Affected: AlmaLinux:9: bpftool, AlmaLinux:9: kernel, AlmaLinux:9: kernel-64k, AlmaLinux:9: kernel-64k-core, AlmaLinux:9: kernel-64k-debug, AlmaLinux:9: kernel-64k-debug-core, AlmaLinux:9: kernel-64k-debug-devel, AlmaLinux:9: kernel-64k-debug-devel-matched, AlmaLinux:9: kernel-64k-debug-modules, AlmaLinux:9: kernel-64k-debug-modules-core and 52 more

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: Local information disclosure on Intel(R) Atom(R) processors (CVE-2023-28746) * kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow (CVE-2024-27403) * kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (CVE-2023-52658) * kernel: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (CVE-2024-35989) * kernel: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (CVE-2021-47385) * kernel: mptcp: ensure snd_nxt is properly initialized on connect (CVE-2024-36889) * kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune() (CVE-2024-36978) * kernel: net/mlx5: Add a timeout to acquire the command queue semaphore (CVE-2024-38556) * kernel: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked (CVE-2024-39483) * kernel: ionic: fix use after netif_napi_del() (CVE-2024-39502) * kernel: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CVE-2024-40959) * kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush (CVE-2024-42079) * kernel: sched: act_ct: take care of padding in struct zones_ht_key (CVE-2024-42272) * kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error (CVE-2024-42284)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgm…

Affected: Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Add a timeout to acquire the command queue semaphore

Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion.

Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Add a timeout to acquire the command queue semaphore

Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion.

Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion

Affected: openEuler:22.03-LTS-SP3: kernel

The Linux Kernel, the operating system core itself. Security Fix(es): In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has one byte appended at the end of a proper NTB. When the NTB is parsed, unwrap call looks for any leftover bytes in SKB provided by u_ether and if there are any pending bytes, it treats them as a separate NTB and parses it. But in case the second NTB (as per unwrap call) is faulty/corrupt, all the datagrams that were parsed properly in the first NTB and saved in rx_list are dropped. Adding a few custom traces showed the following: [002] d..1 7828.532866: dwc3_gadget_giveback: ep1out: req 000000003868811a length 1025/16384 zsI ==> 0 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb toprocess: 1025 [002] d..1 7828.532867: ncm_unwrap_ntb: K: ncm_unwrap_ntb nth: 1751999342 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb seq: 0xce67 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb blk_len: 0x400 [002] d..1 7828.532868: ncm_unwrap_ntb: K: ncm_unwrap_ntb ndp_len: 0x10 [002] d..1 7828.532869: ncm_unwrap_ntb: K: Parsed NTB with 1 frames In this case, the giveback is of 1025 bytes and block length is 1024. The rest 1 byte (which is 0x00) won't be parsed resulting in drop of all datagrams in rx_list. S…

kernel: tty: Fix out-of-bound vmalloc access in imageblit kernel: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump kernel: wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() kernel: cxl/port: Fix delete_endpoint() vs parent unregistration race kernel: platform/x86: wmi: Fix opening of char device kernel: dmaengine/idxd: hardware erratum allows potential security problem with direct access by untrusted application kernel: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() kernel: wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete kernel: nfp: flower: handle acti_netdevs allocation failure kernel: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work kernel: wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes kernel: wifi: iwlwifi: dbg-tlv: ensure NUL termination kernel: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work kernel: mlxbf_gige: call request_irq() after NAPI initialized kernel: wifi: cfg80211: check A-MSDU format more carefully kernel: wifi: iwlwifi: read txq->read_ptr under lock kernel: wifi: nl80211: don't free NULL coalescing rule kernel: net: kernel: UAF in network route management kernel: net: bridge: xmit: make sure we have at least eth header len bytes kernel: net/mlx5: Discard command completions in internal error kernel: net/mlx5: Add a timeout to acquire the command queue semaphore kernel: r8169: Fix possible ring buffer c…

kernel: hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field kernel: Local information disclosure on Intel(R) Atom(R) processors kernel: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" kernel: netfilter: nft_flow_offload: reset dst in route object after setting up flow kernel: dmaengine: idxd: Fix oops during rmmod on single-CPU platforms kernel: mptcp: ensure snd_nxt is properly initialized on connect kernel: net: sched: sch_multiq: fix possible OOB write in multiq_tune() kernel: net/mlx5: Add a timeout to acquire the command queue semaphore kernel: KVM: SVM: WARN on vNMI + NMI window iff NMIs are outright masked kernel: ionic: fix use after netif_napi_del() kernel: xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() kernel: gfs2: Fix NULL pointer dereference in gfs2_log_flush kernel: sched: act_ct: take care of padding in struct zones_ht_key kernel: tipc: Return non-zero value from tipc_udp_addr2str() on error

Security update for the Linux Kernel

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 154 more

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Add a timeout to acquire the command queue semaphore Prevent forced completion handling on an entry that has not yet been assigned an index, causing an out of bounds access on idx = -22. Instead of waiting indefinitely for the sem, blocking flow now waits for index to be allocated or a sem acquisition timeout before beginning the timer for FW completion. Kernel log example: mlx5_core 0000:06:00.0: wait_func_handle_exec_timeout:1128:(pid 185911): cmd[-22]: CREATE_UCTX(0xa04) No done completion

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.