Security update for the Linux Kernel

Announcement ID:	SUSE-SU-2023:3313-1
Rating:	important
References:	#1206418 #1207129 #1210627 #1210780 #1211131 #1211738 #1212502 #1212604 #1212901 #1213167 #1213272 #1213287 #1213304 #1213585 #1213586 #1213588 #1213620 #1213653 #1213713 #1213715 #1213747 #1213756 #1213759 #1213777 #1213810 #1213812 #1213842 #1213856 #1213857 #1213863 #1213867 #1213870 #1213871
Cross-References:	CVE-2022-40982 CVE-2023-0459 CVE-2023-20569 CVE-2023-21400 CVE-2023-2156 CVE-2023-2166 CVE-2023-31083 CVE-2023-3268 CVE-2023-3567 CVE-2023-3609 CVE-2023-3611 CVE-2023-3776 CVE-2023-4004
CVSS scores:	CVE-2022-40982 ( SUSE ): 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVE-2022-40982 ( NVD ): 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2023-0459 ( SUSE ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2023-0459 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVE-2023-20569 ( SUSE ): 5.6 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N CVE-2023-21400 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-21400 ( NVD ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-2156 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-2156 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2023-2166 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2023-2166 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2023-31083 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2023-31083 ( NVD ): 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H CVE-2023-3268 ( SUSE ): 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L CVE-2023-3268 ( NVD ): 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H CVE-2023-3567 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-3567 ( NVD ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-3609 ( SUSE ): 7.0 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-3609 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-3611 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-3611 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-3776 ( SUSE ): 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVE-2023-3776 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-4004 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVE-2023-4004 ( NVD ): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Products:	Basesystem Module 15-SP4 Development Tools Module 15-SP4 Legacy Module 15-SP4 openSUSE Leap 15.4 openSUSE Leap Micro 5.3 openSUSE Leap Micro 5.4 SUSE Linux Enterprise Desktop 15 SP4 SUSE Linux Enterprise High Availability Extension 15 SP4 SUSE Linux Enterprise High Performance Computing 15 SP4 SUSE Linux Enterprise Live Patching 15-SP4 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro for Rancher 5.3 SUSE Linux Enterprise Micro for Rancher 5.4 SUSE Linux Enterprise Real Time 15 SP4 SUSE Linux Enterprise Server 15 SP4 SUSE Linux Enterprise Server for SAP Applications 15 SP4 SUSE Linux Enterprise Workstation Extension 15 SP4 SUSE Manager Proxy 4.3 SUSE Manager Retail Branch Server 4.3 SUSE Manager Server 4.3

An update that solves 13 vulnerabilities and has 20 fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2022-40982: Fixed transient execution attack called "Gather Data Sampling" (bsc#1206418).
• CVE-2023-0459: Fixed information leak in __uaccess_begin_nospec (bsc#1211738).
• CVE-2023-20569: Fixed side channel attack ‘Inception’ or ‘RAS Poisoning’ (bsc#1213287).
• CVE-2023-21400: Fixed several memory corruptions due to improper locking in io_uring (bsc#1213272).
• CVE-2023-2156: Fixed a flaw in the networking subsystem within the handling of the RPL protocol (bsc#1211131).
• CVE-2023-2166: Fixed NULL pointer dereference in can_rcv_filter (bsc#1210627).
• CVE-2023-31083: Fixed race condition in hci_uart_tty_ioctl (bsc#1210780).
• CVE-2023-3268: Fixed an out of bounds memory access flaw in relay_file_read_start_pos in the relayfs (bsc#1212502).
• CVE-2023-3567: Fixed a use-after-free in vcs_read in drivers/tty/vt/vc_screen.c (bsc#1213167).
• CVE-2023-3609: Fixed reference counter leak leading to overflow in net/sched (bsc#1213586).
• CVE-2023-3611: Fixed an out-of-bounds write in net/sched sch_qfq(bsc#1213585).
• CVE-2023-3776: Fixed improper refcount update in cls_fw leads to use-after-free (bsc#1213588).
• CVE-2023-4004: Fixed improper element removal netfilter nft_set_pipapo (bsc#1213812).

The following non-security bugs were fixed:

• afs: Fix access after dec in put functions (git-fixes).
• afs: Fix afs_getattr() to refetch file status if callback break occurred (git-fixes).
• afs: Fix dynamic root getattr (git-fixes).
• afs: Fix fileserver probe RTT handling (git-fixes).
• afs: Fix infinite loop found by xfstest generic/676 (git-fixes).
• afs: Fix lost servers_outstanding count (git-fixes).
• afs: Fix server->active leak in afs_put_server (git-fixes).
• afs: Fix setting of mtime when creating a file/dir/symlink (git-fixes).
• afs: Fix updating of i_size with dv jump from server (git-fixes).
• afs: Fix vlserver probe RTT handling (git-fixes).
• afs: Return -EAGAIN, not -EREMOTEIO, when a file already locked (git-fixes).
• afs: Use refcount_t rather than atomic_t (git-fixes).
• afs: Use the operation issue time instead of the reply time for callbacks (git-fixes).
