suse/kernel-default&distro=SUSE Linux Enterprise Live Patching 15 SP6

Vulnerabilities (4,170)

• CVE-2024-26685Apr 3, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition of the buffer async

• CVE-2024-26684Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handling of DPP safety error for DMA channels Commit 56e58d6c8a56 ("net: stmmac: Implement Safety Features in XGMAC core") checks and reports safety errors, but leaves the Data Path Pari

• CVE-2024-26683Apr 2, 2024
  affected < 6.4.0-150600.23.22.1fixed 6.4.0-150600.23.22.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might want the channel t

• CVE-2024-26682Apr 2, 2024
  affected < 6.4.0-150600.23.22.1fixed 6.4.0-150600.23.22.1

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: improve CSA/ECSA connection refusal As mentioned in the previous commit, we pretty quickly found that some APs have ECSA elements stuck in their probe response, so using that to not attempt to c

• CVE-2024-26679Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a KCSAN warning.

• CVE-2024-26677Apr 2, 2024
  affected < 6.4.0-150600.23.22.1fixed 6.4.0-150600.23.22.1

  In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix delayed ACKs to not set the reference serial number Fix the construction of delayed ACKs to not set the reference serial number as they can't be used as an RTT reference.

• CVE-2024-26676Apr 2, 2024
  affected < 6.4.0-150600.23.14.2fixed 6.4.0-150600.23.14.2

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. syzbot reported a warning [0] in __unix_gc() with a repro, which creates a socketpair and sends one socket's fd to itself using the peer. socketpa

• CVE-2024-26674Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups During memory error injection test on kernels >= v6.4, the kernel panics like below. However, this issue couldn't be reproduced on kernels <= v6.

• CVE-2024-26673Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since destination port is a

• CVE-2024-26671Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. Then in __sbitmap_

• CVE-2023-52635Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from two place one from

• CVE-2024-26669Apr 2, 2024
  affected < 6.4.0-150600.23.22.1fixed 6.4.0-150600.23.22.1

  In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filter block using the '

• CVE-2024-26668Apr 2, 2024
  affected < 6.4.0-150600.23.22.1fixed 6.4.0-150600.23.22.1

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as 17gbyte/s. Its be

• CVE-2024-26665Apr 2, 2024
  affected < 6.4.0-150600.23.17.1fixed 6.4.0-150600.23.17.1

  In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/0x240 Read of

• CVE-2024-26663Apr 2, 2024
  affected < 6.4.0-150600.23.17.1fixed 6.4.0-150600.23.17.1

  In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0xdffffc0000000010:

• CVE-2024-26661Apr 2, 2024
  affected < 6.4.0-150600.23.70.1fixed 6.4.0-150600.23.70.1

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the caller to ensure the tg

• CVE-2023-52631Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_attr_list(). The "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow on a 64bit systems but on 32b

• CVE-2024-26657Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: drm/sched: fix null-ptr-deref in init entity The bug can be triggered by sending an amdgpu_cs_wait_ioctl to the AMDGPU DRM driver on any ASICs with valid context. The bug was reported by Joonkyo Jung <joonkyoj@

• CVE-2024-26656Apr 2, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was reported by Joonkyo J

• CVE-2024-26654Apr 1, 2024
  affected < 6.4.0-150600.23.7.3fixed 6.4.0-150600.23.7.3

  In the Linux kernel, the following vulnerability has been resolved: ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the snd_pcm_substream is