x40/0x70 [2158499.701211] ? __switch_to_asm+0x34/0x70 [2158499.701405] reconn_set_ipaddr_from_hostname+0x81/0x2a0 [cifs] [2158499.701603] cifs_resolve_server+0x4b/0xd0 [cifs] [2158499.701632] process_one_work+0x1f8/0x3e0 [2158499.701658] worker_thread+0x2d/0x3f0 [2158499.701682] ? process_one_work+0x3e0/0x3e0 [2158499.701703] kthread+0x10d/0x130 [2158499.701723] ? kthread_park+0xb0/0xb0 [2158499.701746] ret_from_fork+0x1f/0x40 The situation occurs as follows: * Some kernel facility invokes dns_query() to resolve a hostname, for example, "abcdef". The function registers its global DNS resolver cache as current->cred.thread_keyring and passes the query to request_key_net() -> request_key_tag() -> request_key_and_link(). * Function request_key_and_link() creates a keyring_search_context object. Its match_data.cmp method gets set via a call to type->match_preparse() (resolves to dns_resolver_match_preparse()) to dns_resolver_cmp(). * Function request_key_and_link() continues and invokes search_process_keyrings_rcu() which returns that a given key was not found. The control is then passed to request_key_and_link() -> construct_alloc_key(). * Concurrently to that, a second task similarly makes a DNS query for "abcdef." and its result gets inserted into the DNS resolver cache. * Back on the first task, function construct_alloc_key() first runs __key_link_begin() to determine an assoc_array_edit operation to insert a new key. Index keys in the array are compared exactly as-is, using keyring_compare_object(). The operation ---truncated--- CVE-2023-54170 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54170.html CVE-2023-54170 https://bugzilla.suse.com/1256045 SUSE Bug 1256045 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory leak of iter->temp when reading trace_pipe kmemleak reports: unreferenced object 0xffff88814d14e200 (size 256): comm "cat", pid 336, jiffies 4294871818 (age 779.490s) hex dump (first 32 bytes): 04 00 01 03 00 00 00 00 08 00 00 00 00 00 00 00 ................ 0c d8 c8 9b ff ff ff ff 04 5a ca 9b ff ff ff ff .........Z...... backtrace: [<ffffffff9bdff18f>] __kmalloc+0x4f/0x140 [<ffffffff9bc9238b>] trace_find_next_entry+0xbb/0x1d0 [<ffffffff9bc9caef>] trace_print_lat_context+0xaf/0x4e0 [<ffffffff9bc94490>] print_trace_line+0x3e0/0x950 [<ffffffff9bc95499>] tracing_read_pipe+0x2d9/0x5a0 [<ffffffff9bf03a43>] vfs_read+0x143/0x520 [<ffffffff9bf04c2d>] ksys_read+0xbd/0x160 [<ffffffff9d0f0edf>] do_syscall_64+0x3f/0x90 [<ffffffff9d2000aa>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 when reading file 'trace_pipe', 'iter->temp' is allocated or relocated in trace_find_next_entry() but not freed before 'trace_pipe' is closed. To fix it, free 'iter->temp' in tracing_release_pipe(). CVE-2023-54171 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54171.html CVE-2023-54171 https://bugzilla.suse.com/1256034 SUSE Bug 1256034 In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_event_output We received report [1] of kernel crash, which is caused by using nesting protection without disabled preemption. The bpf_event_output can be called by programs executed by bpf_prog_run_array_cg function that disabled migration but keeps preemption enabled. This can cause task to be preempted by another one inside the nesting protection and lead eventually to two tasks using same perf_sample_data buffer and cause crashes like: BUG: kernel NULL pointer dereference, address: 0000000000000001 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page ... ? perf_output_sample+0x12a/0x9a0 ? finish_task_switch.isra.0+0x81/0x280 ? perf_event_output+0x66/0xa0 ? bpf_event_output+0x13a/0x190 ? bpf_event_output_data+0x22/0x40 ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb ? xa_load+0x87/0xe0 ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0 ? release_sock+0x3e/0x90 ? sk_setsockopt+0x1a1/0x12f0 ? udp_pre_connect+0x36/0x50 ? inet_dgram_connect+0x93/0xa0 ? __sys_connect+0xb4/0xe0 ? udp_setsockopt+0x27/0x40 ? __pfx_udp_push_pending_frames+0x10/0x10 ? __sys_setsockopt+0xdf/0x1a0 ? __x64_sys_connect+0xf/0x20 ? do_syscall_64+0x3a/0x90 ? entry_SYSCALL_64_after_hwframe+0x72/0xdc Fixing this by disabling preemption in bpf_event_output. [1] https://github.com/cilium/cilium/issues/26756 CVE-2023-54173 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54173.html CVE-2023-54173 https://bugzilla.suse.com/1255996 SUSE Bug 1255996 In the Linux kernel, the following vulnerability has been resolved: quota: fix warning in dqgrab() There's issue as follows when do fault injection: WARNING: CPU: 1 PID: 14870 at include/linux/quotaops.h:51 dquot_disable+0x13b7/0x18c0 Modules linked in: CPU: 1 PID: 14870 Comm: fsconfig Not tainted 6.3.0-next-20230505-00006-g5107a9c821af-dirty #541 RIP: 0010:dquot_disable+0x13b7/0x18c0 RSP: 0018:ffffc9000acc79e0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff88825e41b980 RDX: 0000000000000000 RSI: ffff88825e41b980 RDI: 0000000000000002 RBP: ffff888179f68000 R08: ffffffff82087ca7 R09: 0000000000000000 R10: 0000000000000001 R11: ffffed102f3ed026 R12: ffff888179f68130 R13: ffff888179f68110 R14: dffffc0000000000 R15: ffff888179f68118 FS: 00007f450a073740(0000) GS:ffff88882fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffe96f2efd8 CR3: 000000025c8ad000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> dquot_load_quota_sb+0xd53/0x1060 dquot_resume+0x172/0x230 ext4_reconfigure+0x1dc6/0x27b0 reconfigure_super+0x515/0xa90 __x64_sys_fsconfig+0xb19/0xd20 do_syscall_64+0x39/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Above issue may happens as follows: ProcessA ProcessB ProcessC sys_fsconfig vfs_fsconfig_locked reconfigure_super ext4_remount dquot_suspend -> suspend all type quota sys_fsconfig vfs_fsconfig_locked reconfigure_super ext4_remount dquot_resume ret = dquot_load_quota_sb add_dquot_ref do_open -> open file O_RDWR vfs_open do_dentry_open get_write_access atomic_inc_unless_negative(&inode->i_writecount) ext4_file_open dquot_file_open dquot_initialize __dquot_initialize dqget atomic_inc(&dquot->dq_count); __dquot_initialize __dquot_initialize dqget if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) ext4_acquire_dquot -> Return error DQ_ACTIVE_B flag isn't set dquot_disable invalidate_dquots if (atomic_read(&dquot->dq_count)) dqgrab WARN_ON_ONCE(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) -> Trigger warning In the above scenario, 'dquot->dq_flags' has no DQ_ACTIVE_B is normal when dqgrab(). To solve above issue just replace the dqgrab() use in invalidate_dquots() with atomic_inc(&dquot->dq_count). CVE-2023-54177 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54177.html CVE-2023-54177 https://bugzilla.suse.com/1255993 SUSE Bug 1255993 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Array index may go out of bound Klocwork reports array 'vha->host_str' of size 16 may use index value(s) 16..19. Use snprintf() instead of sprintf(). CVE-2023-54179 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54179.html CVE-2023-54179 https://bugzilla.suse.com/1255994 SUSE Bug 1255994 In the Linux kernel, the following vulnerability has been resolved: media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL, so fwnode_handle_put() is a no-op. Release the reference taken from a previous fwnode_graph_get_port_parent() call instead. Also handle fwnode_graph_get_port_parent() failures. In order to fix these issues, add an error handling path to the function and the needed gotos. CVE-2023-54183 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54183.html CVE-2023-54183 https://bugzilla.suse.com/1255990 SUSE Bug 1255990 In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pin_assignment_show This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0 CVE-2023-54186 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54186.html CVE-2023-54186 https://bugzilla.suse.com/1255985 SUSE Bug 1255985 In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Add check for kstrdup Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference. CVE-2023-54189 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54189.html CVE-2023-54189 https://bugzilla.suse.com/1255978 SUSE Bug 1255978 In the Linux kernel, the following vulnerability has been resolved: leds: led-core: Fix refcount leak in of_led_get() class_find_device_by_of_node() calls class_find_device(), it will take the reference, use the put_device() to drop the reference when not need anymore. CVE-2023-54190 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54190.html CVE-2023-54190 https://bugzilla.suse.com/1255979 SUSE Bug 1255979 In the Linux kernel, the following vulnerability has been resolved: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. This patch introduces a possible null-ptr-def problem. Revert it. And the fixed bug by this patch have resolved by commit 73f7b171b7c0 ("Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition"). CVE-2023-54197 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54197.html CVE-2023-54197 https://bugzilla.suse.com/1255969 SUSE Bug 1255969 In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid number. To reproduce: qemu-system-x86_64 -enable-kvm -nographic -serial mon:stdio \ -kernel ../linux-build-x86/arch/x86/boot/bzImage \ -append "console=ttyS0 console=tty3270" This crashes with: [ 0.770599] BUG: kernel NULL pointer dereference, address: 00000000000000ef [ 0.771265] #PF: supervisor read access in kernel mode [ 0.771773] #PF: error_code(0x0000) - not-present page [ 0.772609] Oops: 0000 [#1] PREEMPT SMP PTI [ 0.774878] RIP: 0010:tty_open+0x268/0x6f0 [ 0.784013] chrdev_open+0xbd/0x230 [ 0.784444] ? cdev_device_add+0x80/0x80 [ 0.784920] do_dentry_open+0x1e0/0x410 [ 0.785389] path_openat+0xca9/0x1050 [ 0.785813] do_filp_open+0xaa/0x150 [ 0.786240] file_open_name+0x133/0x1b0 [ 0.786746] filp_open+0x27/0x50 [ 0.787244] console_on_rootfs+0x14/0x4d [ 0.787800] kernel_init_freeable+0x1e4/0x20d [ 0.788383] ? rest_init+0xc0/0xc0 [ 0.788881] kernel_init+0x11/0x120 [ 0.789356] ret_from_fork+0x22/0x30 CVE-2023-54198 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54198.html CVE-2023-54198 https://bugzilla.suse.com/1255970 SUSE Bug 1255970 In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() Fix the below kernel panic due to null pointer access: [ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 [ 18.513464] Mem abort info: [ 18.516346] ESR = 0x0000000096000005 [ 18.520204] EC = 0x25: DABT (current EL), IL = 32 bits [ 18.525706] SET = 0, FnV = 0 [ 18.528878] EA = 0, S1PTW = 0 [ 18.532117] FSC = 0x05: level 1 translation fault [ 18.537138] Data abort info: [ 18.540110] ISV = 0, ISS = 0x00000005 [ 18.544060] CM = 0, WnR = 0 [ 18.547109] user pgtable: 4k pages, 39-bit VAs, pgdp=0000000112826000 [ 18.553738] [0000000000000048] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000 [ 18.562690] Internal error: Oops: 0000000096000005 [#1] PREEMPT SMP **Snip** [ 18.696758] Call trace: [ 18.699278] adreno_gpu_cleanup+0x30/0x88 [ 18.703396] a6xx_destroy+0xc0/0x130 [ 18.707066] a6xx_gpu_init+0x308/0x424 [ 18.710921] adreno_bind+0x178/0x288 [ 18.714590] component_bind_all+0xe0/0x214 [ 18.718797] msm_drm_bind+0x1d4/0x614 [ 18.722566] try_to_bring_up_aggregate_device+0x16c/0x1b8 [ 18.728105] __component_add+0xa0/0x158 [ 18.732048] component_add+0x20/0x2c [ 18.735719] adreno_probe+0x40/0xc0 [ 18.739300] platform_probe+0xb4/0xd4 [ 18.743068] really_probe+0xfc/0x284 [ 18.746738] __driver_probe_device+0xc0/0xec [ 18.751129] driver_probe_device+0x48/0x110 [ 18.755421] __device_attach_driver+0xa8/0xd0 [ 18.759900] bus_for_each_drv+0x90/0xdc [ 18.763843] __device_attach+0xfc/0x174 [ 18.767786] device_initial_probe+0x20/0x2c [ 18.772090] bus_probe_device+0x40/0xa0 [ 18.776032] deferred_probe_work_func+0x94/0xd0 [ 18.780686] process_one_work+0x190/0x3d0 [ 18.784805] worker_thread+0x280/0x3d4 [ 18.788659] kthread+0x104/0x1c0 [ 18.791981] ret_from_fork+0x10/0x20 [ 18.795654] Code: f9400408 aa0003f3 aa1f03f4 91142015 (f9402516) [ 18.801913] ---[ end trace 0000000000000000 ]--- [ 18.809039] Kernel panic - not syncing: Oops: Fatal exception Patchwork: https://patchwork.freedesktop.org/patch/515605/ CVE-2023-54199 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54199.html CVE-2023-54199 https://bugzilla.suse.com/1255971 SUSE Bug 1255971 In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request the device to destroy the object. If the device fails, the object isn't fully destroyed so the user/IB core can try to destroy the object again which will lead to underflow when trying to decrease an already zeroed refcount. Deallocate resources in reverse order of allocating them to safely free them. CVE-2023-54201 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54201.html CVE-2023-54201 https://bugzilla.suse.com/1255964 SUSE Bug 1255964 In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the object after unlocking the metrics_lock. For that reason, unlocking the metrics_lock must be done after we are done dereferencing the object. [tursulin: Manually added stable tag.] (cherry picked from commit 49f6f6483b652108bcb73accd0204a464b922395) CVE-2023-54202 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54202.html CVE-2023-54202 https://bugzilla.suse.com/1255880 SUSE Bug 1255880 In the Linux kernel, the following vulnerability has been resolved: pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. CVE-2023-54205 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54205.html CVE-2023-54205 https://bugzilla.suse.com/1255968 SUSE Bug 1255968 In the Linux kernel, the following vulnerability has been resolved: media: ov5675: Fix memleak in ov5675_init_controls() There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock device: AssertionError: unreferenced object 0xffff888107362160 (size 16): comm "python3", pid 277, jiffies 4294832798 (age 20.722s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000abe7d67c>] __kmalloc_node+0x44/0x1b0 [<000000008a725aac>] kvmalloc_node+0x34/0x180 [<000000009a53cd11>] v4l2_ctrl_handler_init_class+0x11d/0x180 [videodev] [<0000000055b46db0>] ov5675_probe+0x38b/0x897 [ov5675] [<00000000153d886c>] i2c_device_probe+0x28d/0x680 [<000000004afb7e8f>] really_probe+0x17c/0x3f0 [<00000000ff2f18e4>] __driver_probe_device+0xe3/0x170 [<000000000a001029>] driver_probe_device+0x49/0x120 [<00000000e39743c7>] __device_attach_driver+0xf7/0x150 [<00000000d32fd070>] bus_for_each_drv+0x114/0x180 [<000000009083ac41>] __device_attach+0x1e5/0x2d0 [<0000000015b4a830>] bus_probe_device+0x126/0x140 [<000000007813deaf>] device_add+0x810/0x1130 [<000000007becb867>] i2c_new_client_device+0x386/0x540 [<000000007f9cf4b4>] of_i2c_register_device+0xf1/0x110 [<00000000ebfdd032>] of_i2c_notify+0xfc/0x1f0 ov5675_init_controls() won't clean all the allocated resources in fail path, which may causes the memleaks. Add v4l2_ctrl_handler_free() to prevent memleak. CVE-2023-54208 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54208.html CVE-2023-54208 https://bugzilla.suse.com/1255962 SUSE Bug 1255962 In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in trace_buffered_event_disable() Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_event_disable+0x189/0x1b0 __ftrace_event_enable_disable+0x19e/0x3e0 free_probe_data+0x3b/0xa0 unregister_ftrace_function_probe_func+0x6b8/0x800 event_enable_func+0x2f0/0x3d0 ftrace_process_regex.isra.0+0x12d/0x1b0 ftrace_filter_write+0xe6/0x140 vfs_write+0x1c9/0x6f0 [...] The cause of the warning is in __ftrace_event_enable_disable(), trace_buffered_event_enable() was called once while trace_buffered_event_disable() was called twice. Reproduction script show as below, for analysis, see the comments: ``` #!/bin/bash cd /sys/kernel/tracing/ # 1. Register a 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was set; # 2) trace_buffered_event_enable() was called first time; echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter # 2. Enable the event registered, then: # 1) SOFT_DISABLED_BIT was cleared; # 2) trace_buffered_event_disable() was called first time; echo 1 > events/initcall/initcall_finish/enable # 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was # set again!!! cat /proc/cmdline # 4. Unregister the 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was cleared again; # 2) trace_buffered_event_disable() was called second time!!! echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter ``` To fix it, IIUC, we can change to call trace_buffered_event_enable() at fist time soft-mode enabled, and call trace_buffered_event_disable() at last time soft-mode disabled. CVE-2023-54211 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54211.html CVE-2023-54211 https://bugzilla.suse.com/1255843 SUSE Bug 1255843 In the Linux kernel, the following vulnerability has been resolved: USB: sisusbvga: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 1 PID: 26 Comm: kworker/1:1 Not tainted 6.2.0-rc5-syzkaller-00199-g5af6ce704936 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Code: 7c 24 18 e8 6c 50 80 fb 48 8b 7c 24 18 e8 62 1a 01 ff 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 60 b1 fa 8a e8 84 b0 be 03 <0f> 0b e9 58 f8 ff ff e8 3e 50 80 fb 48 81 c5 c0 05 00 00 e9 84 f7 RSP: 0018:ffffc90000a1ed18 EFLAGS: 00010282 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff888012783a80 RSI: ffffffff816680ec RDI: fffff52000143d95 RBP: ffff888079020000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000000 R11: 0000000000000000 R12: 0000000000000003 R13: ffff888017d33370 R14: 0000000000000003 R15: ffff888021213600 FS: 0000000000000000(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005592753a60b0 CR3: 0000000022899000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> sisusb_bulkout_msg drivers/usb/misc/sisusbvga/sisusbvga.c:224 [inline] sisusb_send_bulk_msg.constprop.0+0x904/0x1230 drivers/usb/misc/sisusbvga/sisusbvga.c:379 sisusb_send_bridge_packet drivers/usb/misc/sisusbvga/sisusbvga.c:567 [inline] sisusb_do_init_gfxdevice drivers/usb/misc/sisusbvga/sisusbvga.c:2077 [inline] sisusb_init_gfxdevice+0x87b/0x4000 drivers/usb/misc/sisusbvga/sisusbvga.c:2177 sisusb_probe+0x9cd/0xbe2 drivers/usb/misc/sisusbvga/sisusbvga.c:2869 ... The problem was caused by the fact that the driver does not check whether the endpoints it uses are actually present and have the appropriate types. This can be fixed by adding a simple check of the endpoints. CVE-2023-54213 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54213.html CVE-2023-54213 https://bugzilla.suse.com/1255953 SUSE Bug 1255953 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which makes it possible that the chan is disconnected in the meantime. CVE-2023-54214 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54214.html CVE-2023-54214 https://bugzilla.suse.com/1255954 SUSE Bug 1255954 In the Linux kernel, the following vulnerability has been resolved: Revert "IB/isert: Fix incorrect release of isert connection" Commit: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") is causing problems on OPA when DEVICE_REMOVAL is happening. ------------[ cut here ]------------ WARNING: CPU: 52 PID: 2117247 at drivers/infiniband/core/cq.c:359 ib_cq_pool_cleanup+0xac/0xb0 [ib_core] Modules linked in: nfsd nfs_acl target_core_user uio tcm_fc libfc scsi_transport_fc tcm_loop target_core_pscsi target_core_iblock target_core_file rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill rpcrdma rdma_ucm ib_srpt sunrpc ib_isert iscsi_target_mod target_core_mod opa_vnic ib_iser libiscsi ib_umad scsi_transport_iscsi rdma_cm ib_ipoib iw_cm ib_cm hfi1(-) rdmavt ib_uverbs intel_rapl_msr intel_rapl_common sb_edac ib_core x86_pkg_temp_thermal intel_powerclamp coretemp i2c_i801 mxm_wmi rapl iTCO_wdt ipmi_si iTCO_vendor_support mei_me ipmi_devintf mei intel_cstate ioatdma intel_uncore i2c_smbus joydev pcspkr lpc_ich ipmi_msghandler acpi_power_meter acpi_pad xfs libcrc32c sr_mod sd_mod cdrom t10_pi sg crct10dif_pclmul crc32_pclmul crc32c_intel drm_kms_helper drm_shmem_helper ahci libahci ghash_clmulni_intel igb drm libata dca i2c_algo_bit wmi fuse CPU: 52 PID: 2117247 Comm: modprobe Not tainted 6.5.0-rc1+ #1 Hardware name: Intel Corporation S2600CWR/S2600CW, BIOS SE5C610.86B.01.01.0014.121820151719 12/18/2015 RIP: 0010:ib_cq_pool_cleanup+0xac/0xb0 [ib_core] Code: ff 48 8b 43 40 48 8d 7b 40 48 83 e8 40 4c 39 e7 75 b3 49 83 c4 10 4d 39 fc 75 94 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <0f> 0b eb a1 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f RSP: 0018:ffffc10bea13fc80 EFLAGS: 00010206 RAX: 000000000000010c RBX: ffff9bf5c7e66c00 RCX: 000000008020001d RDX: 000000008020001e RSI: fffff175221f9900 RDI: ffff9bf5c7e67640 RBP: ffff9bf5c7e67600 R08: ffff9bf5c7e64400 R09: 000000008020001d R10: 0000000040000000 R11: 0000000000000000 R12: ffff9bee4b1e8a18 R13: dead000000000122 R14: dead000000000100 R15: ffff9bee4b1e8a38 FS: 00007ff1e6d38740(0000) GS:ffff9bfd9fb00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005652044ecc68 CR3: 0000000889b5c005 CR4: 00000000001706e0 Call Trace: <TASK> ? __warn+0x80/0x130 ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] ? report_bug+0x195/0x1a0 ? handle_bug+0x3c/0x70 ? exc_invalid_op+0x14/0x70 ? asm_exc_invalid_op+0x16/0x20 ? ib_cq_pool_cleanup+0xac/0xb0 [ib_core] disable_device+0x9d/0x160 [ib_core] __ib_unregister_device+0x42/0xb0 [ib_core] ib_unregister_device+0x22/0x30 [ib_core] rvt_unregister_device+0x20/0x90 [rdmavt] hfi1_unregister_ib_device+0x16/0xf0 [hfi1] remove_one+0x55/0x1a0 [hfi1] pci_device_remove+0x36/0xa0 device_release_driver_internal+0x193/0x200 driver_detach+0x44/0x90 bus_remove_driver+0x69/0xf0 pci_unregister_driver+0x2a/0xb0 hfi1_mod_cleanup+0xc/0x3c [hfi1] __do_sys_delete_module.constprop.0+0x17a/0x2f0 ? exit_to_user_mode_prepare+0xc4/0xd0 ? syscall_trace_enter.constprop.0+0x126/0x1a0 do_syscall_64+0x5c/0x90 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? syscall_exit_work+0x103/0x130 ? syscall_exit_to_user_mode+0x12/0x30 ? do_syscall_64+0x69/0x90 ? exc_page_fault+0x65/0x150 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7ff1e643f5ab Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffec9103cc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 RAX: ffffffffffffffda RBX: 00005615267fdc50 RCX: 00007ff1e643f5ab RDX: 0000000000000000 RSI: 0000000000000800 RDI: 00005615267fdcb8 RBP: 00005615267fdc50 R08: 0000000000000000 R09: 0000000000000000 R10: 00007ff1e659eac0 R11: 0000000000000206 R12: 00005615267fdcb8 R13: 00000000000 ---truncated--- CVE-2023-54219 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54219.html CVE-2023-54219 https://bugzilla.suse.com/1256231 SUSE Bug 1256231 In the Linux kernel, the following vulnerability has been resolved: amba: bus: fix refcount leak commit 5de1540b7bc4 ("drivers/amba: create devices from device tree") increases the refcount of of_node, but not releases it in amba_device_release, so there is refcount leak. By using of_node_put to avoid refcount leak. CVE-2023-54230 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54230.html CVE-2023-54230 https://bugzilla.suse.com/1255925 SUSE Bug 1255925 In the Linux kernel, the following vulnerability has been resolved: net/net_failover: fix txq exceeding warning The failover txq is inited as 16 queues. when a packet is transmitted from the failover device firstly, the failover device will select the queue which is returned from the primary device if the primary device is UP and running. If the primary device txq is bigger than the default 16, it can lead to the following warning: eth0 selects TX queue 18, but real number of TX queues is 16 The warning backtrace is: [ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1 [ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014 [ 32.147730] Call Trace: [ 32.147971] <TASK> [ 32.148183] dump_stack_lvl+0x48/0x70 [ 32.148514] dump_stack+0x10/0x20 [ 32.148820] netdev_core_pick_tx+0xb1/0xe0 [ 32.149180] __dev_queue_xmit+0x529/0xcf0 [ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0 [ 32.149967] ip_finish_output2+0x278/0x560 [ 32.150327] __ip_finish_output+0x1fe/0x2f0 [ 32.150690] ip_finish_output+0x2a/0xd0 [ 32.151032] ip_output+0x7a/0x110 [ 32.151337] ? __pfx_ip_finish_output+0x10/0x10 [ 32.151733] ip_local_out+0x5e/0x70 [ 32.152054] ip_send_skb+0x19/0x50 [ 32.152366] udp_send_skb.isra.0+0x163/0x3a0 [ 32.152736] udp_sendmsg+0xba8/0xec0 [ 32.153060] ? __folio_memcg_unlock+0x25/0x60 [ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10 [ 32.153854] ? sock_has_perm+0x85/0xa0 [ 32.154190] inet_sendmsg+0x6d/0x80 [ 32.154508] ? inet_sendmsg+0x6d/0x80 [ 32.154838] sock_sendmsg+0x62/0x70 [ 32.155152] ____sys_sendmsg+0x134/0x290 [ 32.155499] ___sys_sendmsg+0x81/0xc0 [ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0 [ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0 [ 32.156649] ? get_random_u16+0x69/0xf0 [ 32.156989] ? __fget_light+0xcf/0x110 [ 32.157326] __sys_sendmmsg+0xc4/0x210 [ 32.157657] ? __sys_connect+0xb7/0xe0 [ 32.157995] ? __audit_syscall_entry+0xce/0x140 [ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0 [ 32.158820] __x64_sys_sendmmsg+0x24/0x30 [ 32.159171] do_syscall_64+0x38/0x90 [ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc Fix that by reducing txq number as the non-existent primary-dev does. CVE-2023-54236 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54236.html CVE-2023-54236 https://bugzilla.suse.com/1255922 SUSE Bug 1255922 In the Linux kernel, the following vulnerability has been resolved: block, bfq: Fix division by zero error on zero wsum When the weighted sum is zero the calculation of limit causes a division by zero error. Fix this by continuing to the next level. This was discovered by running as root: stress-ng --ioprio 0 Fixes divison by error oops: [ 521.450556] divide error: 0000 [#1] SMP NOPTI [ 521.450766] CPU: 2 PID: 2684464 Comm: stress-ng-iopri Not tainted 6.2.1-1280.native #1 [ 521.451117] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 [ 521.451627] RIP: 0010:bfqq_request_over_limit+0x207/0x400 [ 521.451875] Code: 01 48 8d 0c c8 74 0b 48 8b 82 98 00 00 00 48 8d 0c c8 8b 85 34 ff ff ff 48 89 