Linux Kernel 5.14

A use-after-free flaw was found in cgroup1_parse_param in kernel/cgroup/cgroup-v1.c in the Linux kernel's cgroup v1 parser. A local attacker with a user privilege could cause a privilege escalation by exploiting the fsconfig syscall parameter leading to a container breakout and a denial of service on the system.

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "int_ctl" field, this issue could allow a malicious L1 to enable AVIC support (Advanced Virtual Interrupt Controller) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape. This flaw affects Linux kernel versions prior to 5.14-rc7.

fbmem: Do not delete the mode that is still in use

KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio

net: ti: fix UAF in tlan_remove_one

net: qcom/emac: fix UAF in emac_remove

net: validate lwtstate->data before returning from skb_tunnel_info()

ipv6: fix another slab-out-of-bounds in fib6_nh_flush_exceptions

igb: Fix use-after-free error during reset

bpf: Track subprog poke descriptors correctly and fix use-after-free

bpf: Fix tail_call_reachable rejection for interpreter when jit failed

KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak

net/sched: act_skbmod: Skip non-Ethernet packets

bus: mhi: core: Validate channel ID when processing command completions

net: fddi: fix UAF in fza_probe

igc: Fix use-after-free error during reset

io_uring: check if iowq is killed before queuing

net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error

spi: meson-spicc: Fix double-put in remove path

sctp: handle the error returned from sctp_auth_asoc_init_active_key

clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns

net: sched: fix memory leak in tcindex_partial_destroy_work

ipv6: fix panic when forwarding a pkt with no in6 dev

can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate

scsi: target: Fix NULL dereference on XCOPY completion

An out-of-bounds (OOB) memory read flaw was found in the Qualcomm IPC router protocol in the Linux kernel. A missing sanity check allows a local attacker to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system availability.

media: ngene: Fix out-of-bounds bug in ngene_command_config_free_buf()

bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation

RDMA/irdma: avoid invalid read in irdma_net_event

In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel

A lack of CPU resource in the Linux kernel tracing module functionality in versions prior to 5.14-rc3 was found in the way user uses trace ring buffer in a specific way. Only privileged local users (with CAP_SYS_ADMIN capability) could use this flaw to starve the resources causing denial of service.

A flaw was found in the Linux kernel's OverlayFS subsystem in the way the user mounts the TmpFS filesystem with OverlayFS. This flaw allows a local user to gain access to hidden files that should not be accessible.

netrom: Decrease sock refcount when sock timers expire

ptp: unregister virtual clocks when unregistering physical clock.

net/mlx5: E-Switch, pair only capable devices

octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c

scsi: core: Fix bad pointer dereference when ehandler kthread is invalid

dma-buf/sync_file: Don't leak fences on merge failure

ACPI: fix NULL pointer dereference