kernel: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: d...

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: drm: nv04: Fix out of bounds access (CVE-2024-27008) * kernel: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (CVE-2024-27398) * kernel: pipe: wakeup wr_wait after setting max_usage (CVE-2023-52672) * kernel: net: phy: micrel: Fix potential null pointer dereference (CVE-2024-35891) * kernel: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() (CVE-2024-35934) * kernel: Bluetooth: btintel: Fix null ptr deref in btintel_read_version (CVE-2024-35933) * kernel: Bluetooth: Fix memory leak in hci_req_sync_complete() (CVE-2024-35978) * kernel: Bluetooth: SCO: Fix not validating setsockopt user input (CVE-2024-35967) * kernel: Bluetooth: RFCOMM: Fix not validating setsockopt user input (CVE-2024-35966) * kernel: Bluetooth: L2CAP: Fix not validating setsockopt user input (CVE-2024-35965) * kernel: Bluetooth: ISO: Fix not validating setsockopt user input (CVE-2024-35964) * kernel: Bluetooth: hci_sock: Fix not validating setsockopt user input (CVE-2024-35963) * kernel: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() (CVE-2024-36013) * kernel: Bluetooth: msft: fix slab-use-after-free in msft_do_close() (CVE-2024-36012) * kernel: Bluetooth: HCI: Fix potential null-ptr-deref (CVE-2024-36011) * kernel: Bluetooth: qca: add missing firmware sanity checks (CVE-2024-36880) * kernel: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() (CVE-2024-36968) * kernel: of: module: add buffer overflow check in of_modalias() (CVE-2024-38541) * kernel: sock_map: avoid race between sock_map_close and sk_psock_put (CVE-2024-39500) * kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list (CVE-2024-40956) * kernel: bpf: Fix too early release of tcx_entry (CVE-2024-41010) * kernel: bluetooth/l2cap: sync sock recv cb and release (CVE-2024-41062) * kernel: Bluetooth: Ignore too large handle values in BIG (CVE-2024-42133) * kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race (CVE-2024-42253) * kernel: protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CVE-2024-42265) * kernel: ASoC: TAS2781: Fix tasdev_load_calibrated_data() (CVE-2024-42278) * kernel: ice: Add a per-VF limit on number of FDIR filters (CVE-2024-42291) * kernel: block: fix deadlock between sd_remove & sd_release (CVE-2024-42294) * kernel: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal (CVE-2024-42302) * kernel: ext4: make sure the first directory block is not a hole (CVE-2024-42304) * kernel: ext4: check dot and dotdot of dx_root before making dir indexed (CVE-2024-42305) * kernel: sysctl: always initialize i_uid/i_gid (CVE-2024-42312) * kernel: exfat: fix potential deadlock on __exfat_get_dentry_set (CVE-2024-42315) * kernel: mm/mglru: fix div-by-zero in vmpressure_calc_level() (CVE-2024-42316) * kernel: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE (CVE-2024-42321) * kernel: dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume (CVE-2024-43820) * kernel: scsi: lpfc: Fix a possible null pointer dereference (CVE-2024-43821) * kernel: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() (CVE-2024-43823) * kernel: ext4: fix infinite loop when replaying fast_commit (CVE-2024-43828) * kernel: xdp: fix invalid wait context of page_pool_destroy() (CVE-2024-43834) * kernel: lib: objagg: Fix general protection fault (CVE-2024-43846) * kernel: cgroup/cpuset: Prevent UAF in proc_cpuset_show() (CVE-2024-43853) * kernel: devres: Fix memory leakage caused by driver API devm_free_percpu() (CVE-2024-43871) * kernel: vhost/vsock: always initialize seqpacket_allow (CVE-2024-43873) * kernel: exec: Fix ToCToU between perm check and set-uid/gid usage (CVE-2024-43882) * kernel: Bluetooth: MGMT: Add error handling to pair_device() (CVE-2024-43884) * kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() (CVE-2024-43889) * kernel: ext4: sanity check for NULL pointer after ext4_force_shutdown (CVE-2024-43898) * kernel: bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses (CVE-2024-43910) * kernel: md/raid5: avoid BUG_ON() while continue reshape after reassembling (CVE-2024-43914) * kernel: gpio: prevent potential speculation leaks in gpio_device_get_desc() (CVE-2024-44931) * kernel: idpf: fix UAFs when destroying the queues (CVE-2024-44932) * kernel: net: bridge: mcast: wait for previous gc cycles when removing port (CVE-2024-44934) * kernel: driver core: Fix uevent_show() vs driver detach race (CVE-2024-44952) * kernel: sched/smt: Fix unbalance sched_smt_present dec/inc (CVE-2024-44958) * kernel: idpf: fix memory leaks and crashes while performing a soft reset (CVE-2024-44964) * kernel: cgroup/cpuset: fix panic caused by partcmd_update (CVE-2024-44975) * kernel: ipv6: prevent UAF in ip6_send_skb() (CVE-2024-44987) * kernel: bonding: fix xfrm real_dev null pointer dereference (CVE-2024-44989) * kernel: fs/netfs/fscache_cookie: add missing "n_accesses" check (CVE-2024-45000) * kernel: mptcp: pm: only decrement add_addr_accepted for MPJ req (CVE-2024-45009) * kernel: mptcp: pm: only mark 'subflow' endp as available (CVE-2024-45010) * kernel: netem: fix return value if duplicate enqueue fails (CVE-2024-45016) * kernel: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 (CVE-2024-45022) * kernel: scsi: aacraid: Fix double-free on probe failure (CVE-2024-46673) * kernel: usb: dwc3: core: Prevent USB core invalid event buffer address access (CVE-2024-46675) * kernel: mptcp: pm: fix ID 0 endp usage after multiple re-creations (CVE-2024-46711) * kernel: drm/amdgpu: fix mc_data out-of-bounds read warning (CVE-2024-46722) * kernel: drm/amdgpu: fix ucode out-of-bounds read warning (CVE-2024-46723) * kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number (CVE-2024-46724) * kernel: drm/amdgpu: Fix out-of-bounds write warning (CVE-2024-46725) * kernel: of/irq: Prevent device address out-of-bounds read in interrupt map walk (CVE-2024-46743) * kernel: Input: uinput - reject requests with unreasonable number of slots (CVE-2024-46745) * kernel: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup (CVE-2024-46747) * kernel: PCI: Add missing bridge lock to pci_bus_lock() (CVE-2024-46750) * kernel: bpf: Remove tst_run from lwt_seg6local_prog_ops. (CVE-2024-46754) * kernel: hwmon: (w83627ehf) Fix underflows seen when writing limit attributes (CVE-2024-46756) * kernel: hwmon: (lm95234) Fix underflows seen when writing limit attributes (CVE-2024-46758) * kernel: hwmon: (adc128d818) Fix underflows seen when writing limit attributes (CVE-2024-46759) * kernel: pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv (CVE-2024-46761) * kernel: tcp_bpf: fix return value of tcp_bpf_sendmsg() (CVE-2024-46783) * kernel: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF (CVE-2024-46786) * kernel: userfaultfd: fix checks for huge PMDs (CVE-2024-46787) * kernel: sch/netem: fix use after free in netem_dequeue (CVE-2024-46800) * kernel: drm/amdgpu: fix the waring dereferencing hive (CVE-2024-46805) * kernel: drm/amdgpu: Fix the warning division or modulo by zero (CVE-2024-46806) * kernel: drm/amd/amdgpu: Check tbo resource pointer (CVE-2024-46807) * kernel: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 (CVE-2024-46819) * kernel: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend (CVE-2024-46820) * kernel: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry (CVE-2024-46822) * kernel: sched: sch_cake: fix bulk flow accounting logic for host fairness (CVE-2024-46828) * kernel: drm/amdgpu: Fix smatch static checker warning (CVE-2024-46835) * kernel: workqueue: Improve scalability of workqueue watchdog touch (CVE-2024-46839) * kernel: spi: nxp-fspi: fix the KASAN report out-of-bounds bug (CVE-2024-46853) * kernel: x86/hyperv: fix kexec crash due to VP assist page corruption (CVE-2024-46864) * kernel: drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX (CVE-2024-46871) * kernel: fsnotify: clear PARENT_WATCHED flags lazily (CVE-2024-47660) * kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (CVE-2024-47668) * kernel: sock_map: Add a cond_resched() in sock_hash_free() (CVE-2024-47710) * kernel: iommufd: Protect against overflow of ALIGN() during iova allocation (CVE-2024-47719) * kernel: nfsd: return -EINVAL when namelen