The SUSE Linux Enterprise Micro 6.0 RT kernel was updated to receive various security bugfixes.
The following security bugs were fixed:
CVE-2023-52489: mm/sparsemem: fix race in accessing memory_section->usage (bsc#1221326).
CVE-2023-52581: netfilter: nf_tables: fix memleak when more than 255 elements expired (bsc#1220877).
CVE-2023-52859: perf: hisi: Fix use-after-free when register pmu fails (bsc#1225582).
CVE-2023-52889: apparmor: Fix null pointer deref when receiving skb during sock creation (bsc#1229287).
CVE-2024-26590: erofs: fix inconsistent per-file compression format (bsc#1220252).
CVE-2024-26631: ipv6: mcast: fix data-race in ipv6mcdown / mldifcwork (bsc#1221630).
CVE-2024-26668: netfilter: nft_limit: reject configurations that cause integer overflow (bsc#1222335).
CVE-2024-26669: kABI fix for net/sched: flower: Fix chain template offload (bsc#1222350).
CVE-2024-26677: Blacklist e7870cf13d20 (" Fix delayed ACKs to not set the reference serial number") (bsc#1222387)
CVE-2024-26735: ipv6: sr: fix possible use-after-free and null-ptr-deref (bsc#1222372).
CVE-2024-26808: netfilter: nftchainfilter: handle NETDEV_UNREGISTER for inet/ingress basechain (bsc#1222634).
CVE-2024-26809: netfilter: nftsetpipapo: release elements in clone only from destroy path (bsc#1222633).
CVE-2024-26812: kABI: vfio: struct virqfd kABI workaround (bsc#1222808).
CVE-2024-26835: netfilter: nf_tables: set dormant flag on hook register failure (bsc#1222967).
CVE-2024-26837: net: bridge: switchdev: race between creation of new group memberships and generation of the list of MDB events to replay (bsc#1222973).
CVE-2024-26851: netfilter: nfconntrackh323: Add protection for bmp length out of range (bsc#1223074)
CVE-2024-27010: net/sched: Fix mirred deadlock on device recursion (bsc#1223720).
CVE-2024-27011: netfilter: nf_tables: fix memleak in map from abort path (bsc#1223803).
CVE-2024-27024: net/rds: fix WARNING in rdsconnconnectifdown (bsc#1223777).
CVE-2024-27079: iommu/vt-d: Fix NULL domain on device release (bsc#1223742).
CVE-2024-27403: kabi: restore const specifier in flowoffloadroute_init() (bsc#1224415).
CVE-2024-27433: clk: mediatek: mt7622-apmixedsys: Fix an error handling path in clkmt8135apmixed_probe() (bsc#1224711).
CVE-2024-27437: vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625).
CVE-2024-35897: netfilter: nf_tables: discard table flag update with pending basechain deletion (bsc#1224510).
CVE-2024-35939: Fixed leak pages on dmasetdecrypted() failure (bsc#1224535).
CVE-2024-35949: btrfs: make sure that WRITTEN is set on all metadata blocks (bsc#1224700).
CVE-2024-36286: netfilter: nfnetlinkqueue: acquire rcureadlock() in instancedestroy_rcu() (bsc#1226801)
CVE-2024-36489: tls: fix missing memory barrier in tls_init (bsc#1226874)
CVE-2024-36881: mm/userfaultfd: Fix reset ptes when close() for wr-protected (bsc#1225718).
CVE-2024-36929: net: core: reject skb_copy(_expand) for fraglist GSO skbs (bsc#1225814).
CVE-2024-36933: net: nsh: Use correct macoffset to unwind gso skb in nshgso_segment() (bsc#1225832).
check-for-config-changes: ignore also GCCASMGOTOOUTPUTBROKEN Mainline commit f2f6a8e88717 ("init/Kconfig: remove CONFIGGCCASMGOTOOUTPUTWORKAROUND") replaced GCCASMGOTOOUTPUTWORKAROUND with GCCASMGOTOOUTPUT_BROKEN. Ignore both when checking config changes.
clk: en7523: fix rate divider for slic and spi clocks (git-fixes).
clk: qcom: Park shared RCGs upon registration (git-fixes).
clk: qcom: camcc-sc7280: Add parent dependency to all camera GDSCs (git-fixes).
clk: qcom: gcc-sa8775p: Update the GDSC wait_val fields and flags (git-fixes).
clk: qcom: gcc-sc7280: Update force mem core bit for UFS ICE clock (git-fixes).
clk: qcom: gpucc-sa8775p: Park RCG's clk source at XO during disable (git-fixes).
clk: qcom: gpucc-sa8775p: Remove the CLKISCRITICAL and ALWAYS_ON flags (git-fixes).
clk: qcom: gpucc-sa8775p: Update wait_val fields for GPU GDSC's (git-fixes).
clk: qcom: gpucc-sm8350: Park RCG's clk source at XO during disable (git-fixes).
clk: qcom: kpss-xcc: Return ofclkaddhwprovider to transfer the error (git-fixes).
clk: visconti: Add bounds-checking coverage for struct viscontipllprovider (stable-fixes).
clocksource/drivers/sh_cmt: Address race condition for clock events (stable-fixes).
config.sh: generate and install compile_commands.json (bsc#1228971) This file contains the command line options used to compile every C file. It's useful for the livepatching team.
cpu/SMT: Enable SMT only if a core is online (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588 git-fixes).
cxl/region: Move cxldpato_region() work to the region driver (bsc#1228472)
dev/parport: fix the array out-of-bounds risk (stable-fixes).
device property: Add cleanup.h based fwnodehandleput() scope based cleanup (stable-fixes).
dmaengine: dw: Add memory bus width verification (git-fixes).
dmaengine: dw: Add peripheral bus width verification (git-fixes).
docs: KVM: Fix register ID of SPSR_FIQ (git-fixes).
driver core: Fix uevent_show() vs driver detach race (git-fixes).