The SUSE Linux Enterprise 15 SP2 kernel was updated to receive various security and bugfixes. The following security bugs were fixed: - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb . - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the kernel to read uninitialized memory . - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 . - CVE-2021-3896: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c . - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev- greater than rf_conn_info object . - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking . - CVE-2021-3542: Fixed heap buffer overflow in firedtv driver . - CVE-2021-3715: Fixed a use-after-free in route4_change in net/sched/cls_route.c . - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute privileges . - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write . - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead to root access . The following non-security bugs were fixed: - ACPI: bgrt: Fix CFI violation . - ACPI: fix NULL pointer dereference . - ALSA: hda/realtek - ALC236 headset MIC recording issue . - ALSA: hda/realtek: Add quirk for Clevo PC50HS . - ALSA: hda/realtek: Add quirk for Clevo X170KM-G . - ALSA: hda/realtek: Complete partial device name to avoid ambiguity . - ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW . - ALSA: hda: avoid write to STATESTS if controller is in reset . - ALSA: seq: Fix a potential UAF by wrong private_free call order . - ALSA: usb-audio: Add quirk for VF0770 . - ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset . - ASoC: DAPM: Fix missing kctl change notifications . - ASoC: wm8960: Fix clock configuration on slave mode . - Add obsolete_rebuilds_subpackage . - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS . - HID: betop: fix slab-out-of-bounds Write in betop_probe . - HID: u2fzero: ignore incomplete packets without data . - HID: usbhid: free raw_report buffers in usbhid_stop . - HID: wacom: Add new Intuos BT device IDs . - ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition . - IPv6: reply ICMP error if the first fragment do not include all headers . - Input: snvs_pwrkey - add clk handling . - Input: xpad - add support for another USB ID of Nacon GC-100 . - KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live . - KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state . - KVM: PPC: Book3S HV: Save host FSCR in the P7/8 path . - KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers . - KVM: PPC: Fix clearing never mapped TCEs in realmode . - KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak . - NFC: digital: fix possible memory leak in digital_in_send_sdd_req . - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa . - NFS: dir_cookie is a pointer to the cookie in older kernels, not the cookie itself . - NFS: Do uncached readdir when we"re seeking a cookie in an empty page cache . - PCI: Fix pci_host_bridge struct device release/free handling . - USB: cdc-acm: clean up probe error labels . - USB: cdc-acm: fix minor-number release . - USB: serial: option: add Quectel EC200S-CN module support . - USB: serial: option: add Telit LE910Cx composition 0x1204 . - USB: serial: option: add prod. id for Quectel EG91 . - USB: serial: qcserial: add EM9191 QDL support . - USB: xhci: dbc: fix tty registration race . - acpi/arm64: fix next_platform_timer section mismatch error . - ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators . - ata: sata_dwc_460ex: No need to call phy_exit befre phy_init . - audit: fix possible null-pointer dereference in audit_filter_rules . - bfq: Remove merged request already in bfq_requests_merged . - blk: Fix lock inversion between ioc lock and bfqd lock . - blktrace: Fix uaf in blk_trace access after removing by sysfs . - block: bfq: fix bfq_set_next_ioprio_data . - bnxt_en: Fix TX timeout when TX ring size is set to the smallest . - bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h . - bpf: Fix a typo of reuseport map in bpf.h . - bpf: Fix up bpf_skb_adjust_room helper"s skb csum setting . - can: dev: can_restart: fix use after free bug . - can: peak_pci: peak_pci_remove: fix UAF . - can: peak_usb: fix use after free bugs . - can: peak_usb: pcan_usb_fd_decode_status: fix back to ERROR_ACTIVE state notification . - can: rcar_can: fix suspend/resume . - can: ti_hecc: ti_hecc_probe: add missed clk_disable_unprepare in error path . - can: xilinx_can: handle failure cases of pm_runtime_get_sync . - cb710: avoid NULL pointer subtraction . - ceph: fix handling of meta errors . - ceph: skip existing superblocks that are blocklisted or shut down when mounting . - cfg80211: scan: fix RCU in cfg80211_add_nontrans_list . - drm/amd/display: Pass PCI deviceid into DC . - drm/amdgpu: fix gart.bo pin_count leak . - drm/msm/dsi: Fix an error code in msm_dsi_modeset_init . - drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling . - drm/msm: Fix null pointer dereference on pointer edp . - drm/nouveau/debugfs: fix file release memory leak . - drm/panel: olimex-lcd-olinuxino: select CRC32 . - e1000e: Fix packet loss on Tiger Lake and later . - e100: fix buffer overrun in e100_get_regs . - e100: fix length calculation in e100_get_regs_len . - e100: handle eeprom as little endian . - ext4: fix reserved space counter leakage . - ext4: report correct st_size for encrypted symlinks . - fs, mm: fix race in unlinking swapfile . - fscrypt: add fscrypt_symlink_getattr for computing st_size . - ftrace: Fix scripts/recordmcount.pl due to new binutils . - gpio: pca953x: Improve bias setting . - gve: Avoid freeing NULL pointer . - gve: Correct available tx qpl check . - gve: Properly handle errors in gve_assign_qpl . - gve: fix gve_get_stats . - gve: report 64bit tx_bytes counter from gve_handle_report_stats . - hso: fix bailout in error case of probe . - i2c: acpi: fix resource leak in reconfiguration device addition . - i40e: Fix ATR queue selection . - i40e: Fix freeing of uninitialized misc IRQ vector . - i40e: fix endless loop under rtnl . - iavf: fix double unlock of crit_lock . - ice: Add missing E810 device ids . - iio: adc128s052: Fix the error handling path of "adc128_probe" . - iio: adc: aspeed: set driver data when adc probe . - iio: dac: ti-dac5571: fix an error code in probe . - iio: light: opt3001: Fixed timeout error when 0 lux . - iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED . - iio: ssp_sensors: add more range checking in ssp_parse_dataframe . - iio: ssp_sensors: fix error code in ssp_print_mcu_debug . - ionic: do not remove netdev- greater than dev_addr when syncing uc list . - ipv6/netfilter: Discard first fragment not including all headers . - isdn: cpai: check ctr- greater than cnr to avoid array index out of bound . - isdn: mISDN: Fix sleeping function called from invalid context . - ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup . - kabi: block: Fix kabi of blk_mq_sched_try_insert_merge . - kernel-binary.spec: Do not sign kernel when no key provided . - kernel-binary.spec: suse-kernel-rpm-scriptlets required for uninstall as well. Fixes: e98096d5cf85 - kernel-spec-macros: Since rpm 4.17 %verbose is unusable . - lan78xx: select CRC32 . - libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD . - mac80211: Drop frames from invalid MAC address in ad-hoc mode . - mac80211: check return value of rhashtable_init . - mei: me: add Ice Lake-N device id . - mlx5: count all link events . - mlxsw: thermal: Fix out-of-bounds memory accesses . - mmc: dw_mmc: exynos: fix the finding clock sample value . - mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk . - mmc: vub300: fix control-message timeouts . - net/af_unix: fix a data-race in unix_dgram_poll . - net/mlx4_en: Do not allow aRFS for encapsulated packets . - net/mlx4_en: Resolve bad operstate value . - net/mlx5: FWTrace, cancel work on alloc pd error flow . - net/mlx5: Fix unpublish devlink parameters . - net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp . - net: batman-adv: fix error handling . - net: bridge: use nla_total_size_64bit in br_get_linkxstats_size . - net: can: ems_usb: fix use-after-free in ems_usb_disconnect . - net: cdc_eem: fix tx fixup skb leak . - net: cdc_ncm: correct overhead in delayed_ndp_size . - net: hns3: fix vf reset workqueue cannot exit . - net: hso: add failure handler for add_net_device . - net: hso: fix NULL-deref on disconnect regression . - net: hso: fix null-ptr-deref during tty device unregistration . - net: ipv6: Discard next-hop MTU less than minimum link MTU . - net: lan78xx: fix division by zero in send path . - net: mana: Fix error handling in mana_create_rxq . - net: usb: Fix uninit-was-stored issue in asix_read_phy_addr . - netfilter: conntrack: collect all entries in one cycle . - nfc: fix error handling of nfc_proto_register . - nfc: port100: fix using -ERRNO as command type mask . - nvme-fc: avoid race between time out and tear down . - nvme-fc: remove freeze/unfreeze around update_nr_hw_queues . - nvme-fc: update hardware queues before using them . - nvme-pci: Fix abort command id . - nvme-pci: fix error unwind in nvme_map_data . - nvme-pci: refactor nvme_unmap_data . - nvme: add command id quirk for apple controllers . - ocfs2: fix data corruption after conversion from inline format . - pata_legacy: fix a couple uninitialized variable bugs . - phy: mdio: fix memory leak . - platform/mellanox: mlxreg-io: Fix argument base in kstrtou32 call . - platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call . - powerpc/bpf: Fix BPF_MOD when imm == 1 . - powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 . - powerpc/bpf: Use bctrl for making function calls . - powerpc/lib: Fix emulate_step std test . - powerpc/pseries: Fix build error when NUMA=n . - powerpc/xive: Discard disabled interrupts in get_irqchip_state . - pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init . - ptp_pch: Load module automatically if ID matches . - ptp_pch: Restore dependency on PCI . - qed: Fix missing error code in qed_slowpath_start . - qed: Handle management FW error . - qed: rdma - do not wait for resources under hw error recovery flow . - regmap: Fix possible double-free in regcache_rbtree_exit . - rpm: fix kmp install path - rpm: use _rpmmacrodir - scsi: lpfc: Allow PLOGI retry if previous PLOGI was aborted . - scsi: lpfc: Allow fabric node recovery if recovery is in progress before devloss . - scsi: lpfc: Correct sysfs reporting of loop support after SFP status change . - scsi: lpfc: Fix link down processing to address NULL pointer dereference . - scsi: lpfc: Fix memory overwrite during FC-GS I/O abort handling . - scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi routine . - scsi: lpfc: Revert LOG_TRACE_EVENT back to LOG_INIT prior to driver_resource_setup . - scsi: lpfc: Update lpfc version to 14.0.0.3 . - scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset . - scsi: qla2xxx: Add debug print of 64G link speed . - scsi: qla2xxx: Add host attribute to trigger MPI hang . - scsi: qla2xxx: Add support for mailbox passthru . - scsi: qla2xxx: Adjust request/response queue size for 28xx . - scsi: qla2xxx: Call process_response_queue in Tx path . - scsi: qla2xxx: Changes to support FCP2 Target . - scsi: qla2xxx: Changes to support kdump kernel . - scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS . - scsi: qla2xxx: Check for firmware capability before creating QPair . - scsi: qla2xxx: Display 16G only as supported speeds for 3830c card . - scsi: qla2xxx: Do not call fc_block_scsi_eh during bus reset . - scsi: qla2xxx: Fix NPIV create erroneous error . - scsi: qla2xxx: Fix NVMe retry . - scsi: qla2xxx: Fix NVMe session down detection . - scsi: qla2xxx: Fix NVMe | FCP personality change . - scsi: qla2xxx: Fix crash in NVMe abort path . - scsi: qla2xxx: Fix excessive messages during device logout . - scsi: qla2xxx: Fix hang during NVMe session tear down . - scsi: qla2xxx: Fix hang on NVMe command timeouts . - scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file . - scsi: qla2xxx: Fix port type info . - scsi: qla2xxx: Fix unsafe removal from linked list . - scsi: qla2xxx: Fix use after free in eh_abort path . - scsi: qla2xxx: Move heartbeat handling from DPC thread to workqueue . - scsi: qla2xxx: Open-code qla2xxx_eh_device_reset . - scsi: qla2xxx: Open-code qla2xxx_eh_target_reset . - scsi: qla2xxx: Remove redundant initialization of pointer req . - scsi: qla2xxx: Restore initiator in dual mode . - scsi: qla2xxx: Show OS name and version in FDMI-1 . - scsi: qla2xxx: Suppress unnecessary log messages during login . - scsi: qla2xxx: Sync queue idx with queue_pair_map idx . - scsi: qla2xxx: Update version to 10.02.06.100-k . - scsi: qla2xxx: Update version to 10.02.06.200-k . - scsi: qla2xxx: Update version to 10.02.07.100-k . - scsi: qla2xxx: Use scsi_cmd_to_rq instead of scsi_cmnd.request . - scsi: qla2xxx: edif: Add N2N support for EDIF . - scsi: qla2xxx: edif: Do secure PLOGI when auth app is present . - scsi: qla2xxx: edif: Fix EDIF enable flag . - scsi: qla2xxx: edif: Fix returnvar.cocci warnings . - scsi: qla2xxx: edif: Fix stale session . - scsi: qla2xxx: edif: Reject AUTH ELS on session down . - scsi: qla2xxx: edif: Use link event to wake up app . - sctp: check asoc peer.asconf_capable before processing asconf . - soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment . - spi: spi-nxp-fspi: do not depend on a specific node name erratum workaround . - tpm: ibmvtpm: Avoid error message when process gets signal while waiting . - usb: hso: fix error handling code of hso_create_net_device . - usb: hso: remove the bailout parameter . - usb: musb: dsps: Fix the probe error path . - video: fbdev: gbefb: Only instantiate device when built for IP32 . - virtio: write back F_VERSION_1 before validate . - watchdog: orion: use 0 for unset heartbeat . - x86/pat: Pass valid address to sanitize_phys . - x86/reboot: Limit Dell Optiplex 990 quirk to early BIOS versions . - x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state fails . - xen: fix setting of max_pfn in shared_info . - xen: reset legacy rtc flag for PV domU . - xfs: Fixed non-directory creation in SGID directories introduced by CVE-2018-13405 patch . - xfs: ensure that the inode uid/gid match values match the icdinode ones . - xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes . - xfs: merge the projid fields in struct xfs_icdinode . - xfs: remove the icdinode di_uid/di_gid members . - xhci: Enable trust tx length quirk for Fresco FL11 USB controller . - xhci: Fix command ring pointer corruption while aborting a command . - xhci: guard accesses to ep_state in xhci_endpoint_reset . - xhci: guard accesses to ep_state in xhci_endpoint_reset . Special Instructions and Notes: Please reboot the system after installing this update.