suse/kernel-default&distro=SUSE Linux Enterprise High Availability Extension 15 SP6

Vulnerabilities (4,170)

• CVE-2024-49902MedOct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: jfs: check if leafidx greater than num leaves per dmap tree syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.

• CVE-2024-49900HigOct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of new_ea in ea_buffer syzbot reports that lzo1x_1_do_compress is using uninit-value: ===================================================== BUG: KMSAN: uninit-value in lzo1x_1_do_c

• CVE-2024-49894HigOct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation Fixes index out of bounds issue in `cm_helper_translate_curve_to_degamma_hw_format` function. The issue could occur when the index

• CVE-2024-49892MedOct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize get_bytes_per_element's default to 1 Variables, used as denominators and maybe not assigned to other values, should not be 0. bytes_per_element_y & bytes_per_element_c are initialize

• CVE-2024-49890MedOct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: ensure the fw_info is not null before using it This resolves the dereference null return value warning reported by Coverity.

• CVE-2024-49884HigOct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix slab-use-after-free in ext4_split_extent_at() We hit the following use-after-free: ================================================================== BUG: KASAN: slab-use-after-free in ext4_split_ext

• CVE-2024-49883HigOct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin mentioned in Link, in ext4_ext_insert_extent(), if the path is reallocated in ext4_ext_create_new_leaf(), we'll use the stale path and cause UAF

• CVE-2024-49882HigOct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_merge_up(), set path[1].p_bh to NULL after it has been released, otherwise it may be released twice. An example of what triggers this

• CVE-2024-50002Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: static_call: Handle module init failure correctly in static_call_del_module() Module insertion invokes static_call_add_module() to initialize the static calls in a module. static_call_add_module() invokes __sta

• CVE-2024-50000Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() In mlx5e_tir_builder_alloc() kvzalloc() may return NULL which is dereferenced on the next line in a reference to the modify field. Found by Linux Verifica

• CVE-2024-49998Oct 21, 2024
  affected < 6.4.0-150600.23.38.1fixed 6.4.0-150600.23.38.1

  In the Linux kernel, the following vulnerability has been resolved: net: dsa: improve shutdown sequence Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens to reproduce there. The first problem i

• CVE-2024-49994Oct 21, 2024
  affected < 6.4.0-150600.23.47.2fixed 6.4.0-150600.23.47.2

  In the Linux kernel, the following vulnerability has been resolved: block: fix integer overflow in BLKSECDISCARD I independently rediscovered commit 22d24a544b0d49bbcbd61c8c0eaf77d3c9297155 block: fix overflow in blk_ioctl_discard() but for secure erase. Same problem: ui

• CVE-2024-49987Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix undefined behavior in qsort(NULL, 0, ...) When netfilter has no entry to display, qsort is called with qsort(NULL, 0, ...). This results in undefined behavior, as UBSan reports: net.c:827:2: runti

• CVE-2024-49985Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume In case there is any sort of clock controller attached to this I2C bus controller, for example Versaclock or even an AIC32x4 I2C codec,

• CVE-2024-49983Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free When calling ext4_force_split_extent_at() in ext4_ext_replay_update_ex(), the 'ppath' is updated but it is the 'path' that is freed, thus p

• CVE-2024-49982Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 ("aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts") makes tx() calling dev_put() instead of d

• CVE-2024-49981Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free bug in venus_remove due to race condition in venus_probe, core->work is bound with venus_sys_error_handler, which is used to handle error. The code use core->sys_err_done to mak

• CVE-2024-49978Oct 21, 2024
  affected < 6.4.0-150600.23.38.1fixed 6.4.0-150600.23.38.1

  In the Linux kernel, the following vulnerability has been resolved: gso: fix udp gso fraglist segmentation after pull from frag_list Detect gso fraglist skbs with corrupted geometry (see below) and pass these to skb_segment instead of skb_segment_list, as the first can segment

• CVE-2024-49976Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: tracing/timerlat: Drop interface_lock in stop_kthread() stop_kthread() is the offline callback for "trace/osnoise:online", since commit 5bfbcd1ee57b ("tracing/timerlat: Add interface_lock around clearing of kth

• CVE-2024-49975Oct 21, 2024
  affected < 6.4.0-150600.23.30.1fixed 6.4.0-150600.23.30.1

  In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninitialized page allocated by __create_xol_area() into userspace. On some architectures (x86) this memory is readable even without VM_R