Linux Kernel 5.16

vduse: fix memory corruption in vduse_dev_ioctl()

blk-mq: cancel blk-mq dispatch work in both blk_cleanup_queue and disk_release()

i2c: virtio: disable timeout handling

net: avoid race between device unregistration and ethnl ops

iavf: Fix out-of-bounds when setting channels on remove

io-wq: check for wq exit after adding new worker task_work

drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer

seg6: fix the iif in the IPv6 socket control block

Input: elantech - fix stack out of bound access in elantech_change_report_id()

An out-of-bounds (OOB) memory write flaw was found in the NFSD in the Linux kernel. Missing sanity may lead to a write beyond bmval[bmlen-1] in nfsd4_decode_bitmap4 in fs/nfsd/nfs4xdr.c. In this flaw, a local attacker with user privilege may gain access to out-of-bounds memory, leading to a system integrity and confidentiality threat.

net: marvell: prestera: fix incorrect structure access

scsi: scsi_debug: Fix type in min_t to avoid stack OOB

pinctrl: mediatek: fix global-out-of-bounds issue

asix: fix uninit-value in asix_mdio_read()

HID: intel-ish-hid: Fix kernel panic during warm reset

A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers in the way users call close() and fget() simultaneously and can potentially trigger a race condition. This flaw allows a local user to crash the system or escalate their privileges on the system. This flaw affects Linux kernel versions prior to 5.16-rc4.

mm/damon/dbgfs: protect targets destructions with kdamond_lock

scsi: pm80xx: Do not call scsi_remove_host() in pm8001_alloc()

The check_alu_op() function in kernel/bpf/verifier.c in the Linux kernel through v5.16-rc5 did not properly update bounds while handling the mov32 instruction, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."

mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()

ice: xsk: return xsk buffers back to pool when cleaning the ring

KVM: VMX: Always clear vmx->fail on emulation_required

drm/amd/pm: fix a potential gpu_metrics_table memory leak

platform/x86: intel_pmc_core: fix memleak on registration failure

A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6

serial: core: fix transmit-buffer reset and memleak

bpf: Fix kernel address leakage in atomic cmpxchg's r0 aux reg

mptcp: clear 'kern' flag from fallback sockets

IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()

ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module

net/sched: sch_ets: don't peek at classes beyond 'nbands'

i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc

iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove

ALSA: pcm: oss: Limit the period size to 16MB

ALSA: pcm: oss: Fix negative period/buffer sizes

IB/hfi1: Fix leak of rcvhdrtail_dummy_kvaddr

btrfs: skip reserved bytes warning on unmount after log cleanup failure

devlink: fix netns refcount leak in devlink_nl_cmd_reload()

rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()

x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails