RHSA-2024:9315 Red Hat Security Advisory: kernel security update
kernel: use after free in i2c kernel: bluetooth: BR/EDR Bluetooth Impersonation Attacks (BIAS) kernel: hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations kernel: asix: fix uninit-value in asix_mdio_read() kernel: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc kernel: hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field kernel: hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field kernel: powerpc/64s: fix program check interrupt emergency stack path kernel: powerpc/64s: Fix unrecoverable MCE calling async handler from NMI kernel: lib/generic-radix-tree.c: Don't overflow in peek() kernel: powerpc/smp: do not decrement idle task preempt count in CPU offline kernel: can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() kernel: usbnet: sanity check for maxpacket kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells kernel: aio: fix use-after-free due to missing POLLFREE handling kernel: powerpc/pseries: Fix potential memleak in papr_get_attr() kernel: of: fdt: fix off-by-one error in unflatten_dt_nodes() kernel: thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR kernel: vt_ioctl: fix array_index_nospec in vt_setactivate kernel: bpf: Fix crash due to out of bounds access into reg2btf_ids. kernel: lz4: fix LZ4_decompress_safe_partial read out of bound kernel: x86/mce: Work around an erratum on fast string copy instructions kernel: af_netlink: Fix shift out of bounds in group mask calculation kernel: net: asix: add proper error handling of usb read errors kernel: mmc: core: use sysfs_emit() instead of sprintf() kernel: extcon: Modify extcon device to be created after driver data is set kernel: vduse: Fix NULL pointer dereference on sysfs access kernel: Input: gpio-keys - cancel delayed work only in case of GPIO kernel: x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails kernel: tick/nohz: unexport __init-annotated tick_nohz_full_setup() kernel: mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() kernel: dmaengine: ti: k3-udma-glue: fix memory leak when register device fail kernel: tty: n_gsm: avoid call of sleeping functions from atomic context kernel: tty: serial: Fix refcount leak bug in ucc_uart.c kernel: net: tap: NULL pointer derefence in dev_parse_header_protocol when skb->dev is null kernel: x86/kprobes: Update kcb status flag after singlestepping kernel: mmc: sdhci-of-esdhc: Fix refcount leak in esdhc_signal_voltage_switch kernel: rcutorture: Fix ksoftirqd boosting timing and iteration kernel: Linux kernel: Denial of Service due to memory leak in mmc: vub300 module kernel: Kernel: Denial of Service in mmc: moxart due to improper return value check kernel: ipc: fix memory leak in init_mqueue_fs() kernel: drivers: serial: jsm: fix some leaks in probe kernel: mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() kernel: Kernel: Denial of Service via improper return value check in mmc_add_host() kernel: platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init() kernel: net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() kernel: x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() kernel: dmaengine: ti: k3-udma: Reset UDMA_CHAN_RT byte counters to prevent overflow kernel: serial: amba-pl011: avoid SBSA UART accessing DMACR register kernel: mmc: core: Fix kernel panic when remove non-standard SDIO card kernel: mmc: atmel-mci: fix return value check of mmc_add_host() kernel: net: stmmac: fix possible memory leak in stmmac_dvr_probe() kernel: mmc: omap_hsmmc: fix return value check of mmc_add_host() kernel: x86/apic: Don't disable x2APIC if locked kernel: Kernel: Denial of Service via memory leak in mqueue component kernel: Linux kernel (x86/xen): Memory leak in CPU lock initialization leading to denial of service. kernel: mmc: mxcmmc: fix return value check of mmc_add_host() kernel: mmc: via-sdmmc: fix return value check of mmc_add_host() kernel: mmc: alcor: fix return value check of mmc_add_host() kernel: mmc: toshsd: fix return value check of mmc_add_host() kernel: pvrusb2: fix use after free on context disconnection kernel: powerpc: Fix access beyond end of drmem array kernel: iommu: Don't reserve 0-length IOVA region kernel: bpf: fix check for attempt to corrupt spilled pointer kernel: EDAC/thunderx: Incorrect buffer size in drivers/edac/thunderx_edac.c kernel: out-of-bounds read in pci_dev_for_each_resource() kernel: null pointer dereference in of_syscon_register() kernel: NULL pointer dereference in zone registration error path kernel: use-after-free in powermate_config_complete kernel: usb: hub: Guard against accesses to uninitialized BOS descriptors kernel: x86/srso: Add SRSO mitigation for Hygon processors kernel: drm: Don't unref the same fb many times by mistake