Linux Kernel 5.4

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

can: gw: fix OOB heap access in cgw_csum_crc8_rel()

A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and freeing of the virtio_vsock_sock structure during an AF_VSOCK connect syscall can occur before a worker thread accesses it resulting in a dangling pointer and potential kernel code execution.

A memory leak in the fastrpc_dma_buf_attach() function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service (memory consumption) by triggering dma_get_sgtable() failures, aka CID-fc739a058d99.

HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure

net: fec: Better handle pm_runtime_get() failing in .remove()

riscv: fix reserved memory setup

ALSA: usb-audio: Use correct version for UAC3 header validation

An issue was discovered in the Linux kernel 5.4 and 5.5 through 5.5.6 on the AArch64 architecture. It ignores the top byte in the address passed to the brk system call, potentially moving the memory break downwards when the application expects it to move upwards, aka CID-dcde237319e6. This has been observed to cause heap corruption with the GNU C Library malloc implementation.

rxrpc: Fix rxrpc_local leak in rxrpc_lookup_peer()

net: restrict SO_REUSEPORT to inet sockets

KVM: x86/mmu: Treat NX as a valid SPTE bit for NPT

mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup()

can: j1939: make j1939_session_activate() fail if device is no longer registered

A flaw was found in the Linux kernel. A corrupted timer tree caused the task wakeup to be missing in the timerqueue_add function in lib/timerqueue.c. This flaw allows a local attacker with special user privileges to cause a denial of service, slowing and eventually stopping the system while running OSP.

cpufreq: Fix hotplug-suspend race during reboot