Linux Kernel 6.3

nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()

net: qrtr: Fix a refcount bug in qrtr_recvmsg()

tty: serial: fsl_lpuart: fix race on RX DMA shutdown

iommufd: Do not corrupt the pfn list when doing batch carry

tee: amdtee: fix race condition in amdtee_open_session

Bluetooth: Fix race condition in hci_cmd_sync_clear

Bluetooth: SCO: fix race conditions in sco_sock_connect()

mptcp: fix disconnect vs accept race

tracing/synthetic: Fix races on freeing last_cmd

net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.

A use-after-free flaw was found in mt7921_check_offload_capability in drivers/net/wireless/mediatek/mt76/mt7921/init.c in wifi mt76/mt7921 sub-component in the Linux Kernel. This flaw could allow an attacker to crash the system after 'features' memory release. This vulnerability could even lead to a kernel information leak problem.

wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta

nilfs2: fix kernel-infoleak in nilfs_ioctl_wrap_copy()

fs: prevent out-of-bounds array speculation when closing a file descriptor

platform/chrome: cros_ec_chardev: fix kernel data leak from ioctl

drm/i915/sseu: fix max_subslices array-index-out-of-bounds access

af_unix: fix struct pid leaks in OOB support

riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode

drm/edid: fix info leak when failing to get panel id

HID: intel-ish-hid: Fix kernel panic during warm reset

vsock/virtio: fix potential unbounded skb queue

An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace "data->block[0]" variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dma_buffer. This flaw could allow a local privileged user to crash the system or potentially achieve code execution.

Use-after-free in setup_async_work()

An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.

A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea

A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux Kernel Driver (xgene-hwmon). This flaw could allow a local attacker to crash the system due to a race problem. This vulnerability could even lead to a kernel information leak problem.

mips: bmips: BCM6358: make sure CBR is correctly set

The Linux kernel io_uring IORING_OP_SOCKET operation contained a double free in function __sys_socket_file() in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067.

Revert "net/mlx5: Block entering switchdev mode with ns inconsistency"

scsi: core: Fix unremoved procfs host directory regression

ca8210: fix mac_len negative array access

dm crypt: add cond_resched() to dmcrypt_write()

bpf, arm64: Fixed a BTI error on returning to patched function

qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info

net/mlx5: E-Switch, Fix an Oops in error handling code

net/mlx5: Fix steering rules cleanup

can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write

usb: dwc2: fix a devres leak in hw_enable upon suspend resume

ext4: zero i_disksize when initializing the bootloader inode