due to deadlock handling kernel: dmaengine: fix NULL pointer in channel unregistration function kernel: PM: sleep: Fix possible deadlocks in core system-wide PM code kernel: ring-buffer: Do not attempt to read past "commit" kernel: RDMA/siw: Fix connection failure handling kernel: platform/x86: think-lmi: Fix reference leak kernel: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg kernel: mm/damon/vaddr-test: memory leak in damon_do_test_apply_three_regions() kernel: media: uvcvideo: out-of-bounds read in uvc_query_v4l2_menu() kernel: drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper() kernel: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() kernel: wifi: rt2x00: restart beacon queue when hardware reset kernel: powerpc/lib: Validate size for vector operations kernel: PM / devfreq: Fix buffer overflow in trans_stat_show kernel: hwrng: core - Fix page fault dead lock on mmap-ed hwrng kernel: pstore/ram: Fix crash when setting number of cpus to an odd number kernel: bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers kernel: ext4: avoid online resizing failures due to oversized flex bg kernel: drm/amd/display: Wake DMCUB before executing GPINT commands kernel: drm/amd/display: Refactor DMCUB enter/exit idle interface kernel: drm/amdkfd: lock dependency warning with srcu kernel: drm/amd/display: Fix disable_otg_wa logic kernel: PM / devfreq: Synchronize devfreq_monitor_[start/stop] kernel: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) kernel: iio: core: fix memleak in iio_device_register_sysfs kernel: drm/vmwgfx: Unmap the surface before resetting it on a plane state kernel: drm/vkms: Avoid reading beyond LUT array kernel: drm/tegra: dsi: Add missing check for of_find_device_by_node kernel: io_uring: drop any code related to SCM_RIGHTS kernel: x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type kernel: drm/tegra: rgb: Fix missing clk_put() in the error handling paths of tegra_dc_rgb_probe() kernel: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node kernel: ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe() kernel: net: atlantic: eliminate double free in error handling logic kernel: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() kernel: bpf: Guard stack limits against 32bit overflow kernel: of: Fix double free in of_parse_phandle_with_args_map kernel: ALSA: scarlett2: Add missing error checks to *_ctl_get() kernel: ACPI: LPIT: Avoid u32 multiplication overflow kernel: powerpc/powernv: Add a null pointer check in opal_event_init() kernel: ALSA: scarlett2: Add missing mutex lock around get meter levels kernel: powerpc/powernv: Add a null pointer check to scom_debug_init_one() kernel: powerpc/powernv: Add a null pointer check in opal_powercap_init() kernel: ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx-&gt;headset_codec_dev = NULL kernel: calipso: fix memory leak in netlbl_calipso_add_pass() kernel: net/usb: kalmia: Don&#39;t pass act_len in usb_bulk_msg error path kernel: mmc: sdio: fix possible resource leaks in some error paths kernel: fbdev: Fix invalid page access after closing deferred I/O devices kernel: powerpc/64s/interrupt: Fix interrupt exit race with security mitigation switch kernel: spi: Fix null dereference on suspend kernel: smb: client: fix use-after-free in smb2_query_info_compound() kernel: pwm: Fix double shift bug kernel: smb: client: fix potential deadlock when releasing mids kernel: i2c: dev: copy userspace array safely kernel: virtio-blk: fix implicit overflow on virtio_max_dma_size kernel: net/smc: avoid data corruption caused by decline kernel: bonding: stop the device in bond_setup_by_slave() kernel: i915/perf: Fix NULL deref bugs with drm_dbg() calls kernel: i2c: core: Run atomic i2c xfer when !preemptible kernel: scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool kernel: crypto: pcrypt - Fix hungtask for PADATA_RESET kernel: drm/amdgpu: Fix potential null pointer derefernce kernel: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL kernel: drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga kernel: cpu/hotplug: Don't offline the last non-isolated CPU kernel: Bluetooth: btusb: Add date->evt_skb is NULL check kernel: atl1c: Work around the DMA RX overflow issue kernel: nbd: fix uaf in nbd_open kernel: Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() kernel: perf: hisi: Fix use-after-free when register pmu fails kernel: drm/radeon: possible buffer overflow kernel: pstore/platform: Add check for kstrdup kernel: can: dev: can_put_echo_skb(): don&#39;t crash kernel if can_priv::echo_skb is accessed out of bounds kernel: nommu: fix memory leak in do_mmap() error path kernel: mm/swapfile: add cond_resched() in get_swap_pages() kernel: mm/khugepaged: fix ->anon_vma race kernel: platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl kernel: net: usb: lan78xx: Limit packet length to skb->len kernel: tty: pcn_uart: fix memory leak with using debugfs_lookup() kernel: serial: 8250: Reinit port->pm on port specific driver unbind kernel: mm: fix zswap writeback race condition kernel: Linux kernel: ACPICA undefined behavior due to zero offset to null pointer kernel: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() kernel: Kernel: Denial of Service via memory leak in SMB client kernel: clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe kernel: clk: imx: clk-imxrt1050: fix memory leak in imxrt1050_clocks_probe kernel: Linux kernel: Denial of Service due to improper thread termination in rcuscale module kernel: Linux kernel: Memory leak in shmem's ramfs-based tmpfs leads to denial of service kernel: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer kernel: modpost: fix off by one in is_executable_section() kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() kernel: kernel/printk/index.c: fix memory leak with using debugfs_lookup() kernel: ionic: catch failure from devlink_alloc kernel: ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() kernel: ext4: allow ext4_get_group_info() to fail kernel: clk: tegra: tegra124-emc: Fix potential memory leak kernel: null_blk: fix poll request timeout handling kernel: rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() kernel: clk: imx: scu: use _safe list iterator to avoid a use after free kernel: drivers: base: Free devm resources when unregistering a device kernel: cifs: fix mid leak during reconnection after timeout threshold kernel: dax: Fix dax_mapping_release() use after free kernel: ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup} kernel: clk: Fix memory leak in devm_clk_notifier_register() kernel: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk kernel: nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() kernel: s390/crypto: use vector instructions only if available for ChaCha20 kernel: clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() kernel: ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects kernel: Linux kernel: Resource leak in arc_uart driver can cause denial of service kernel: Kernel: Denial of Service due to a Netlink subsystem deadlock kernel: soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe kernel: Linux kernel: Denial of Service via use-after-free in vc_screen kernel: Linux kernel: Denial of Service via integer overflow in kmalloc_reserve() kernel: regmap-irq: Fix out-of-bounds access when allocating config buffers kernel: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error kernel: ext4: correct grp validation in ext4_mb_good_group kernel: thermal: of: fix double-free on unregistration kernel: Linux kernel: Denial of Service via null pointer dereference in ACPI kernel: sched/psi: use kernfs polling functions for PSI trigger polling kernel: Linux kernel: Denial of Service in dvb-usb-v2 gl861 due to null-pointer dereference kernel: phy: tegra: xusb: Clear the driver reference in usb-phy dev kernel: Linux kernel: Denial of Service in anysee media driver via null pointer dereference kernel: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses kernel: rcu: dump vmalloc memory info safely kernel: Linux kernel: Denial of Service due to incorrect network packet processing in NSH module kernel: serial: sc16is7xx: setup GPIO controller later in probe kernel: serial: sprd: Fix DMA buffer leak issue kernel: x86/kexec: Fix double-free of elf header buffer kernel: ext4: turn quotas off if mount failed after enabling quotas kernel: zsmalloc: move LRU update from zs_map_object() to zs_malloc() kernel: x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction kernel: exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree kernel: tty: fix out-of-bounds access in tty_driver_lookup_tty() kernel: blk-mq: fix tags leak when shrink nr_hw_queues kernel: ACPI: EC: Fix oops when removing custom query handlers kernel: rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() kernel: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT kernel: debugobjects: Don't wake up kswapd from fill_pool() kernel: Linux kernel: Denial of Service via NULL pointer dereference in blk-cgroup kernel: vduse: fix NULL pointer dereference kernel: thermal: intel: quark_dts: fix error pointer dereference kernel: usb: typec: bus: verify partner exists in typec_altmode_attention kernel: serial: 8250_bcm7271: fix leak in `brcmuart_probe` kernel: cxl/pmem: Fix nvdimm registration races kernel: Information disclosure in vhost/vhost.c:vhost_new_msg() kernel: stack overflow problem in Open vSwitch kernel module leading to DoS kernel: NULL Pointer dereference  bluetooth allows Overflow Buffers kernel: Integer Overflow in raid5_cache_count kernel: use-after-free in cec_queue_msg_fh kernel: net/bluetooth: race condition in conn_info_{min,max}_age_set() kernel: net/bluetooth: race condition in {conn,adv}_{min,max}_interval_set() function kernel: bluetooth: race condition in sniff_{min,max}_interval_set() kernel: crash due to a missing check for leb_size kernel: bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS kernel: bpf: Fix re-attachment branch in bpf_tracing_prog_attach kernel: ext4: regenerate buddy after block freeing failed if under fc replay kernel: x86/fpu: Stop relying on userspace for info to fault in xsave buffer that cause loop forever kernel: PCI/ASPM: Fix deadlock when enabling ASPM kernel: xsk: fix usage of multi-buffer BPF helpers for ZC XDP kernel: netfs, fscache: Prevent Oops in fscache_put_cache() kernel: tcp: make sure init the accept_queue&#39;s spinlocks once hw: arm64/sme: Always exit sme_alloc() early with existing storage kernel: ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work kernel: nbd: always initialize struct msghdr completely kernel: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() kernel: tracing: Ensure visibility when inserting an element into tracing_map kernel: thermal: intel: hfi: Add syscore callbacks for system-wide PM kernel: p2sb_bar() calls during PCI device probe kernel: drm/amdgpu: use-after-free vulnerability kernel: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 kernel: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' kernel: drm/amd/display: 'panel_cntl' could be null in 'dcn21_set_backlight_level()' kernel: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() kernel: hwmon: (coretemp) Fix out-of-bounds memory access kernel: net/sched: flower: Fix chain template offload kernel: arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD kernel: drm/amdgpu: variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()' kernel: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups kernel: ppp_async: limit MRU to 64K kernel: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section kernel: inet: read sk-&gt;sk_family once in inet_recv_error() kernel: net: atlantic: Fix DMA mapping for PTP hwts ring kernel: fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats kernel: KVM: arm64: Fix circular locking dependency kernel: drm/amd/display: Fix MST Null Ptr for RV kernel: ext4: fix double-free of blocks due to wrong extents moved_len kernel: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() kernel: mptcp: really cope with fastopen race kernel: powerpc/kasan: Fix addr error caused by page alignment kernel: HID: i2c-hid-of: fix NULL-deref on failed power up kernel: nouveau: offload fence uevents work to workqueue kernel: dpll: fix possible deadlock during netlink dump operation kernel: arp: Prevent overflow in arp_req_get(). kernel: devlink: fix possible use-after-free and memory leaks in devlink_init() kernel: net/sched: act_mirred: use the backlog for mirred ingress kernel: RDMA/qedr: Fix qedr_create_user_qp error flow kernel: RDMA/srpt: Support specifying the srpt_service_guid parameter kernel: dmaengine: idxd: Ensure safe user copy of completion record kernel: md: Don't ignore read-only array in md_check_recovery() kernel: md: Don't ignore suspended array in md_check_recovery() kernel: mm/swap: fix race when skipping swapcache kernel: cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window kernel: drm/amd/display: fixed integer types and null check locations kernel: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() kernel: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt kernel: mptcp: fix double-free on socket dismantle kernel: iommufd: Fix protection fault in iommufd_test_syz_conv_iova kernel: iommufd: Fix iopt_access_list_id overwrite bug kernel: net: veth: clear GRO when clearing XDP even when down kernel: vfio/pci: Create persistent INTx handler kernel: net/sched: taprio: proper TCA_TAPRIO_TC_ENTRY_INDEX check kernel: netfilter: nf_tables: set dormant flag on hook register failure kernel: net: bridge: switchdev: Skip MDB replays of deferred events on offload kernel: RDMA/irdma: Fix KASAN issue with tasklet kernel: cachefiles: fix memory leak in cachefiles_add_cache() kernel: efi: runtime: Fix potential overflow of soft-reserved region size kernel: nvme-fc: do not wait in vain when unloading module kernel: geneve: make sure to pull inner header in geneve_rx() kernel: wireguard: receive: annotate data-race around receiving_counter.counter kernel: packet: annotate data-races around ignore_outgoing kernel: hsr: Fix uninit-value access in hsr_get_node() kernel: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 kernel: RDMA/srpt: Do not register event handler until srpt device is fully setup kernel: quota: Fix potential NULL pointer