ca 41 0f af 41 50 48 d1 ea 48 98 48 01 d0 31 d2 <48> f7 f1 41 39 41 48 89 85 34 ff ff ff 0f 8c 7b 01 00 00 49 8b 44 [ 521.452699] RSP: 0018:ffffb1af84eb3948 EFLAGS: 00010046 [ 521.452938] RAX: 000000000000003c RBX: 0000000000000000 RCX: 0000000000000000 [ 521.453262] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffb1af84eb3978 [ 521.453584] RBP: ffffb1af84eb3a30 R08: 0000000000000001 R09: ffff8f88ab8a4ba0 [ 521.453905] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8f88ab8a4b18 [ 521.454224] R13: ffff8f8699093000 R14: 0000000000000001 R15: ffffb1af84eb3970 [ 521.454549] FS: 00005640b6b0b580(0000) GS:ffff8f88b3880000(0000) knlGS:0000000000000000 [ 521.454912] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 521.455170] CR2: 00007ffcbcae4e38 CR3: 00000002e46de001 CR4: 0000000000770ee0 [ 521.455491] PKRU: 55555554 [ 521.455619] Call Trace: [ 521.455736] <TASK> [ 521.455837] ? bfq_request_merge+0x3a/0xc0 [ 521.456027] ? elv_merge+0x115/0x140 [ 521.456191] bfq_limit_depth+0xc8/0x240 [ 521.456366] __blk_mq_alloc_requests+0x21a/0x2c0 [ 521.456577] blk_mq_submit_bio+0x23c/0x6c0 [ 521.456766] __submit_bio+0xb8/0x140 [ 521.457236] submit_bio_noacct_nocheck+0x212/0x300 [ 521.457748] submit_bio_noacct+0x1a6/0x580 [ 521.458220] submit_bio+0x43/0x80 [ 521.458660] ext4_io_submit+0x23/0x80 [ 521.459116] ext4_do_writepages+0x40a/0xd00 [ 521.459596] ext4_writepages+0x65/0x100 [ 521.460050] do_writepages+0xb7/0x1c0 [ 521.460492] __filemap_fdatawrite_range+0xa6/0x100 [ 521.460979] file_write_and_wait_range+0xbf/0x140 [ 521.461452] ext4_sync_file+0x105/0x340 [ 521.461882] __x64_sys_fsync+0x67/0x100 [ 521.462305] ? syscall_exit_to_user_mode+0x2c/0x1c0 [ 521.462768] do_syscall_64+0x3b/0xc0 [ 521.463165] entry_SYSCALL_64_after_hwframe+0x5a/0xc4 [ 521.463621] RIP: 0033:0x5640b6c56590 [ 521.464006] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 80 3d 71 70 0e 00 00 74 17 b8 4a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c CVE-2023-54242 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54242.html CVE-2023-54242 https://bugzilla.suse.com/1255919 SUSE Bug 1255919 In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix table blob use-after-free We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not. t = find_table_lock(net, repl->name, &ret, &ebt_mutex); ... this can return a valid table, with ret != 0. This bug causes update of table->private with the new blob, but then frees the blob right away in the caller. Syzbot report: BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace: kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169 cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ... ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious. CVE-2023-54243 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54243.html CVE-2023-54243 https://bugzilla.suse.com/1255908 SUSE Bug 1255908 In the Linux kernel, the following vulnerability has been resolved: ACPI: EC: Fix oops when removing custom query handlers When removing custom query handlers, the handler might still be used inside the EC query workqueue, causing a kernel oops if the module holding the callback function was already unloaded. Fix this by flushing the EC query workqueue when removing custom query handlers. Tested on a Acer Travelmate 4002WLMi CVE-2023-54244 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54244.html CVE-2023-54244 https://bugzilla.suse.com/1255909 SUSE Bug 1255909 In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds When we run syzkaller we get below Out of Bound. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace of the issue: dump_backtrace+0x0/0x4c8 show_stack+0x34/0x44 dump_stack_lvl+0xd8/0x118 print_address_description+0x30/0x2d8 kasan_report+0x158/0x198 __asan_report_load4_noabort+0x44/0x50 regcache_flat_read+0x10c/0x110 regcache_read+0xf4/0x180 _regmap_read+0xc4/0x278 _regmap_update_bits+0x130/0x290 regmap_update_bits_base+0xc0/0x15c snd_soc_component_update_bits+0xa8/0x22c snd_soc_component_write_field+0x68/0xd4 tx_macro_digital_mute+0xec/0x140 Actually There is no need to have decimator with 32 bits. By limiting the variable with short type u8 issue is resolved. CVE-2023-54245 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54245.html CVE-2023-54245 https://bugzilla.suse.com/1255912 SUSE Bug 1255912 In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings My previous commit introduced a memory leak where the item allocated from tlmi_setting was not freed. This commit also renames it to avoid confusion with the similarly name variable in the same function. CVE-2023-54252 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54252.html CVE-2023-54252 https://bugzilla.suse.com/1255889 SUSE Bug 1255889 In the Linux kernel, the following vulnerability has been resolved: cifs: Fix lost destroy smbd connection when MR allocate failed If the MR allocate failed, the smb direct connection info is NULL, then smbd_destroy() will directly return, then the connection info will be leaked. Let's set the smb direct connection info to the server before call smbd_destroy(). CVE-2023-54260 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54260.html CVE-2023-54260 https://bugzilla.suse.com/1255878 SUSE Bug 1255878 In the Linux kernel, the following vulnerability has been resolved: fs/sysv: Null check to prevent null-ptr-deref bug sb_getblk(inode->i_sb, parent) return a null ptr and taking lock on that leads to the null-ptr-deref bug. CVE-2023-54264 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54264.html CVE-2023-54264 https://bugzilla.suse.com/1255872 SUSE Bug 1255872 In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() 'read' is freed when it is known to be NULL, but not when a read error occurs. Revert the logic to avoid a small leak, should a m920x_read() call fail. CVE-2023-54266 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54266.html CVE-2023-54266 https://bugzilla.suse.com/1255875 SUSE Bug 1255875 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - and also remains in the svc_deferred_req. In the (rare?) case that the request is deferred a second time, the old svc_deferred_req is reused - it still has all the correct content. However in that case the rq_xprt_ctxt pointer is NOT cleared so that when xpo_release_xprt is called, the ctxt is freed (UDP) or possible added to a free list (RDMA). When the deferred request is revisited for a second time, it will reference this ctxt which may be invalid, and the free the object a second time which is likely to oops. So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that the value is now stored in the svc_deferred_req. CVE-2023-54269 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54269.html CVE-2023-54269 https://bugzilla.suse.com/1255876 SUSE Bug 1255876 In the Linux kernel, the following vulnerability has been resolved: media: usb: siano: Fix use after free bugs caused by do_submit_urb There are UAF bugs caused by do_submit_urb(). One of the KASan reports is shown below: [ 36.403605] BUG: KASAN: use-after-free in worker_thread+0x4a2/0x890 [ 36.406105] Read of size 8 at addr ffff8880059600e8 by task kworker/0:2/49 [ 36.408316] [ 36.408867] CPU: 0 PID: 49 Comm: kworker/0:2 Not tainted 6.2.0-rc3-15798-g5a41237ad1d4-dir8 [ 36.411696] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g15584 [ 36.416157] Workqueue: 0x0 (events) [ 36.417654] Call Trace: [ 36.418546] <TASK> [ 36.419320] dump_stack_lvl+0x96/0xd0 [ 36.420522] print_address_description+0x75/0x350 [ 36.421992] print_report+0x11b/0x250 [ 36.423174] ? _raw_spin_lock_irqsave+0x87/0xd0 [ 36.424806] ? __virt_addr_valid+0xcf/0x170 [ 36.426069] ? worker_thread+0x4a2/0x890 [ 36.427355] kasan_report+0x131/0x160 [ 36.428556] ? worker_thread+0x4a2/0x890 [ 36.430053] worker_thread+0x4a2/0x890 [ 36.431297] ? worker_clr_flags+0x90/0x90 [ 36.432479] kthread+0x166/0x190 [ 36.433493] ? kthread_blkcg+0x50/0x50 [ 36.434669] ret_from_fork+0x22/0x30 [ 36.435923] </TASK> [ 36.436684] [ 36.437215] Allocated by task 24: [ 36.438289] kasan_set_track+0x50/0x80 [ 36.439436] __kasan_kmalloc+0x89/0xa0 [ 36.440566] smsusb_probe+0x374/0xc90 [ 36.441920] usb_probe_interface+0x2d1/0x4c0 [ 36.443253] really_probe+0x1d5/0x580 [ 36.444539] __driver_probe_device+0xe3/0x130 [ 36.446085] driver_probe_device+0x49/0x220 [ 36.447423] __device_attach_driver+0x19e/0x1b0 [ 36.448931] bus_for_each_drv+0xcb/0x110 [ 36.450217] __device_attach+0x132/0x1f0 [ 36.451470] bus_probe_device+0x59/0xf0 [ 36.452563] device_add+0x4ec/0x7b0 [ 36.453830] usb_set_configuration+0xc63/0xe10 [ 36.455230] usb_generic_driver_probe+0x3b/0x80 [ 36.456166] printk: console [ttyGS0] disabled [ 36.456569] usb_probe_device+0x90/0x110 [ 36.459523] really_probe+0x1d5/0x580 [ 36.461027] __driver_probe_device+0xe3/0x130 [ 36.462465] driver_probe_device+0x49/0x220 [ 36.463847] __device_attach_driver+0x19e/0x1b0 [ 36.465229] bus_for_each_drv+0xcb/0x110 [ 36.466466] __device_attach+0x132/0x1f0 [ 36.467799] bus_probe_device+0x59/0xf0 [ 36.469010] device_add+0x4ec/0x7b0 [ 36.470125] usb_new_device+0x863/0xa00 [ 36.471374] hub_event+0x18c7/0x2220 [ 36.472746] process_one_work+0x34c/0x5b0 [ 36.474041] worker_thread+0x4b7/0x890 [ 36.475216] kthread+0x166/0x190 [ 36.476267] ret_from_fork+0x22/0x30 [ 36.477447] [ 36.478160] Freed by task 24: [ 36.479239] kasan_set_track+0x50/0x80 [ 36.480512] kasan_save_free_info+0x2b/0x40 [ 36.481808] ____kasan_slab_free+0x122/0x1a0 [ 36.483173] __kmem_cache_free+0xc4/0x200 [ 36.484563] smsusb_term_device+0xcd/0xf0 [ 36.485896] smsusb_probe+0xc85/0xc90 [ 36.486976] usb_probe_interface+0x2d1/0x4c0 [ 36.488303] really_probe+0x1d5/0x580 [ 36.489498] __driver_probe_device+0xe3/0x130 [ 36.491140] driver_probe_device+0x49/0x220 [ 36.492475] __device_attach_driver+0x19e/0x1b0 [ 36.493988] bus_for_each_drv+0xcb/0x110 [ 36.495171] __device_attach+0x132/0x1f0 [ 36.496617] bus_probe_device+0x59/0xf0 [ 36.497875] device_add+0x4ec/0x7b0 [ 36.498972] usb_set_configuration+0xc63/0xe10 [ 36.500264] usb_generic_driver_probe+0x3b/0x80 [ 36.501740] usb_probe_device+0x90/0x110 [ 36.503084] really_probe+0x1d5/0x580 [ 36.504241] __driver_probe_device+0xe3/0x130 [ 36.505548] driver_probe_device+0x49/0x220 [ 36.506766] __device_attach_driver+0x19e/0x1b0 [ 36.508368] bus_for_each_drv+0xcb/0x110 [ 36.509646] __device_attach+0x132/0x1f0 [ 36.510911] bus_probe_device+0x59/0xf0 [ 36.512103] device_add+0x4ec/0x7b0 [ 36.513215] usb_new_device+0x863/0xa00 [ 36.514736] hub_event+0x18c7/0x2220 [ 36.516130] process_one_work+ ---truncated--- CVE-2023-54270 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54270.html CVE-2023-54270 https://bugzilla.suse.com/1255901 SUSE Bug 1255901 In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init blk-iocost sometimes causes the following crash: BUG: kernel NULL pointer dereference, address: 00000000000000e0 ... RIP: 0010:_raw_spin_lock+0x17/0x30 Code: be 01 02 00 00 e8 79 38 39 ff 31 d2 89 d0 5d c3 0f 1f 00 0f 1f 44 00 00 55 48 89 e5 65 ff 05 48 d0 34 7e b9 01 00 00 00 31 c0 <f0> 0f b1 0f 75 02 5d c3 89 c6 e8 ea 04 00 00 5d c3 0f 1f 84 00 00 RSP: 0018:ffffc900023b3d40 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 00000000000000e0 RCX: 0000000000000001 RDX: ffffc900023b3d20 RSI: ffffc900023b3cf0 RDI: 00000000000000e0 RBP: ffffc900023b3d40 R08: ffffc900023b3c10 R09: 0000000000000003 R10: 0000000000000064 R11: 000000000000000a R12: ffff888102337000 R13: fffffffffffffff2 R14: ffff88810af408c8 R15: ffff8881070c3600 FS: 00007faaaf364fc0(0000) GS:ffff88842fdc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000000000e0 CR3: 00000001097b1000 CR4: 0000000000350ea0 Call Trace: <TASK> ioc_weight_write+0x13d/0x410 cgroup_file_write+0x7a/0x130 kernfs_fop_write_iter+0xf5/0x170 vfs_write+0x298/0x370 ksys_write+0x5f/0xb0 __x64_sys_write+0x1b/0x20 do_syscall_64+0x3d/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 This happens because iocg->ioc is NULL. The field is initialized by ioc_pd_init() and never cleared. The NULL deref is caused by blkcg_activate_policy() installing blkg_policy_data before initializing it. blkcg_activate_policy() was doing the following: 1. Allocate pd's for all existing blkg's and install them in blkg->pd[]. 2. Initialize all pd's. 3. Online all pd's. blkcg_activate_policy() only grabs the queue_lock and may release and re-acquire the lock as allocation may need to sleep. ioc_weight_write() grabs blkcg->lock and iterates all its blkg's. The two can race and if ioc_weight_write() runs during #1 or between #1 and #2, it can encounter a pd which is not initialized yet, leading to crash. The crash can be reproduced with the following script: #!/bin/bash echo +io > /sys/fs/cgroup/cgroup.subtree_control systemd-run --unit touch-sda --scope dd if=/dev/sda of=/dev/null bs=1M count=1 iflag=direct echo 100 > /sys/fs/cgroup/system.slice/io.weight bash -c "echo '8:0 enable=1' > /sys/fs/cgroup/io.cost.qos" & sleep .2 echo 100 > /sys/fs/cgroup/system.slice/io.weight with the following patch applied: > diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c > index fc49be622e05..38d671d5e10c 100644 > --- a/block/blk-cgroup.c > +++ b/block/blk-cgroup.c > @@ -1553,6 +1553,12 @@ int blkcg_activate_policy(struct gendisk *disk, const struct blkcg_policy *pol) > pd->online = false; > } > > + if (system_state == SYSTEM_RUNNING) { > + spin_unlock_irq(&q->queue_lock); > + ssleep(1); > + spin_lock_irq(&q->queue_lock); > + } > + > /* all allocated, init in the same order */ > if (pol->pd_init_fn) > list_for_each_entry_reverse(blkg, &q->blkg_list, q_node) I don't see a reason why all pd's should be allocated, initialized and onlined together. The only ordering requirement is that parent blkgs to be initialized and onlined before children, which is guaranteed from the walking order. Let's fix the bug by allocating, initializing and onlining pd for each blkg and holding blkcg->lock over initialization and onlining. This ensures that an installed blkg is always fully initialized and onlined removing the the race window. CVE-2023-54271 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54271.html CVE-2023-54271 https://bugzilla.suse.com/1255902 SUSE Bug 1255902 In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Add a check for valid 'mad_agent' pointer When unregistering MAD agent, srpt module has a non-null check for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). This check can pass if 'mad_agent' variable holds an error value. The 'mad_agent' can have an error value for a short window when srpt_add_one() and srpt_remove_one() is executed simultaneously. In srpt module, added a valid pointer check for 'sport->mad_agent' before unregistering MAD agent. This issue can hit when RoCE driver unregisters ib_device Stack Trace: ------------ BUG: kernel NULL pointer dereference, address: 000000000000004d PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020 Workqueue: bnxt_re bnxt_re_task [bnxt_re] RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40 Call Trace: ib_unregister_mad_agent+0x46/0x2f0 [ib_core] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready ? __schedule+0x20b/0x560 srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt] srpt_remove_one+0x20/0x150 [ib_srpt] remove_client_context+0x88/0xd0 [ib_core] bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex disable_device+0x8a/0x160 [ib_core] bond0: active interface up! ? kernfs_name_hash+0x12/0x80 (NULL device *): Bonding Info Received: rdev: 000000006c0b8247 __ib_unregister_device+0x42/0xb0 [ib_core] (NULL device *): Master: mode: 4 num_slaves:2 ib_unregister_device+0x22/0x30 [ib_core] (NULL device *): Slave: id: 105069936 name:p2p1 link:0 state:0 bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re] bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re] CVE-2023-54274 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54274.html CVE-2023-54274 https://bugzilla.suse.com/1255905 SUSE Bug 1255905 In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup crypto_alloc_shash() allocates resources, which should be released by crypto_free_shash(). When ath11k_peer_find() fails, there has memory leak. Add missing crypto_free_shash() to fix this. CVE-2023-54275 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54275.html CVE-2023-54275 https://bugzilla.suse.com/1255906 SUSE Bug 1255906 In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: Fix endpoint check The syzbot fuzzer detected a problem in the udlfb driver, caused by an endpoint not having the expected type: usb 1-1: Read EDID byte 0 failed: -71 usb 1-1: Unable to get valid EDID from device/display ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 0 PID: 9 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.4.0-rc1-syzkaller-00016-ga4422ff22142 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Workqueue: usb_hub_wq hub_event RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504 ... Call Trace: <TASK> dlfb_submit_urb+0x92/0x180 drivers/video/fbdev/udlfb.c:1980 dlfb_set_video_mode+0x21f0/0x2950 drivers/video/fbdev/udlfb.c:315 dlfb_ops_set_par+0x2a7/0x8d0 drivers/video/fbdev/udlfb.c:1111 dlfb_usb_probe+0x149a/0x2710 drivers/video/fbdev/udlfb.c:1743 The current approach for this issue failed to catch the problem because it only checks for the existence of a bulk-OUT endpoint; it doesn't check whether this endpoint is the one that the driver will actually use. We can fix the problem by instead checking that the endpoint used by the driver does exist and is bulk-OUT. CVE-2023-54277 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54277.html CVE-2023-54277 https://bugzilla.suse.com/1255910 SUSE Bug 1255910 In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential race when tree connecting ipc Protect access of TCP_Server_Info::hostname when building the ipc tree name as it might get freed in cifsd thread and thus causing an use-after-free bug in __tree_connect_dfs_target(). Also, while at it, update status of IPC tcon on success and then avoid any extra tree connects. CVE-2023-54280 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54280.html CVE-2023-54280 https://bugzilla.suse.com/1255819 SUSE Bug 1255819 In the Linux kernel, the following vulnerability has been resolved: media: av7110: prevent underflow in write_ts_to_decoder() The buf[4] value comes from the user via ts_play(). It is a value in the u8 range. The final length we pass to av7110_ipack_instant_repack() is "len - (buf[4] + 1) - 4" so add a check to ensure that the length is not negative. It's not clear that passing a negative len value does anything bad necessarily, but it's not best practice. With the new bounds checking the "if (!len)" condition is no longer possible or required so remove that. CVE-2023-54284 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54284.html CVE-2023-54284 https://bugzilla.suse.com/1255808 SUSE Bug 1255808 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copying these over overflows the iwl_keyinfo.key field. Add a check to not copy more data to iwl_keyinfo.key then will fit. This fixes backtraces like this one: memcpy: detected field-spanning write (size 32) of single field "sta_cmd.key.key" at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 (size 16) WARNING: CPU: 1 PID: 946 at drivers/net/wireless/intel/iwlwifi/dvm/sta.c:1103 iwlagn_send_sta_key+0x375/0x390 [iwldvm] <snip> Hardware name: Dell Inc. Latitude E6430/0H3MT5, BIOS A21 05/08/2017 RIP: 0010:iwlagn_send_sta_key+0x375/0x390 [iwldvm] <snip> Call Trace: <TASK> iwl_set_dynamic_key+0x1f0/0x220 [iwldvm] iwlagn_mac_set_key+0x1e4/0x280 [iwldvm] drv_set_key+0xa4/0x1b0 [mac80211] ieee80211_key_enable_hw_accel+0xa8/0x2d0 [mac80211] ieee80211_key_replace+0x22d/0x8e0 [mac80211] <snip> CVE-2023-54286 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54286.html CVE-2023-54286 https://bugzilla.suse.com/1255803 SUSE Bug 1255803 In the Linux kernel, the following vulnerability has been resolved: tty: serial: imx: disable Ageing Timer interrupt request irq There maybe pending USR interrupt before requesting irq, however uart_add_one_port has not executed, so there will be kernel panic: [ 0.795668] Unable to handle kernel NULL pointer dereference at virtual addre ss 0000000000000080 [ 0.802701] Mem abort info: [ 0.805367] ESR = 0x0000000096000004 [ 0.808950] EC = 0x25: DABT (current EL), IL = 32 bits [ 0.814033] SET = 0, FnV = 0 [ 0.816950] EA = 0, S1PTW = 0 [ 0.819950] FSC = 0x04: level 0 translation fault [ 0.824617] Data abort info: [ 0.827367] ISV = 0, ISS = 0x00000004 [ 0.831033] CM = 0, WnR = 0 [ 0.833866] [0000000000000080] user address but active_mm is swapper [ 0.839951] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 0.845953] Modules linked in: [ 0.848869] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.1.1+g56321e101aca #1 [ 0.855617] Hardware name: Freescale i.MX8MP EVK (DT) [ 0.860452] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 0.867117] pc : __imx_uart_rxint.constprop.0+0x11c/0x2c0 [ 0.872283] lr : imx_uart_int+0xf8/0x1ec The issue only happends in the inmate linux when Jailhouse hypervisor enabled. The test procedure is: while true; do jailhouse enable imx8mp.cell jailhouse cell linux xxxx sleep 10 jailhouse cell destroy 1 jailhouse disable sleep 5 done And during the upper test, press keys to the 2nd linux console. When `jailhouse cell destroy 1`, the 2nd linux has no chance to put the uart to a quiese state, so USR1/2 may has pending interrupts. Then when `jailhosue cell linux xx` to start 2nd linux again, the issue trigger. In order to disable irqs before requesting them, both UCR1 and UCR2 irqs should be disabled, so here fix that, disable the Ageing Timer interrupt in UCR2 as UCR1 does. CVE-2023-54287 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54287.html CVE-2023-54287 https://bugzilla.suse.com/1255804 SUSE Bug 1255804 In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix NULL dereference in error handling Smatch reported: drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues() warn: missing unwind goto? At this point in the function, nothing has been allocated so we can return directly. In particular the "qedf->global_queues" have not been allocated so calling qedf_free_global_queues() will lead to a NULL dereference when we check if (!gl[i]) and "gl" is NULL. CVE-2023-54289 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54289.html CVE-2023-54289 https://bugzilla.suse.com/1255806 SUSE Bug 1255806 In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. Annotate lockless intent with READ_ONCE/WRITE_ONCE to avoid any compiler optimizations like load fusing and/or KCSAN warning. [222808.417128] BUG: KCSAN: data-race in irdma_cqp_ce_handler [irdma] / irdma_wait_event [irdma] [222808.417532] write to 0xffff8e44107019dc of 1 bytes by task 29658 on cpu 5: [222808.417610] irdma_cqp_ce_handler+0x21e/0x270 [irdma] [222808.417725] cqp_compl_worker+0x1b/0x20 [irdma] [222808.417827] process_one_work+0x4d1/0xa40 [222808.417835] worker_thread+0x319/0x700 [222808.417842] kthread+0x180/0x1b0 [222808.417852] ret_from_fork+0x22/0x30 [222808.417918] read to 0xffff8e44107019dc of 1 bytes by task 29688 on cpu 1: [222808.417995] irdma_wait_event+0x1e2/0x2c0 [irdma] [222808.418099] irdma_handle_cqp_op+0xae/0x170 [irdma] [222808.418202] irdma_cqp_cq_destroy_cmd+0x70/0x90 [irdma] [222808.418308] irdma_puda_dele_rsrc+0x46d/0x4d0 [irdma] [222808.418411] irdma_rt_deinit_hw+0x179/0x1d0 [irdma] [222808.418514] irdma_ib_dealloc_device+0x11/0x40 [irdma] [222808.418618] ib_dealloc_device+0x2a/0x120 [ib_core] [222808.418823] __ib_unregister_device+0xde/0x100 [ib_core] [222808.418981] ib_unregister_device+0x22/0x40 [ib_core] [222808.419142] irdma_ib_unregister_device+0x70/0x90 [irdma] [222808.419248] i40iw_close+0x6f/0xc0 [irdma] [222808.419352] i40e_client_device_unregister+0x14a/0x180 [i40e] [222808.419450] i40iw_remove+0x21/0x30 [irdma] [222808.419554] auxiliary_bus_remove+0x31/0x50 [222808.419563] device_remove+0x69/0xb0 [222808.419572] device_release_driver_internal+0x293/0x360 [222808.419582] driver_detach+0x7c/0xf0 [222808.419592] bus_remove_driver+0x8c/0x150 [222808.419600] driver_unregister+0x45/0x70 [222808.419610] auxiliary_driver_unregister+0x16/0x30 [222808.419618] irdma_exit_module+0x18/0x1e [irdma] [222808.419733] __do_sys_delete_module.constprop.0+0x1e2/0x310 [222808.419745] __x64_sys_delete_module+0x1b/0x30 [222808.419755] do_syscall_64+0x39/0x90 [222808.419763] entry_SYSCALL_64_after_hwframe+0x63/0xcd [222808.419829] value changed: 0x01 -> 0x03 CVE-2023-54292 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54292.html CVE-2023-54292 https://bugzilla.suse.com/1255800 SUSE Bug 1255800 In the Linux kernel, the following vulnerability has been resolved: bcache: fixup btree_cache_wait list damage We get a kernel crash about "list_add corruption. next->prev should be prev (ffff9c801bc01210), but was ffff9c77b688237c. (next=ffffae586d8afe68)." crash> struct list_head 0xffff9c801bc01210 struct list_head { next = 0xffffae586d8afe68, prev = 0xffffae586d8afe68 } crash> struct list_head 0xffff9c77b688237c struct list_head { next = 0x0, prev = 0x0 } crash> struct list_head 0xffffae586d8afe68 struct list_head struct: invalid kernel virtual address: ffffae586d8afe68 type: "gdb_readmem_callback" Cannot access memory at address 0xffffae586d8afe68 [230469.019492] Call Trace: [230469.032041] prepare_to_wait+0x8a/0xb0 [230469.044363] ? bch_btree_keys_free+0x6c/0xc0 [escache] [230469.056533] mca_cannibalize_lock+0x72/0x90 [escache] [230469.068788] mca_alloc+0x2ae/0x450 [escache] [230469.080790] bch_btree_node_get+0x136/0x2d0 [escache] [230469.092681] bch_btree_check_thread+0x1e1/0x260 [escache] [230469.104382] ? finish_wait+0x80/0x80 [230469.115884] ? bch_btree_check_recurse+0x1a0/0x1a0 [escache] [230469.127259] kthread+0x112/0x130 [230469.138448] ? kthread_flush_work_fn+0x10/0x10 [230469.149477] ret_from_fork+0x35/0x40 bch_btree_check_thread() and bch_dirty_init_thread() may call mca_cannibalize() to cannibalize other cached btree nodes. Only one thread can do it at a time, so the op of other threads will be added to the btree_cache_wait list. We must call finish_wait() to remove op from btree_cache_wait before free it's memory address. Otherwise, the list will be damaged. Also should call bch_cannibalize_unlock() to release the btree_cache_alloc_lock and wake_up other waiters. CVE-2023-54293 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54293.html CVE-2023-54293 https://bugzilla.suse.com/1255801 SUSE Bug 1255801 In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak of md thread In raid10_run(), if setup_conf() succeed and raid10_run() failed before setting 'mddev->thread', then in the error path 'conf->thread' is not freed. Fix the problem by setting 'mddev->thread' right after setup_conf(). CVE-2023-54294 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54294.html CVE-2023-54294 https://bugzilla.suse.com/1255802 SUSE Bug 1255802 In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: Fix shift-out-of-bounds in spi_nor_set_erase_type spi_nor_set_erase_type() was used either to set or to mask out an erase type. When we used it to mask out an erase type a shift-out-of-bounds was hit: UBSAN: shift-out-of-bounds in drivers/mtd/spi-nor/core.c:2237:24 shift exponent 4294967295 is too large for 32-bit type 'int' The setting of the size_{shift, mask} and of the opcode are unnecessary when the erase size is zero, as throughout the code just the erase size is considered to determine whether an erase type is supported or not. Setting the opcode to 0xFF was wrong too as nobody guarantees that 0xFF is an unused opcode. Thus when masking out an erase type, just set the erase size to zero. This will fix the shift-out-of-bounds. [ta: refine changes, new commit message, fix compilation error] CVE-2023-54295 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54295.html CVE-2023-54295 https://bugzilla.suse.com/1255797 SUSE Bug 1255797 In the Linux kernel, the following vulnerability has been resolved: thermal: intel: quark_dts: fix error pointer dereference If alloc_soc_dts() fails, then we can just return. Trying to free "soc_dts" will lead to an Oops. CVE-2023-54298 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54298.html CVE-2023-54298 https://bugzilla.suse.com/1255796 SUSE Bug 1255796 In the Linux kernel, the following vulnerability has been resolved: usb: typec: bus: verify partner exists in typec_altmode_attention Some usb hubs will negotiate DisplayPort Alt mode with the device but will then negotiate a data role swap after entering the alt mode. The data role swap causes the device to unregister all alt modes, however the usb hub will still send Attention messages even after failing to reregister the Alt Mode. type_altmode_attention currently does not verify whether or not a device's altmode partner exists, which results in a NULL pointer error when dereferencing the typec_altmode and typec_altmode_ops belonging to the altmode partner. Verify the presence of a device's altmode partner before sending the Attention message to the Alt Mode driver. CVE-2023-54299 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54299.html CVE-2023-54299 https://bugzilla.suse.com/1255789 SUSE Bug 1255789 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_htc_rx_msg() should validate pkt_len before accessing the SKB. For example, the obtained SKB may have been badly constructed with pkt_len = 8. In this case, the SKB can only contain a valid htc_frame_hdr but after being processed in ath9k_htc_rx_msg() and passed to ath9k_wmi_ctrl_rx() endpoint RX handler, it is expected to have a WMI command header which should be located inside its data payload. Implement sanity checking inside ath9k_wmi_ctrl_rx(). Otherwise, uninit memory can be referenced. Tested on Qualcomm Atheros Communications AR9271 802.11n . Found by Linux Verification Center (linuxtesting.org) with Syzkaller. CVE-2023-54300 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54300.html CVE-2023-54300 https://bugzilla.suse.com/1255790 SUSE Bug 1255790 In the Linux kernel, the following vulnerability has been resolved: serial: 8250_bcm7271: fix leak in `brcmuart_probe` Smatch reports: drivers/tty/serial/8250/8250_bcm7271.c:1120 brcmuart_probe() warn: 'baud_mux_clk' from clk_prepare_enable() not released on lines: 1032. The issue is fixed by using a managed clock. CVE-2023-54301 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54301.html CVE-2023-54301 https://bugzilla.suse.com/1255791 SUSE Bug 1255791 In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP completion stats CQP completion statistics is read lockesly in irdma_wait_event and irdma_check_cqp_progress while it can be updated in the completion thread irdma_sc_ccq_get_cqe_info on another CPU as KCSAN reports. Make completion statistics an atomic variable to reflect coherent updates to it. This will also avoid load/store tearing logic bug potentially possible by compiler optimizations. [77346.170861] BUG: KCSAN: data-race in irdma_handle_cqp_op [irdma] / irdma_sc_ccq_get_cqe_info [irdma] [77346.171383] write to 0xffff8a3250b108e0 of 8 bytes by task 9544 on cpu 4: [77346.171483] irdma_sc_ccq_get_cqe_info+0x27a/0x370 [irdma] [77346.171658] irdma_cqp_ce_handler+0x164/0x270 [irdma] [77346.171835] cqp_compl_worker+0x1b/0x20 [irdma] [77346.172009] process_one_work+0x4d1/0xa40 [77346.172024] worker_thread+0x319/0x700 [77346.172037] kthread+0x180/0x1b0 [77346.172054] ret_from_fork+0x22/0x30 [77346.172136] read to 0xffff8a3250b108e0 of 8 bytes by task 9838 on cpu 2: [77346.172234] irdma_handle_cqp_op+0xf4/0x4b0 [irdma] [77346.172413] irdma_cqp_aeq_cmd+0x75/0xa0 [irdma] [77346.172592] irdma_create_aeq+0x390/0x45a [irdma] [77346.172769] irdma_rt_init_hw.cold+0x212/0x85d [irdma] [77346.172944] irdma_probe+0x54f/0x620 [irdma] [77346.173122] auxiliary_bus_probe+0x66/0xa0 [77346.173137] really_probe+0x140/0x540 [77346.173154] __driver_probe_device+0xc7/0x220 [77346.173173] driver_probe_device+0x5f/0x140 [77346.173190] __driver_attach+0xf0/0x2c0 [77346.173208] bus_for_each_dev+0xa8/0xf0 [77346.173225] driver_attach+0x29/0x30 [77346.173240] bus_add_driver+0x29c/0x2f0 [77346.173255] driver_register+0x10f/0x1a0 [77346.173272] __auxiliary_driver_register+0xbc/0x140 [77346.173287] irdma_init_module+0x55/0x1000 [irdma] [77346.173460] do_one_initcall+0x7d/0x410 [77346.173475] do_init_module+0x81/0x2c0 [77346.173491] load_module+0x1232/0x12c0 [77346.173506] __do_sys_finit_module+0x101/0x180 [77346.173522] __x64_sys_finit_module+0x3c/0x50 [77346.173538] do_syscall_64+0x39/0x90 [77346.173553] entry_SYSCALL_64_after_hwframe+0x63/0xcd [77346.173634] value changed: 0x0000000000000094 -> 0x0000000000000095 CVE-2023-54302 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54302.html CVE-2023-54302 https://bugzilla.suse.com/1255792 SUSE Bug 1255792 In the Linux kernel, the following vulnerability has been resolved: firmware: meson_sm: fix to avoid potential NULL pointer dereference of_match_device() may fail and returns a NULL pointer. Fix this by checking the return value of of_match_device. CVE-2023-54304 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54304.html CVE-2023-54304 https://bugzilla.suse.com/1255786 SUSE Bug 1255786 In the Linux kernel, the following vulnerability has been resolved: ext4: refuse to create ea block when umounted The ea block expansion need to access s_root while it is already set as NULL when umount is triggered. Refuse this request to avoid panic. CVE-2023-54305 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54305.html CVE-2023-54305 https://bugzilla.suse.com/1255787 SUSE Bug 1255787 In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation /dev/vtpmx is made visible before 'workqueue' is initialized, which can lead to a memory corruption in the worst case scenario. Address this by initializing 'workqueue' as the very first step of the driver initialization. CVE-2023-54309 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54309.html CVE-2023-54309 https://bugzilla.suse.com/1255780 SUSE Bug 1255780 In the Linux kernel, the following vulnerability has been resolved: ext4: fix deadlock when converting an inline directory in nojournal mode In no journal mode, ext4_finish_convert_inline_dir() can self-deadlock by calling ext4_handle_dirty_dirblock() when it already has taken the directory lock. There is a similar self-deadlock in ext4_incvert_inline_data_nolock() for data files which we'll fix at the same time. A simple reproducer demonstrating the problem: mke2fs -Fq -t ext2 -O inline_data -b 4k /dev/vdc 64 mount -t ext4 -o dirsync /dev/vdc /vdc cd /vdc mkdir file0 cd file0 touch file0 touch file1 attr -s BurnSpaceInEA -V abcde . touch supercalifragilisticexpialidocious CVE-2023-54311 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54311.html CVE-2023-54311 https://bugzilla.suse.com/1255773 SUSE Bug 1255773 In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/sriov: perform null check on iov before dereferencing iov Currently pointer iov is being dereferenced before the null check of iov which can lead to null pointer dereference errors. Fix this by moving the iov null check before the dereferencing. Detected using cppcheck static analysis: linux/arch/powerpc/platforms/powernv/pci-sriov.c:597:12: warning: Either the condition '!iov' is redundant or there is possible null pointer dereference: iov. [nullPointerRedundantCheck] num_vfs = iov->num_vfs; ^ CVE-2023-54315 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54315.html CVE-2023-54315 https://bugzilla.suse.com/1255769 SUSE Bug 1255769 In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page When we need to zero some range on a block device, the function __blkdev_issue_zero_pages submits a write bio with the bio vector pointing to the zero page. If we use dm-flakey with corrupt bio writes option, it will corrupt the content of the zero page which results in crashes of various userspace programs. Glibc assumes that memory returned by mmap is zeroed and it uses it for calloc implementation; if the newly mapped memory is not zeroed, calloc will return non-zeroed memory. Fix this bug by testing if the page is equal to ZERO_PAGE(0) and avoiding the corruption in this case. CVE-2023-54317 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54317.html CVE-2023-54317 https://bugzilla.suse.com/1255771 SUSE Bug 1255771 In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91-pio4: check return value of devm_kasprintf() devm_kasprintf() returns a pointer to dynamically allocated memory. Pointer could be NULL in case allocation fails. Check pointer validity. Identified with coccinelle (kmerr.cocci script). Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks") Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int") CVE-2023-54319 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54319.html CVE-2023-54319 https://bugzilla.suse.com/1255760 SUSE Bug 1255760 In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential null-ptr-deref in device_add() I got the following null-ptr-deref report while doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000000058 CPU: 2 PID: 278 Comm: 37-i2c-ds2482 Tainted: G B W N 6.1.0-rc3+ RIP: 0010:klist_put+0x2d/0xd0 Call Trace: <TASK> klist_remove+0xf1/0x1c0 device_release_driver_internal+0x196/0x210 bus_remove_device+0x1bd/0x240 device_add+0xd3d/0x1100 w1_add_master_device+0x476/0x490 [wire] ds2482_probe+0x303/0x3e0 [ds2482] This is how it happened: w1_alloc_dev() // The dev->driver is set to w1_master_driver. memcpy(&dev->dev, device, sizeof(struct device)); device_add() bus_add_device() dpm_sysfs_add() // It fails, calls bus_remove_device. // error path bus_remove_device() // The dev->driver is not null, but driver is not bound. __device_release_driver() klist_remove(&dev->p->knode_driver) <-- It causes null-ptr-deref. // normal path bus_probe_device() // It's not called yet. device_bind_driver() If dev->driver is set, in the error path after calling bus_add_device() in device_add(), bus_remove_device() is called, then the device will be detached from driver. But device_bind_driver() is not called yet, so it causes null-ptr-deref while access the 'knode_driver'. To fix this, set dev->driver to null in the error path before calling bus_remove_device(). CVE-2023-54321 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54321.html CVE-2023-54321 https://bugzilla.suse.com/1255762 SUSE Bug 1255762 In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix out-of-bounds read When preparing an AER-CTR request, the driver copies the key provided by the user into a data structure that is accessible by the firmware. If the target device is QAT GEN4, the key size is rounded up by 16 since a rounded up size is expected by the device. If the key size is rounded up before the copy, the size used for copying the key might be bigger than the size of the region containing the key, causing an out-of-bounds read. Fix by doing the copy first and then update the keylen. This is to fix the following warning reported by KASAN: [ 138.150574] BUG: KASAN: global-out-of-bounds in qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] [ 138.150641] Read of size 32 at addr ffffffff88c402c0 by task cryptomgr_test/2340 [ 138.150651] CPU: 15 PID: 2340 Comm: cryptomgr_test Not tainted 6.2.0-rc1+ #45 [ 138.150659] Hardware name: Intel Corporation ArcherCity/ArcherCity, BIOS EGSDCRB1.86B.0087.D13.2208261706 08/26/2022 [ 138.150663] Call Trace: [ 138.150668] <TASK> [ 138.150922] kasan_check_range+0x13a/0x1c0 [ 138.150931] memcpy+0x1f/0x60 [ 138.150940] qat_alg_skcipher_init_com.isra.0+0x197/0x250 [intel_qat] [ 138.151006] qat_alg_skcipher_init_sessions+0xc1/0x240 [intel_qat] [ 138.151073] crypto_skcipher_setkey+0x82/0x160 [ 138.151085] ? prepare_keybuf+0xa2/0xd0 [ 138.151095] test_skcipher_vec_cfg+0x2b8/0x800 CVE-2023-54325 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54325.html CVE-2023-54325 https://bugzilla.suse.com/1255757 SUSE Bug 1255757 In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Free IRQs before removing the device In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released, causing the IRQ handler to access invalid memory, resulting in an oops. Free the device IRQs before removing the device to avoid this issue. CVE-2023-54326 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2023-54326.html CVE-2023-54326 https://bugzilla.suse.com/1255758 SUSE Bug 1255758 Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. CVE-2024-28956 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2024-28956.html CVE-2024-28956 https://bugzilla.suse.com/1242006 SUSE Bug 1242006 A transient execution vulnerability in some AMD processors may allow a user process to infer the control registers speculatively even if UMIP feature is enabled, potentially resulting in information leakage. CVE-2024-36348 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2024-36348.html CVE-2024-36348 https://bugzilla.suse.com/1238896 SUSE Bug 1238896 A transient execution vulnerability in some AMD processors may allow a user process to infer TSC_AUX even when such a read is disabled, potentially resulting in information leakage. CVE-2024-36349 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2024-36349.html CVE-2024-36349 https://bugzilla.suse.com/1238896 SUSE Bug 1238896 A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. CVE-2024-36350 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2024-36350.html CVE-2024-36350 https://bugzilla.suse.com/1238896 SUSE Bug 1238896 A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries. CVE-2024-36357 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2024-36357.html CVE-2024-36357 https://bugzilla.suse.com/1238896 SUSE Bug 1238896 In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdrinc()") Another potential issue in ip6_finish_output2() is handled in a separate patch. [1] BUG: KASAN: slab-use-after-free in ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 Read of size 8 at addr ffff88806dde4858 by task syz.1.380/6530 CPU: 1 UID: 0 PID: 6530 Comm: syz.1.380 Not tainted 6.11.0-rc3-syzkaller-00306-gdf6cbc62cc9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 ip6_send_skb+0x18d/0x230 net/ipv6/ip6_output.c:1964 rawv6_push_pending_frames+0x75c/0x9e0 net/ipv6/raw.c:588 rawv6_sendmsg+0x19c7/0x23c0 net/ipv6/raw.c:926 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 sock_write_iter+0x2dd/0x400 net/socket.c:1160 do_iter_readv_writev+0x60a/0x890 vfs_writev+0x37c/0xbb0 fs/read_write.c:971 do_writev+0x1b1/0x350 fs/read_write.c:1018 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f936bf79e79 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f936cd7f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f936c115f80 RCX: 00007f936bf79e79 RDX: 0000000000000001 RSI: 0000000020000040 RDI: 0000000000000004 RBP: 00007f936bfe7916 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f936c115f80 R15: 00007fff2860a7a8 </TASK> Allocated by task 6530: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4044 dst_alloc+0x12b/0x190 net/core/dst.c:89 ip6_blackhole_route+0x59/0x340 net/ipv6/route.c:2670 make_blackhole net/xfrm/xfrm_policy.c:3120 [inline] xfrm_lookup_route+0xd1/0x1c0 net/xfrm/xfrm_policy.c:3313 ip6_dst_lookup_flow+0x13e/0x180 net/ipv6/ip6_output.c:1257 rawv6_sendmsg+0x1283/0x23c0 net/ipv6/raw.c:898 sock_sendmsg_nosec net/socket.c:730 [inline] __sock_sendmsg+0x1a6/0x270 net/socket.c:745 ____sys_sendmsg+0x525/0x7d0 net/socket.c:2597 ___sys_sendmsg net/socket.c:2651 [inline] __sys_sendmsg+0x2b0/0x3a0 net/socket.c:2680 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 45: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4548 dst_destroy+0x2ac/0x460 net/core/dst.c:124 rcu_do_batch kernel/rcu/tree.c:2569 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree. ---truncated--- CVE-2024-44987 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2024-44987.html CVE-2024-44987 https://bugzilla.suse.com/1230185 SUSE Bug 1230185 In the Linux kernel, the following vulnerability has been resolved: crypto: lzo - Fix compression buffer overrun Unlike the decompression code, the compression code in LZO never checked for output overruns. It instead assumes that the caller always provides enough buffer space, disregarding the buffer length provided by the caller. Add a safe compression interface that checks for the end of buffer before each write. Use the safe interface in crypto/lzo. CVE-2025-38068 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-38068.html CVE-2025-38068 https://bugzilla.suse.com/1245210 SUSE Bug 1245210 In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_pool_recycle_in_ring: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 Read of size 8 at addr ffff8880286045a0 by task syz.0.284/6943 CPU: 0 UID: 0 PID: 6943 Comm: syz.0.284 Not tainted 6.13.0-rc3-syzkaller-gdfa94ce54f41 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 lock_release+0x151/0xa30 kernel/locking/lockdep.c:5862 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:165 [inline] _raw_spin_unlock_bh+0x1b/0x40 kernel/locking/spinlock.c:210 spin_unlock_bh include/linux/spinlock.h:396 [inline] ptr_ring_produce_bh include/linux/ptr_ring.h:164 [inline] page_pool_recycle_in_ring net/core/page_pool.c:707 [inline] page_pool_put_unrefed_netmem+0x748/0xb00 net/core/page_pool.c:826 page_pool_put_netmem include/net/page_pool/helpers.h:323 [inline] page_pool_put_full_netmem include/net/page_pool/helpers.h:353 [inline] napi_pp_put_page+0x149/0x2b0 net/core/skbuff.c:1036 skb_pp_recycle net/core/skbuff.c:1047 [inline] skb_free_head net/core/skbuff.c:1094 [inline] skb_release_data+0x6c4/0x8a0 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x1c9/0x380 net/core/skbuff.c:1242 kfree_skb_reason include/linux/skbuff.h:1263 [inline] __skb_queue_purge_reason include/linux/skbuff.h:3343 [inline] root cause is: page_pool_recycle_in_ring ptr_ring_produce spin_lock(&r->producer_lock); WRITE_ONCE(r->queue[r->producer++], ptr) //recycle last page to pool page_pool_release page_pool_scrub page_pool_empty_ring ptr_ring_consume page_pool_return_page //release all page __page_pool_destroy free_percpu(pool->recycle_stats); free(pool) //free spin_unlock(&r->producer_lock); //pool->ring uaf read recycle_stat_inc(pool, ring); page_pool can be free while page pool recycle the last page in ring. Add producer-lock barrier to page_pool_release to prevent the page pool from being free before all pages have been recycled. recycle_stat_inc() is empty when CONFIG_PAGE_POOL_STATS is not enabled, which will trigger Wempty-body build warning. Add definition for pool stat macro to fix warning. CVE-2025-38129 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-38129.html CVE-2025-38129 https://bugzilla.suse.com/1245723 SUSE Bug 1245723 In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtw_fw_bt_wifi_control(rtwdev, para[0], &para[1])', which reads 5 bytes: void rtw_fw_bt_wifi_control(struct rtw_dev *rtwdev, u8 op_code, u8 *data) { ... SET_BT_WIFI_CONTROL_DATA1(h2c_pkt, *data); SET_BT_WIFI_CONTROL_DATA2(h2c_pkt, *(data + 1)); ... SET_BT_WIFI_CONTROL_DATA5(h2c_pkt, *(data + 4)); Detected using the static analysis tool - Svace. CVE-2025-38159 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-38159.html CVE-2025-38159 https://bugzilla.suse.com/1245751 SUSE Bug 1245751 https://bugzilla.suse.com/1257629 SUSE Bug 1257629 In the Linux kernel, the following vulnerability has been resolved: virtio-net: ensure the received length does not exceed allocated size In xdp_linearize_page, when reading the following buffers from the ring, we forget to check the received length with the true allocate size. This can lead to an out-of-bound read. This commit adds that missing check. CVE-2025-38375 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-38375.html CVE-2025-38375 https://bugzilla.suse.com/1247177 SUSE Bug 1247177 In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 T2 futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue() futex_proxy_trylock_atomic() futex_requeue_pi_prepare() requeue_pi_wake_futex() futex_requeue_pi_complete() /* preempt */ * timeout/ signal wakes T1 * futex_requeue_pi_wakeup_sync() // Q_REQUEUE_PI_LOCKED futex_hash_put() // back to userland, on stack futex_q is garbage /* back */ wake_up_state(q->task, TASK_NORMAL); In this scenario futex_wait_requeue_pi() is able to leave without using futex_q::lock_ptr for synchronization. This can be prevented by reading futex_q::task before updating the futex_q::requeue_state. A reference on the task_struct is not needed because requeue_pi_wake_futex() is invoked with a spinlock_t held which implies a RCU read section. Even if T1 terminates immediately after, the task_struct will remain valid during T2's wake_up_state(). A READ_ONCE on futex_q::task before futex_requeue_pi_complete() is enough because it ensures that the variable is read before the state is updated. Read futex_q::task before updating the requeue state, use it for the following wakeup. CVE-2025-39977 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-39977.html CVE-2025-39977 https://bugzilla.suse.com/1252046 SUSE Bug 1252046 https://bugzilla.suse.com/1252048 SUSE Bug 1252048 In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption. CVE-2025-40019 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40019.html CVE-2025-40019 https://bugzilla.suse.com/1252678 SUSE Bug 1252678 https://bugzilla.suse.com/1252719 SUSE Bug 1252719 In the Linux kernel, the following vulnerability has been resolved: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set(). smc_clc_prfx_set() is called during connect() and not under RCU nor RTNL. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dev_dst_rcu() under rcu_read_lock() after kernel_getsockname(). Note that the returned value of smc_clc_prfx_set() is not used in the caller. While at it, we change the 1st arg of smc_clc_prfx_set[46]_rcu() not to touch dst there. CVE-2025-40139 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40139.html CVE-2025-40139 https://bugzilla.suse.com/1253409 SUSE Bug 1253409 https://bugzilla.suse.com/1253411 SUSE Bug 1253411 In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (from the various lists and hashtables) as the last user state that needed that fallback is destroyed (not deleted). If a reference to that user state still exists, the fallback state will remain on the hashtables/lists, triggering the WARN in xfrm_state_fini. Because of those remaining references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state synchronously on net exit path") is not complete. We recently fixed one such situation in TCP due to defered freeing of skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we currently drop dst")). This can also happen due to IP reassembly: skbs with a secpath remain on the reassembly queue until netns destruction. If we can't guarantee that the queues are flushed by the time xfrm_state_fini runs, there may still be references to a (user) xfrm_state, preventing the timely deletion of the corresponding fallback state. Instead of chasing each instance of skbs holding a secpath one by one, this patch fixes the issue directly within xfrm, by deleting the fallback state as soon as the last user state depending on it has been deleted. Destruction will still happen when the final reference is dropped. A separate lockdep class for the fallback state is required since we're going to lock x->tunnel while x is locked. CVE-2025-40215 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40215.html CVE-2025-40215 https://bugzilla.suse.com/1254959 SUSE Bug 1254959 https://bugzilla.suse.com/1255054 SUSE Bug 1255054 In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when running generic/323 against a fuseblk server. This test opens a file, initiates a lot of AIO writes to that file descriptor, and closes the file descriptor before the writes complete. Unsurprisingly, the AIO exerciser threads are mostly stuck waiting for responses from the fuseblk server: # cat /proc/372265/task/372313/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_do_getattr+0xfc/0x1f0 [fuse] [<0>] fuse_file_read_iter+0xbe/0x1c0 [fuse] [<0>] aio_read+0x130/0x1e0 [<0>] io_submit_one+0x542/0x860 [<0>] __x64_sys_io_submit+0x98/0x1a0 [<0>] do_syscall_64+0x37/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 But the /weird/ part is that the fuseblk server threads are waiting for responses from itself: # cat /proc/372210/task/372232/stack [<0>] request_wait_answer+0x1fe/0x2a0 [fuse] [<0>] __fuse_simple_request+0xd3/0x2b0 [fuse] [<0>] fuse_file_put+0x9a/0xd0 [fuse] [<0>] fuse_release+0x36/0x50 [fuse] [<0>] __fput+0xec/0x2b0 [<0>] task_work_run+0x55/0x90 [<0>] syscall_exit_to_user_mode+0xe9/0x100 [<0>] do_syscall_64+0x43/0xf0 [<0>] entry_SYSCALL_64_after_hwframe+0x4b/0x53 The fuseblk server is fuse2fs so there's nothing all that exciting in the server itself. So why is the fuse server calling fuse_file_put? The commit message for the fstest sheds some light on that: "By closing the file descriptor before calling io_destroy, you pretty much guarantee that the last put on the ioctx will be done in interrupt context (during I/O completion). Aha. AIO fgets a new struct file from the fd when it queues the ioctx. The completion of the FUSE_WRITE command from userspace causes the fuse server to call the AIO completion function. The completion puts the struct file, queuing a delayed fput to the fuse server task. When the fuse server task returns to userspace, it has to run the delayed fput, which in the case of a fuseblk server, it does synchronously. Sending the FUSE_RELEASE command sychronously from fuse server threads is a bad idea because a client program can initiate enough simultaneous AIOs such that all the fuse server threads end up in delayed_fput, and now there aren't any threads left to handle the queued fuse commands. Fix this by only using asynchronous fputs when closing files, and leave a comment explaining why. CVE-2025-40220 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40220.html CVE-2025-40220 https://bugzilla.suse.com/1254520 SUSE Bug 1254520 In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent flags. This triggers a BUG_ON in ocfs2_refcount_cal_cow_clusters(). The problem occurs when: 1. copy_file_range() creates a reflinked extent with OCFS2_EXT_REFCOUNTED 2. ioctl(FITRIM) triggers ocfs2_move_extents() 3. __ocfs2_move_extents_range() reads and caches the extent (flags=0x2) 4. ocfs2_move_extent()/ocfs2_defrag_extent() calls __ocfs2_move_extent() which clears OCFS2_EXT_REFCOUNTED flag on disk (flags=0x0) 5. The extent map cache is not invalidated after the move 6. Later write() operations read stale cached flags (0x2) but disk has updated flags (0x0), causing a mismatch 7. BUG_ON(!(rec->e_flags & OCFS2_EXT_REFCOUNTED)) triggers Fix by clearing the extent map cache after each extent move/defrag operation in __ocfs2_move_extents_range(). This ensures subsequent operations read fresh extent data from disk. CVE-2025-40233 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40233.html CVE-2025-40233 https://bugzilla.suse.com/1254813 SUSE Bug 1254813 In the Linux kernel, the following vulnerability has been resolved: xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added In commit b441cf3f8c4b ("xfrm: delete x->tunnel as we delete x"), I missed the case where state creation fails between full initialization (->init_state has been called) and being inserted on the lists. In this situation, ->init_state has been called, so for IPcomp tunnels, the fallback tunnel has been created and added onto the lists, but the user state never gets added, because we fail before that. The user state doesn't go through __xfrm_state_delete, so we don't call xfrm_state_delete_tunnel for those states, and we end up leaking the FB tunnel. There are several codepaths affected by this: the add/update paths, in both net/key and xfrm, and the migrate code (xfrm_migrate, xfrm_state_migrate). A "proper" rollback of the init_state work would probably be doable in the add/update code, but for migrate it gets more complicated as multiple states may be involved. At some point, the new (not-inserted) state will be destroyed, so call xfrm_state_delete_tunnel during xfrm_state_gc_destroy. Most states will have their fallback tunnel cleaned up during __xfrm_state_delete, which solves the issue that b441cf3f8c4b (and other patches before it) aimed at. All states (including FB tunnels) will be removed from the lists once xfrm_state_fini has called flush_work(&xfrm_state_gc_work). CVE-2025-40256 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40256.html CVE-2025-40256 https://bugzilla.suse.com/1254851 SUSE Bug 1254851 In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer) while another might have free entry already, as reported by syzbot. Add RCU protection to fix this issue. Also change confusing add_timer variable with stop_timer boolean. syzbot report: BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44 CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Workqueue: events mptcp_worker Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616 sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631 mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362 mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174 tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361 tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441 tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931 tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374 ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318 __netif_receive_skb_one_core net/core/dev.c:6079 [inline] __netif_receive_skb+0x143/0x380 net/core/dev.c:6192 process_backlog+0x31e/0x900 net/core/dev.c:6544 __napi_poll+0xb6/0x540 net/core/dev.c:7594 napi_poll net/core/dev.c:7657 [inline] net_rx_action+0x5f7/0xda0 net/core/dev.c:7784 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] __local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302 mptcp_pm_send_ack net/mptcp/pm.c:210 [inline] mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1 mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 44: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748 kmalloc_noprof include/linux/slab.h:957 [inline] mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385 mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355 mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline] __mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529 mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008 mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 6630: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 __kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587 kasan_save_free_info mm/kasan/kasan.h:406 [inline] poison_slab_object m ---truncated--- CVE-2025-40257 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40257.html CVE-2025-40257 https://bugzilla.suse.com/1254842 SUSE Bug 1254842 https://bugzilla.suse.com/1257242 SUSE Bug 1257242 In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptcp_schedule_work() [1] Issue here is that mptcp_schedule_work() schedules a work, then gets a refcount on sk->sk_refcnt if the work was scheduled. This refcount will be released by mptcp_worker(). [A] if (schedule_work(...)) { [B] sock_hold(sk); return true; } Problem is that mptcp_worker() can run immediately and complete before [B] We need instead : sock_hold(sk); if (schedule_work(...)) return true; sock_put(sk); [1] refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] sock_hold include/net/sock.h:816 [inline] mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943 mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316 call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747 expire_timers kernel/time/timer.c:1798 [inline] __run_timers kernel/time/timer.c:2372 [inline] __run_timer_base+0x648/0x970 kernel/time/timer.c:2384 run_timer_base kernel/time/timer.c:2393 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403 handle_softirqs+0x22f/0x710 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] run_ktimerd+0xcf/0x190 kernel/softirq.c:1138 smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 CVE-2025-40258 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40258.html CVE-2025-40258 https://bugzilla.suse.com/1254843 SUSE Bug 1254843 https://bugzilla.suse.com/1255053 SUSE Bug 1255053 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE This data originates from userspace and is used in buffer offset calculations which could potentially overflow causing an out-of-bounds access. CVE-2025-40277 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40277.html CVE-2025-40277 https://bugzilla.suse.com/1254894 SUSE Bug 1254894 In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_mon_reinit_self(). syzbot reported use-after-free of tipc_net(net)->monitors[] in tipc_mon_reinit_self(). [0] The array is protected by RTNL, but tipc_mon_reinit_self() iterates over it without RTNL. tipc_mon_reinit_self() is called from tipc_net_finalize(), which is always under RTNL except for tipc_net_finalize_work(). Let's hold RTNL in tipc_net_finalize_work(). [0]: BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989 CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Workqueue: events tipc_net_finalize_work Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568 kasan_check_byte include/linux/kasan.h:399 [inline] lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162 rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline] rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline] rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244 rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243 write_lock_bh include/linux/rwlock_rt.h:99 [inline] tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718 tipc_net_finalize+0x115/0x190 net/tipc/net.c:140 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 6089: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:388 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405 kasan_kmalloc include/linux/kasan.h:260 [inline] __kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657 tipc_enable_bearer net/tipc/bearer.c:357 [inline] __tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047 __tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline] tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393 tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline] tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321 genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115 genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x508/0x820 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/ ---truncated--- CVE-2025-40280 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40280.html CVE-2025-40280 https://bugzilla.suse.com/1254847 SUSE Bug 1254847 https://bugzilla.suse.com/1254951 SUSE Bug 1254951 In the Linux kernel, the following vulnerability has been resolved: x86/vmscape: Add conditional IBPB mitigation VMSCAPE is a vulnerability that exploits insufficient branch predictor isolation between a guest and a userspace hypervisor (like QEMU). Existing mitigations already protect kernel/KVM from a malicious guest. Userspace can additionally be protected by flushing the branch predictors after a VMexit. Since it is the userspace that consumes the poisoned branch predictors, conditionally issue an IBPB after a VMexit and before returning to userspace. Workloads that frequently switch between hypervisor and userspace will incur the most overhead from the new IBPB. This new IBPB is not integrated with the existing IBPB sites. For instance, a task can use the existing speculation control prctl() to get an IBPB at context switch time. With this implementation, the IBPB is doubled up: one at context switch and another before running userspace. The intent is to integrate and optimize these cases post-embargo. [ dhansen: elaborate on suboptimal IBPB solution ] CVE-2025-40300 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40300.html CVE-2025-40300 https://bugzilla.suse.com/1249561 SUSE Bug 1249561 In the Linux kernel, the following vulnerability has been resolved: sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock, sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump() make sure not to exceed bounds in case the address list has grown between buffer allocation (time-of-check) and write (time-of-use). CVE-2025-40331 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-40331.html CVE-2025-40331 https://bugzilla.suse.com/1254615 SUSE Bug 1254615 In the Linux kernel, the following vulnerability has been resolved: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr Currently when both IMA and EVM are in fix mode, the IMA signature will be reset to IMA hash if a program first stores IMA signature in security.ima and then writes/removes some other security xattr for the file. For example, on Fedora, after booting the kernel with "ima_appraise=fix evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, installing/reinstalling a package will not make good reference IMA signature generated. Instead IMA hash is generated, # getfattr -m - -d -e hex /usr/bin/bash # file: usr/bin/bash security.ima=0x0404... This happens because when setting security.selinux, the IMA_DIGSIG flag that had been set early was cleared. As a result, IMA hash is generated when the file is closed. Similarly, IMA signature can be cleared on file close after removing security xattr like security.evm or setting/removing ACL. Prevent replacing the IMA file signature with a file hash, by preventing the IMA_DIGSIG flag from being reset. Here's a minimal C reproducer which sets security.selinux as the last step which can also replaced by removing security.evm or setting ACL, #include <stdio.h> #include <sys/xattr.h> #include <fcntl.h> #include <unistd.h> #include <string.h> #include <stdlib.h> int main() { const char* file_path = "/usr/sbin/test_binary"; const char* hex_string = "030204d33204490066306402304"; int length = strlen(hex_string); char* ima_attr_value; int fd; fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); if (fd == -1) { perror("Error opening file"); return 1; } ima_attr_value = (char*)malloc(length / 2 ); for (int i = 0, j = 0; i < length; i += 2, j++) { sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); } if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } const char* selinux_value= "system_u:object_r:bin_t:s0"; if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { perror("Error setting extended attribute"); close(fd); return 1; } close(fd); return 0; } CVE-2025-68183 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-68183.html CVE-2025-68183 https://bugzilla.suse.com/1255251 SUSE Bug 1255251 In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds writes in handle_auth_session_key() The len field originates from untrusted network packets. Boundary checks have been added to prevent potential out-of-bounds writes when decrypting the connection secret or processing service tickets. [ idryomov: changelog ] CVE-2025-68284 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-68284.html CVE-2025-68284 https://bugzilla.suse.com/1255377 SUSE Bug 1255377 https://bugzilla.suse.com/1255378 SUSE Bug 1255378 In the Linux kernel, the following vulnerability has been resolved: libceph: fix potential use-after-free in have_mon_and_osd_map() The wait loop in __ceph_open_session() can race with the client receiving a new monmap or osdmap shortly after the initial map is received. Both ceph_monc_handle_map() and handle_one_map() install a new map immediately after freeing the old one kfree(monc->monmap); monc->monmap = monmap; ceph_osdmap_destroy(osdc->osdmap); osdc->osdmap = newmap; under client->monc.mutex and client->osdc.lock respectively, but because neither is taken in have_mon_and_osd_map() it's possible for client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in client->monc.monmap && client->monc.monmap->epoch && client->osdc.osdmap && client->osdc.osdmap->epoch; condition to dereference an already freed map. This happens to be reproducible with generic/395 and generic/397 with KASAN enabled: BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70 Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305 CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266 ... Call Trace: <TASK> have_mon_and_osd_map+0x56/0x70 ceph_open_session+0x182/0x290 ceph_get_tree+0x333/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Allocated by task 13305: ceph_osdmap_alloc+0x16/0x130 ceph_osdc_init+0x27a/0x4c0 ceph_create_client+0x153/0x190 create_fs_client+0x50/0x2a0 ceph_get_tree+0xff/0x680 vfs_get_tree+0x49/0x180 do_new_mount+0x1a3/0x2d0 path_mount+0x6dd/0x730 do_mount+0x99/0xe0 __do_sys_mount+0x141/0x180 do_syscall_64+0x9f/0x100 entry_SYSCALL_64_after_hwframe+0x76/0x7e Freed by task 9475: kfree+0x212/0x290 handle_one_map+0x23c/0x3b0 ceph_osdc_handle_map+0x3c9/0x590 mon_dispatch+0x655/0x6f0 ceph_con_process_message+0xc3/0xe0 ceph_con_v1_try_read+0x614/0x760 ceph_con_workfn+0x2de/0x650 process_one_work+0x486/0x7c0 process_scheduled_works+0x73/0x90 worker_thread+0x1c8/0x2a0 kthread+0x2ec/0x300 ret_from_fork+0x24/0x40 ret_from_fork_asm+0x1a/0x30 Rewrite the wait loop to check the above condition directly with client->monc.mutex and client->osdc.lock taken as appropriate. While at it, improve the timeout handling (previously mount_timeout could be exceeded in case wait_event_interruptible_timeout() slept more than once) and access client->auth_err under client->monc.mutex to match how it's set in finish_auth(). monmap_show() and osdmap_show() now take the respective lock before accessing the map as well. CVE-2025-68285 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-68285.html CVE-2025-68285 https://bugzilla.suse.com/1255401 SUSE Bug 1255401 https://bugzilla.suse.com/1255402 SUSE Bug 1255402 In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix race in syncpt alloc/free Fix race condition between host1x_syncpt_alloc() and host1x_syncpt_put() by using kref_put_mutex() instead of kref_put() + manual mutex locking. This ensures no thread can acquire the syncpt_mutex after the refcount drops to zero but before syncpt_release acquires it. This prevents races where syncpoints could be allocated while still being cleaned up from a previous release. Remove explicit mutex locking in syncpt_release as kref_put_mutex() handles this atomically. CVE-2025-68732 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-68732.html CVE-2025-68732 https://bugzilla.suse.com/1255688 SUSE Bug 1255688 https://bugzilla.suse.com/1255689 SUSE Bug 1255689 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix kernel BUG in ocfs2_find_victim_chain syzbot reported a kernel BUG in ocfs2_find_victim_chain() because the `cl_next_free_rec` field of the allocation chain list (next free slot in the chain list) is 0, triggring the BUG_ON(!cl->cl_next_free_rec) condition in ocfs2_find_victim_chain() and panicking the kernel. To fix this, an if condition is introduced in ocfs2_claim_suballoc_bits(), just before calling ocfs2_find_victim_chain(), the code block in it being executed when either of the following conditions is true: 1. `cl_next_free_rec` is equal to 0, indicating that there are no free chains in the allocation chain list 2. `cl_next_free_rec` is greater than `cl_count` (the total number of chains in the allocation chain list) Either of them being true is indicative of the fact that there are no chains left for usage. This is addressed using ocfs2_error(), which prints the error log for debugging purposes, rather than panicking the kernel. CVE-2025-68771 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-68771.html CVE-2025-68771 https://bugzilla.suse.com/1256582 SUSE Bug 1256582 In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in __ip_vs_get_out_rt() calls dst_link_failure() without ensuring skb->dev is set, leading to a NULL pointer dereference in fib_compute_spec_dst() when ipv4_link_failure() attempts to send ICMP destination unreachable messages. The issue emerged after commit ed0de45a1008 ("ipv4: recompile ip options in ipv4_link_failure") started calling __ip_options_compile() from ipv4_link_failure(). This code path eventually calls fib_compute_spec_dst() which dereferences skb->dev. An attempt was made to fix the NULL skb->dev dereference in commit 0113d9c9d1cc ("ipv4: fix null-deref in ipv4_link_failure"), but it only addressed the immediate dev_net(skb->dev) dereference by using a fallback device. The fix was incomplete because fib_compute_spec_dst() later in the call chain still accesses skb->dev directly, which remains NULL when IPVS calls dst_link_failure(). The crash occurs when: 1. IPVS processes a packet in NAT mode with a misconfigured destination 2. Route lookup fails in __ip_vs_get_out_rt() before establishing a route 3. The error path calls dst_link_failure(skb) with skb->dev == NULL 4. ipv4_link_failure() -> ipv4_send_dest_unreach() -> __ip_options_compile() -> fib_compute_spec_dst() 5. fib_compute_spec_dst() dereferences NULL skb->dev Apply the same fix used for IPv6 in commit 326bf17ea5d4 ("ipvs: fix ipv6 route unreach panic"): set skb->dev from skb_dst(skb)->dev before calling dst_link_failure(). KASAN: null-ptr-deref in range [0x0000000000000328-0x000000000000032f] CPU: 1 PID: 12732 Comm: syz.1.3469 Not tainted 6.6.114 #2 RIP: 0010:__in_dev_get_rcu include/linux/inetdevice.h:233 RIP: 0010:fib_compute_spec_dst+0x17a/0x9f0 net/ipv4/fib_frontend.c:285 Call Trace: <TASK> spec_dst_fill net/ipv4/ip_options.c:232 spec_dst_fill net/ipv4/ip_options.c:229 __ip_options_compile+0x13a1/0x17d0 net/ipv4/ip_options.c:330 ipv4_send_dest_unreach net/ipv4/route.c:1252 ipv4_link_failure+0x702/0xb80 net/ipv4/route.c:1265 dst_link_failure include/net/dst.h:437 __ip_vs_get_out_rt+0x15fd/0x19e0 net/netfilter/ipvs/ip_vs_xmit.c:412 ip_vs_nat_xmit+0x1d8/0xc80 net/netfilter/ipvs/ip_vs_xmit.c:764 CVE-2025-68813 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-68813.html CVE-2025-68813 https://bugzilla.suse.com/1256641 SUSE Bug 1256641 https://bugzilla.suse.com/1256644 SUSE Bug 1256644 In the Linux kernel, the following vulnerability has been resolved: iommu: disable SVA when CONFIG_X86 is set Patch series "Fix stale IOTLB entries for kernel address space", v7. This proposes a fix for a security vulnerability related to IOMMU Shared Virtual Addressing (SVA). In an SVA context, an IOMMU can cache kernel page table entries. When a kernel page table page is freed and reallocated for another purpose, the IOMMU might still hold stale, incorrect entries. This can be exploited to cause a use-after-free or write-after-free condition, potentially leading to privilege escalation or data corruption. This solution introduces a deferred freeing mechanism for kernel page table pages, which provides a safe window to notify the IOMMU to invalidate its caches before the page is reused. This patch (of 8): In the IOMMU Shared Virtual Addressing (SVA) context, the IOMMU hardware shares and walks the CPU's page tables. The x86 architecture maps the kernel's virtual address space into the upper portion of every process's page table. Consequently, in an SVA context, the IOMMU hardware can walk and cache kernel page table entries. The Linux kernel currently lacks a notification mechanism for kernel page table changes, specifically when page table pages are freed and reused. The IOMMU driver is only notified of changes to user virtual address mappings. This can cause the IOMMU's internal caches to retain stale entries for kernel VA. Use-After-Free (UAF) and Write-After-Free (WAF) conditions arise when kernel page table pages are freed and later reallocated. The IOMMU could misinterpret the new data as valid page table entries. The IOMMU might then walk into attacker-controlled memory, leading to arbitrary physical memory DMA access or privilege escalation. This is also a Write-After-Free issue, as the IOMMU will potentially continue to write Accessed and Dirty bits to the freed memory while attempting to walk the stale page tables. Currently, SVA contexts are unprivileged and cannot access kernel mappings. However, the IOMMU will still walk kernel-only page tables all the way down to the leaf entries, where it realizes the mapping is for the kernel and errors out. This means the IOMMU still caches these intermediate page table entries, making the described vulnerability a real concern. Disable SVA on x86 architecture until the IOMMU can receive notification to flush the paging cache before freeing the CPU kernel page table pages. CVE-2025-71089 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-71089.html CVE-2025-71089 https://bugzilla.suse.com/1256612 SUSE Bug 1256612 https://bugzilla.suse.com/1256615 SUSE Bug 1256615 In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (maliciously) corrupted such that the encoded length of ceph_pg_pool envelope is less than what is expected for a particular encoding version, out-of-bounds reads may ensue because the only bounds check that is there is based on that length value. This patch adds explicit bounds checks for each field that is decoded or skipped. CVE-2025-71116 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-71116.html CVE-2025-71116 https://bugzilla.suse.com/1256744 SUSE Bug 1256744 In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A zero length gss_token results in pages == 0 and in_token->pages[0] is NULL. The code unconditionally evaluates page_address(in_token->pages[0]) for the initial memcpy, which can dereference NULL even when the copy length is 0. Guard the first memcpy so it only runs when length > 0. CVE-2025-71120 SUSE Linux Enterprise Micro 5.3:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.3:kernel-source-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-rt-5.14.21-150400.15.142.1 SUSE Linux Enterprise Micro 5.4:kernel-source-rt-5.14.21-150400.15.142.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2026/suse-su-20260411-1/ https://www.suse.com/security/cve/CVE-2025-71120.html CVE-2025-71120 https://bugzilla.suse.com/1256779 SUSE Bug 1256779 https://bugzilla.suse.com/1256780 SUSE Bug 1256780