Linux Kernel 5.17

ASoC: max9759: fix underflow in speaker_gain_control_put()

netfilter: nf_queue: fix possible use-after-free

drm/vmwgfx: Fix stale file descriptors on failed usercopy

IB/hfi1: Fix panic with larger ipoib send_queue_size

arm64: extable: fix load_unaligned_zeropad() reg indices

block: don't revert iter for -EIOCBQUEUED

rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev

iavf: fix out-of-bounds writes in iavf_get_ethtool_stats()

net: bridge: vlan: fix memory leak in __allowed_ingress

NFSD: Fix the behavior of READ near OFFSET_MAX

phy: ti: Fix missing sentinel for clk_div_table

KVM: arm64: Avoid consuming a stale esr value when SError occur

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.

A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information.

phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable()

mm: don't try to NUMA-migrate COW pages that have other uses

bpf: Use VM_MAP instead of VM_ALLOC for ringbuf

ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()

ASoC: hdmi-codec: Fix OOB memory accesses

net: fix information leakage in /proc/net/ptype

USB: core: Fix hang in usb_kill_urb by adding memory barriers

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.

A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.

A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.

A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space.

A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system.

vt_ioctl: fix array_index_nospec in vt_setactivate

fs/proc: task_mmu.c: don't read mapcount for migration entry

ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler

netfilter: nf_tables: initialize registers in nft_do_chain()

eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX

scsi: qedf: Fix refcount issue when LOGO is received during TMF

net: dsa: felix: don't use devres for mdiobus

net: dsa: mv88e6xxx: don't use devres for mdiobus

i40e: Fix XDP program unloading while removing the driver

net: dsa: seville: register the mdiobus under devres

net: dsa: lantiq_gswip: don't use devres for mdiobus

scsi: qedf: Add stag_work to all the vports

ibmvnic: don't release napi in __ibmvnic_open()

ima: fix reference leak in asymmetric_verify()