Nikolay Aleksandrov

A vulnerability has been resolved in the Linux kernel, specifically in the bonding module, where a null pointer dereference could occur when setting `real dev` to NULL while packets are in transit and `xfrm` might call `xdo dev offload ok()` in parallel. All callbacks assume `real dev` is set. This issue can lead to a page fault and potentially cause the system to crash.

A null pointer dereference issue has been resolved in the Linux kernel. The issue is related to the bonding functionality, specifically in the `bond ipsec offload ok` function. It is necessary to check if there is an active slave before dereferencing the pointer to prevent the null pointer dereference.

The Linux kernel has a vulnerability that can cause a null pointer dereference when IPv6 is not enabled. This occurs when trying to add an IPv6 nexthop, resulting in a call to `ipv6 stub->fib6 nh release` in the error path of `nh create ipv6()`. The bug has been present since the beginning of IPv6 nexthop gateway support. To fix this, the dummy stub's `-EAFNOSUPPORT` error should be returned directly without calling `ipv6 stub->fib6 nh release` in `nh create ipv6()`'s error path.

The issue is related to a null pointer dereference in the Linux kernel's bridge tunnel due to lockless access in the tunnel egress path. When a VLAN tunnel is deleted, the `tunnel dst` pointer is set to NULL without waiting for a grace period, and packets egressing are dereferencing it without checking. The patch fixes this by using `READ/WRITE ONCE` to annotate the lockless use of `tunnel id` and RCU for accessing `tunnel dst`, ensuring it is read only once and checked in the egress path.

The vulnerability is related to the egress tunnel code in the Linux kernel's bridge module. The code uses `dst clone()` and directly sets the result, which can cause problems if the entry has a reference count of 0 or has already been deleted. This triggers a `WARN ON()` in `dst hold()` when a reference count cannot be taken. The issue is fixed by using `dst hold safe()` and checking if a reference was actually taken before setting the destination.

The issue allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field in the ext4 journal stop function.

The issue is related to multiple vulnerabilities in the openSUSE operating system, specifically in various kernel packages. These vulnerabilities can lead to a violation of confidentiality, integrity, and availability of protected information. The exploitation of these vulnerabilities can be carried out remotely. A race condition in the inet frag intern function in net/ipv4/inet fragment.c in the Linux kernel through 3.13.6 allows remote attackers to cause a denial of service (use-after-free error) or possibly have unspecified other impact via a large series of fragmented ICMP Echo Request packets to a system with a heavy CPU load.