Linux Kernel 5.17

nvme-rdma: fix possible use-after-free in transport error_recovery work

tipc: improve size validations for received domain records

ASoC: codecs: wcd938x: fix incorrect used of portid

Memory leak in ICMP6 in Linux Kernel

NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes

NFSD: Fix ia_size underflow

A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.

can: isotp: fix potential CAN frame reception race in isotp_rcv()

ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()

phylib: fix potential use-after-free

crypto: qcom-rng - ensure buffer for generate is completely filled

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.

A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

A heap buffer overflow flaw was found in IPsec ESP transformation code in net/ipv4/esp4.c and net/ipv6/esp6.c. This flaw allows a local attacker with a normal user privilege to overwrite kernel heap objects and may cause a local privilege escalation threat.

A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation.

net/mlx5e: Avoid field-overflowing memcpy()

A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.

A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.

A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.

net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup

iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL

SUNRPC: lock against ->sock changing during sysfs read

ALSA: oss: Fix PCM OSS buffer allocation overflow

uaccess: fix integer overflow on access_ok()

misc: fastrpc: avoid double fput() on failed usercopy

bonding: fix missed rcu protection

usb: usbtmc: Fix bug in pipe direction for control transfers

iommu: Fix potential use-after-free during probe

vsock: remove vsock from connected table when connect is interrupted by a signal

ax25: fix incorrect dev_tracker usage

selinux: fix double free of cond_list on error paths

RDMA/ucma: Protect mc during concurrent multicast leaves

ALSA: hda: Fix UAF of leds class devs at unbinding

ax25: Fix netdev refcount issue

net/smc: Forward wakeup to smc socket waitqueue after fallback

btrfs: fix use-after-free after failure to create a snapshot

net: macsec: Fix offload support for NETDEV_UNREGISTER event

btrfs: prevent copying too big compressed lzo segment

ext4: fix error handling in ext4_fc_record_modified_inode()

net/smc: Transitional solution for clcsock race issue