AVG-2834 log

Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED controllers remain registered for too long

the return code of of tcf_classify is insufficiently validated before interpreting part of the result as a pointer in the network schedulers code

cbq_classify in net/sched/sch_cbq.c allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non- negative numbers...

memory corruption with IPV6_CHECKSUM socket option

use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service

out-of-bounds read memory can be written to a file, if DataOffset is 0 and Length is too large in SMB2_WRITE request of compound request in...

heap-overflow in set_ntacl_dacl() when setting a malformed file attribute under the label `security.NTACL` using SMB2_SET_INFO_HE followed by SMB2_QUERY_INFO_HE

memory leak in smb2_handle_negotiate() under error conditions

smb2_write() and smb2_write_pipe do not avlidate the length when no padding is used

use-after-free in smb2_tree_disconnect) when a danging pointer is accessed in compound requests

out of bound read in smb2_tree_connnect

null pointer dereference in net/sched/sch_api.c

send buffer overflow in NFSv2 READDIR

userspace can cause kernel memory corruption in drivers/usb/mon/mon_bin.c

use-after-free in net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req may allow code execution and leaking kernel memory (respectively)...

infoleak in net/bluetooth/l2cap_core.c's l2cap_parse_conf_req can be used to leak kernel pointers remotely

use-after-free in ufx_ops_open() due to race condition with ufx_usb_disconnect() when disconnecting a usb device while calling open() on the device

use-after-free when dvb_demux_open() is called between the two syncs of dvbdev->users and dvr_dvbdev->users in dvb_dmxdev_release()

I pxa3xx_gcu_write defined in  drivers/video/fbdev/pxa3xx-gcu.c, a count parameter of type size_t is passed to words of type int.  Then, copy_from_user()...

nfqnl_mangle in net/netfilter/nfnetlink_queue.c allows remote attackers to cause a denial of service in the case of a nf_queue verdict with a one-byte...

double xfrm_pols_put() in xfrm_bundle_lookup()

double-free in rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c

tcp clients could be fingerprinted due to insufficient randomness when selecting the source port

use-after-free in in gadgetfs driver when concurrently mounting and unmounting the gadgetfs filesystem between gadgetfs_fill_super() and race with gadgetfs_kill_sb()

integer type confusion in get_proc_long

use-after-free in nilfs_new_inode in fs/nilfs2/inode.c

memory leak when nilfs_attach_log_writer() fails to create a log writer thread

potential use-after-free in sch_sfb enqueue()

use-after-free in nfp6000_area_init in drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c

memory leaks in net/unix/af_unix.c

use after free in spl2sw_nvmem_get_mac_address

memory leak in ipv6_renew_options() when one thread is converting an IPv6 socket into IPv4 with IPV6_ADDRFORM while another thread calls...

race-condition with xfrm_probe_algs() in net/key/af_key.c

In alloc_inode, inode_init_always() could return -ENOMEM if security_inode_alloc() fails, which causes inode->i_private uninitialized. Then...

NULL pointer dereference in kvm_irq_delivery_to_apic_fast() could cause the the host to crash

bulk-add