Linux Linux Kernel 2.6.12

The inotify functionality in Linux kernel 2.6 before 2.6.28-rc5 might allow local users to gain privileges via unknown vectors related to race conditions in inotify watch removal and umount.

USB: serial: io_ti: fix heap overflow in get_manuf_info()

The dbg_lvl file for the megaraid_sas driver in the Linux kernel before 2.6.27 has world-writable permissions, which allows local users to change the (1) behavior and (2) logging level of the driver by modifying this file.

The IPv6 flow label handling code (ip6_flowlabel.c) in Linux kernels 2.4 up to 2.4.32 and 2.6 before 2.6.14 modifies the wrong variable in certain circumstances, which allows local users to corrupt kernel memory or cause a denial of service (crash) by triggering a free of non-allocated memory.

NULL pointer deference in rfcomm_check_security in Linux kernel

A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash the system and possibly cause a kernel information lea

Race condition in the setsid function in Linux before 2.6.8.1 allows local users to cause a denial of service (crash) and possibly access portions of kernel memory, related to TTY changes, locking, and semaphores.

The sctp_new function in (1) ip_conntrack_proto_sctp.c and (2) nf_conntrack_proto_sctp.c in Netfilter in Linux kernel 2.6 before 2.6.20.13, and 2.6.21.x before 2.6.21.4, allows remote attackers to cause a denial of service by causing certain invalid states that trigger a NULL pointer dereference.

Use-after-free vulnerability in the xacct_add_tsk function in kernel/tsacct.c in the Linux kernel before 2.6.19 allows local users to obtain potentially sensitive information from kernel memory or cause a denial of service (system crash) via a taskstats TASKSTATS_CMD_ATTR_PID command.

Linux kernel before 2.6.16.21 and 2.6.17, when running on PowerPC, does not perform certain required access_ok checks, which allows local users to read arbitrary kernel memory on 64-bit systems (signal_64.c) and cause a denial of service (crash) and possibly read kernel memory on 32-bit systems (signal_32.c).

Linux Kernel IPv6 ipv6_renew_options memory leak

tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets

A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.

ppp: reject claimed-as-LCP but actually malformed packets

media: av7110: fix a spectre vulnerability

llc: do not use skb_get() before dev_queue_xmit()

nfs: Handle error of rpc_proc_register() in nfs_net_init().

ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()

net: let net.core.dev_weight always be non-zero

macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"

net: usb: rtl8150: enable basic endpoint checking

romfs: check sb_set_blocksize() return value

atm: Revert atm_account_tx() if copy_from_iter_full() fails.

jfs: add check read-only before txBeginAnon() call

atm: atmtcp: Free invalid length skb in atmtcp_c_send().

netlink: Fix wraparounds of sk->sk_rmem_alloc.

atm: clip: Fix NULL pointer dereference in vcc_sendmsg()

fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var

jfs: Regular file corruption check

atm: clip: Fix memory leak of struct clip_vcc.

sctp: initialize more fields in sctp_v6_from_sk()

ACPICA: Avoid walking the Namespace if start_node is NULL

fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var

USB: serial: mct_u232: fix missing interrupt-in transfer sanity check

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

MIPS: DEC: Prevent initial console buffer from landing in XKPHYS

net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf

net: usb: catc: enable basic endpoint checking

FS: JFS: Fix null-ptr-deref Read in txBegin

parisc: Revise __get_user() to probe user read access