Linux Kernel 2.6.12

sunrpc: fix cache_request leak in cache_release

MIPS: DEC: Prevent initial console buffer from landing in XKPHYS

net: usb: pegasus: enable basic endpoint checking

usb: usblp: fix heap leak in IEEE 1284 device ID via short response

ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()

FS: JFS: Fix null-ptr-deref Read in txBegin

fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var

md: fix soft lockup in status_resync

parisc: Revise __get_user() to probe user read access

ACPICA: Avoid walking the Namespace if start_node is NULL

8021q: delete cleared egress QoS mappings

mtd: Avoid boot crash in RedBoot partition table parser

fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

net: usb: pegasus: validate USB endpoints

posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path

atm: lec: fix null-ptr-deref in lec_arp_clear_vccs

ipv4: restrict IPOPT_SSRR and IPOPT_LSRR options

net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect

net: usb: kaweth: validate USB endpoints

USB: serial: digi_acceleport: fix broken rx after throttle

tcp: restrict SO_ATTACH_FILTER to priv users

Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig

serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN

fbdev: rivafb: fix divide error in nv3_arb()

net: add proper RCU protection to /proc/net/ptype

USB: serial: digi_acceleport: fix hard lockup on disconnect

Race condition vulnerability in Linux kernel media/dvb-core in dvbdmx_write()

The huft_build function in inflate.c in the zlib routines in the Linux kernel before 2.6.12.5 returns the wrong value, which allows remote attackers to cause a denial of service (kernel crash) via a certain compressed file that leads to a null pointer dereference, a different vulnerability than CVE-2005-2458.

inflate.c in the zlib routines in the Linux kernel before 2.6.12.5 allows remote attackers to cause a denial of service (kernel crash) via a compressed file with "improper tables".

Linux kernel before 2.6.15.3 down to 2.6.12, while constructing an ICMP response in icmp_send, does not properly handle when the ip_options_echo function in icmp.c fails, which allows remote attackers to cause a denial of service (crash) via vectors such as (1) record-route and (2) timestamp IP options with the needaddr bit set and a truncated value.

The driver for compressed ISO file systems (zisofs) in the Linux kernel before 2.6.12.5 allows local users and remote attackers to cause a denial of service (kernel crash) via a crafted compressed ISO file system.

Double free vulnerability in the xfrm6_tunnel_rcv function in net/ipv6/xfrm6_tunnel.c in the Linux kernel before 2.6.22, when the xfrm6_tunnel module is enabled, allows remote attackers to cause a denial of service (panic) via crafted IPv6 packets.

The ip_push_pending_frames function in Linux 2.4.x and 2.6.x before 2.6.16 increments the IP ID field when sending a RST after receiving unsolicited TCP SYN-ACK packets, which allows remote attackers to conduct an Idle Scan (nmap -sI) attack, which bypasses intended protections against such attacks.

The Linux kernel before 2.6.12.5 does not properly destroy a keyring that is not instantiated properly, which allows local users or remote attackers to cause a denial of service (kernel oops) via a keyring with a payload that is not empty, which causes the creation to fail, leading to a null dereference in the keyring destructor.

The KEYCTL_JOIN_SESSION_KEYRING operation in the Linux kernel before 2.6.12.5 contains an error path that does not properly release the session management semaphore, which allows local users or remote attackers to cause a denial of service (semaphore hang) via a new session keyring (1) with an empty name string, (2) with a long name string, (3) with the key quota reached, or (4) ENOMEM.

The nl_fib_input function in fib_frontend.c in the Linux kernel before 2.6.15 does not check for valid lengths of the header and payload, which allows remote attackers to cause a denial of service (invalid memory reference) via malformed fib_lookup netlink messages.

Unspecified vulnerability in drivers/crypto/geode-aes.c in GEODE-AES in the Linux kernel before 2.6.21.3 allows attackers to obtain sensitive information via unspecified vectors.

The nl_fib_lookup function in net/ipv4/fib_frontend.c in Linux Kernel before 2.6.20.8 allows attackers to cause a denial of service (kernel panic) via NETLINK_FIB_LOOKUP replies, which trigger infinite recursion and a stack overflow.

Linux kernel before 2.6.15 allows local users to cause a denial of service (panic) via a set_mempolicy call with a 0 bitmask, which causes a panic when a page fault occurs.

The do_sigaltstack function in kernel/signal.c in Linux kernel 2.4 through 2.4.37 and 2.6 before 2.6.31-rc5, when running on 64-bit systems, does not clear certain padding bytes from a structure, which allows local users to obtain sensitive information from the kernel stack via the sigaltstack function.