Linux Kernel any version

Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue()

ax25: properly unshare skbs in ax25_kiss_rcv()

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

swiotlb: Fix double-allocation of slots due to broken alignment handling

KVM: x86: Mark target gfn of emulated atomic instruction as dirty

can: dev: can_restart: fix use after free bug

Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

wifi: mwifiex: Fix OOB and integer underflow when rx packets

Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

scsi: qla2xxx: Fix crash when I/O abort times out

HID: multitouch: fix slab out-of-bounds access in mt_report_fixup()

wifi: ath12k: Decrement TID on RX peer frag setup error handling

Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

wifi: iwlwifi: mvm: don't trust firmware n_channels

wifi: ath12k: Correct tid cleanup when tid setup fails

wifi: ath11k: Fix SKB corruption in REO destination ring

powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW

net: mctp: unshare packets when reassembling

HID: multitouch: Correct devm device reference for hidinput input_dev name

wifi: cfg80211: fix use-after-free in cmp_bss()

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

i40e: Fix macvlan leak by synchronizing access to mac_filter_hash

wifi: wilc1000: avoid buffer overflow in WID string configuration

smb: client: split cached_fid bitfields to avoid shared-byte RMW races

Inappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

wifi: prevent A-MSDU attacks in mesh networks

Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

x86/xen: Drop USERGS_SYSRET64 paravirt call

Bluetooth: L2CAP: Fix use-after-free

can: peak_usb: fix use after free bugs

wifi: ath12k: fix node corruption in ar->arvifs list

Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv

Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

Use after free in PDF in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: High)

wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers