Linux Kernel 6.2

btrfs: always report error in run_one_delayed_ref()

mm/page_alloc: prevent pcp corruption with SMP=n

mm/khugepaged: fix ->anon_vma race

net: nfc: Fix use-after-free in local_cleanup()

net/sched: sch_taprio: fix possible use-after-free

io_uring: lock overflowing for IOPOLL

drm/amdkfd: Add sync after creating vram bo

rxrpc: Fix missing locking causing hanging calls

mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()

block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq

drm/panfrost: Fix GEM handle creation ref-counting

HID: mcp-2221: prevent UAF in delayed work

netfilter: nft_set_rbtree: fix null deref on element insertion

iommu/mediatek: fix use-after-free on probe deferral

drm/vmwgfx: Return the correct value in vmw_translate_ptr functions

mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups

nfsd: fix handling of cached open files in nfsd4_open codepath

net: fix NULL pointer in skb_segment_list

can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

smb: server: fix active_num_conn leak on transport allocation failure

rxrpc: Only put the call ref if one was acquired

A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem.

net: use a bounce buffer for copying skb->mark

bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation

wifi: mt76: mt7996: Fix possible oob access in mt7996_mac_write_txwi_80211()

There is an UAF vulnerability in vmwgfx driver

There is an UAF vulnerability in vmwgfx driver

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. This flaw causes the system to crash.

An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2. There is a blocking operation when a task is in !TASK_RUNNING. In dvb_frontend_get_event, wait_event_interruptible is called; the condition is dvb_frontend_test_event(fepriv,events). In dvb_frontend_test_event, down(&fepriv->sem) is called. However, wait_event_interruptible would put the process to sleep, and down(&fepriv->sem) may block the process.

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.

An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2. There is a sleeping function called from an invalid context in gsmld_write, which will block the kernel. Note: This has been disputed by 3rd parties as not a valid vulnerability.

An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_bridge.c in the Linux kernel 6.2. There is a NULL pointer dereference in vidtv_mux_stop_thread. In vidtv_stop_streaming, after dvb->mux=NULL occurs, it executes vidtv_mux_stop_thread(dvb->mux).

A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the way user can guess location of exception stack(s) or other important data. A local user could use this flaw to get access to some important data with expected location in memory.

efi: fix potential NULL deref in efi_mem_reserve_persistent

bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener

Squashfs: fix handling and sanity checking of xattr_ids count

trace_events_hist: add check for return value of 'create_hist_field'

x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL

ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()

net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices