Linux Kernel 6.3

vmxnet3: disable rx data ring on dma allocation failure

nvmet: avoid potential UAF in nvmet_req_complete()

nfsd: don't replace page in rq_pages if it's a continuation of last page

scsi: ses: Handle enclosure with just a primary component gracefully

wifi: mt76: connac: do not check WED status for non-mmio devices

iommufd: Fix unpinning of pages when an access is present

sctp: fix a potential overflow in sctp_ifwdtsn_skip

skbuff: Fix a race between coalescing and releasing SKBs

NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) because of calls to hci_dev_put and hci_conn_put. There is a double free that may lead to privilege escalation.

erspan: do not use skb_mac_header() in ndo_start_xmit()

xsk: Add missing overflow check in xdp_umem_reg

ext4: fix possible double unlock when moving a directory

ice: copy last block omitted in ice_get_module_eeprom()

drm/i915/active: Fix misuse of non-idle barriers as fence trackers

ext4: fix WARNING in ext4_update_inline_data

ocfs2: fix data corruption after failed write

perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output

ice: xsk: disable txq irq before flushing hw

scsi: mpi3mr: Bad drive in topology results kernel crash

Bluetooth: HCI: Fix global-out-of-bounds

arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent

nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition

HID: intel-ish-hid: ipc: Fix potential use-after-free in work function

drm/shmem-helper: Remove another errant put in error path

ftrace: Fix invalid address access in lookup_rec() when index is 0

loop: Fix use-after-free issues

vp_vdpa: fix the crash in hot unplug with vp_vdpa

veth: Fix use after free in XDP_REDIRECT

mptcp: use the workqueue to destroy unaccepted sockets

mptcp: fix UaF in listener shutdown

PCI: Fix use-after-free in pci_bus_release_domain_nr()

net: caif: Fix use-after-free in cfusbl_device_notify()

Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition

PCI: s390: Fix use-after-free of PCI resources with per-function hotplug

cifs: fix use-after-free bug in refresh_cache_worker()

net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()

cgroup,freezer: hold cpu_hotplug_lock before freezer_mutex

drm/i915/dpt: Treat the DPT BO as a framebuffer

nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()