Linux Kernel 6.7

tcp: do not accept ACK of bytes we never sent

net/smc: avoid data corruption caused by decline

smb: client: fix potential OOBs in smb2_parse_contexts()

Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap

io_uring/af_unix: disable sending io_uring over sockets

io_uring/kbuf: hold io_buffer_list reference over mmap

Possible UAF in bt_accept_poll in Linux kernel

Use-after-free in Linux kernel's netfilter: nf_tables component

Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data is mishandled.

net: hns3: fix out-of-bounds access may occur when coalesce info is read via debugfs

ipvlan: add ipvlan_route_v6_outbound() helper

vhost-vdpa: fix use after free in vhost_vdpa_probe()

tee: optee: Fix kernel panic caused by incorrect error handling

mm/migrate: fix shmem xarray update during migration

bcachefs: Fix sb_field_downgrade validation

debugfs: fix wait/cancellation handling during remove

futex: Require sys_futex_requeue() to have identical flags

net: rose: fix invalid array index in rose_kill_by_device()

Kernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerability

net: stmmac: Prevent NULL deref when RX memory exhausted

Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client

Kernel: out-of-bounds read vulnerability in smbcalcsize

wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()

An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because of a vcc_recvmsg race condition.

An issue was discovered in the Linux kernel before 6.6.8. atalk_ioctl in net/appletalk/ddp.c has a use-after-free because of an atalk_recvmsg race condition.

An issue was discovered in the Linux kernel before 6.6.8. rose_ioctl in net/rose/af_rose.c has a use-after-free because of a rose_accept race condition.

Kernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uaf

Kernel: nf_tables: pointer math issue in nft_byteorder_eval()

Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c

Kernel: null pointer dereference vulnerability in nft_dynset_init()

Kernel: io_uring out of boundary memory access in __io_uaddr_map()

usb: aqc111: check packet for fixup for true limit

ASoC: ops: Consistently treat platform_max as control value

bonding: stop the device in bond_setup_by_slave()

usb: config: fix iteration issue in 'usb_get_bos_descriptor()'

s390/dasd: protect device queue against concurrent access

mptcp: deal with large GSO size

blk-mq: make sure active queue usage is held for bio_integrity_prep()

net: mvneta: fix calls to page_pool_get_stats