• afs: adjust ack interpretation to try and cope with nat (git-fixes).
• alsa: emu10k1: roll up loops in dsp setup code for audigy (git-fixes).
• alsa: hda/realtek: support asus g713pv laptop (git-fixes).
• alsa: hda/relatek: enable mute led on hp 250 g8 (git-fixes).
• alsa: usb-audio: add quirk for microsoft modern wireless headset (bsc#1207129).
• alsa: usb-audio: update for native dsd support quirks (git-fixes).
• asoc: atmel: fix the 8k sample parameter in i2sc master (git-fixes).
• asoc: codecs: es8316: fix dmic config (git-fixes).
• asoc: da7219: check for failure reading aad irq events (git-fixes).
• asoc: da7219: flush pending aad irq when suspending (git-fixes).
• asoc: fsl_sai: disable bit clock with transmitter (git-fixes).
• asoc: fsl_spdif: silence output on stop (git-fixes).
• asoc: rt5682-sdw: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: rt711-sdca: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: rt711: fix for jd event handling in clockstop mode0 (git-fixes).
• asoc: wm8904: fill the cache for wm8904_adc_test_0 register (git-fixes).
• ata: pata_ns87415: mark ns87560_tf_read static (git-fixes).
• block, bfq: Fix division by zero error on zero wsum (bsc#1213653).
• block: Fix a source code comment in include/uapi/linux/blkzoned.h (git-fixes).
• can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED (git-fixes).
• ceph: do not let check_caps skip sending responses for revoke msgs (bsc#1213856).
• coda: Avoid partial allocation of sig_inputArgs (git-fixes).
• dlm: fix missing lkb refcount handling (git-fixes).
• dlm: fix plock invalid read (git-fixes).
• documentation: devices.txt: reconcile serial/ucc_uart minor numers (git-fixes).
• drm/amd/display: Disable MPC split by default on special asic (git-fixes).
• drm/amd/display: Keep PHY active for DP displays on DCN31 (git-fixes).
• drm/client: Fix memory leak in drm_client_modeset_probe (git-fixes).
• drm/msm/adreno: Fix snapshot BINDLESS_DATA size (git-fixes).
• drm/msm/dpu: drop enum dpu_core_perf_data_bus_id (git-fixes).
• drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() (git-fixes).
• drm/radeon: Fix integer overflow in radeon_cs_parser_init (git-fixes).
• file: always lock position for FMODE_ATOMIC_POS (bsc#1213759).
• fs: dlm: add midcomms init/start functions (git-fixes).
• fs: dlm: do not set stop rx flag after node reset (git-fixes).
• fs: dlm: filter user dlm messages for kernel locks (git-fixes).
• fs: dlm: fix log of lowcomms vs midcomms (git-fixes).
• fs: dlm: fix race between test_bit() and queue_work() (git-fixes).
• fs: dlm: fix race in lowcomms (git-fixes).
• fs: dlm: handle -EBUSY first in lock arg validation (git-fixes).
• fs: dlm: move sending fin message into state change handling (git-fixes).
• fs: dlm: retry accept() until -EAGAIN or error returns (git-fixes).
• fs: dlm: return positive pid value for F_GETLK (git-fixes).
• fs: dlm: start midcomms before scand (git-fixes).
• fs: hfsplus: remove WARN_ON() from hfsplus_cat_{read,write}_inode() (git-fixes).
• fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (git-fixes).
• fs: jfs: check for read-only mounted filesystem in txbegin (git-fixes).
• fs: jfs: fix null-ptr-deref read in txbegin (git-fixes).
• gve: Set default duplex configuration to full (git-fixes).
• gve: unify driver name usage (git-fixes).
• hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature (git-fixes).
• hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled (git-fixes).
• iavf: Fix out-of-bounds when setting channels on remove (git-fixes).
• iavf: Fix use-after-free in free_netdev (git-fixes).
• iavf: use internal state to free traffic IRQs (git-fixes).
• igc: Check if hardware TX timestamping is enabled earlier (git-fixes).
• igc: Enable and fix RX hash usage by netstack (git-fixes).
• igc: Fix Kernel Panic during ndo_tx_timeout callback (git-fixes).
• igc: Fix inserting of empty frame for launchtime (git-fixes).
• igc: Fix launchtime before start of cycle (git-fixes).
• igc: Fix race condition in PTP tx code (git-fixes).
• igc: Handle PPS start time programming for past time values (git-fixes).
• igc: Prevent garbled TX queue with XDP ZEROCOPY (git-fixes).
• igc: Remove delay during TX ring configuration (git-fixes).
• igc: Work around HW bug causing missing timestamps (git-fixes).
• igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings (git-fixes).
• input: i8042 - add clevo pcx0dx to i8042 quirk table (git-fixes).
• input: iqs269a - do not poll during ati (git-fixes).
• input: iqs269a - do not poll during suspend or resume (git-fixes).
• jffs2: GC deadlock reading a page that is used in jffs2_write_begin() (git-fixes).
• jffs2: fix memory leak in jffs2_do_fill_super (git-fixes).
• jffs2: fix memory leak in jffs2_do_mount_fs (git-fixes).
• jffs2: fix memory leak in jffs2_scan_medium (git-fixes).
• jffs2: fix use-after-free in jffs2_clear_xattr_subsystem (git-fixes).
• jffs2: reduce stack usage in jffs2_build_xattr_subsystem() (git-fixes).
• jfs: jfs_dmap: Validate db_l2nbperpage while mounting (git-fixes).
• kvm: arm64: do not read a hw interrupt pending state in user context (git-fixes)
• kvm: arm64: warn if accessing timer pending state outside of vcpu (bsc#1213620)
• kvm: do not null dereference ops->destroy (git-fixes)
• kvm: downgrade two bug_ons to warn_on_once (git-fixes)
• kvm: initialize debugfs_dentry when a vm is created to avoid null (git-fixes)
• kvm: s390: pv: fix index value of replaced asce (git-fixes bsc#1213867).
• kvm: vmx: inject #gp on encls if vcpu has paging disabled (cr0.pg==0) (git-fixes).
• kvm: vmx: inject #gp, not #ud, if sgx2 encls leafs are unsupported (git-fixes).
• kvm: vmx: restore vmx_vmexit alignment (git-fixes).
• kvm: x86: account fastpath-only vm-exits in vcpu stats (git-fixes).
• libceph: harden msgr2.1 frame segment length checks (bsc#1213857).
• media: staging: atomisp: select V4L2_FWNODE (git-fixes).
• net/sched: sch_qfq: refactor parsing of netlink parameters (bsc#1213585).
• net/sched: sch_qfq: reintroduce lmax bound check for MTU (bsc#1213585).
• net: ena: fix shift-out-of-bounds in exponential backoff (git-fixes).
• net: mana: Batch ringing RX queue doorbell on receiving packets (bsc#1212901).
• net: mana: Use the correct WQE count for ringing RQ doorbell (bsc#1212901).
• net: phy: marvell10g: fix 88x3310 power up (git-fixes).
• nfsd: add encoding of op_recall flag for write delegation (git-fixes).
• nfsd: fix double fget() bug in __write_ports_addfd() (git-fixes).
• nfsd: fix sparse warning (git-fixes).
• nfsd: remove open coding of string copy (git-fixes).
• nfsv4.1: always send a reclaim_complete after establishing lease (git-fixes).
• nfsv4.1: freeze the session table upon receiving nfs4err_badsession (git-fixes).
• nvme-pci: fix DMA direction of unmapping integrity data (git-fixes).
• nvme-pci: remove nvme_queue from nvme_iod (git-fixes).
• octeontx-af: fix hardware timestamp configuration (git-fixes).
• octeontx2-af: Move validation of ptp pointer before its usage (git-fixes).
• octeontx2-pf: Add additional check for MCAM rules (git-fixes).
• phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() (git-fixes).
• pinctrl: amd: Do not show Invalid config param errors (git-fixes).
• pinctrl: amd: Use amd_pinconf_set() for all config options (git-fixes).
• platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 (git-fixes).
• rdma/bnxt_re: fix hang during driver unload (git-fixes)
• rdma/bnxt_re: prevent handling any completions after qp destroy (git-fixes)
• rdma/core: update cma destination address on rdma_resolve_addr (git-fixes)
• rdma/irdma: add missing read barriers (git-fixes)
• rdma/irdma: fix data race on cqp completion stats (git-fixes)
• rdma/irdma: fix data race on cqp request done (git-fixes)
• rdma/irdma: fix op_type reporting in cqes (git-fixes)
• rdma/irdma: report correct wc error (git-fixes)
• rdma/mlx4: make check for invalid flags stricter (git-fixes)
• rdma/mthca: fix crash when polling cq for shared qps (git-fixes)
• regmap: Account for register length in SMBus I/O limits (git-fixes).
• regmap: Drop initial version of maximum transfer length fixes (git-fixes).
• revert "debugfs, coccinelle: check for obsolete define_simple_attribute() usage" (git-fixes).
• revert "nfsv4: retry lock on old_stateid during delegation return" (git-fixes).
• revert "usb: dwc3: core: enable autoretry feature in the controller" (git-fixes).
• revert "usb: gadget: tegra-xudc: fix error check in tegra_xudc_powerdomain_init()" (git-fixes).
• revert "usb: xhci: tegra: fix error check" (git-fixes).
• revert "xhci: add quirk for host controllers that do not update endpoint dcs" (git-fixes).
• rxrpc, afs: Fix selection of abort codes (git-fixes).
• s390/bpf: Add expoline to tail calls (git-fixes bsc#1213870).
• s390/dasd: fix hanging device after quiesce/resume (git-fixes bsc#1213810).
• s390/decompressor: specify __decompress() buf len to avoid overflow (git-fixes bsc#1213863).
• s390/ipl: add missing intersection check to ipl_report handling (git-fixes bsc#1213871).
• s390/qeth: Fix vipa deletion (git-fixes bsc#1213713).
• s390/vmem: fix empty page tables cleanup under KASAN (git-fixes bsc#1213715).
• s390: introduce nospec_uses_trampoline() (git-fixes bsc#1213870).
• scftorture: Count reschedule IPIs (git-fixes).
• scsi: lpfc: Abort outstanding ELS cmds when mailbox timeout error is detected (bsc#1213756).
• scsi: lpfc: Avoid -Wstringop-overflow warning (bsc#1213756).
• scsi: lpfc: Clean up SLI-4 sysfs resource reporting (bsc#1213756).
• scsi: lpfc: Copyright updates for 14.2.0.14 patches (bsc#1213756).
• scsi: lpfc: Fix a possible data race in lpfc_unregister_fcf_rescan() (bsc#1213756).
• scsi: lpfc: Fix incorrect big endian type assignment in bsg loopback path (bsc#1213756).
• scsi: lpfc: Fix incorrect big endian type assignments in FDMI and VMID paths (bsc#1213756).
• scsi: lpfc: Fix lpfc_name struct packing (bsc#1213756).
• scsi: lpfc: Make fabric zone discovery more robust when handling unsolicited LOGO (bsc#1213756).
• scsi: lpfc: Pull out fw diagnostic dump log message from driver's trace buffer (bsc#1213756).
• scsi: lpfc: Qualify ndlp discovery state when processing RSCN (bsc#1213756).
• scsi: lpfc: Refactor cpu affinity assignment paths (bsc#1213756).
• scsi: lpfc: Remove extra ndlp kref decrement in FLOGI cmpl for loop topology (bsc#1213756).
• scsi: lpfc: Replace all non-returning strlcpy() with strscpy() (bsc#1213756).
• scsi: lpfc: Replace one-element array with flexible-array member (bsc#1213756).
• scsi: lpfc: Revise ndlp kref handling for dev_loss_tmo_callbk and lpfc_drop_node (bsc#1213756).
• scsi: lpfc: Set Establish Image Pair service parameter only for Target Functions (bsc#1213756).
• scsi: lpfc: Simplify fcp_abort transport callback log message (bsc#1213756).
• scsi: lpfc: Update lpfc version to 14.2.0.14 (bsc#1213756).
• scsi: lpfc: Use struct_size() helper (bsc#1213756).
• scsi: qla2xxx: Adjust IOCB resource on qpair create (bsc#1213747).
• scsi: qla2xxx: Array index may go out of bound (bsc#1213747).
• scsi: qla2xxx: Avoid fcport pointer dereference (bsc#1213747).
• scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (bsc#1213747).
• scsi: qla2xxx: Correct the index of array (bsc#1213747).
• scsi: qla2xxx: Drop useless LIST_HEAD (bsc#1213747).
• scsi: qla2xxx: Fix NULL pointer dereference in target mode (bsc#1213747).
• scsi: qla2xxx: Fix TMF leak through (bsc#1213747).
• scsi: qla2xxx: Fix buffer overrun (bsc#1213747).
• scsi: qla2xxx: Fix command flush during TMF (bsc#1213747).
• scsi: qla2xxx: Fix deletion race condition (bsc#1213747).
• scsi: qla2xxx: Fix end of loop test (bsc#1213747).
• scsi: qla2xxx: Fix erroneous link up failure (bsc#1213747).
• scsi: qla2xxx: Fix error code in qla2x00_start_sp() (bsc#1213747).
• scsi: qla2xxx: Fix potential NULL pointer dereference (bsc#1213747).
• scsi: qla2xxx: Fix session hang in gnl (bsc#1213747).
• scsi: qla2xxx: Limit TMF to 8 per function (bsc#1213747).
• scsi: qla2xxx: Pointer may be dereferenced (bsc#1213747).
• scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue (bsc#1213747).
• scsi: qla2xxx: Replace one-element array with DECLARE_FLEX_ARRAY() helper (bsc#1213747).
• scsi: qla2xxx: Silence a static checker warning (bsc#1213747).
• scsi: qla2xxx: Turn off noisy message log (bsc#1213747).
• scsi: qla2xxx: Update version to 10.02.08.400-k (bsc#1213747).
• scsi: qla2xxx: Update version to 10.02.08.500-k (bsc#1213747).
• scsi: qla2xxx: Use vmalloc_array() and vcalloc() (bsc#1213747).
• scsi: qla2xxx: fix inconsistent TMF timeout (bsc#1213747).
• serial: qcom-geni: drop bogus runtime pm state update (git-fixes).
• serial: sifive: Fix sifive_serial_console_setup() section (git-fixes).
• soundwire: qcom: update status correctly with mask (git-fixes).
• staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() (git-fixes).
• staging: r8712: Fix memory leak in _r8712_init_xmit_priv() (git-fixes).
• sunrpc: always free ctxt when freeing deferred request (git-fixes).
• sunrpc: double free xprt_ctxt while still in use (git-fixes).
• sunrpc: fix trace_svc_register() call site (git-fixes).
• sunrpc: fix uaf in svc_tcp_listen_data_ready() (git-fixes).
• sunrpc: remove dead code in svc_tcp_release_rqst() (git-fixes).
• sunrpc: remove the maximum number of retries in call_bind_status (git-fixes).
• svcrdma: Prevent page release when nothing was received (git-fixes).
• tpm_tis: Explicitly check for error code (git-fixes).
• tty: n_gsm: fix UAF in gsm_cleanup_mux (git-fixes).
• ubifs: Add missing iput if do_tmpfile() failed in rename whiteout (git-fixes).
• ubifs: Error path in ubifs_remount_rw() seems to wrongly free write buffers (git-fixes).
• ubifs: Fix 'ui->dirty' race between do_tmpfile() and writeback work (git-fixes).
• ubifs: Fix AA deadlock when setting xattr for encrypted file (git-fixes).
• ubifs: Fix build errors as symbol undefined (git-fixes).
• ubifs: Fix deadlock in concurrent rename whiteout and inode writeback (git-fixes).
• ubifs: Fix memory leak in alloc_wbufs() (git-fixes).
• ubifs: Fix memory leak in do_rename (git-fixes).
• ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock() (git-fixes).
• ubifs: Fix to add refcount once page is set private (git-fixes).
• ubifs: Fix wrong dirty space budget for dirty inode (git-fixes).
• ubifs: Free memory for tmpfile name (git-fixes).
• ubifs: Rectify space amount budget for mkdir/tmpfile operations (git-fixes).
• ubifs: Rectify space budget for ubifs_symlink() if symlink is encrypted (git-fixes).
• ubifs: Rectify space budget for ubifs_xrename() (git-fixes).
• ubifs: Rename whiteout atomically (git-fixes).
• ubifs: Reserve one leb for each journal head while doing budget (git-fixes).
• ubifs: do_rename: Fix wrong space budget when target inode's nlink > 1 (git-fixes).
• ubifs: rename_whiteout: Fix double free for whiteout_ui->data (git-fixes).
• ubifs: rename_whiteout: correct old_dir size computing (git-fixes).
• ubifs: setflags: Make dirtied_ino_d 8 bytes aligned (git-fixes).
• ubifs: ubifs_writepage: Mark page dirty after writing inode failed (git-fixes).
• usb: dwc3: do not reset device side if dwc3 was configured as host-only (git-fixes).
• usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy (git-fixes).
• usb: gadget: core: remove unbalanced mutex_unlock in usb_gadget_activate (git-fixes).
• usb: xhci-mtk: set the dma max_seg_size (git-fixes).
• vhost: support PACKED when setting-getting vring_base (git-fixes).
• vhost_net: revert upend_idx only on retriable error (git-fixes).
• virtio-net: Maintain reverse cleanup order (git-fixes).
• virtio_net: Fix error unwinding of XDP initialization (git-fixes).
• x86/PVH: obtain VGA console info in Dom0 (git-fixes).
• xen/blkfront: Only check REQ_FUA for writes (git-fixes).
• xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (git-fixes).

Special Instructions and Notes:

• Please reboot the system after installing this update.

Patch Instructions:

To install this SUSE Important update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

• SUSE Linux Enterprise Micro for Rancher 5.4
  zypper in -t patch SUSE-SLE-Micro-5.4-2023-3313=1
• SUSE Linux Enterprise Micro 5.4
  zypper in -t patch SUSE-SLE-Micro-5.4-2023-3313=1
• Basesystem Module 15-SP4
  zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP4-2023-3313=1
• Development Tools Module 15-SP4
  zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP4-2023-3313=1
• Legacy Module 15-SP4
  zypper in -t patch SUSE-SLE-Module-Legacy-15-SP4-2023-3313=1
• SUSE Linux Enterprise Live Patching 15-SP4
  zypper in -t patch SUSE-SLE-Module-Live-Patching-15-SP4-2023-3313=1
  Please note that this is the initial kernel livepatch without fixes itself, this package is later updated by separate standalone kernel livepatch updates.
• SUSE Linux Enterprise High Availability Extension 15 SP4
  zypper in -t patch SUSE-SLE-Product-HA-15-SP4-2023-3313=1
• SUSE Linux Enterprise Workstation Extension 15 SP4
  zypper in -t patch SUSE-SLE-Product-WE-15-SP4-2023-3313=1
• openSUSE Leap 15.4
  zypper in -t patch SUSE-2023-3313=1 openSUSE-SLE-15.4-2023-3313=1
• openSUSE Leap Micro 5.3
  zypper in -t patch openSUSE-Leap-Micro-5.3-2023-3313=1
• openSUSE Leap Micro 5.4
  zypper in -t patch openSUSE-Leap-Micro-5.4-2023-3313=1
• SUSE Linux Enterprise Micro for Rancher 5.3
  zypper in -t patch SUSE-SLE-Micro-5.3-2023-3313=1
• SUSE Linux Enterprise Micro 5.3
  zypper in -t patch SUSE-SLE-Micro-5.3-2023-3313=1

Package List:

• SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 nosrc s390x x86_64)
  • kernel-default-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 x86_64)
  • kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
• SUSE Linux Enterprise Micro for Rancher 5.4 (aarch64 s390x x86_64)
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Micro 5.4 (aarch64 nosrc s390x x86_64)
  • kernel-default-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Micro 5.4 (aarch64 x86_64)
  • kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
• SUSE Linux Enterprise Micro 5.4 (aarch64 s390x x86_64)
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• Basesystem Module 15-SP4 (aarch64 nosrc)
  • kernel-64kb-5.14.21-150400.24.81.1
• Basesystem Module 15-SP4 (aarch64)
  • kernel-64kb-devel-5.14.21-150400.24.81.1
  • kernel-64kb-debuginfo-5.14.21-150400.24.81.1
  • kernel-64kb-debugsource-5.14.21-150400.24.81.1
  • kernel-64kb-devel-debuginfo-5.14.21-150400.24.81.1
• Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64 nosrc)
  • kernel-default-5.14.21-150400.24.81.1
• Basesystem Module 15-SP4 (aarch64 ppc64le x86_64)
  • kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
• Basesystem Module 15-SP4 (aarch64 ppc64le s390x x86_64)
  • kernel-default-devel-5.14.21-150400.24.81.1
  • kernel-default-devel-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• Basesystem Module 15-SP4 (noarch)
  • kernel-devel-5.14.21-150400.24.81.1
  • kernel-macros-5.14.21-150400.24.81.1
• Basesystem Module 15-SP4 (nosrc s390x)
  • kernel-zfcpdump-5.14.21-150400.24.81.1
• Basesystem Module 15-SP4 (s390x)
  • kernel-zfcpdump-debugsource-5.14.21-150400.24.81.1
  • kernel-zfcpdump-debuginfo-5.14.21-150400.24.81.1
• Development Tools Module 15-SP4 (noarch nosrc)
  • kernel-docs-5.14.21-150400.24.81.1
• Development Tools Module 15-SP4 (aarch64 ppc64le s390x x86_64)
  • kernel-obs-build-debugsource-5.14.21-150400.24.81.1
  • kernel-syms-5.14.21-150400.24.81.1
  • kernel-obs-build-5.14.21-150400.24.81.1
• Development Tools Module 15-SP4 (noarch)
  • kernel-source-5.14.21-150400.24.81.1
• Legacy Module 15-SP4 (nosrc)
  • kernel-default-5.14.21-150400.24.81.1
• Legacy Module 15-SP4 (aarch64 ppc64le s390x x86_64)
  • reiserfs-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • reiserfs-kmp-default-5.14.21-150400.24.81.1
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Live Patching 15-SP4 (nosrc)
  • kernel-default-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Live Patching 15-SP4 (ppc64le s390x x86_64)
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-livepatch-SLE15-SP4_Update_16-debugsource-1-150400.9.3.3
  • kernel-livepatch-5_14_21-150400_24_81-default-1-150400.9.3.3
  • kernel-default-livepatch-5.14.21-150400.24.81.1
  • kernel-default-livepatch-devel-5.14.21-150400.24.81.1
  • kernel-livepatch-5_14_21-150400_24_81-default-debuginfo-1-150400.9.3.3
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• SUSE Linux Enterprise High Availability Extension 15 SP4 (aarch64 ppc64le s390x x86_64)
  • ocfs2-kmp-default-5.14.21-150400.24.81.1
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • cluster-md-kmp-default-5.14.21-150400.24.81.1
  • gfs2-kmp-default-5.14.21-150400.24.81.1
  • cluster-md-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • gfs2-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • ocfs2-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • dlm-kmp-default-5.14.21-150400.24.81.1
  • dlm-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• SUSE Linux Enterprise High Availability Extension 15 SP4 (nosrc)
  • kernel-default-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Workstation Extension 15 SP4 (nosrc)
  • kernel-default-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Workstation Extension 15 SP4 (x86_64)
