Summary
[5.15.0-300.163.18]
- crypto: qat - specify firmware files for 402xx (Giovanni Cabiddu) [Orabug: 37044631]
[5.15.0-300.163.17]
- KVM/x86: Do not clear SIPI while in SMM (Boris Ostrovsky) [Orabug: 36955051]
- Revert 'Fix userfaultfd_api to return EINVAL as expected' (Vijayendra Suman) [Orabug: 36992217]
[5.15.0-300.163.16]
- Revert 'bpf: Allow reads from uninit stack' (Vijayendra Suman) [Orabug: 36977604]
- platform/x86/amd/hsmp: Check HSMP support on AMD family of processors (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: switch to use device_add_groups() (Greg Kroah-Hartman) [Orabug: 36965024]
- platform/x86/amd/hsmp: Change devm_kzalloc() to devm_kcalloc() (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Remove extra parenthesis and add a space (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Check num_sockets against MAX_AMD_SOCKETS (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Non-ACPI support for AMD F1A_M00~0Fh (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Add support for ACPI based probing (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Restructure sysfs group creation (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Move dev from platdev to hsmp_socket (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Define a struct to hold mailbox regs (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Create static func to handle platdev (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Cache pci_dev in struct hsmp_socket (Suma Hegde) [Orabug: 36965024]
- platform/x86/amd/hsmp: Move hsmp_test to probe (Suma Hegde) [Orabug: 36965024]
- uek-rpm/core-x86_64.list: Add amd_hsmp.ko in kernel-uek-core (Vijay Kumar) [Orabug: 36970850]
- mtd: use refcount to prevent corruption (Tomas Winkler) [Orabug: 36975228]
- mtd: core: clear out unregistered devices a bit more (Zev Weiss) [Orabug: 36975228]
- mtd: core: Drop duplicate NULL checks around nvmem_unregister() (Andy Shevchenko) [Orabug: 36975228]
- mtd: core: Fix refcount error in del_mtd_device() (Shang XiaoJing) [Orabug: 36975228]
- mips: add pte_unmap() to balance pte_offset_map() (Hugh Dickins) [Orabug: 36975237]
- selftests/vm: Fix build issue with pkey_sighandler_tests.c (Aruna Ramakrishna) [Orabug: 36976755]
- Revert 'igb: free up irq resources in device shutdown path.' (Yifei Liu) [Orabug: 36948889]
- Revert 'igb: fix __free_irq warnings seen during module unload.' (Yifei Liu) [Orabug: 36948889]
- SUNRPC: Improve accuracy of socket ENOBUFS determination (Trond Myklebust) [Orabug: 36834328]
- SUNRPC: Replace internal use of SOCKWQ_ASYNC_NOSPACE (Trond Myklebust) [Orabug: 36834328]
- uek-rpm: mips: Disable CONFIG_CRYPTO_FIPS for kdump kernel (Dave Kleikamp) [Orabug: 36935921]
- MIPS: Octeon: Add PCIe link status check (Dave Kleikamp) [Orabug: 36948261]
- fwctl/mlx5: Add INTERNAL_DEV_RES uctx capability (Avihai Horon) [Orabug: 36863219]
- uek-rpm: build the fwctl mlx5 driver on UEK (Qing Huang) [Orabug: 36466726]
- fwctl: Adapt code for UEK7 (Mikhael Goikhman) [Orabug: 36466726]
- taint: Add TAINT_FWCTL (Jason Gunthorpe) [Orabug: 36466726]
- mm/slab: make __free(kfree) accept error pointers (Dan Carpenter) [Orabug: 36466726]
- mlx5: Create an auxiliary device for fwctl_mlx5 (Saeed Mahameed) [Orabug: 36466726]
- fwctl/mlx5: Support for communicating with mlx5 fw (Saeed Mahameed) [Orabug: 36466726]
- fwctl: FWCTL_RPC to execute a Remote Procedure Call to device firmware (Jason Gunthorpe) [Orabug: 36466726]
- fwctl: FWCTL_INFO to return basic information about the device (Jason Gunthorpe) [Orabug: 36466726]
- fwctl: Basic ioctl dispatch for the character device (Jason Gunthorpe) [Orabug: 36466726]
- fwctl: Add basic structure for a class subsystem with a cdev (Jason Gunthorpe) [Orabug: 36466726]
- cleanup: Add conditional guard support (Peter Zijlstra) [Orabug: 36466726]
- cleanup: Make no_free_ptr() __must_check (Peter Zijlstra) [Orabug: 36466726]
- locking: Introduce __cleanup() based infrastructure (Peter Zijlstra) [Orabug: 36466726]
- dmaengine: ioat: Free up __cleanup() name (Peter Zijlstra) [Orabug: 36466726]
- container_of: Update header inclusions (Andy Shevchenko) [Orabug: 36466726]
- container_of: add container_of_const() that preserves const-ness of the pointer (Greg Kroah-Hartman) [Orabug: 36466726]
- linux/container_of.h: Warn about loss of constness (Sakari Ailus) [Orabug: 36466726]
- container_of: remove container_of_safe() (Greg Kroah-Hartman) [Orabug: 36466726]
- dmaengine: ioat: Fix spelling mistake 'idel' -> 'idle' (Colin Ian King) [Orabug: 36466726]
- preempt: Provide preempt_[dis|en]able_nested() (Thomas Gleixner) [Orabug: 36466726]
- locking: Detect includes rwlock.h outside of spinlock.h (Sebastian Andrzej Siewior) [Orabug: 36466726]
- tracepoint: Allow trace events in modules with TAINT_TEST (Alison Schofield) [Orabug: 36466726]
- panic: Taint kernel if tests are run (David Gow) [Orabug: 36466726]
- linux/container_of.h: switch to static_assert (Rasmus Villemoes) [Orabug: 36466726]
- kernel.h: split out container_of() and typeof_member() macros (Andy Shevchenko) [Orabug: 36466726]
- uek-rpm: add CONFIG_NETDEVSIM=m build flag (Qing Huang) [Orabug: 36836285]
- Revert 'net: netdevsim: use mock PHC driver' (Qing Huang) [Orabug: 36836285]
- Revert 'net: netdevsim: mimic tc-taprio offload' (Qing Huang) [Orabug: 36836285]
- Revert 'net: netdevsim: don't try to destroy PHC on VFs' (Qing Huang) [Orabug: 36836285]
- xfrm: call xfrm_dev_policy_delete when kill policy (Jianbo Liu) [Orabug: 36848687]
- xfrm: fix netdev reference count imbalance (Jianbo Liu) [Orabug: 36848687]
- xfrm: don't skip free of empty state in acquire policy (Leon Romanovsky) [Orabug: 36848687]
- xfrm: delete offloaded policy (Leon Romanovsky) [Orabug: 36848687]
- Revert 'arch/arm64/boot/dts: psci support' (Joe Dobosenski) [Orabug: 36911826]
- uek-rpm: mips: Config changes for fips (Dave Kleikamp) [Orabug: 36912607]
-
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | bpftool | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-container | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-container-debug | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-core | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-debug | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-core | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-devel | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-debug-modules-extra | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-devel | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-doc | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-modules | 0:5.15.0-300.163.18.el9uek |
| Oracle Linux · 8 | kernel-uek-modules-extra | 0:5.15.0-300.163.18.el9uek |
Vulnerabilities 22
-
High 8.8
scsi: qla2xxx: Complete command early within lock
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Complete command early within lock A crash was observed while performing NPIV and FW reset, BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read…
-
High 7.8
mm/slab: make __free(kfree) accept error pointers
In the Linux kernel, the following vulnerability has been resolved: mm/slab: make __free(kfree) accept error pointers Currently, if an automatically freed allocation is an error pointer that will lead to a crash. An example of this is in wm831x_gpio_dbg_show(…
-
High 7.8
sched: act_ct: take care of padding in struct zones_ht_key
In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointer. Make sure rhashtabl…
-
High 7.8
scsi: qla2xxx: Fix for possible memory corruption
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix for possible memory corruption Init Control Block is dereferenced incorrectly. Correctly dereference ICB
-
High 7.5
Hardware logic with insecure de-synchronization in Intel(R) DSA and Intel(R) IAA for some Intel(R) 4th or 5th generatio…
-
High 7.5
scsi: qla2xxx: validate nvme_local_port correctly
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: validate nvme_local_port correctly The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BU…
-
High 7.0
drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() The "instance" variable needs to be signed for the error handling to work.
-
Unscored —
net: mana: Fix TX CQE error handling
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type (probably from a newer hardware), still free the SKB, update the queue tail, etc., otherwise the accounting will be wrong…
-
Unscored —
net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context Indirection (*) is of lower precedence than postfix increment (++). Logic in napi_poll context would cause an ou…
-
Unscored —
net: netdevsim: don't try to destroy PHC on VFs
In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: don't try to destroy PHC on VFs PHC gets initialized in nsim_init_netdevsim(), which is only called if (nsim_dev_port_is_pf()). Create a counterpart of nsim_init_netdevsim() a…
-
Unscored —
scsi: smartpqi: Fix disable_managed_interrupts
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix disable_managed_interrupts Correct blk-mq registration issue with module parameter disable_managed_interrupts enabled. When we turn off the default PCI_IRQ_AFFINITY flag, …
-
Unscored —
dmaengine: idxd: Ensure safe user copy of completion record
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Ensure safe user copy of completion record If CONFIG_HARDENED_USERCOPY is enabled, copying completion record from event log cache to user triggers a kernel bug. [ 1987.159822…
-
Unscored —
net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use a memory barrier to enforce PTP WQ xmit submission tracking occurs after populating the metadata_map Just simply reordering the functions mlx5e_ptp_metadata_map_put and mlx5e_p…
-
Unscored —
dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue drain_workqueue() cannot be called safely in a spinlocked context due to possible task rescheduling. In the multi-task scenari…
-
Unscored —
net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules rx_create no longer allocates a modify_hdr instance that needs to be cleaned up. The mlx5_modify_header_dealloc cal…
-
Unscored —CVE-2024-36907 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING When the "storcli2 show" command is executed for eHBA-9600, mpi3mr driver prints this WARNING message: memcpy: detected field-spanning …
-
Unscored —
scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() lpfc_worker_wake_up() calls the lpfc_work_done() routine, which takes the hbalock. Thus, lpfc_worker_wake_up() should not be c…
-
Unscored —
dmaengine: idxd: Avoid unnecessary destruction of file_ida
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary destruction of file_ida file_ida is allocated during cdev open and is freed accordingly during cdev release. This sequence is guaranteed by driver file oper…
-
Unscored —
scsi: mpi3mr: Sanitise num_phys
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Sanitise num_phys Information is stored in mr_sas_port->phy_mask, values larger then size of this field shouldn't be allowed.
-
Unscored —
scsi: qla2xxx: During vport delete send async logout explicitly
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: During vport delete send async logout explicitly During vport delete, it is observed that during unload we hit a crash because of stale entries in outstanding command array. Fo…
-
Unscored —CVE-2024-44952 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.