is 0 (CVE-2024-47692) * kernel: block: fix potential invalid pointer dereference in blk_add_partition (CVE-2024-47705) * kernel: ACPI: sysfs: validate return type of _STR method (CVE-2024-49860) * kernel: powercap: intel_rapl: Fix off by one in get_rpi() (CVE-2024-49862) * kernel: padata: use integer wrap around to prevent deadlock on seq_nr overflow (CVE-2024-47739) * kernel: icmp: change the order of rate limits (CVE-2024-47678) * kernel: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() (CVE-2023-52917) * kernel: vdpa/mlx5: Fix invalid mr resource destroy (CVE-2024-47687) * kernel: x86/sgx: Fix deadlock in SGX NUMA node search (CVE-2024-49856) * kernel: wifi: mt76: mt7915: fix oops on non-dbdc mt7986 (CVE-2024-47715) * kernel: wifi: rtw88: always wait for both firmware loading attempts (CVE-2024-47718) * kernel: block, bfq: fix possible UAF for bfqq->bic with merge chain (CVE-2024-47706) * kernel: nfsd: call cache_put if xdr_reserve_space returns NULL (CVE-2024-47737) * kernel: wifi: mac80211: don't use rate mask for offchannel TX either (CVE-2024-47738) * kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() (CVE-2024-47713) * kernel: vhost_vdpa: assign irq bypass producer token correctly (CVE-2024-47748) * kernel: tpm: Clean up TPM space after command failure (CVE-2024-49851) * kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages() (CVE-2024-47745) * kernel: bpf, lsm: Add check for BPF LSM return value (CVE-2024-47703) * kernel: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (CVE-2024-47685) * kernel: ext4: check stripe size compatibility on remount as well (CVE-2024-47700) * kernel: nfsd: map the EBADMSG to nfserr_io to avoid warning (CVE-2024-49875) * kernel: iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count (CVE-2024-49993) * kernel: tipc: guard against string buffer overrun (CVE-2024-49995) * kernel: exfat: fix memory leak in exfat_load_bitmap() (CVE-2024-50013) * kernel: Bluetooth: L2CAP: Fix uaf in l2cap_connect (CVE-2024-49950) * kernel: ext4: fix double brelse() the buffer of the extents path (CVE-2024-49882) * kernel: cachefiles: fix dentry leak in cachefiles_open_file() (CVE-2024-49870) * kernel: ppp: do not assume bh is held in ppp_channel_bridge_input() (CVE-2024-49946) * kernel: ext4: filesystems without casefold feature cannot be mounted with siphash (CVE-2024-49968) * kernel: net: napi: Prevent overflow of napi_defer_hard_irqs (CVE-2024-50018) * kernel: ext4: fix access to uninitialised lock in fc replay path (CVE-2024-50014) * kernel: mm, slub: avoid zeroing kmalloc redzone (CVE-2024-49885) * kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer (CVE-2024-49991) * kernel: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug (CVE-2024-49886) * kernel: drm/amdgpu: add list empty check to avoid null pointer issue (CVE-2024-49904) * kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVE-2024-49929) * kernel: uprobes: fix kernel info leak via "[uprobes]" vma (CVE-2024-49975) * kernel: ext4: aovid use-after-free in ext4_ext_insert_extent() (CVE-2024-49883) * kernel: ext4: fix timer use-after-free on failed mount (CVE-2024-49960) * kernel: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free (CVE-2024-49983) * kernel: cpufreq: amd-pstate: add check for cpufreq_cpu_get's return value (CVE-2024-50009) * kernel: ext4: update orig_path in ext4_find_extent() (CVE-2024-49881) * kernel: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit (CVE-2024-49938) * kernel: wifi: cfg80211: Set correct chandef when starting CAC (CVE-2024-49937) * kernel: ext4: avoid use-after-free in ext4_ext_show_leaf() (CVE-2024-49889) * kernel: resource: fix region_intersects() vs add_memory_driver_managed() (CVE-2024-49878) * kernel: wifi: ath11k: fix array out-of-bound access in SoC stats (CVE-2024-49930) * kernel: ext4: dax: fix overflowing extents beyond inode size when partially writing (CVE-2024-50015) * kernel: r8169: add tally counter fields added with RTL8125 (CVE-2024-49973) * kernel: wifi: rtw89: avoid reading out of bounds when loading TX power FW elements (CVE-2024-49928) * kernel: ext4: fix i_data_sem unlock order in ext4_ind_migrate() (CVE-2024-50006) * kernel: static_call: Replace pointless WARN_ON() in static_call_module_notify() (CVE-2024-49954) * kernel: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name (CVE-2024-49934) * kernel: ext4: no need to continue when the number of entries is 1 (CVE-2024-49967) * kernel: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error (CVE-2024-49959) * kernel: net: add more sanity checks to qdisc_pkt_len_init() (CVE-2024-49948) * kernel: block: fix integer overflow in BLKSECDISCARD (CVE-2024-49994) * kernel: afs: Fix the setting of the server responding flag (CVE-2024-49999) * kernel: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() (CVE-2024-49962) * kernel: NFSD: Limit the number of concurrent async COPY operations (CVE-2024-49974) * kernel: wifi: rtw89: avoid to add interface to list twice when SER (CVE-2024-49939) * kernel: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed (CVE-2024-49951) * kernel: drm/amd/display: Increase array size of dummy_boolean (CVE-2024-49971) * kernel: ACPI: PAD: fix crash in exit_round_robin() (CVE-2024-49935) * kernel: static_call: Handle module init failure correctly in static_call_del_module() (CVE-2024-50002) * kernel: x86/ioapic: Handle allocation failures gracefully (CVE-2024-49927) * kernel: ext4: fix slab-use-after-free in ext4_split_extent_at() (CVE-2024-49884) * kernel: net: stmmac: Fix zero-division error when disabling tc cbs (CVE-2024-49977) * kernel: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() (CVE-2024-50008) * kernel: blk_iocost: fix more out of bound shifts (CVE-2024-49933) * kernel: smb: client: fix UAF in async decryption (CVE-2024-50047) * kernel: netfilter: xtables: avoid NFPROTO_UNSPEC where needed (CVE-2024-50038) * kernel: slip: make slhc_remember() more robust against malicious packets (CVE-2024-50033) * kernel: zram: free secondary algorithms names (CVE-2024-50064) * kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change (CVE-2024-50044) * kernel: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync (CVE-2024-50029) * kernel: device-dax: correct pgoff align in dax_set_mapping() (CVE-2024-50022) * kernel: usb: typec: tipd: Free IRQ only if it was requested before (CVE-2024-50057) * kernel: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() (CVE-2024-50046) * kernel: thermal: core: Reference count the zone in thermal_zone_get_by_id() (CVE-2024-50028) * kernel: net: Fix an unsafe loop on the list (CVE-2024-50024) * kernel: serial: protect uart_port_dtr_rts() in uart_shutdown() too (CVE-2024-50058) * kernel: driver core: bus: Fix double free in driver API bus_register() (CVE-2024-50055) * kernel: net/sched: accept TCA_STAB only for root qdisc (CVE-2024-50039) * kernel: kthread: unpark only parked kthread (CVE-2024-50019) * kernel: net: phy: Remove LED entry from LEDs list on unregister (CVE-2024-50023) * kernel: thermal: core: Free tzp copy along with the thermal zone (CVE-2024-50027) * kernel: ppp: fix ppp_async_encode() illegal access (CVE-2024-50035) * kernel: xen-netfront: Fix NULL sring after live migration (CVE-2022-48969) * kernel: net: tun: Fix use-after-free in tun_detach() (CVE-2022-49014) * kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails (CVE-2022-49029) * kernel: fscache: Fix oops due to race with cookie_lru and use_cookie (CVE-2022-48989) * kernel: tracing: Free buffers when a used dynamic event is removed (CVE-2022-49006) * kernel: uprobe: avoid out-of-bounds memory access of fetching args (CVE-2024-50067) * kernel: Bluetooth: ISO: Fix multiple init when debugfs is disabled (CVE-2024-50077) * kernel: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (CVE-2024-50082) * kernel: parport: Proper fix for array out-of-bounds access (CVE-2024-50074) * kernel: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux (CVE-2024-50073) * kernel: blk-mq: setup queue ->tag_set before initializing hctx (CVE-2024-50081) * kernel: xhci: tegra: fix checked USB2 port number (CVE-2024-50075) * kernel: Bluetooth: Call iso_exit() on module unload (CVE-2024-50078) * kernel: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net (CVE-2024-50121) * kernel: md/raid10: fix null ptr dereference in raid10_size() (CVE-2024-50109) * kernel: net: wwan: fix global oob in wwan_rtnl_policy (CVE-2024-50128) * kernel: net: sched: use RCU read-side critical section in taprio_dump() (CVE-2024-50126) * kernel: net: sched: fix use-after-free in taprio_change() (CVE-2024-50127) * kernel: x86: fix user address masking non-canonical speculation issue (CVE-2024-50102) * kernel: drm/amd: Guard against bad data for ATIF ACPI method (CVE-2024-50117) * kernel: smb: client: Handle kstrdup failures for passwords (CVE-2024-50120) * kernel: platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses (CVE-2024-50107) * kernel: nfsd: fix race between laundromat and free_stateid (CVE-2024-50106) * kernel: thermal: intel: int340x: processor: Fix warning during module unload (CVE-2024-50093) * kernel: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices (CVE-2024-50101) * kernel: netfilter: bpf: must hold reference on net namespace (CVE-2024-50130) * kernel: bpf: devmap: provide rxq after redirect (CVE-2024-50162) * kernel: udf: fix uninit-value use in udf_get_fileshortad (CVE-2024-50143) * kernel: scsi: target: core: Fix null-ptr-deref in target_alloc_device() (CVE-2024-50153) * kernel: smb: client: fix OOBs when building SMB2_IOCTL request (CVE-2024-50151) * kernel: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap (CVE-2024-50163) * kernel: vsock: Update rx_bytes on read_skb() (CVE-2024-50169) * kernel: ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context (CVE-2024-50141) * kernel: usb: typec: altmode should keep reference to parent (CVE-2024-50150) * kernel: smb: client: fix possible double free in smb2_set_ea() (CVE-2024-50152) * kernel: ext4: don't set SB_RDONLY after filesystem errors (CVE-2024-50191) * kernel: maple_tree: correct tree corruption on spanning store (CVE-2024-50200) * kernel: pinctrl: intel: platform: fix error path in device_for_each_child_node() (CVE-2024-50197) * kernel: net: explicitly clear the sk pointer, when pf->create fails (CVE-2024-50186) * kernel: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() (CVE-2024-50189) * kernel: drm/radeon: Fix encoder->possible_clones (CVE-2024-50201) * kernel: mm/swapfile: skip HugeTLB pages for unuse_vma (CVE-2024-50199) * kernel: secretmem: disable memfd_secret() if arch cannot set direct map (CVE-2024-50182) * kernel: wifi: ath10k: Fix memory leak in management tx (CVE-2024-50236) * kernel: mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves (CVE-2024-50219) * kernel: mm: shmem: fix data-race in shmem_getattr() (CVE-2024-50228) * kernel: wifi: cfg80211: clear wdev->cqm_config pointer on free (CVE-2024-50235) * kernel: nvmet-auth: assign dh_key to NULL after kfree_sensitive (CVE-2024-50215) * kernel: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (CVE-2024-50256) * kernel: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower (CVE-2024-50237) * kernel: xfs: fix finding a last resort AG in xfs_filestream_pick_ag (CVE-2024-50216) * kernel: macsec: Fix use-after-free while sending the offloading packet (CVE-2024-50261) * kernel: signal: restore the override_rlimit logic (CVE-2024-50271) * kernel: dm cache: fix potential out-of-bounds access on the first resume (CVE-2024-50278) * kernel: filemap: Fix bounds checking in filemap_read() (CVE-2024-50272) * kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() (CVE-2024-50282) * kernel: sctp: properly validate chunk size in sctp_sf_ootb() (CVE-2024-50299) * kernel: usb: dwc3: fix fault at system suspend if device was already runtime suspended (CVE-2024-53070) * kernel: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported (CVE-2024-53060) * kernel: virtio_net: Add hash_key_length check (CVE-2024-53082) * kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() (CVE-2024-53042) * kernel: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT (CVE-2024-53057) * kernel: wifi: iwlwifi: mvm: fix 6 GHz scan construction (CVE-2024-53055) * kernel: tpm: Lock TPM chip in tpm_pm_suspend() first (CVE-2024-53085) * kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (CVE-2024-50304) * kernel: drm/i915/hdcp: Add encoder check in hdcp2_get_capability (CVE-2024-53050) * kernel: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability (CVE-2024-53051) * kernel: mptcp: init: protect sched with rcu_read_lock (CVE-2024-53047) * kernel: platform/x86/amd/pmc: Detect when STB is not available (CVE-2024-53072) * kernel: wifi: iwlwifi: mvm: don't leak a link on AP removal (CVE-2024-53074) * kernel: net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() (CVE-2024-53044) * kernel: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() (CVE-2024-53059) * kernel: smb: client: Fix use-after-free of network namespace. (CVE-2024-53095) * kernel: nvme-multipath: defer partition scanning (CVE-2024-53093) * kernel: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx (CVE-2024-53091) * kernel: mm: resolve faulty mmap_region() error path behaviour (CVE-2024-53096) * kernel: mm: krealloc: Fix MTE false alarm in __do_krealloc (CVE-2024-53097) * kernel: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer (CVE-2024-53103) * kernel: vsock: Fix sk_error_queue memory leak (CVE-2024-53118) * kernel: mptcp: error out earlier on disconnect (CVE-2024-53123) * kernel: net: fix data-races around sk->sk_forward_alloc (CVE-2024-53124) * kernel: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() (CVE-2024-53105) * kernel: net/mlx5e: CT: Fix null-ptr-deref in add rule err flow (CVE-2024-53120) * kernel: virtio/vsock: Improve MSG_ZEROCOPY error handling (CVE-2024-53117) * kernel: net/mlx5: fs, lock FTE when checking if active (CVE-2024-53121) * kernel: vp_vdpa: fix id_table array not null terminated error (CVE-2024-53110) * kernel: mm: revert "mm: shmem: fix data-race in shmem_getattr()" (CVE-2024-53136) * kernel: pmdomain: imx93-blk-ctrl: correct remove path (CVE-2024-53134) * kernel: initramfs: avoid filename buffer overrun (CVE-2024-53142) * kernel: NFSD: Prevent a potential integer overflow (CVE-2024-53146) * kernel: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() (CVE-2024-53152) * kernel: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (CVE-2024-53156) * kernel: EDAC/bluefield: Fix potential integer overflow (CVE-2024-53161) * kernel: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu (CVE-2024-53160) * kernel: net: sched: fix ordering of qlen adjustment (CVE-2024-53164) * kernel: PCI: Fix use-after-free of slot->bus on hot remove (CVE-2024-53194) * kernel: zram: fix NULL pointer in comp_algorithm_show() (CVE-2024-53222) * kernel: block, bfq: fix bfqq uaf in bfq_limit_depth() (CVE-2024-53166) * kernel: Bluetooth: fix use-after-free in device_for_each_child() (CVE-2024-53237) * kernel: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation (CVE-2024-53213) * kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync (CVE-2024-53208) * kernel: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (CVE-2024-53173) * kernel: RDMA/mlx5: Move events notifier registration to be after device registration (CVE-2024-53224) * kernel: wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures (CVE-2024-53190) * kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() (CVE-2024-53203) * kernel: SUNRPC: make sure cache entry active before cache_show (CVE-2024-53174) * kernel: Bluetooth: hci_conn: Use disable_delayed_work_sync (CVE-2024-56591) * kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() (CVE-2024-56562) * kernel: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM (CVE-2024-56611) * kernel: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() (CVE-2024-56535) * kernel: net: inet6: do not leave a dangling sk pointer in inet6_create() (CVE-2024-56600) * kernel: scsi: qla2xxx: Fix use after free on unload (CVE-2024-56623) * kernel: mm/slub: Avoid list corruption when removing a slab from the full list (CVE-2024-56566) * kernel: ovl: Filter invalid inodes with missing lookup function (CVE-2024-56570) * kernel: net: inet: do not leave a dangling sk pointer in inet_create() (CVE-2024-56601) * kernel: drm/amdgpu: fix usage slab after free (CVE-2024-56551) * kernel: drm/dp_mst: Fix MST sideband message body length check (CVE-2024-56616) * kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (CVE-2024-56590) * kernel: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() (CVE-2024-56604) * kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() (CVE-2024-56602) * kernel: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (CVE-2024-56605) * kernel: scsi: sg: Fix slab-use-after-free read in sg_release() (CVE-2024-56631) * kernel: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump (CVE-2024-56653) * kernel: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one (CVE-2024-56663) * kernel: drm/i915: Fix NULL pointer dereference in capture_engine (CVE-2024-56667) * kernel: net/ipv6: release expired exception dst cached in socket (CVE-2024-56644) * kernel: net: Fix icmp host relookup triggering ip_rt_bug (CVE-2024-56647) * kernel: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). (CVE-2024-56642) * kernel: Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating (CVE-2024-56654) * kernel: xsk: fix OOB map writes when deleting elements (CVE-2024-56614) * kernel: nfsd: make sure exp active before svc_export_show (CVE-2024-56558) * kernel: bpf, sockmap: Fix race between element replace and close() (CVE-2024-56664) * kernel: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (CVE-2024-56688) * kernel: brd: defer automatic disk creation until module initialization succeeds (CVE-2024-56693) * kernel: smb: Initialize cfid->tcon before performing network ops (CVE-2024-56729) * kernel: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect (CVE-2024-56757) * kernel: PCI/MSI: Handle lack of irqdomain gracefully (CVE-2024-56760) * kernel: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level (CVE-2024-56783) * kernel: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur (CVE-2024-56779) * kernel: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR (CVE-2024-48873) * kernel: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() (CVE-2024-57798) * kernel: Bluetooth: iso: Fix circular lock in iso_listen_bis (CVE-2024-54460) * kernel: smb: client: fix TCP timers deadlock after rmmod (CVE-2024-54680) * kernel: nvme-rdma: unquiesce admin_q before destroy it (CVE-2024-49569) * kernel: virtio-net: fix overflow inside virtnet_rq_alloc (CVE-2024-57843) * kernel: Bluetooth: iso: Always release hdev at the end of iso_listen_bis (CVE-2024-57879) * kernel: pinmux: Use sequential access to access desc->pinmux data (CVE-2024-47141) * kernel: PCI: imx6: Fix suspend/resume support on i.MX6QDL (CVE-2024-57809) * kernel: Bluetooth: hci_core: Fix sleeping function called from invalid context (CVE-2024-57894) * kernel: workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker (CVE-2024-57888) * kernel: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (CVE-2024-57884) * kernel: wifi: cfg80211: clear link ID from bitmap during link delete after clean up (CVE-2024-57898) * kernel: RDMA/uverbs: Prevent integer overflow issue (CVE-2024-57890) * kernel: nvmet: Don't overflow subsysnqn (CVE-2024-53681) * kernel: afs: Fix the maximum cell name length (CVE-2025-21646) * kernel: dm array: fix releasing a faulty array block twice in dm_array_cursor_end (CVE-2024-57929) * kernel: exfat: fix the infinite loop in exfat_readdir() (CVE-2024-57940) * kernel: selinux: ignore unknown extended permissions (CVE-2024-57931) * kernel: net: stmmac: dwmac-tegra: Read iommu stream id from device tree (CVE-2025-21663) * kernel: vsock/virtio: discard packets if the transport changes (CVE-2025-21669) * kernel: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] (CVE-2025-21666) * kernel: pmdomain: imx8mp-blk-ctrl: add missing loop break condition (CVE-2025-21668) * kernel: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (CVE-2025-21689) * kernel: fs/proc: fix softlockup in __read_vmcore (part 2) (CVE-2025-21694) * kernel: Secure Boot does not automatically enable kernel lockdown (CVE-2025-1272) * kernel: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame (CVE-2024-58099) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9 Release Notes linked from the References section.

Where it's fixed