Security update for the Linux Kernel

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: - CVE-2021-22543: Fixed improper handling of VM_IO|VM_PFNMAP vmas in KVM (bsc#1186482). - CVE-2021-47634: ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl (bsc#1237758). - CVE-2021-47644: media: staging: media: zoran: move videodev alloc (bsc#1237766). - CVE-2022-48953: rtc: cmos: fix build on non-ACPI platforms (bsc#1231941). - CVE-2022-48975: gpiolib: fix memory leak in gpiochip_setup_dev() (bsc#1231885). - CVE-2022-49006: tracing: Free buffers when a used dynamic event is removed (bsc#1232163). - CVE-2022-49076: RDMA/hfi1: Fix use-after-free bug for mm struct (bsc#1237738). - CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238033). - CVE-2022-49089: IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition (bsc#1238041). - CVE-2022-49124: x86/mce: Work around an erratum on fast string copy instructions (bsc#1238148). - CVE-2022-49134: mlxsw: spectrum: Guard against invalid local ports (bsc#1237982). - CVE-2022-49135: drm/amd/display: Fix memory leak (bsc#1238006). - CVE-2022-49151: can: mcba_usb: properly check endpoint type (bsc#1237778). - CVE-2022-49178: memstick/mspro_block: fix handling of read-only devices (bsc#1238107). - CVE-2022-49182: net: hns3: add vlan list lock to protect vlan list (bsc#1238260). - CVE-2022-49201: ibmvnic: fix race between xmit and reset (bsc#1238256). - CVE-2022-49247: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED (bsc#1237783). - CVE-2022-49490: drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is (bsc#1238275). - CVE-2022-49626: sfc: fix use after free when disabling sriov (bsc#1238270). - CVE-2022-49661: can: gs_usb: gs_usb_open/close(): fix memory leak (bsc#1237788). - CVE-2023-52572: Fixed UAF in cifs_demultiplex_thread() in cifs (bsc#1220946). - CVE-2023-52853: hid: cp2112: Fix duplicate workqueue initialization (bsc#1224988). - CVE-2023-52924: netfilter: nf_tables: do not skip expired elements during walk (bsc#1236821). - CVE-2023-6606: Fixed an out of bounds read in the SMB client when receiving a malformed length from a server (bsc#1217947). - CVE-2024-23307: Fixed Integer Overflow or Wraparound vulnerability in x86 and ARM md, raid, raid5 modules (bsc#1219169). - CVE-2024-27397: netfilter: nf_tables: use timestamp to check for set element timeout (bsc#1224095). - CVE-2024-49963: mailbox: bcm2835: Fix timeout during suspend mode (bsc#1232147). - CVE-2024-49975: uprobes: fix kernel info leak via '[uprobes]' vma (bsc#1232104). - CVE-2024-50036: net: do not delay dst_entries_add() in dst_release() (bsc#1231912). - CVE-2024-50067: uprobe: avoid out-of-bounds memory access of fetching args (bsc#1232416). - CVE-2024-50251: netfilter: nft_payload: sanitize offset and length before calling skb_checksum() (bsc#1233248). - CVE-2024-50304: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() (bsc#1233522). - CVE-2024-53217: nfsd: restore callback functionality for NFSv4.0 (bsc#1234999). - CVE-2024-56633: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data (bsc#1235485). - CVE-2024-56647: net: Fix icmp host relookup triggering ip_rt_bug (bsc#1235435). - CVE-2024-56658: net: defer final 'struct net' free in netns dismantle (bsc#1235441). - CVE-2024-56688: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport (bsc#1235538). - CVE-2025-21638: sctp: sysctl: auth_enable: avoid using current->nsproxy (bsc#1236115). - CVE-2025-21639: sctp: sysctl: rto_min/max: avoid using current->nsproxy (bsc#1236122). - CVE-2025-21640: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy (bsc#1236123). - CVE-2025-21673: smb: client: fix double free of TCP_Server_Info::hostname (bsc#1236689). - CVE-2025-21689: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() (bsc#1237017). - CVE-2025-21690: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service (bsc#1237025). - CVE-2025-21700: net: sched: Disallow replacing of child qdisc from one parent to another (bsc#1237159). - CVE-2025-21753: btrfs: fix use-after-free when attempting to join an aborted transaction (bsc#1237875). The following non-security bugs were fixed: - bpf: fix mixed signed/unsigned derived min/max value bounds (bsc#1050081). - btrfs: add a flag to iterate_inodes_from_logical to find all - btrfs: add a flag to iterate_inodes_from_logical to find all extent refs for uncompressed extents (bsc#1174206). - cifs: Fix use after free of a mid_q_entry (bsc#1112903). - cifs: check for STATUS_USER_SESSION_DELETED (bsc#1112902). - cifs: fix memory leak in SMB2_open() (bsc#1112894). - crypto: caam/qi - fix IV DMA mapping and updating (bsc#1051510). - drm/amd/powerplay: Fix missing break in switch (bsc#1120902) - drm/i915: Remove stale asserts from i915_gem_find_active_request() (bsc#1051510). - drm/i915: Restore planes after load detection (bsc#1051510). - drm/i915: always return something on DDI clock selection (bsc#1120902) - drm/msm/mdp5: Fix global state lock backoff (bsc#1238275) - fix SCTP regression (bsc#1158082) - fixup 'rpm: support gz and zst compression methods' once more (bsc#1190428, bsc#1190358). - iio: trigger: stm32-timer: fix get/set down count direction (bsc#1051510). - kABI: Add clear_trace to trace_array (bsc#1232163). - kABI: Preserve TRACE_EVENT_FL values (bsc#1232163). - mm, numa: Migrate pages to local nodes quicker early in the lifetime of a task (bnc#1101669). - mm, numa: Remove rate-limiting of automatic numa balancing migration (bnc#1101669). - net: mana: Add get_link and get_link_ksettings in ethtool (bsc#1236761). - net: netvsc: Update default VMBus channels (bsc#1236757). - powerpc/64/kdump: Limit kdump base to 512MB (bsc#1203410 ltc#199904). - powerpc/papr_scm: Fix DIMM device registration race (FATE#326628, bsc#1113295, git-fixes). - powerpc/papr_scm: Fix DIMM device registration race (bsc#1113295, git-fixes). - powerpc/papr_scm: Fix resource end address (FATE#326628, bsc#1113295, git-fixes). - powerpc/papr_scm: Fix resource end address (bsc#1113295, git-fixes). - powerpc/papr_scm: Remove endian conversions (FATE#326628, bsc#1113295, git-fixes). - powerpc/papr_scm: Remove endian conversions (bsc#1113295, git-fixes). - powerpc/papr_scm: Update DT properties (FATE#326628, bsc#1113295, git-fixes). - powerpc/papr_scm: Update DT properties (bsc#1113295, git-fixes). - powerpc/papr_scm: Use depend instead of select (FATE#326628, bsc#1113295, git-fixes). - powerpc/papr_scm: Use depend instead of select (bsc#1113295, git-fixes). - powerpc/papr_scm: Use ibm,unit-guid as the iset cookie (FATE#326628, bsc#1113295, git-fixes). - powerpc/papr_scm: Use ibm,unit-guid as the iset cookie (bsc#1113295, git-fixes). - powerpc/pseries: Fix use after free in remove_phb_dynamic() (bsc#1065729). - powerpc/tm: Fix more userspace r13 corruption (bsc#1065729). - rpm/kernel-binary.spec.in: Fix build regression The previous fix forgot to take over grep -c option that broke the conditional expression - rpm/kernel-source.spec.in: Add subpackage-names.conf as source. - s390/cpum_cf: rename IBM z13/z14 counter names (FATE#326341, LTC#169491, bsc#1100823). - s390/cpum_cf: rename IBM z13/z14 counter names (LTC#169491, bsc#1100823). - s390/dasd: fix hanging offline processing due to canceled worker (bsc#1175165). - sched/numa: Avoid task migration for small NUMA improvement (bnc#1101669). - sched/numa: Pass destination CPU as a parameter to migrate_task_rq (bnc#1101669). - sched/numa: Reset scan rate whenever task moves across nodes (bnc#1101669). - sched/numa: Stop multiple tasks from moving to the CPU at the same time (bnc#1101669). - scsi: core: Allow state transitions from OFFLINE to BLOCKED (bsc#1112246). - scsi: libfc: check fc_frame_payload_get() return value for null (bsc#1104731). - scsi: libfc: retry PRLI if we cannot analyse the payload (bsc#1104731). - scsi: storvsc: Add validation for untrusted Hyper-V values (git-fixes). - scsi: storvsc: Correctly handle multiple flags in srb_status (git-fixes). - scsi: storvsc: Fix handling of srb_status and capacity change events (git-fixes). - scsi: storvsc: Fix spelling mistake (git-fixes). - scsi: storvsc: Handle SRB status value 0x30 (git-fixes). - scsi: storvsc: Log TEST_UNIT_READY errors as warnings (git-fixes). - scsi: storvsc: Miscellaneous code cleanups (git-fixes). - scsi: storvsc: Return DID_ERROR for invalid commands (git-fixes). - scsi: storvsc: Update error logging (git-fixes). - scsi: storvsc: Use scsi_cmd_to_rq() instead of scsi_cmnd.request (git-fixes). - smb2: fix missing files in root share directory listing (bsc#1112907). - smb3: fill in statfs fsid and correct namelen (bsc#1112905). - smb3: fix reset of bytes read and written stats (bsc#1112906). - smb3: on reconnect set PreviousSessionId field (bsc#1112899). - tracing: Only have rmmod clear buffers that its events were active in (bsc#1232163). - ubi: fastmap: Cancel work upon detach (bsc#1051510).