Linux Kernel 5.15

mm, slub: fix potential use-after-free in slab_debugfs_fops

ocfs2: fix race between searching chunks and release journal_head from buffer_head

userfaultfd: fix a race between writeprotect and exit_mmap()

bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data

cfg80211: fix management registrations locking

bpf: Fix stack-out-of-bounds write in devmap

net: macb: fix clk handling on PCI glue driver removal

sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb

riscv, bpf: Fix potential NULL dereference

dma-debug: prevent an error message from causing runtime problems

ksmbd: fix memory leaks and NULL deref in smb2_lock()

mptcp: fix possible stall on recvmsg()

ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size

smc91x: fix broken irq-context in PREEMPT_RT

ksmbd: Compare MACs in constant time

audit: fix possible null-pointer dereference in audit_filter_rules

mlxsw: thermal: Fix out-of-bounds memory accesses

hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs

ipack: ipoctal: fix stack information leak

ipack: ipoctal: fix module reference leak

net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path

KVM: PPC: Book3S HV: Fix stack handling in idle_kvm_start_guest()

nexthop: Fix memory leaks in nexthop notification chain listeners

afs: Fix corruption in reads at fpos 2G-4G from an OpenAFS server

s390/cio: fix out-of-bounds access on cio_ignore free

A use-after-free read flaw was found in sock_getsockopt() in net/core/sock.c due to SO_PEERCRED and SO_PEERGROUPS race with listen() (and connect()) in the Linux kernel. In this flaw, an attacker with a user privileges may crash the system or leak internal kernel information.

blktrace: Fix uaf in blk_trace access after removing by sysfs

A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory consumption). This vulnerability is similar with the older CVE-2019-18808.

A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock operation in btrfs. In this flaw, a user with a local privilege may cause a denial of service (DOS) due to a deadlock problem.

A use-after-free flaw was found in the add_partition in block/partitions/core.c in the Linux kernel. A local attacker with user privileges could cause a denial of service on the system. The issue results from the lack of code cleanup when device_add call fails when adding a partition to the disk.

A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).

ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler

block: fix rq-qos breakage from skipping rq_qos_done_bio()

A memory leak flaw was found in the Linux kernel's ccp_run_aes_gcm_cmd() function that allows an attacker to cause a denial of service. The vulnerability is similar to the older CVE-2019-18808. The highest threat from this vulnerability is to system availability.

net: dsa: fix panic on shutdown if multi-chip tree failed to probe

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.

bpf: Add oversize check before call kvcalloc()

netfilter: conntrack: serialize hash resizes and cleanups

irqchip/gic-v3-its: Fix potential VPE leak on error

binder: make sure fd closes complete