Linux Kernel 5.19

lockd: set other missing fields when unlocking files

NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

Linux disk/nic frontends data leaks T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Linux Block and Network PV device frontends don't zero memory regions before sharing them with the backend (CVE-2022-26365, CVE-2022-33740). Additionally the granularity of the grant table doesn't allow sharing less than a 4K page, leading to unrelated data residing in the same 4K page as data shared with a backend being accessible by such backend (CVE-2022-33741, CVE-2022-33742).

virtio_net: fix xdp_rxq_info bug after suspend/resume

dm raid: fix accesses beyond end of raid member array

ip_gre: test csum_start instead of transport header

powerpc/xive/spapr: correct bitmap allocation size

ima: Fix a potential integer overflow in ima_appraise_measurement

zonefs: fix zonefs_iomap_begin() for reads

cxl/mbox: validate payload size before accessing contents in cxl_payload_from_user_allowed()

When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.

An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.

There are use-after-free vulnerabilities caused by timer handler in net/rose/rose_timer.c of linux that allow attackers to crash linux kernel without any privileges.

An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.

vlan: fix memory leak in vlan_newlink()

afs: Fix dynamic root getattr

KVM: Don't null dereference ops->destroy

ipv6: Fix signed integer overflow in __ip6_append_data

net: xfrm: unexport __init-annotated xfrm4_protocol_init()

sfc: fix kernel panic when creating VF

usb: dwc2: Fix memory leak in dwc2_hcd_init

x86/speculation: Fill RSB on vmexit for IBRS

ext4: fix bug_on ext4_mb_use_inode_pa

net: mdio: unexport __init-annotated mdio_bus_init()

netfilter: nf_tables: memleak flow rule from commit path

dm raid: fix KASAN warning in raid5_add_disks

bpf, arm64: Clear prog->jited_len along prog->jited

erspan: do not assume transport header is always set

tick/nohz: unexport __init-annotated tick_nohz_full_setup()

dm mirror log: round up region bitmap size to BITS_PER_LONG

i2c: piix4: Fix a memory leak in the EFCH MMIO support

bpf: Fix insufficient bounds propagation from adjust_scalar_min_max_vals

irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions

RDMA/cm: Fix memory leak in ib_cm_insert_listen

drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector()

ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()

ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg