🛡️ SUSE-SU-2025:4123-1 — kgraft-patch-sle12-sp5-update-61 (CVE-2022-48956 +57 more)

Security update for the Linux Kernel (Live Patch 61 for SUSE Linux Enterprise 12 SP5)

This update for the SUSE Linux Enterprise kernel 4.12.14-122.231 fixes various security issues

The following security issues were fixed:

• CVE-2022-48956: ipv6: avoid use-after-free in ip6_fragment() (bsc#1232637).
• CVE-2022-49014: net: tun: Fix use-after-free in tun_detach() (bsc#1232818).
• CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF (bsc#1237930).
• CVE-2022-49080: mm/mempolicy: fix mpol_new leak in shared_policy_replace (bsc#1238324).
• CVE-2022-49179: block, bfq: don't move oom_bfqq (bsc#1241331).
• CVE-2022-49465: blk-throttle: set BIO_THROTTLED when bio has been throttled (bsc#1238920).
• CVE-2022-49545: ALSA: usb-audio: cancel pending work at closing a MIDI substream (bsc#1238730).
• CVE-2022-49563: crypto: qat - add param check for RSA (bsc#1238788).
• CVE-2022-49564: crypto: qat - add param check for DH (bsc#1238790).
• CVE-2022-50252: igb: Do not free q_vector unless new one was allocated (bsc#1249847).
• CVE-2022-50386: Bluetooth: L2CAP: Fix user-after-free (bsc#1250302).
• CVE-2024-45016: netem: fix return value if duplicate enqueue fails (bsc#1230998).
• CVE-2024-46818: drm/amd/display: check gpio_id before used as array index (bsc#1231204).
• CVE-2024-47674: mm: avoid leaving partial pfn mappings around in error case (bsc#1231676).
• CVE-2024-47684: tcp: check skb is non-NULL in tcp_rto_delta_us() (bsc#1231993).
• CVE-2024-47706: block, bfq: fix possible UAF for bfqq->bic with merge chain (bsc#1231943).
• CVE-2024-49860: ACPI: sysfs: validate return type of _STR method (bsc#1231862).
• CVE-2024-50115: KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory (bsc#1233019).
• CVE-2024-50125: Bluetooth: SCO: Fix UAF on sco_sock_timeout (bsc#1232929).
• CVE-2024-50154: tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink() (bsc#1233072).
• CVE-2024-50264: vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (bsc#1233712).
• CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing (bsc#1233708).
• CVE-2024-50301: security/keys: fix slab-out-of-bounds in key_task_permission (bsc#1233680).
• CVE-2024-50302: HID: core: zero-initialize the report buffer (bsc#1233679).
• CVE-2024-53104: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (bsc#1236783).
• CVE-2024-53146: NFSD: prevent a potential integer overflow (bsc#1234854).
• CVE-2024-53156: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() (bsc#1234847).
• CVE-2024-53168: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket (bsc#1243650).
• CVE-2024-53173: NFSv4.0: Fix a use-after-free problem in the asynchronous open() (bsc#1234892).
• CVE-2024-53214: vfio/pci: Properly hide first-in-list PCIe extended capability (bsc#1235005).
• CVE-2024-56600: net: inet6: do not leave a dangling sk pointer in inet6_create() (bsc#1235218).
• CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inet_create() (bsc#1235231).
• CVE-2024-56605: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() (bsc#1235062).
• CVE-2024-56650: netfilter: x_tables: fix LED ID check in led_tg_check() (bsc#1235431).
• CVE-2024-56664: bpf, sockmap: fix race between element replace and close() (bsc#1235250).
• CVE-2024-57893: ALSA: seq: oss: fix races at processing SysEx messages (bsc#1235921).
• CVE-2024-57996: net_sched: sch_sfq: don't allow 1 packet limit (bsc#1239077).
• CVE-2024-8805: BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability (bsc#1240840).
• CVE-2025-21702: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 (bsc#1245797).
• CVE-2025-21772: partitions: mac: fix handling of bogus partition table (bsc#1238912).
• CVE-2025-21791: vrf: use RCU protection in l3mdev_l3_out() (bsc#1240744).
• CVE-2025-21971: net_sched: Prevent creation of classes with TC_H_ROOT (bsc#1245794).
• CVE-2025-37752: net_sched: sch_sfq: move the limit validation (bsc#1245776).
• CVE-2025-37797: net_sched: hfsc: Fix a UAF vulnerability in class handling (bsc#1245793).
• CVE-2025-38000: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (bsc#1245775).
• CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept (bsc#1245218).
• CVE-2025-38083: net_sched: prio: fix a race in prio_tune() (bsc#1245350).
• CVE-2025-38177: kernel: sch_hfsc: make hfsc_qlen_notify() idempotent (bsc#1246356).
• CVE-2025-38181: calipso: fix null-ptr-deref in calipso_req_{set,del}attr() (bsc#1246001).
• CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU (bsc#1246030).
• CVE-2025-38477: net/sched: sch_qfq: Fix race condition on qfq_aggregate (bsc#1247315).
• CVE-2025-38494: HID: core: do not bypass hid_hw_raw_request (bsc#1247350).
• CVE-2025-38495: HID: core: ensure the allocated report buffer can contain the reserved report ID (bsc#1247351).
• CVE-2025-38498: do_change_type(): refuse to operate