Linux Kernel

ceph: blocklist the kclient when receiving corrupted snap trace

smb: client: fix UAF in async decryption

mptcp: fix TCP options overflow.

bpf: devmap: provide rxq after redirect

NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this vulnerability may lead to code execution and data tampering.

nvmet: avoid potential UAF in nvmet_req_complete()

serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails

bpf: Reject fragmented frames in devmap

staging: gdm724x: fix use after free in gdm_lte_rx()

bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT

nvmet-tcp: propagate nvmet_tcp_build_pdu_iovec() errors to its callers

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system. IBM X-Force ID: 218281.

libceph: Fix potential out-of-bounds access in crush_decode()

NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, code execution, and escalation of privileges.

tipc: improve size validations for received domain records

ksmbd: fix racy issue from session lookup and expire

netfs: Fix missing locking around retry adding new subreqs

net/smc: Fix possible access to freed memory in link clear

ibmvnic: fix race between xmit and reset

nfsd: fix race between laundromat and free_stateid

NFSD: Fix nfsd4_encode_fattr4() crasher

net/mlx5e: kTLS, Fix crash in RX resync flow

RDMA/iwcm: Fix workqueue list corruption by removing work_list

tls: Fix race condition in tls_sw_cancel_work_tx()

netmem: prevent TX of unreadable skbs

fs: dlm: fix use after free in midcomms commit

nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()

ksmbd: fix race condition between session lookup and expire

mptcp: consolidate suboption status

rxrpc: Fix call timer start racing with call destruction

net/tls: Fix flipped sign in tls_err_abort() calls

Incorrect privilege assignment in Portal for ArcGIS

nfsd: don't replace page in rq_pages if it's a continuation of last page

smb: client: fix possible double free in smb2_set_ea()

net: ethernet: mtk_eth_soc: fix SER panic with 4GB+ RAM

igb: cope with large MAX_SKB_FRAGS

ksmbd: fix user-after-free from session log off

mptcp: pm: fix UaF read in mptcp_pm_nl_rm_addr_or_subflow

scsi: lpfc: Fix buffer free/clear order in deferred receive path

Weak Password Recovery Mechanism in Portal for ArcGIS