Linux Kernel 2.6.34

Multiple buffer overflows in fs/nfsd/nfs4xdr.c in the XDR implementation in the NFS server in the Linux kernel before 2.6.34-rc6 allow remote attackers to cause a denial of service (panic) or possibly execute arbitrary code via a crafted NFSv4 compound WRITE request, related to the read_buf and nfsd4_decode_compound functions.

ceph: avoid putting the realm twice when decoding snaps fails

ceph: blocklist the kclient when receiving corrupted snap trace

libceph: Fix potential out-of-bounds access in crush_decode()

libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()

libceph: Fix slab-out-of-bounds access in auth message processing

fs/cifs/cifssmb.c in the CIFS implementation in the Linux kernel before 2.6.34-rc4 allows remote attackers to cause a denial of service (panic) via an SMB response packet with an invalid CountHigh value, as demonstrated by a response from an OS/2 server, related to the CIFSSMBWrite and CIFSSMBWrite2 functions.

ceph: fix race condition validating r_parent before applying state

ceph: only d_add() negative dentries when they are unhashed

libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply()

net/ipv6: release expired exception dst cached in socket

libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

The release_one_tty function in drivers/char/tty_io.c in the Linux kernel before 2.6.34-rc4 omits certain required calls to the put_pid function, which has unspecified impact and local attack vectors.

Race condition in the find_keyring_by_name function in security/keys/keyring.c in the Linux kernel 2.6.34-rc5 and earlier allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via keyctl session commands that trigger access to a dead keyring that is undergoing deletion by the key_cleanup function.

ceph: fix inode reference leakage in ceph_get_snapdir()

ceph: give up on paths longer than PATH_MAX

net: usb: smsc75xx: Limit packet length to skb->len

usb: net: sierra: check for no status endpoint

wifi: radiotap: reject radiotap with unknown bits

can: mcp251x: fix deadlock in error path of mcp251x_open

fs/namei.c in Linux kernel 2.6.18 through 2.6.34 does not always follow NFS automount "symlinks," which allows attackers to have an unknown impact, related to LOOKUP_FOLLOW.

The ip6_frag_queue function in net/ipv6/reassembly.c in the Linux kernel before 2.6.36 allows remote attackers to bypass intended network restrictions via overlapping IPv6 fragments.

Race condition vulnerability in Linux kernel scsi device driver lpfc_unregister_fcf_rescan()

btrfs: fix btrfs_ioctl_space_info() slot_count TOCTOU which can lead to info-leak

The do_gfs2_set_flags function in fs/gfs2/file.c in the Linux kernel before 2.6.34-git10 does not verify the ownership of a file, which allows local users to bypass intended access restrictions via a SETFLAGS ioctl request.

The proc_oom_score function in fs/proc/base.c in the Linux kernel before 2.6.34-rc4 uses inappropriate data structures during selection of a candidate for the OOM killer, which might allow local users to cause a denial of service via unspecified patterns of task creation.

Linux kernel 2.6.33 and 2.6.34.y does not initialize the kvm_vcpu_events->interrupt.pad structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via unspecified vectors.