Debian Debian Linux 11.0

ext4: aovid use-after-free in ext4_ext_insert_extent()

drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer

MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery

Out-of-bounds write in Linux kernel's net/sched: sch_qfq component

mptcp: pm: avoid possible UaF when selecting endp

ocfs2: cancel dqi_sync_work before freeing oinfo

x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavailable, Xen will run guests in so called shadow mode. Shadow mode maintains a pool of memory used for both shadow page tables as well as auxiliary data structures. To migrate or snapshot guests, Xen additionally runs them in so called log-dirty mode. The data structures needed by the log-dirty tracking are part of aformentioned auxiliary data. In order to keep error handling efforts within reasonable bounds, for operations which may require memory allocations shadow mode logic ensures up front that enough memory is available for the worst case requirements. Unfortunately, while page table memory is properly accounted for on the code path requiring the potential establishing of new shadows, demands by the log-dirty infrastructure were not taken into consideration. As a result, just established shadow page tables could be freed again immediately, while other code is still accessing them on the assumption that they would remain allocated.

ext4: fix slab-use-after-free in ext4_split_extent_at()

drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error

smb: client: fix potential UAF in cifs_stats_proc_show()

Another race in XENMAPSPACE_grant_table handling Guests are permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, are de-allocated when a guest switches (back) from v2 to v1. Freeing such pages requires that the hypervisor enforce that no parallel request can result in the addition of a mapping of such a page to a guest. That enforcement was missing, allowing guests to retain access to pages that were freed and perhaps re-used for other purposes. Unfortunately, when XSA-379 was being prepared, this similar issue was not noticed.

grant table v2 status pages may remain accessible after de-allocation Guest get permitted access to certain Xen-owned pages of memory. The majority of such pages remain allocated / associated with a guest for its entire lifetime. Grant table v2 status pages, however, get de-allocated when a guest switched (back) from v2 to v1. The freeing of such pages requires that the hypervisor know where in the guest these pages were mapped. The hypervisor tracks only one use within guest space, but racing requests from the guest to insert mappings of these pages may result in any of them to become mapped in multiple locations. Upon switching back from v2 to v1, the guest would then retain access to a page that was freed and perhaps re-used for other purposes.

drm/amd: check num of link levels when update pcie param

af_unix: Don't leave consecutive consumed OOB skbs.

drm/amd/pm: Fix negative array index read

drm/amd/display: fix double free issue during amdgpu module unload

drm/amdkfd: Fix mode1 reset crash issue

drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration

driver core: bus: Fix double free in driver API bus_register()

bna: adjust 'name' buf size of bna_tcb and bna_ccb structures

Use-after-free in Linux kernel's netfilter: nf_tables component

crypto: hisilicon/qm - inject error before stopping queue

drm/amdgpu: Validate TA binary size

ASoC: meson: axg-card: fix 'use-after-free'

ALSA: asihpi: Fix potential OOB array access

can: bcm: add missing rcu read protection for procfs content

fbdev: pxafb: Fix possible use after free in pxafb_task()

platform/x86: x86-android-tablets: Fix use after free on platform_device_register() errors

HID: amd_sfh: free driver_data after destroying hid device

KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS

smb: client: fix use-after-free bug in cifs_debug_data_proc_show()

spi: nxp-fspi: fix the KASAN report out-of-bounds bug

smb: client: fix potential UAF in cifs_dump_full_key()

openvswitch: Fix unsafe attribute parsing in output_userspace()

PCI/MSI: Fix UAF in msi_capability_init

bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers

drm/amdgpu: Fix out-of-bounds write warning

f2fs: check validation of fault attrs in f2fs_build_fault_attr()

ftrace: Fix possible use-after-free issue in ftrace_location()

tracing: Fix oob write in trace_seq_to_buffer()