Linux Kernel 6.1

Bluetooth: virtio_bt: clamp rx length before skb_put

net: gso: fix panic on frag_list with mixed head alloc types

SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed

iio: adc: mp2629: fix potential array out of bound access

iio: health: afe4403: Fix oob read in afe4403_read_raw

iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw

net: mvneta: Prevent out of bounds read in mvneta_config_rss()

ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network

capabilities: fix undefined behavior in bit shift for CAP_TO_MASK

riscv: process: fix kernel info leakage

riscv: fix reserved memory setup

tracing: Fix wild-memory-access in register_synth_event()

can: dev: fix skb drop check

KVM: x86: smm: number of GPRs in the SMRAM image depends on the image format

cpufreq: qcom: fix writes in read-only memory region

s390/cio: fix out-of-bounds access on cio_ignore free

riscv: fix race when vmap stack overflow

A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges.

In imgsys_cmdq, there is a possible use after free due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340350.

In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07354259; Issue ID: ALPS07340477.

In imgsys, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326455; Issue ID: ALPS07326441.

In imgsys_cmdq, there is a possible out of bounds read due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340433.

In imgsys, there is a possible out of bounds read and write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07326430; Issue ID: ALPS07326430.

In imgsys_cmdq, there is a possible out of bounds write due to a missing valid range checking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS07340433; Issue ID: ALPS07340381.

xen/netfront: fix crash when removing device

A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during call cleanup. This flaw may lead to a denial of service.

Null pointer dereference in submit_lookup_cmds() in drivers/gpu/drm/msm/msm_gem_submit.c

net: phy: fix null-ptr-deref while probe() failed

mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add()

A known cache speculation vulnerability, known as Branch History Injection (BHI) or Spectre-BHB, becomes actual again for the new hw AmpereOne. Spectre-BHB is similar to Spectre v2, except that malicious code uses the shared branch history (stored in the CPU Branch History Buffer, or BHB) to influence mispredicted branches within the victim's hardware context. Once that occurs, speculation caused by the mispredicted branches can cause cache allocation. This issue leads to obtaining information that should not be accessible.

io_uring: Fix a null-ptr-deref in io_tctx_exit_cb()

xen-netfront: Fix NULL sring after live migration

udf: Fix preallocation discarding at indirect extent boundary

A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memory corruption) when nested virtualisation and the TDP MMU are enabled.

igb: Initialize mailbox message for VF reset

btrfs: qgroup: fix sleep from invalid context bug in btrfs_qgroup_inherit()

HID: core: fix shift-out-of-bounds in hid_report_raw_event

iavf: Fix error handling in iavf_init_module()

iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init()

nilfs2: fix NULL pointer dereference in nilfs_palloc_commit_free_entry()