Linux Kernel 5.10

Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with low privileges to trigger an out-of-bounds read, potentially leading to information disclosure

An issue was discovered in the Linux kernel before 5.9.3. io_uring takes a non-refcounted reference to the files_struct of the process that submitted a request, causing execve() to incorrectly optimize unshare_fd(), aka CID-0f2122045b94.

perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output

drm/shmem-helper: Remove another errant put in error path

media: vidtv: Terminating the subsequent process of initialization failure

nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set

bpf: Fix OOB in pcpu_init_value

wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211()

A use-after-free flaw was found in kernel/trace/ring_buffer.c in Linux kernel (before 5.10-rc1). There was a race problem in trace_open and resize of cpu buffer running parallely on different cpus, may cause a denial of service problem (DOS). This flaw could even allow a local attacker with special user privilege to a kernel information leak threat.

An information disclosure vulnerability exists in the /proc/pid/syscall functionality of Linux Kernel 5.1 Stable and 5.4.66. More specifically, this issue has been introduced in v5.1-rc4 (commit 631b7abacd02b88f4b0795c08b54ad4fc3e7c7c0) and is still present in v5.10-rc4, so it’s likely that all versions in between are affected. An attacker can read /proc/pid/syscall to trigger this vulnerability, which leads to the kernel leaking memory contents.

An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a high rate of events to dom0, aka CID-e99502f76271.

A flaw memory leak in the Linux kernel performance monitoring subsystem was found in the way if using PERF_EVENT_IOC_SET_FILTER. A local user could use this flaw to starve the resources causing denial of service.

mm/hugetlb: fix missing hugetlb_lock for resv uncharge

can: dev: can_get_echo_skb(): prevent call to kfree_skb() in hard IRQ context

btrfs: fix invalid leaf access in btrfs_quota_enable() if ref key not found

firmware: xilinx: don't make a sleepable memory allocation from an atomic context

net: marvell: prestera: fix NULL dereference on devlink_alloc() failure

migrate: correct lock ordering for hugetlb file folios

sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting

ext4: don't set up encryption key during jbd2 transaction

A flaw was found in the Linux kernel. A use-after-free was found in the way the console subsystem was using ioctls KDGKBSENT and KDSKBSENT. A local user could use this flaw to get read memory access out of bounds. The highest threat from this vulnerability is to data confidentiality.