  • kernel-default-extra-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-extra-5.14.21-150400.24.81.1
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (ppc64le s390x x86_64)
  • kernel-livepatch-5_14_21-150400_24_81-default-debuginfo-1-150400.9.3.3
  • kernel-livepatch-5_14_21-150400_24_81-default-1-150400.9.3.3
  • kernel-livepatch-SLE15-SP4_Update_16-debugsource-1-150400.9.3.3
• openSUSE Leap 15.4 (noarch nosrc)
  • kernel-docs-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (noarch)
  • kernel-source-vanilla-5.14.21-150400.24.81.1
  • kernel-source-5.14.21-150400.24.81.1
  • kernel-devel-5.14.21-150400.24.81.1
  • kernel-docs-html-5.14.21-150400.24.81.1
  • kernel-macros-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (nosrc ppc64le x86_64)
  • kernel-debug-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (ppc64le x86_64)
  • kernel-debug-debuginfo-5.14.21-150400.24.81.1
  • kernel-debug-livepatch-devel-5.14.21-150400.24.81.1
  • kernel-debug-devel-5.14.21-150400.24.81.1
  • kernel-debug-devel-debuginfo-5.14.21-150400.24.81.1
  • kernel-debug-debugsource-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (aarch64 ppc64le x86_64)
  • kernel-default-base-rebuild-5.14.21-150400.24.81.1.150400.24.35.3
  • kernel-kvmsmall-debugsource-5.14.21-150400.24.81.1
  • kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
  • kernel-kvmsmall-devel-5.14.21-150400.24.81.1
  • kernel-kvmsmall-debuginfo-5.14.21-150400.24.81.1
  • kernel-kvmsmall-devel-debuginfo-5.14.21-150400.24.81.1
  • kernel-kvmsmall-livepatch-devel-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64)
  • cluster-md-kmp-default-5.14.21-150400.24.81.1
  • kernel-default-optional-debuginfo-5.14.21-150400.24.81.1
  • kernel-obs-build-5.14.21-150400.24.81.1
  • kernel-default-livepatch-5.14.21-150400.24.81.1
  • kernel-default-extra-5.14.21-150400.24.81.1
  • kernel-default-optional-5.14.21-150400.24.81.1
  • kernel-obs-qa-5.14.21-150400.24.81.1
  • kernel-default-devel-5.14.21-150400.24.81.1
  • kernel-obs-build-debugsource-5.14.21-150400.24.81.1
  • kernel-default-extra-debuginfo-5.14.21-150400.24.81.1
  • gfs2-kmp-default-5.14.21-150400.24.81.1
  • cluster-md-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • reiserfs-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • kselftests-kmp-default-5.14.21-150400.24.81.1
  • dlm-kmp-default-5.14.21-150400.24.81.1
  • kernel-syms-5.14.21-150400.24.81.1
  • ocfs2-kmp-default-5.14.21-150400.24.81.1
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • gfs2-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • kselftests-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-devel-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
  • kernel-default-livepatch-devel-5.14.21-150400.24.81.1
  • ocfs2-kmp-default-debuginfo-5.14.21-150400.24.81.1
  • reiserfs-kmp-default-5.14.21-150400.24.81.1
  • dlm-kmp-default-debuginfo-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 nosrc)
  • kernel-default-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (aarch64 nosrc ppc64le x86_64)
  • kernel-kvmsmall-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (nosrc s390x)
  • kernel-zfcpdump-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (s390x)
  • kernel-zfcpdump-debugsource-5.14.21-150400.24.81.1
  • kernel-zfcpdump-debuginfo-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (nosrc)
  • dtb-aarch64-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (aarch64)
  • dtb-marvell-5.14.21-150400.24.81.1
  • dtb-apple-5.14.21-150400.24.81.1
  • dtb-renesas-5.14.21-150400.24.81.1
  • dtb-qcom-5.14.21-150400.24.81.1
  • kernel-64kb-extra-debuginfo-5.14.21-150400.24.81.1
  • kernel-64kb-devel-5.14.21-150400.24.81.1
  • kernel-64kb-debugsource-5.14.21-150400.24.81.1
  • dtb-altera-5.14.21-150400.24.81.1
  • dtb-freescale-5.14.21-150400.24.81.1
  • dtb-cavium-5.14.21-150400.24.81.1
  • kernel-64kb-optional-5.14.21-150400.24.81.1
  • ocfs2-kmp-64kb-debuginfo-5.14.21-150400.24.81.1
  • kernel-64kb-livepatch-devel-5.14.21-150400.24.81.1
  • kernel-64kb-optional-debuginfo-5.14.21-150400.24.81.1
  • gfs2-kmp-64kb-5.14.21-150400.24.81.1
  • dtb-amd-5.14.21-150400.24.81.1
  • dtb-amlogic-5.14.21-150400.24.81.1
  • dtb-exynos-5.14.21-150400.24.81.1
  • dtb-broadcom-5.14.21-150400.24.81.1
  • ocfs2-kmp-64kb-5.14.21-150400.24.81.1
  • cluster-md-kmp-64kb-5.14.21-150400.24.81.1
  • dtb-allwinner-5.14.21-150400.24.81.1
  • gfs2-kmp-64kb-debuginfo-5.14.21-150400.24.81.1
  • dtb-rockchip-5.14.21-150400.24.81.1
  • dlm-kmp-64kb-debuginfo-5.14.21-150400.24.81.1
  • dtb-amazon-5.14.21-150400.24.81.1
  • kselftests-kmp-64kb-debuginfo-5.14.21-150400.24.81.1
  • kselftests-kmp-64kb-5.14.21-150400.24.81.1
  • kernel-64kb-extra-5.14.21-150400.24.81.1
  • dtb-nvidia-5.14.21-150400.24.81.1
  • kernel-64kb-debuginfo-5.14.21-150400.24.81.1
  • dtb-lg-5.14.21-150400.24.81.1
  • dtb-arm-5.14.21-150400.24.81.1
  • dtb-sprd-5.14.21-150400.24.81.1
  • kernel-64kb-devel-debuginfo-5.14.21-150400.24.81.1
  • reiserfs-kmp-64kb-debuginfo-5.14.21-150400.24.81.1
  • dtb-apm-5.14.21-150400.24.81.1
  • cluster-md-kmp-64kb-debuginfo-5.14.21-150400.24.81.1
  • dtb-xilinx-5.14.21-150400.24.81.1
  • dlm-kmp-64kb-5.14.21-150400.24.81.1
  • reiserfs-kmp-64kb-5.14.21-150400.24.81.1
  • dtb-mediatek-5.14.21-150400.24.81.1
  • dtb-socionext-5.14.21-150400.24.81.1
  • dtb-hisilicon-5.14.21-150400.24.81.1
• openSUSE Leap 15.4 (aarch64 nosrc)
  • kernel-64kb-5.14.21-150400.24.81.1
• openSUSE Leap Micro 5.3 (aarch64 nosrc x86_64)
  • kernel-default-5.14.21-150400.24.81.1
• openSUSE Leap Micro 5.3 (aarch64 x86_64)
  • kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• openSUSE Leap Micro 5.4 (aarch64 nosrc s390x x86_64)
  • kernel-default-5.14.21-150400.24.81.1
• openSUSE Leap Micro 5.4 (aarch64 x86_64)
  • kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
• openSUSE Leap Micro 5.4 (aarch64 s390x x86_64)
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 nosrc s390x x86_64)
  • kernel-default-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 x86_64)
  • kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
• SUSE Linux Enterprise Micro for Rancher 5.3 (aarch64 s390x x86_64)
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Micro 5.3 (aarch64 nosrc s390x x86_64)
  • kernel-default-5.14.21-150400.24.81.1
• SUSE Linux Enterprise Micro 5.3 (aarch64 x86_64)
  • kernel-default-base-5.14.21-150400.24.81.1.150400.24.35.3
• SUSE Linux Enterprise Micro 5.3 (aarch64 s390x x86_64)
  • kernel-default-debuginfo-5.14.21-150400.24.81.1
  • kernel-default-debugsource-5.14.21-150400.24.81.1

References:

• https://www.suse.com/security/cve/CVE-2022-40982.html
• https://www.suse.com/security/cve/CVE-2023-0459.html
• https://www.suse.com/security/cve/CVE-2023-20569.html
• https://www.suse.com/security/cve/CVE-2023-21400.html
• https://www.suse.com/security/cve/CVE-2023-2156.html
• https://www.suse.com/security/cve/CVE-2023-2166.html
• https://www.suse.com/security/cve/CVE-2023-31083.html
• https://www.suse.com/security/cve/CVE-2023-3268.html
• https://www.suse.com/security/cve/CVE-2023-3567.html
• https://www.suse.com/security/cve/CVE-2023-3609.html
• https://www.suse.com/security/cve/CVE-2023-3611.html
• https://www.suse.com/security/cve/CVE-2023-3776.html
• https://www.suse.com/security/cve/CVE-2023-4004.html
• https://bugzilla.suse.com/show_bug.cgi?id=1206418
• https://bugzilla.suse.com/show_bug.cgi?id=1207129
• https://bugzilla.suse.com/show_bug.cgi?id=1210627
• https://bugzilla.suse.com/show_bug.cgi?id=1210780
• https://bugzilla.suse.com/show_bug.cgi?id=1211131
• https://bugzilla.suse.com/show_bug.cgi?id=1211738
• https://bugzilla.suse.com/show_bug.cgi?id=1212502
• https://bugzilla.suse.com/show_bug.cgi?id=1212604
• https://bugzilla.suse.com/show_bug.cgi?id=1212901
• https://bugzilla.suse.com/show_bug.cgi?id=1213167
• https://bugzilla.suse.com/show_bug.cgi?id=1213272
• https://bugzilla.suse.com/show_bug.cgi?id=1213287
• https://bugzilla.suse.com/show_bug.cgi?id=1213304
• https://bugzilla.suse.com/show_bug.cgi?id=1213585
• https://bugzilla.suse.com/show_bug.cgi?id=1213586
• https://bugzilla.suse.com/show_bug.cgi?id=1213588
• https://bugzilla.suse.com/show_bug.cgi?id=1213620
• https://bugzilla.suse.com/show_bug.cgi?id=1213653
• https://bugzilla.suse.com/show_bug.cgi?id=1213713
• https://bugzilla.suse.com/show_bug.cgi?id=1213715
• https://bugzilla.suse.com/show_bug.cgi?id=1213747
• https://bugzilla.suse.com/show_bug.cgi?id=1213756
• https://bugzilla.suse.com/show_bug.cgi?id=1213759
• https://bugzilla.suse.com/show_bug.cgi?id=1213777
• https://bugzilla.suse.com/show_bug.cgi?id=1213810
• https://bugzilla.suse.com/show_bug.cgi?id=1213812
• https://bugzilla.suse.com/show_bug.cgi?id=1213842
• https://bugzilla.suse.com/show_bug.cgi?id=1213856
• https://bugzilla.suse.com/show_bug.cgi?id=1213857
• https://bugzilla.suse.com/show_bug.cgi?id=1213863
• https://bugzilla.suse.com/show_bug.cgi?id=1213867
• https://bugzilla.suse.com/show_bug.cgi?id=1213870
• https://bugzilla.suse.com/show_bug.cgi?id=1213871