Linux Kernel 6.1

nvme: fix SRCU protection of nvme_ns_head list

net: mana: Fix race on per-CQ variable napi work_done

ceph: avoid putting the realm twice when decoding snaps fails

skmsg: pass gfp argument to alloc_sk_msg()

tls: always refresh the queue when reading sock

tipc: re-fetch skb cb after tipc_msg_validate

net: hsr: Fix potential use-after-free

NFC: nci: Bounds check struct nfc_target arrays

net: hisilicon: Fix potential use-after-free in hix5hd2_rx()

net: hisilicon: Fix potential use-after-free in hisi_femac_rx()

s390/qeth: fix use-after-free in hsci

ravb: Fix potential use-after-free in ravb_rx_gbeth()

Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu

wifi: ath11k: update channel list in reg notifier instead reg worker

mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths

IB/hfi1: Correctly move list in sc_disable()

Out-of-Bounds Read in netfilter/ipset in Linux Kernel ChromeOS [6.1, 5.15, 5.10, 5.4, 4.19] allows a local attacker with low privileges to trigger an out-of-bounds read, potentially leading to information disclosure

KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception

x86/tdx: Panic on bad configs that #VE on "private" memory access

wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration

wifi: cfg80211: fix buffer overflow in elem comparison

libbpf: Handle size overflow for ringbuf mmap

usb: gadget: uvc: Prevent buffer overflow in setup handler

ipv6: avoid use-after-free in ip6_fragment()

net: tun: Fix use-after-free in tun_detach()

i40e: fix vf may be used uninitialized in this function warning

tracing: Free buffers when a used dynamic event is removed

mm/gup: fix gup_pud_range() for dax

perf: Fix perf_pending_task() UaF

An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.

drm/shmem-helper: Remove errant put in error path

net/mlx5e: Fix use-after-free when reverting termination table

ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx()

hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails

memcg: fix possible use-after-free in memcg_write_event_control()

net: dsa: sja1105: avoid out of bounds access in sja1105_init_l2_policing()

arm64: entry: avoid kprobe recursion

drm/amdgpu: fix use-after-free during gpu recovery

e100: Fix possible use after free in e100_xmit_prepare

udf: Fix a slab-out-of-bounds write bug in udf_find_entry()