dereference kernel: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() kernel: Bluetooth: hci_core: Fix possible buffer overflow kernel: Bluetooth: btrtl: fix out of bounds memory access kernel: wifi: mt76: mt7921e: fix use-after-free in free_irq() kernel: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() kernel: block: fix deadlock between bd_link_disk_holder and partition scan kernel: md: fix kmemleak of rdev->serial kernel: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak kernel: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security kernel: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() kernel: RDMA/mlx5: Fix fortify source warning while accessing Eth segment kernel: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit kernel: tracing/trigger: Fix to return error if failed to alloc snapshot kernel: inet: inet_defrag: prevent sk release while still in use kernel: drm/amdgpu: validate the parameters of bo mapping operations more clearly kernel: netfilter: nft_set_pipapo: do not free live element kernel: ASoC: SOF: Add some bounds checking to firmware data kernel: smb: client: potential use-after-free in cifs_debug_files_proc_show() kernel: USB: core: Fix deadlock in port &#34;disable&#34; sysfs attribute kernel: USB: core: Fix deadlock in usb_deauthorize_interface() kernel: drm/i915/gt: Reset queue_priority_hint on parking kernel: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() kernel: drm/i915/vma: Fix UAF on destroy against retire race kernel: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed kernel: wireguard: netlink: access device through ctx instead of peer kernel: wireguard: netlink: check for dangling peer via is_dead instead of empty list kernel: net: esp: fix bad handling of pages from page_pool kernel: nfs: fix UAF in direct writes kernel: mm: swap: fix race between free_swap_and_cache() and swapoff() kernel: dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape kernel: usb: xhci: Add error handling in xhci_map_urb_for_dma kernel: fat: fix uninitialized field in nostale filehandles kernel: powercap: intel_rapl: Fix a NULL pointer dereference kernel: KVM: Always flush async #PF workqueue when vCPU is being destroyed kernel: nouveau: fix instmem race condition around ptr stores kernel: mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled kernel: init/main.c: Fix potential static_command_line memory overflow kernel: arm64: hibernate: Fix level3 translation fault in swsusp_save() kernel: KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status kernel: KVM: x86/pmu: Disable support for adaptive PEBS kernel: clk: Get runtime PM before walking tree for clk_summary kernel: clk: Get runtime PM before walking tree during disable_unused kernel: net/sched: Fix mirred deadlock on device recursion kernel: netfilter: nf_tables: fix memleak in map from abort path kernel: netfilter: nf_tables: restore set elements when delete set fails kernel: tun: limit printing rate when illegal packet received by tun dev kernel: net/mlx5e: Prevent deadlock while disabling aRFS kernel: netfilter: flowtable: incorrect pppoe tuple kernel: netfilter: nft_set_pipapo: walk over current view on netlink dump kernel: md: Fix missing release of &#39;active_io&#39; for flush kernel: nbd: null check for nla_nest_start kernel: clk: Fix clk_core_get NULL dereference kernel: drm/amdgpu: Fix potential out-of-bounds access in &#39;amdgpu_discovery_reg_base_init()&#39; kernel: wifi: brcm80211: handle pmk_op allocation failure kernel: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend kernel: nouveau: lock the client object tree. kernel: iommu/vt-d: Fix NULL domain on device release kernel: pstore: inode: Only d_invalidate() is needed kernel: net: openvswitch: Fix Use-After-Free in ovs_ct_exit kernel: mptcp: fix data races on remote_id kernel: wifi: nl80211: reject iftype change with mesh ID change kernel: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back kernel: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program kernel: ALSA: usb-audio: Stop parsing channels bits when all channels are found. kernel: vfio/pci: Disable auto-enable of exclusive INTx IRQ kernel: genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline kernel: md/md-bitmap: fix incorrect usage for sb_index kernel: dm-raid: really frozen sync_thread during suspend kernel: drm/amdgpu: fix deadlock while reading mqd from debugfs kernel: x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD kernel: dm snapshot: fix lockup in dm_exception_table_exit kernel: ext4: fix corruption during on-line resize kernel: md/dm-raid: don&#39;t call md_reap_sync_thread() directly kernel: PCI/PM: Drain runtime-idle callbacks before driver removal kernel: drm/vmwgfx: Fix the lifetime of the bo cursor memory kernel: usb: cdc-wdm: close race between read and workqueue kernel: swiotlb: Fix double-allocation of slots due to broken alignment handling kernel: drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag kernel: usb: udc: remove warning when queue disabled ep kernel: misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume kernel: io_uring/net: fix overflow check in io_recvmsg_mshot_prep() kernel: io_uring: Fix release of pinned pages when __io_uaddr_map fails kernel: net/mlx5e: fix a double-free in arfs_create_groups kernel: wifi: mac80211: fix potential sta-link leak kernel: mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() kernel: iommu/vt-d: Use device rbtree in iopf reporting path kernel: irqchip/gic-v3-its: Prevent double free on error kernel: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash kernel: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash kernel: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update kernel: block: fix module reference leakage from bdev_open_by_dev error path kernel: smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() kernel: smb: client: fix potential UAF in smb2_is_network_name_deleted() kernel: smb: client: fix potential UAF in is_valid_oplock_break() kernel: smb: client: fix potential UAF in smb2_is_valid_lease_break() kernel: smb: client: fix potential UAF in smb2_is_valid_oplock_break() kernel: smb: client: fix potential UAF in cifs_dump_full_key() kernel: smb: client: fix potential UAF in cifs_stats_proc_show() kernel: smb: client: guarantee refcounted children from parent session kernel: mm/secretmem: fix GUP-fast succeeding on secretmem folios kernel: x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() kernel: x86/mm/pat: fix VM_PAT handling in COW mappings kernel: of: module: prevent NULL pointer dereference in vsnprintf() kernel: io_uring/kbuf: hold io_buffer_list reference over mmap kernel: ipv6: Fix infinite recursion in fib6_dump_done(). kernel: erspan: make sure erspan_base_hdr is present in skb-&gt;head kernel: net/sched: fix lockdep splat in qdisc_tree_reduce_backlog() kernel: mptcp: prevent BPF accessing lowat from a subflow socket. kernel: netfilter: nf_tables: reject new basechain after table flag update kernel: selinux: avoid dereference of garbage after mount failure kernel: bpf: Protect against int overflow for stack access size kernel: tls: get psock ref after taking rxlock to avoid leak kernel: wifi: iwlwifi: mvm: rfi: fix potential response leaks kernel: wifi: iwlwifi: mvm: pick the version of SESSION_PROTECTION_NOTIF kernel: randomize_kstack: Improve entropy diffusion kernel: io_uring: clear opcode specific data for an early failure kernel: usb: typec: ucsi: Limit read size on v1.2 kernel: block: prevent division by zero in blk_rq_stat_sum() kernel: drm: Check output polling initialized before disabling kernel: drm/amd/amdgpu: Fix potential ioremap() memory leaks in amdgpu_device_init() kernel: scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() kernel: drm/amdgpu: Skip do PCI error slot reset during RAS recovery kernel: wifi: ath11k: decrease MHI channel buffer length to 8KB kernel: dma-direct: Leak pages on dma_set_decrypted() failure kernel: pmdomain: imx8mp-blk-ctrl: imx8mp_blk: Add fdcc clock to hdmimix domain kernel: VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() kernel: wifi: rtw89: fix null pointer access when abort scan kernel: dyndbg: fix old BUG_ON in &gt;control parser kernel: drm/client: Fully protect modes[] with dev-&gt;mode_config.mutex kernel: drm/ast: Fix soft lockup kernel: scsi: sg: Avoid sg device teardown race kernel: iommu/vt-d: Fix WARN_ON in iommu probe path kernel: net/mlx5e: Fix mlx5e_priv_init() cleanup flow kernel: geneve: fix header validation in geneve[6]_xmit_skb kernel: xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING kernel: raid1: fix use-after-free for original bio in raid1_write_request() kernel: bounds: Use the right number of bits for power-of-two CONFIG_NR_CPUS kernel: dmaengine: idxd: Convert spinlock to mutex to lock evl workqueue kernel: ACPI: CPPC: Use access_width over bit_width for system memory accesses kernel: dpll: fix dpll_pin_on_pin_register() for multiple parent pins kernel: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage kernel: igb: Fix string truncation warnings in igb_set_fw_version kernel: ppdev: Add an error check in register_device kernel: drm/amdgpu: Init zone device and drm client after mode-1 reset on reload kernel: mm/hugetlb: fix DEBUG_LOCKS_WARN_ON(1) when dissolve_free_hugetlb_folio() kernel: octeontx2-af: fix the double free in rvu_npc_freemem() kernel: keys: Fix overwrite of key expiration on instantiation kernel: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer kernel: mm/userfaultfd: reset ptes when close() for