Linux Kernel 5.18

net/tls: fix slab-out-of-bounds bug in decrypt_internal

skbuff: fix coalescing for page_pool fragment recycling

cifs: potential buffer overflow in handling symlinks

A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem.

btrfs: fix qgroup reserve overflow the qgroup limit

net/sched: fix pedit partial COW leading to page cache corruption

ice: arfs: fix use-after-free when freeing @rx_cpu_rmap

nfc: nci: add flush_workqueue to prevent uaf

scsi: target: tcmu: Fix possible page UAF

dm integrity: fix memory corruption when tag_size is less than digest size

drbd: Fix five use after free bugs in get_initial_state

ata: sata_dwc_460ex: Fix crash due to OOB write

net: sfc: add missing xdp queue reinitialization

RDMA/hfi1: Fix use-after-free bug for mm struct

cachefiles: Fix KASAN slab-out-of-bounds in cachefiles_set_volume_xattr

rxrpc: fix a race in rxrpc_exit_net()

scsi: mpt3sas: Fix use after free in _scsih_expander_node_remove()

ep93xx: clock: Fix UAF in ep93xx_clk_register_gate()

IB/rdmavt: add lock to call to rvt_error_qp to prevent a race condition

s390: avoid using global register for current_stack_pointer

mm/page_alloc: clear page->private in free_pages_prepare()

drm/amd/display: Do not skip unrelated mode changes in DSC validation

ext4: fix use-after-free in update_super_work when racing with umount

xdp: produce a warning when calculated tailroom is negative

ipv6: fix panic when forwarding a pkt with no in6 dev

qede: confirm skb is allocated before using

SUNRPC: Fix the svc_deferred_event trace class

nvmet: move async event work off nvmet-wq

net/rds: Fix circular locking dependency in rds_tcp_tune

Drivers: hv: vmbus: Deactivate sysctl_record_panic_msg by default in isolated guests

mm: fix unexpected zeroed page mapping with zram swap

net: ipv4: fix route with nexthop object delete warning

A flaw in Linux Kernel found in nfcmrvl_nci_unregister_dev() in drivers/nfc/nfcmrvl/main.c can lead to use after free both read or write when non synchronized between cleanup routine and firmware download routine.

net: usb: aqc111: Fix out-of-bounds accesses in RX fixup

A use after free issue was discovered in driver/firewire in outbound_phy_packet_callback in the Linux Kernel. In this flaw a local attacker with special privilege may cause a use after free problem when queue_event() fails.

A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allows an unprivileged local attacker on the host to issue specific ioctl calls, causing a kernel oops condition that results in a denial of service.

A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.

mm/mempolicy: fix mpol_new leak in shared_policy_replace

afs: Fix dynamic root getattr

A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).