SUSE CVE-2022-49258

In the Linux kernel, the following vulnerability has been resolved: crypto: ccree - Fix use after free in cccipherexit kfreesensitivectxp-user.key will free the ctxp-user.key. But ctxp-user.key is still used in the next line, which will lead to a use after free. We can call kfreesensitive after...

SUSE CVE-2022-49330

In the Linux kernel, the following vulnerability has been resolved: tcp: fix tcpmtupprobesuccess vs wrong sndcwnd syzbot got a new report 1 finally pointing to a very old bug, added in initial support for MTU probing. tcpmtuprobe has checks about starting an MTU probe if tcpsndcwndtp = 11. But...

SUSE CVE-2022-49410

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix potential double free in createvarref In createvarref, initvarref is called to initialize the fields of variable reffield, which is allocated in the previous function call to createhistfield. Function initvarref...

SUSE CVE-2022-49477

In the Linux kernel, the following vulnerability has been resolved: ASoC: samsung: Fix refcount leak in ariesaudioprobe ofparsephandle returns a node pointer with refcount incremented, we should use ofnodeput on it when done. If extconfindedevbynode fails, it doesn't call ofnodeput Calling...

SUSE CVE-2022-49577

In the Linux kernel, the following vulnerability has been resolved: udp: Fix a data-race around sysctludpl3mdevaccept. While reading sysctludpl3mdevaccept, it can be changed concurrently. Thus, we need to add READONCE to its reader...

SUSE CVE-2022-49624

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: remove aqnicdeinit when resume aqnicdeinit has been called while suspending, so we don't have to call it again on resume. Actually, call it again leads to another hang issue when resuming from S3. Jul 8 03:09:44...

SUSE CVE-2022-49629

In the Linux kernel, the following vulnerability has been resolved: nexthop: Fix data-races around nexthopcompatmode. While reading nexthopcompatmode, it can be changed concurrently. Thus, we need to add READONCE to its readers...

CVE-2025-21792 ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt

In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount leak caused by setting SOBINDTODEVICE sockopt If an AX25 device is bound to a socket by setting the SOBINDTODEVICE socket option, a refcount leak will occur in ax25release. Commit 9fd75b66b8f6 "ax25: Fix refcou...

CVE-2025-21791 vrf: use RCU protection in l3mdev_l3_out()

In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdevl3out l3mdevl3out can be called without RCU being held: rawsendmsg ippushpendingframes ipsendskb iplocalout iplocalout l3mdevipout Add rcureadlock / rcureadunlock pair to avoid a potential UAF...

CVE-2025-21787

CVE-2025-21787 affects the Linux kernel's team subsystem due to insufficient validation of TEAM_OPTION_TYPE_STRING in the net/TEAM code paths. The root cause is validated data handling in team_mode_get/ team_mode_option_set/ team_option_set, with inline occurrences in team_core.c:480, 607, 1401 a...

CVE-2025-21782 orangefs: fix a oob in orangefs_debug_write

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix a oob in orangefsdebugwrite I got a syzbot report: slab-out-of-bounds Read in orangefsdebugwrite... several people suggested fixes, I tested Al Viro's suggestion and made this patch...

CVE-2025-21781 batman-adv: fix panic during interface removal

In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix panic during interface removal Reference counting is used to ensure that batadvhardifneighnode and batadvhardiface are not freed before/during batadvvelpthroughputmetricupdate work is finished. But there isn't a...

CVE-2025-21783 gpiolib: Fix crash on error in gpiochip_get_ngpios()

In the Linux kernel, the following vulnerability has been resolved: gpiolib: Fix crash on error in gpiochipgetngpios The gpiochipgetngpios uses chip macros to print messages. However these macros rely on gpiodev to be initialised and set, which is not the case when called via bgpioinit. In such a...

CVE-2025-21782

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix a oob in orangefsdebugwrite I got a syzbot report: slab-out-of-bounds Read in orangefsdebugwrite... several people suggested fixes, I tested Al Viro's suggestion and made this patch...

CVE-2025-21780 drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smusyssetpptable It malicious user provides a small pptable through sysfs and then a bigger pptable, it may cause buffer overflow attack in function smusyssetpptable...

CVE-2025-21778

CVE-2025-21778 (Linux kernel) involves a crash when mmap() is used on a persistent tracing ring buffer that is attached to reserve_mem. The root cause is that the code maps ring buffer pages using virt_to_page() on memory that is vmap()’d, which is invalid for that memory type and can trigger a p...

CVE-2025-21777 ring-buffer: Validate the persistent meta data subbuf array

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Validate the persistent meta data subbuf array The meta data for a mapped ring buffer contains an array of indexes of all the subbuffers. The first entry is the reader page, and the rest of the entries lay out the...

CVE-2025-21774

CVE-2025-21774 affects the Linux kernel in the Rockchip RKCANFD code path. The issue is addressed by fixing can: rkcanfd_handle_rx_fifo_overflow_int() to bail out when skb allocation fails, via a NULL pointer check. The vulnerability vulnerable path leads to a potential failure to handle RX FIFO ...

CVE-2025-21774 can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated

In the Linux kernel, the following vulnerability has been resolved: can: rockchip: rkcanfdhandlerxfifooverflowint: bail out if skb cannot be allocated Fix NULL pointer check in rkcanfdhandlerxfifooverflowint to bail out if skb cannot be allocated...

CVE-2025-21771 sched_ext: Fix incorrect autogroup migration detection

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix incorrect autogroup migration detection scxmovetask is called from schedmovetask and tells the BPF scheduler that cgroup migration is being committed. schedmovetask is used by both cgroup and autogroup migrations an...