SUSE-SU-2026:0317-1: Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to fix various security issues The following security issues were fixed: - CVE-2022-50630: mm: hugetlb: fix UAF in hugetlb_handle_userfault (bsc#1254785). - CVE-2022-50700: wifi: ath10k: Delay the unmapping of the buffer (bsc#1255576). - CVE-2023-53254: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels (bsc#1249871). - CVE-2023-53781: smc: Fix use-after-free in tcp_write_timer_handler() (bsc#1254751). - CVE-2024-56590: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet (bsc#1235038). - CVE-2025-39977: futex: Prevent use-after-free during requeue-PI (bsc#1252046). - CVE-2025-40019: crypto: essiv - Check ssize for decryption and in-place encryption (bsc#1252678). - CVE-2025-40139: smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set() (bsc#1253409). - CVE-2025-40215: kABI: xfrm: delete x->tunnel as we delete x (bsc#1254959). - CVE-2025-40220: fuse: fix livelock in synchronous file put from fuseblk workers (bsc#1254520). - CVE-2025-40233: ocfs2: clear extent cache after moving/defragmenting extents (bsc#1254813). - CVE-2025-40258: mptcp: fix race condition in mptcp_schedule_work() (bsc#1254843). - CVE-2025-40277: drm/vmwgfx: Validate command header size against (bsc#1254894). - CVE-2025-40280: tipc: Fix use-after-free in tipc_mon_reinit_self() (bsc#1254847). - CVE-2025-40331: sctp: Prevent TOCTOU out-of-bounds write (bsc#1254615). - CVE-2025-68732: gpu: host1x: Fix race in syncpt alloc/free (bsc#1255688). The following non security issues were fixed: - ACPI/IORT: Fix memory leak in iort_rmr_alloc_sids() (git-fixes). - ACPI: PRM: Remove unnecessary strict handler address checks (git-fixes). - ACPI: property: Do not pass NULL handles to acpi_attach_data() (git-fixes). - ACPI: property: Fix buffer properties extraction for subnodes (git-fixes). - KVM: SVM: Fix TSC_AUX virtualization setup (git-fixes). - RDMA/cm: Rate limit destroy CM ID timeout error message (git-fixes). - RDMA/counter: Check CAP_NET_RAW check in user namespace for RDMA counters (git-fixes). - RDMA/hns: Fix the modification of max_send_sge (git-fixes). - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (git-fixes). - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (git-fixes). - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (git-fixes). - RDMA/mlx5: Fix compilation warning when USER_ACCESS isn't set (git-fixes). - RDMA/nldev: Check CAP_NET_RAW in user namespace for QP modify (git-fixes). - RDMA/uverbs: Add empty rdma_uattrs_has_raw_cap() declaration (git-fixes). - RDMA/uverbs: Check CAP_NET_RAW in user namespace for QP create (git-fixes). - RDMA/uverbs: Check CAP_NET_RAW in user namespace for RAW QP create (git-fixes). - RDMA/uverbs: Check CAP_NET_RAW in user namespace for flow create (git-fixes). - arch/idle: Change arch_cpu_idle() behavior: always exit with IRQs disabled (git-fixes). - cpuidle/poll: Ensure IRQs stay disabled after cpuidle_state::enter() calls (git-fixes). - cpuidle: Move IRQ state validation (git-fixes). - cpuidle: haltpoll: Do not enable interrupts when entering idle (git-fixes). - dm: free table mempools if not used in __bind (git-fixes). - padata: Honor the caller's alignment in case of chunk_size 0 (bsc#1237563). - platform/x86/intel-uncore-freq: Fail module load when plat_info is NULL (git-fixes). - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (git-fixes). - x86/bugs: Use SBPB in write_ibpb() if applicable (git-fixes). - x86/paravirt: Move halt paravirt calls under CONFIG_PARAVIRT (git-fixes). - x86/tdx: Drop flags from __tdx_hypercall() (git-fixes). - x86/tdx: Dynamically disable SEPT violations from causing #VEs (git-fixes). - x86/tdx: Emit warning if IRQs are enabled during HLT #VE handling (git-fixes). - x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs (git-fixes). - x86/tdx: Fix __noreturn build warning around __tdx_hypercall_failed() (git-fixes). - x86/tdx: Fix arch_safe_halt() execution for TDX VMs (git-fixes). - x86/tdx: Introduce wrappers to read and write TD metadata (git-fixes). - x86/tdx: Make TDX_HYPERCALL asm similar to TDX_MODULE_CALL (git-fixes). - x86/tdx: Make macros of TDCALLs consistent with the spec (git-fixes). - x86/tdx: Pass TDCALL/SEAMCALL input/output registers via a structure (git-fixes). - x86/tdx: Reimplement __tdx_hypercall() using TDX_MODULE_CALL asm (git-fixes). - x86/tdx: Remove 'struct tdx_hypercall_args' (git-fixes). - x86/tdx: Remove TDX_HCALL_ISSUE_STI (git-fixes). - x86/tdx: Rename __tdx_module_call() to __tdcall() (git-fixes). - x86/tdx: Rename tdx_parse_tdinfo() to tdx_setup() (git-fixes). - x86/tdx: Retry partially-completed page conversion hypercalls (git-fixes). - x86/tdx: Skip saving output regs when SEAMCALL fails with VMFailInvalid (git-fixes). - x86/tdx: Zero out the missing RSI in TDX_HYPERCALL macro (git-fixes). - x86/virt/tdx: Make TDX_MODULE_CALL handle SEAMCALL #UD and #GP (git-fixes). - x86/virt/tdx: Wire up basic SEAMCALL functions (git-fixes). - xfs: fix sparse inode limits on runt AG (bsc#1254392).

View original source

05 / REFERENCES

Affected packages

Connected vulnerabilities

Source records

Further evidence