Linux Kernel 2.6.12

Linux kernel before 2.6.16.21 and 2.6.17, when running on PowerPC, does not perform certain required access_ok checks, which allows local users to read arbitrary kernel memory on 64-bit systems (signal_64.c) and cause a denial of service (crash) and possibly read kernel memory on 32-bit systems (signal_32.c).

Linux Kernel IPv6 ipv6_renew_options memory leak

tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets

A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.

ppp: reject claimed-as-LCP but actually malformed packets

nfs: Handle error of rpc_proc_register() in nfs_net_init().

ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()

net: usb: rtl8150: enable basic endpoint checking

macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"

llc: do not use skb_get() before dev_queue_xmit()

net: let net.core.dev_weight always be non-zero

jfs: add check read-only before txBeginAnon() call

romfs: check sb_set_blocksize() return value

atm: Revert atm_account_tx() if copy_from_iter_full() fails.

atm: atmtcp: Free invalid length skb in atmtcp_c_send().

media: av7110: fix a spectre vulnerability

netlink: Fix wraparounds of sk->sk_rmem_alloc.

jfs: Regular file corruption check

fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var

dm mirror: fix integer overflow in create_dirty_log()

hfsplus: fix uninit-value by validating catalog record size

atm: clip: Fix NULL pointer dereference in vcc_sendmsg()

sctp: initialize more fields in sctp_v6_from_sk()

xfrm: clear trailing padding in build_polexpire()

net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()

net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

module: Fix kernel panic when a symbol st_shndx is out of bounds

fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO

USB: core: Limit the length of unkillable synchronous timeouts

ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4()

usb: usblp: fix heap leak in IEEE 1284 device ID via short response

usb: usblp: fix uninitialized heap leak via LPGETSTATUS ioctl

net: usb: catc: enable basic endpoint checking

ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()

net: af_key: zero aligned sockaddr tail in PF_KEY exports

ipmi: Check event message buffer response for bad data

ipmi:si: Return state to normal if message allocation fails

MIPS: DEC: Prevent initial console buffer from landing in XKPHYS

net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf

usb: image: mdc800: kill download URB on timeout