wr-protected ones kernel: mm: use memalloc_nofs_save() in page_cache_ra_order() kernel: iommu/arm-smmu: Use the correct type in nvidia_smmu_context_fault() kernel: drm/nouveau/firmware: Fix SG_DEBUG error with nvkm_firmware_ctor() kernel: maple_tree: fix mas_empty_area_rev() null pointer dereference kernel: USB: core: Fix access violation during port device removal kernel: ipv6: prevent NULL dereference in ip6_output() kernel: ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() kernel: tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets kernel: block: fix overflow in blk_ioctl_discard() kernel: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING kernel: powerpc/pseries/iommu: LPAR panics during boot up with a frozen PE kernel: ipv4: Fix uninit-value access in __ip_make_skb() kernel: s390/qeth: Fix kernel panic after setting hsuid kernel: spi: fix null pointer dereference within spi_sync kernel: thermal/debugfs: Prevent use-after-free from occurring after cdev removal kernel: nsh: Restore skb-&gt;{protocol,data,mac_header} for outer header in nsh_gso_segment(). kernel: efi/unaccepted: touch soft lockup during memory accept kernel: nfs: Handle error of rpc_proc_register() in nfs_net_init(). kernel: pinctrl: core: delete incorrect free in pinctrl_enable() kernel: Reapply &#34;drm/qxl: simplify qxl_fence_wait&#34; kernel: net/smc: fix neighbour and rtable leak in smc_ib_find_route() kernel: ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() kernel: thermal/debugfs: Free all thermal zone debug memory on zone removal kernel: drm/vmwgfx: Fix invalid reads in fence signaled events kernel: thermal/debugfs: Fix two locking issues with thermal zone debug kernel: KEYS: trusted: Fix memory leak in tpm2_key_encode() kernel: net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP kernel: usb: dwc3: Wait unconditionally after issuing EndXfer command kernel: ALSA: hda/cs_dsp_ctl: Use private_free for control cleanup kernel: net/mlx5: Discard command completions in internal error kernel: drm/amdgpu/mes: fix use-after-free issue kernel: af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg kernel: md: fix resync softlockup when bitmap size is less than array size kernel: ALSA: Fix deadlocks with kctl removals at disconnection kernel: block: refine the EOF check in blkdev_iomap_begin kernel: ALSA: core: Fix NULL module pointer assignment at card init kernel: ipv6: sr: fix invalid unregister error path kernel: ALSA: timer: Set lower bound of start tick time kernel: stm class: Fix a double free in stm_register_device() kernel: dmaengine: idxd: Avoid unnecessary destruction of file_ida kernel: vfio/pci: fix potential memory leak in vfio_intx_enable() kernel: soundwire: cadence: fix invalid PDI offset kernel: ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() kernel: drm/amdgpu: Fix buffer size in gfx_v9_4_3_init_ cp_compute_microcode() and rlc_microcode() kernel: mm/memory-failure: fix handling of dissolved but not taken off from buddy pages kernel: drm/amdgpu: add error handle to avoid out-of-bounds kernel: ASoC: SOF: ipc4-topology: Fix input format query of process modules without base extension kernel: mm/vmalloc: fix vmalloc which may return null if called with __GFP_NOFAIL kernel: drm/i915/hwmon: Get rid of devm kernel: drm/drm_file: Fix pid refcounting race kernel: arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY kernel: ALSA: hda: cs35l56: Fix lifetime of cs_dsp instance kernel: drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) kernel: drm/mst: Fix NULL pointer dereference at drm_dp_add_payload_part2 kernel: vmci: prevent speculation leaks by sanitizing event in event_deliver() kernel: drivers: core: synchronize really_probe() and dev_uevent() kernel: netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type kernel: net: hns3: fix kernel crash problem in concurrent scenario kernel: io_uring/io-wq: Use set_bit() and test_bit() at worker->flags kernel: scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory kernel: usb: typec: tcpm: fix use-after-free case in tcpm_register_source_caps kernel: net/mlx5: Always stop health timer during driver removal kernel: ionic: fix kernel panic in XDP_TX action kernel: cachefiles: defer exposing anon_fd until after copy_to_user() succeeds kernel: bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() kernel: io_uring/rsrc: don&#39;t lock while !TASK_RUNNING kernel: vmxnet3: disable rx data ring on dma allocation failure kernel: drm/i915/dpt: Make DPT object unshrinkable kernel: block: fix request.queuelist usage in flush kernel: wifi: cfg80211: validate HE operation element parsing kernel: net/mlx5: Fix tainted pointer delete is case of flow rules creation fail kernel: iommu: Return right value in iommu_sva_bind_device() kernel: mm/page_table_check: fix crash on ZONE_DEVICE kernel: i2c: lpi2c: Avoid calling clk_get_rate during transfer kernel: tty: add the option to have a tty reject a new ldisc kernel: serial: imx: Introduce timeout when waiting on transmitter empty kernel: drm/radeon: fix UBSAN warning in kv_dpm.c kernel: KVM: arm64: Disassociate vcpus from redistributor region on teardown kernel: cpufreq: amd-pstate: fix memory leak on CPU EPP exit kernel: io_uring/sqpoll: work around a potential audit memory leak kernel: tcp: avoid too many retransmit packets kernel: drm/amdgpu: change vm-&gt;task_info handling kernel: filelock: Remove locks reliably when fcntl/close race is detected kernel: filelock: Fix fcntl/close race recovery compat path kernel: mm: vmalloc: check if a hash-index is in cpu_possible_mask kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers kernel: firmware: cs_dsp: Fix overflow checking of wmfw header kernel: netfilter: nf_tables: prefer nft_chain_validate kernel: filelock: fix potential use-after-free in posix_lock_inode kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files kernel: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() kernel: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() kernel: drm/radeon: check bo_va-&gt;bo is non-NULL before using it kernel: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() kernel: powerpc/pseries: Whitelist dtl slub object for copying to userspace kernel: null_blk: fix validation of block size kernel: nvmet: always initialize cqe.result kernel: nvme-fabrics: use reserved tag for reg read/write command kernel: cxl/region: Avoid null pointer dereference in region lookup kernel: cxl/mem: Fix no cxl_nvd during pmem region auto-assembling kernel: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes kernel: drm/i915/gt: Fix potential UAF by revoke of fence registers kernel: drm/amdgpu: avoid using null object of framebuffer kernel: drm/fbdev-dma: Only set smem_start is enable per module option kernel: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes kernel: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers kernel: nfsd: initialise nfsd_info.mutex early. kernel: ftruncate: pass a signed offset kernel: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER kernel: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes kernel: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values kernel: drm/amdgpu: fix double free err_addr pointer warnings kernel: scsi: qedf: Make qedf_execute_tmf() non-preemptible kernel: wifi: rtw89: fw: scan offload prohibit all 6 GHz channel if no 6 GHz sband kernel: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX kernel: Bluetooth: ISO: Check socket flag instead of hcon kernel: tcp_metrics: validate source addr length kernel: scsi: mpi3mr: Sanitise num_phys kernel: usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB kernel: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc kernel: firmware: cs_dsp: Validate payload length before processing block kernel: firmware: cs_dsp: Return error if block header overflows file kernel: x86/bhi: Avoid warning in #DB handler due to BHI mitigation kernel: Revert "sched/fair: Make sure to try to detach at least one movable task" kernel: mm: huge_memory: use !CONFIG_64BIT to relax huge page alignment on 32 bit machines kernel: net/mlx5: Fix missing lock on sync reset reload kernel: net/iucv: fix use after free in iucv_sock_close() kernel: nvme-pci: add missing condition check for existence of mapped data kernel: dev/parport: fix the array out-of-bounds risk kernel: net: missing check virtio kernel: nfs: pass explicit offset/count to trace events kernel: leds: trigger: Unregister sysfs attributes before calling deactivate() kernel: wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() kernel: dma: fix call order in dmam_free_coherent kernel: s390/fpu: Re-add exception handling in load_fpu_state() kernel: net/mlx5: Always drain health in shutdown callback kernel: perf: Fix event leak upon exec and file release kernel: perf: Fix event leak upon exit kernel: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() kernel: mm: list_lru: fix UAF for memory cgroup kernel: memcg: protect concurrent access to mem_cgroup_idr kernel: wifi: mac80211: fix NULL dereference at band check in starting tx ba session kernel: fuse: Initialize beyond-EOF page contents before setting uptodate kernel: usb: gadget: core: Check for unset descriptor kernel: x86/mm: Fix pti_clone_pgtable() alignment assumption kernel: net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink kernel: bnxt_en: Fix double DMA unmapping for XDP_REDIRECT kernel: KVM: s390: fix validity interception issue when gisa is switched off kernel: tls: stop recv() if initial process_rx_list gave us non-DATA
CVSS v3.1 score: 5.9