Linux Kernel 6.2

cifs: Fix use-after-free in rdata->read_into_pages()

cifs: Fix oops due to uncleared server->smbd_conn in reconnect

ceph: blocklist the kclient when receiving corrupted snap trace

bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself

iommu/iova: Fix alloc iova overflows issue

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalate their privileges on the system.

Use-after-free vulnerability in the Linux Kernel

UAF in Linux kernel's tcindex (traffic control index filter) implementation

scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress

vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()

drm/i915: Fix potential bit_17 double-free

Kernel: the nfta_inner_num and nfta_expr_name netlink attributes accessed without checking its presence in nft_inner.c

scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress

sched/psi: Fix use-after-free in ep_remove_wait_queue()

EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info

Fix page corruption caused by racy check in __free_pages

ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write()

drm/i915: Fix potential context UAFs

net/sched: act_mpls: Fix warning during failed attribute validation

drm/vmwgfx: Remove rcu locks from user resources

drm/virtio: Fix GEM handle creation UAF

fbdev: Fix invalid page access after closing deferred I/O devices

misc: fastrpc: Fix use-after-free race condition for maps

block: ublk: extending queue_size to fix overflow

nfc: pn533: Wait for out_urb's completion in pn533_usb_send_frame()

misc: fastrpc: Don't remove map on creater_process and device_release

net: fix UaF in netns ops registration error path

drm/i915: Avoid potential vm use-after-free

drm/i915: Fix request ref counting during error capture & debugfs dump

dmaengine: Fix double increment of client_count in dma_chan_get()

usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait

net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent

freezer,umh: Fix call_usermode_helper_exec() vs SIGKILL

iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED

netlink: prevent potential spectre v1 gadgets

Bluetooth: Fix a buffer overflow in mgmt_mesh_add()

net: mdio: validate parameter addr in mdiobus_get_phy()

netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits

RDMA/core: Fix ib block iterator counter overflow