Linux Kernel

net: bcmgenet: keep RBUF EEE/PM disabled

rxrpc: reject undecryptable rxkad response tickets

memory: tegra124-emc: Fix dll_change check

ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison

netfilter: nf_conntrack_expect: use expect->helper

ipv6: sit: reload inner IPv6 header after GSO offloads

batman-adv: fix fragment reassembly length accounting

SUNRPC: Fix loop termination condition in gss_free_in_token_pages()

keys: Fix overwrite of key expiration on instantiation

tracing: Correct the length check which causes memory corruption

Missing Authentication

net: tls: handle backlogging of crypto requests

tls: fix use-after-free on failed backlog decryption

net: mvpp2: limit XDP frame size to the RX buffer

libceph: define and enforce CEPH_MAX_KEY_LEN

net: mvpp2: refill RX buffers before XDP or skb use

ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()

tipc: skb_linearize the head skb when reassembling msgs

gve: Clear napi->skb before dev_kfree_skb_any()

sctp: do asoc update earlier in sctp_sf_do_dupcook_a

Insufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver

net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service.

RDMA/siw: Reject MPA FPDU length underflow before signed receive math

cifs: Fix use-after-free in rdata->read_into_pages()

crypto: xilinx - call finalize with bh disabled

ksmbd: add permission checks for FSCTL_DUPLICATE_EXTENTS_TO_FILE

ext4: handle wraparound when searching for blocks for indirect mapped blocks

ksmbd: fix out-of-bounds write in smb2_get_ea() EA alignment

tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages, and other input data. NOTE: this issue exists because of an incomplete fix for CVE-2020-36767, which only considered single and double quote characters.

ksmbd: fix use-after-free from async crypto on Qualcomm crypto engine

net: tls: fix use-after-free with partial reads and async decrypt

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, data tampering, and information disclosure.

RDMA/siw: bound Read Response placement to the RREAD length

mptcp: fix double-free on socket dismantle

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause a remote code execution by manipulating the model name parameter in the model control APIs. A successful exploit of this vulnerability might lead to remote code execution, denial of service, information disclosure, and data tampering.

net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption

ksmbd: close durable scavenger races against m_fp_list lookups

nvme-tcp: fix UAF when detecting digest errors

ksmbd: fix signededness bug in smb_direct_prepare_negotiation()