The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2022-4378: Fixed stack overflow in __do_proc_dointvec . - CVE-2022-3635: Fixed a use-after-free in the tst_timer of the file drivers/atm/idt77252.c . - CVE-2022-3424: Fixed use-after-free in gru_set_context_option, gru_fault and gru_handle_user_call_os that could lead to kernel panic . - CVE-2022-41850: Fixed a race condition in roccat_report_event in drivers/hid/hid-roccat.c . - CVE-2022-45934: Fixed a integer wraparound via L2CAP_CONF_REQ packets in l2cap_config_req in net/bluetooth/l2cap_core.c . - CVE-2022-3628: Fixed potential buffer overflow in brcmf_fweh_event_worker in wifi/brcmfmac . - CVE-2022-3567: Fixed a to race condition in inet6_stream_ops/inet6_dgram_ops . - CVE-2022-41858: Fixed a denial of service in sl_tx_timeout in drivers/net/slip . - CVE-2022-43945: Fixed a buffer overflow in the NFSD implementation . - CVE-2022-4095: Fixed a use-after-free in rtl8712 driver . - CVE-2022-3903: Fixed a denial of service with the Infrared Transceiver USB driver . - CVE-2022-2964: Fixed memory corruption issues in ax88179_178a devices . - CVE-2021-4037: Fixed function logic vulnerability that allowed local users to create files for the XFS file-system with an unintended group ownership and with group execution and SGID permission bits set . - CVE-2022-43750: Fixed vulnerability in usbmon that allowed a user-space client to corrupt the monitor"s internal memory . - CVE-2022-3542: Fixed memory leak in bnx2x_tpa_stop in drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c . - CVE-2022-3629: Fixed memory leak in vsock_connect in net/vmw_vsock/af_vsock.c . - CVE-2022-3646: Fixed memory leak in nilfs_attach_log_writer in fs/nilfs2/segment.c . - CVE-2022-3649: Fixed use-after-free in nilfs_new_inode in fs/nilfs2/inode.c . - CVE-2022-3621: Fixed null pointer dereference in nilfs_bmap_lookup_at_level in fs/nilfs2/inode.c . - CVE-2022-3594: Fixed excessive data logging in intr_callback in drivers/net/usb/r8152.c . - CVE-2022-3586: Fixed use-after-free in socket buffer that could allow a local unprivileged user to cause a denial of service . - CVE-2022-3565: Fixed use-after-free in del_timer in drivers/isdn/mISDN/l1oip_core.c . - CVE-2022-3524: Fixed memory leak in ipv6_renew_options in the IPv6 handler . - CVE-2022-40768: Fixed information leak in the scsi driver which allowed local users to obtain sensitive information from kernel memory . - CVE-2022-42703: Fixed use-after-free in mm/rmap.c related to leaf anon_vma double reuse . - CVE-2022-3169: Fixed an denial of service though request to NVME_IOCTL_RESET and NVME_IOCTL_SUBSYS_RESET . - CVE-2022-40307: Fixed a race condition that could had been exploited to trigger a use-after-free in the efi firmware capsule-loader.c . - CVE-2022-4139: Fixed an issue with the i915 driver that allowed the GPU to access any physical memory . - CVE-2022-4129: Fixed a denial of service with the Layer 2 Tunneling Protocol . A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. - CVE-2022-42896: Fixed a use-after-free vulnerability in the net/bluetooth/l2cap_core.c"s l2cap_connect and l2cap_le_connect_req which may have allowed code execution and leaking kernel memory remotely via Bluetooth . - CVE-2022-42895: Fixed an information leak in the net/bluetooth/l2cap_core.c"s l2cap_parse_conf_req which can be used to leak kernel pointers remotely . - CVE-2022-2602: Fixed a local privilege escalation vulnerability involving Unix socket Garbage Collection and io_uring . - CVE-2022-3176: Fixed a use-after-free in io_uring related to signalfd_poll and binder_poll . - CVE-2022-3707: Fixed a double free in the Intel GVT-g graphics driver . - CVE-2022-3625: Fixed a user-after-free vulnerability in devlink_param_set/devlink_param_get of the file net/core/devlink.c . - CVE-2022-3535: Fixed a memory leak in mvpp2_dbgfs_port_init of the file drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c . - CVE-2022-3545: Fixed a use-after-free in area_cache_get of the file drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c . - CVE-2022-39189: Fixed an issue were an unprivileged guest users can compromise the guest kernel because TLB flush operations were mishandled in certain KVM_VCPU_PREEMPTED situations . - CVE-2022-3577: Fixed an out-of-bounds memory write in bigben_probe of drivers/hid/hid-bigbenff.c . - CVE-2022-3521: Fixed a race condition in kcm_tx_work of the file net/kcm/kcmsock.c . - CVE-2022-2153: Fixed a NULL pointer dereference in the KVM subsystem, when attempting to set a SynIC IRQ . - CVE-2022-2978: Fixed a use-after-free in the NILFS file system . The following non-security bugs were fixed: - Drivers: hv: vmbus: Add VMbus IMC device to unsupported list . - Drivers: hv: vmbus: Add vmbus_requestor data structure for VMBus hardening . - Drivers: hv: vmbus: Allow cleanup of VMBUS_CONNECT_CPU if disconnected . - Drivers: hv: vmbus: Always handle the VMBus messages on CPU0 . - Drivers: hv: vmbus: Do not bind the offerrescind works to a specific CPU . - Drivers: hv: vmbus: Drop error message when "No request id available" . - Drivers: hv: vmbus: Fix handling of messages with transaction ID of zero . - Drivers: hv: vmbus: Fix potential crash on module unload . - Drivers: hv: vmbus: Introduce vmbus_request_addr_match . - Drivers: hv: vmbus: Introduce vmbus_sendpacket_getid . - Drivers: hv: vmbus: Introduce {lock,unlock}_requestor . - Drivers: hv: vmbus: Move __vmbus_open . - Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer . - Drivers: hv: vmbus: Replace smp_store_mb with virt_store_mb . - Drivers: hv: vmbus: Replace the per-CPU channel lists with a global array of channels . - Drivers: hv: vmbus: Use a spin lock for synchronizing channel scheduling vs. channel removal . - Drivers: hv: vmbus: fix double free in the error path of vmbus_add_channel_work . - Drivers: hv: vmbus: fix possible memory leak in vmbus_device_register . - PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv . - PCI: hv: Add hibernation support . - PCI: hv: Add validation for untrusted Hyper-V values . - PCI: hv: Drop msi_controller structure . - PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology . - PCI: hv: Fix a race condition when removing the device . - PCI: hv: Fix hibernation in case interrupts are not re-created . - PCI: hv: Fix hv_arch_irq_unmask for multi-MSI . - PCI: hv: Fix interrupt mapping for multi-MSI . - PCI: hv: Fix multi-MSI to allow more than one MSI vector . - PCI: hv: Fix sleep while in non-sleep context when removing child devices from the bus . - PCI: hv: Fix synchronization between channel callback and hv_compose_msi_msg . - PCI: hv: Fix synchronization between channel callback and hv_pci_bus_exit . - PCI: hv: Fix the definition of vector in hv_compose_msi_msg . - PCI: hv: Make the code arch neutral by adding arch specific interfaces . - PCI: hv: Only reuse existing IRTE allocation for Multi-MSI . - PCI: hv: Prepare hv_compose_msi_msg for the VMBus-channel-interrupt-to-vCPU reassignment functionality . - PCI: hv: Remove bus device removal unused refcount/functions . - PCI: hv: Remove unnecessary use of %hx . - PCI: hv: Reuse existing IRTE allocation in compose_msi_msg . - PCI: hv: Support for create interrupt v3 . - PCI: hv: Use PCI_ERROR_RESPONSE to identify config read errors . - PCI: hv: Use struct_size helper . - PCI: hv: Use vmbus_requestor to generate transaction IDs for VMbus hardening . - exfat: Return ENAMETOOLONG consistently for oversized paths . - hv_netvsc: Add check for kvmalloc_array . - hv_netvsc: Add error handling while switching data path . - hv_netvsc: Add the support of hibernation . - hv_netvsc: Add validation for untrusted Hyper-V values . - hv_netvsc: Cache the current data path to avoid duplicate call and message . - hv_netvsc: Check VF datapath when sending traffic to VF . - hv_netvsc: Fix hibernation for mlx5 VF driver . - hv_netvsc: Fix potential dereference of NULL pointer . - hv_netvsc: Fix race between VF offering and VF association message from host . - hv_netvsc: Print value of invalid ID in netvsc_send_{completion,tx_complete} . - hv_netvsc: Process NETDEV_GOING_DOWN on VF hot remove . - hv_netvsc: Remove unnecessary round_up for recv_completion_cnt . - hv_netvsc: Reset the RSC count if NVSP_STAT_FAIL in netvsc_receive . - hv_netvsc: Switch the data path at the right time during hibernation . - hv_netvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening . - hv_netvsc: Wait for completion on request SWITCH_DATA_PATH . - hv_netvsc: use netif_is_bond_master instead of open code . - mm/hugetlb: fix races when looking up a CONT-PTE/PMD size hugetlb page . - net: hyperv: remove use of bpf_op_t . - net: mana: Add rmb after checking owner bits . - net: netvsc: remove break after return . - scsi: storvsc: Drop DID_TARGET_FAILURE use . - scsi: storvsc: Fix max_outstanding_req_per_channel for Win8 and newer . - scsi: storvsc: Fix validation for unsolicited incoming packets . - scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq . - scsi: storvsc: Resolve data race in storvsc_probe . - scsi: storvsc: Use blk_mq_unique_tag to generate requestIDs . - scsi: storvsc: Use vmbus_requestor to generate transaction IDs for VMBus hardening . - scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback . - scsi: storvsc: Validate length of incoming packet in storvsc_on_channel_callback . - v3 of "PCI: hv: Only reuse existing IRTE allocation for Multi-MSI" - x86/cpu: Restore AMD"s DE_CFG MSR after resume . - x86/hyperv: Output host build info as normal Windows version number . - xfs: reserve data and rt quota at the same time . Special Instructions and Notes: Please reboot the system after installing this update.