SB2025051664 - openEuler 22.03 LTS SP4 update for kernel

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Memory leak (CVE-ID: CVE-2022-49901)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory leak within the blk_mq_init_allocated_queue() function in block/blk-mq.c. A local user can perform a denial of service (DoS) attack.

2) Resource management error (CVE-ID: CVE-2023-53093)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to resource management error within the __create_val_field() function in kernel/trace/trace_events_hist.c. A local user can perform a denial of service (DoS) attack.

3) Use-after-free (CVE-ID: CVE-2025-21999)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a use-after-free error within the proc_get_inode() function in fs/proc/inode.c, within the proc_create_reg(), proc_create_seq_private() and proc_create_single_data() functions in fs/proc/generic.c. A local user can escalate privileges on the system.

4) Improper locking (CVE-ID: CVE-2025-23144)

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper locking within the led_bl_remove() function in drivers/video/backlight/led_bl.c. A local user can perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1515