Linux Kernel 6.0

netfilter: nf_tables: possible module reference underflow in error path

ASoC: Intel: avs: Fix potential buffer overflow by snprintf()

rxrpc: Fix locking in rxrpc's sendmsg

drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex

mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW

drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib

dma-buf/dma-resv: check if the new fence is really later

binder: fix UAF of ref->proc caused by race condition

ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC

net_sched: ets: fix a race in ets_qdisc_change()

bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing

bpf: Fix a UAF issue in bpf_trampoline_link_cgroup_shim

ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header

A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet_setup_auth(), allows an attacker to perform a Pre-Auth Denial of Service (DoS) attack on a remote machine. Affected versions v6.0-rc1 to v6.0-rc3, fixed in v6.0-rc4.

net: lantiq_xrx200: restore buffer if memory allocation failed

bpf, cgroup: Fix kernel BUG in purge_effective_progs

bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO

drm/amd/display: Check correct bounds for stream encoder instances for DCN303

ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()

hwmon: (gpio-fan) Fix array out of bounds access

clk: bcm: rpi: Prevent out-of-bounds access

exfat: fix overflow for large capacity partition

regmap: spi: Reserve space for register address/padding

fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

A use-after-free flaw was found in the Linux kernel’s PLP Rose functionality in the way a user triggers a race condition by calling bind while simultaneously triggering the rose_bind() function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously. This flaw could allow a local attacker to potentially trigger an out-of-bounds write or leak kernel heap memory by performing an out-of-bounds read and copying it into a socket.

Memory leak in btrfs_get_dev_args_from_path()

fsdax: Fix infinite loop in dax_iomap_rw()

sfc/siena: fix null pointer dereference in efx_hard_start_xmit

A flaw was found in the Linux kernel’s networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service.

An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data.

A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.

Linux Kernel Netfilter sysfs.c damon_sysfs_add_target memory leak

kcm: fix strp_init() order and cleanup

tee: add overflow check in register_shm_helper()

wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected

loop: Check for overflow while configuring loop

HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report

xfrm: fix refcount leak in __xfrm_policy_check()

drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors()