Linux Kernel 5.16

A race condition was found in the Linux kernel's ebpf verifier between bpf_map_update_elem and bpf_map_freeze due to a missing lock in kernel/bpf/syscall.c. In this flaw, a local user with a special privilege (cap_sys_admin or cap_bpf) can modify the frozen mapped address space. This flaw affects kernel versions prior to 5.16 rc2.

A memory leak flaw in the Linux kernel's hugetlbfs memory usage was found in the way the user maps some regions of memory twice using shmget() which are aligned to PUD alignment with the fault of some of the memory pages. A local user could use this flaw to get unauthorized access to some data.

net: tulip: de4x5: fix the problem that the array 'lp->phy[8]' may be out of bound

audit: improve robustness of the audit queue handling

drm/vc4: kms: Add missing drm_crtc_commit_put

ALSA: rawmidi - fix the uninitalized user_pversion

kfence: fix memory leak when cat kfence objects