CVE-2022-50379 btrfs: fix race between quota enable and quota rescan ioctl

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota enable and quota rescan ioctl When enabling quotas, at btrfsquotaenable, after committing the transaction, we change fsinfo-quotaroot to point to the quota root we created and set BTRFSFSQUOTAENABLED...

SUSE CVE-2022-50364

In the Linux kernel, the following vulnerability has been resolved: i2c: mux: reg: check return value after calling platformgetresource It will cause null-ptr-deref in resourcesize, if platformgetresource returns NULL, move calling resourcesize after devmioremapresource that will check 'res' to...

SUSE CVE-2022-50370

In the Linux kernel, the following vulnerability has been resolved: i2c: designware: Fix handling of real but unexpected device interrupts Commit c7b79a752871 "mfd: intel-lpss: Add Intel Alder Lake PCH-S PCI IDs" caused a regression on certain Gigabyte motherboards for Intel Alder Lake-S where...

SUSE CVE-2023-53362

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: don't assume child devices are all fsl-mc devices Changes in VFIO caused a pseudo-device to be created as child of fsl-mc devices causing a crash 1 when trying to bind a fsl-mc device to VFIO. Fix this by checking th...

CVE-2023-53363

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free in pcibusreleasedomainnr Commit c14f7ccc9f5d "PCI: Assign PCI domain IDs by idaalloc" introduced a use-after-free bug in the bus removal cleanup. The issue was found with kfence: 19.293351 BUG: KFENCE:...

CVE-2023-53345

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential data race in rxrpcwaittobeconnected Inside the loop in rxrpcwaittobeconnected it checks call-error to see if it should exit the loop without first checking the call state. This is probably safe as if call-err...

DEBIAN-CVE-2023-53345

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix potential data race in rxrpcwaittobeconnected Inside the loop in rxrpcwaittobeconnected it checks call-error to see if it should exit the loop without first checking the call state. This is probably safe as if call-err...

DEBIAN-CVE-2022-50374

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcildisc,serdev: check percpuinitrwsem failure syzbot is reporting NULL pointer dereference at hciuartttyclose 1, for rcusyncenter is called without rcusyncinit due to hciuartttyopen ignoring percpuinitrwsem failure...

CVE-2023-53367 accel/habanalabs: fix mem leak in capture user mappings

In the Linux kernel, the following vulnerability has been resolved: accel/habanalabs: fix mem leak in capture user mappings This commit fixes a memory leak caused when clearing the usermappings info when a new context is opened immediately after usermapping is captured and a hard reset is perform...

CVE-2023-53360 NFSv4.2: Rework scratch handling for READ_PLUS (again)

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: Rework scratch handling for READPLUS again I found that the read code might send multiple requests using the same nfspgioheader, but nfs4procreadsetup is only called once. This is how we ended up occasionally...

CVE-2023-53353 accel/habanalabs: postpone mem_mgr IDR destruction to hpriv_release()

In the Linux kernel, the following vulnerability has been resolved: accel/habanalabs: postpone memmgr IDR destruction to hprivrelease The memory manager IDR is currently destroyed when user releases the file descriptor. However, at this point the user context might be still held, and memory buffe...

CVE-2023-53350 accel/qaic: Fix slicing memory leak

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Fix slicing memory leak The temporary buffer storing slicing configuration data from user is only freed on error. This is a memory leak. Free the buffer unconditionally...

CVE-2023-53342 net: marvell: prestera: fix handling IPv4 routes with nhid

In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix handling IPv4 routes with nhid Fix handling IPv4 routes referencing a nexthop via its id by replacing calls to fibinfonh with fibinfonhc. Trying to add an IPv4 route referencing a nextop via nhid: $ ip...

CVE-2023-53342 net: marvell: prestera: fix handling IPv4 routes with nhid

In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: fix handling IPv4 routes with nhid Fix handling IPv4 routes referencing a nexthop via its id by replacing calls to fibinfonh with fibinfonhc. Trying to add an IPv4 route referencing a nextop via nhid: $ ip...

CVE-2023-53338 lwt: Fix return values of BPF xmit ops

In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NETRXDROP, NETXMITCN, NETDEVTXBUSY, and so on, from function skbdoredirect and bpflwtxmitreroute. At the xmit hook, suc...

SUSE CVE-2022-50288

In the Linux kernel, the following vulnerability has been resolved: qlcnic: prevent -dcb use-after-free on qlcnicdcbenable failure adapter-dcb would get silently freed inside qlcnicdcbenable in case qlcnicdcbattach would return an error, which always happens under OOM conditions. This would lead ...

SUSE CVE-2022-50342

In the Linux kernel, the following vulnerability has been resolved: floppy: Fix memory leak in dofloppyinit A memory leak was reported when floppyallocdisk failed in dofloppyinit. unreferenced object 0xffff888115ed25a0 size 8: comm "modprobe", pid 727, jiffies 4295051278 age 25.529s hex dump firs...

SUSE CVE-2023-53194

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add length check in indxgetroot This adds a length check to guarantee the retrieved index root is legit. 162.459513 BUG: KASAN: use-after-free in hdrfinde.isra.0+0x10c/0x320 162.460176 Read of size 2 at addr...

SUSE CVE-2023-53265

In the Linux kernel, the following vulnerability has been resolved: ubi: ensure that VID header offset + VID header size dumpstack lib/dumpstack.c:88 inline dumpstacklvl+0x85/0xad lib/dumpstack.c:106 printaddressdescription mm/kasan/report.c:317 inline printreport.cold.13+0xb6/0x6bb...

SUSE CVE-2023-53325

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: Change logging to dev for mtkdpauxtransfer Change logging from drmerr,info to deverr,info in functions mtkdpauxtransfer and mtkdpauxdotransfer: this will be essential to avoid getting NULL pointer kernel panics ...