suse/kernel-livepatch-SLE15-SP2_Update_48&distro=SUSE Linux Enterprise Live Patching 15 SP2

Vulnerabilities (56)

• CVE-2022-48631Apr 28, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 When walking through an inode extents, the ext4_ext_binsearch_idx() function assumes that the extent header has been previously validated.

• CVE-2024-26923MedApr 25, 2024
  affected < 3-150200.5.6.1fixed 3-150200.5.6.1

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix garbage collector racing against connect() Garbage collector does not take into account the risk of embryo getting enqueued during the garbage collection. If such embryo has a peer that carries SCM

• CVE-2024-26906MedApr 17, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: BUG: unable to h

• CVE-2024-26903MedApr 17, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing the packets from a no

• CVE-2024-26898HigApr 17, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel.

• CVE-2024-26852HigApr 17, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_route_mpath_notify") w

• CVE-2024-26862Apr 17, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignore_outgoing ignore_outgoing is read locklessly from dev_queue_xmit_nit() and packet_getsockopt() Add appropriate READ_ONCE()/WRITE_ONCE() annotations. syzbot reported:

• CVE-2024-26840Apr 17, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache() The following memory leak was reported after unbinding /dev/cachefiles: ================================================================== unreferenced obj

• CVE-2024-26828Apr 17, 2024
  affected < 3-150200.5.6.1fixed 3-150200.5.6.1

  In the Linux kernel, the following vulnerability has been resolved: cifs: fix underflow in parse_server_interfaces() In this loop, we step through the buffer and after each item we check if the size_left is greater than the minimum size we need. However, the problem is that "b

• CVE-2021-47212Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Update error handler for UCTX and UMEM In the fast unload flow, the device state is set to internal error, which indicates that the driver started the destroy process. In this case, when a destroy com

• CVE-2021-47207Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: ALSA: gus: fix null pointer dereference on pointer block The pointer block return from snd_gf1_dma_next_block could be null, so there is a potential null pointer dereference issue. Fix this by adding a null che

• CVE-2021-47206Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: usb: host: ohci-tmio: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.

• CVE-2021-47203Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass the requests to the adapter. If such an attempt fails, a local "fail_msg" str

• CVE-2021-47201Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: iavf: free q_vectors before queues in iavf_disable_vf iavf_free_queues() clears adapter->num_active_queues, which iavf_free_q_vectors() relies on, so swap the order of these two function calls in iavf_disable_v

• CVE-2021-47198Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi() routine An error is detected with the following report when unloading the driver: "KASAN: use-after-free in lpfc_unreg_rpi+0x1b1b" The NLP_REG_LOGIN_SEND nl

• CVE-2021-47194Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: cfg80211: call cfg80211_stop_ap when switch from P2P_GO type If the userspace tools switch from NL80211_IFTYPE_P2P_GO to NL80211_IFTYPE_ADHOC via send_msg(NL80211_CMD_SET_INTERFACE), it does not call the cleanu

• CVE-2021-47185Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, which look like this one: Workqueue: events_unbound

• CVE-2021-47184Apr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL ptr dereference on VSI filter sync Remove the reason of null pointer dereference in sync VSI filters. Added new I40E_VSI_RELEASING flag to signalize deleting and releasing of VSI resources to syn

• CVE-2024-26816MedApr 10, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the "startup_xen" entry point. This information is us

• CVE-2024-26744Apr 3, 2024
  affected < 1-150200.5.3.1fixed 1-150200.5.3.1

  In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Support specifying the srpt_service_guid parameter Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt kernel module trigg