Kernel: net: panic while pushing pending data out of a IPv6 socket with UDP_CORK

kernel: dm: dm-snapshot data leak

Kernel: llc: information leak via getsockname

Kernel: Bluetooth: RFCOMM - information leak

Kernel: Bluetooth: RFCOMM - information leak

kernel: handling of IPv6 temporary addresses

kernel: handling of IPv6 temporary addresses

Kernel: information leak in fs/compat_ioctl.c VIDEO_SET_SPU_PALETTE

Kernel: tg3: buffer overflow in VPD firmware parsing

Kernel: information leak in cdrom driver

kernel: block: passing disk names as format strings

Kernel: net: information leak in AF_KEY notify

Kernel: HID: memory corruption flaw

Kernel: HID: zeroplus: heap overflow flaw

Kernel: HID: zeroplus: heap overflow flaw

Kernel: llc: Fix missing msg_namelen update in llc_ui_recvmsg

kernel: ansi_cprng: off by one error in non-block size request

Kernel: net: IPv6: panic when UFO=On for an interface

kernel: nfs: missing check for buffer length in __nfs4_get_acl_uncached

Kernel: HID: pantherlord: heap overflow flaw

kernel: kvm: memory leak when memory slot is moved with assigned device

kernel: kvm: memory leak when memory slot is moved with assigned device

Kernel: signal: information leak in tkill/tgkill

Kernel: net: memory corruption with UDP_CORK and UFO

Kernel: net: memory corruption with UDP_CORK and UFO

kvm: division by zero in apic_get_tmcct()

kvm: cross page vapic_addr access

Add x86_match_cpu missed on earlier rhel6 kernels.

inet: prevent leakage of uninitialized memory to user in recv syscalls

inet: fix addr_len/msg->msg_namelen assignment in recv_error functions

kernel: exec/ptrace: get_dumpable() incorrect tests

Kernel: qeth: buffer overflow in snmp ioctl

netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages

ipvs: Add boundary check on ioctl arguments

ipv6: fix leaking uninitialized port number of offender sockaddr

usb: cdc-wdm: Fix race between autosuspend and reading from the device

usb: cdc-wdm: fix buffer overflow

net: fix memory information leaks in recv protocol handlers

selinux: handle TCP SYN-ACK packets correctly in selinux_ip_output()

selinux: handle TCP SYN-ACK packets correctly in selinux_ip_postroute()

selinux: look for IPsec labels on both inbound and outbound packets

selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()

selinux: fix broken peer recv check

vhost: validate vhost_get_vq_desc return value

net: sctp: fix sctp_sf_do_5_1D_ce to verify if peer is AUTH capable

a bug in the VFS lookup code could cause a kernel panic (PSBM-25537)

aacraid: missing capable() check in compat ioctl

vhost: fix total length when packets are too short

n_tty: Fix n_tty_write crash when echoing in raw mode

futex: Forbid uaddr == uaddr2 in futex_requeue(..., requeue_pi=1)

futex: Validate atomic acquisition in futex_lock_pi_atomic()

futex: Always cleanup owner tid in unlock_pi

futex: Make lookup_pi_state more robust

ms ext4: fix online resize with a non-standard blocks per group setting

fix for netconsole over bonding

filter: prevent nla extensions to peek beyond the end of the message

floppy: ignore kernel-only members in FDRAWCMD ioctl input

floppy: don't write kernel-only members to FDRAWCMD ioctl output

libertas: potential oops in debugfs

SELinux: Fix kernel BUG on empty security contexts.

Fixed a critical vulnerability in the legacy simfs container filesystem (ploop is not affected)

NULL pointer dereference in disk quota subsystem.

Use-after-free in checkpoint-restore mount failure handling.

kernel: ptrace,x86: force IRET path after a ptrace_stop()

net: l2tp: don't fall back on UDP [get|set]sockopt()

SCTP: Fix auth_capable inheritence on INIT collision

ipv4: current group_info should be put after using.

rds: prevent dereference of a NULL device in rds_ib_laddr_check

rds: prevent dereference of a NULL device in rds_iw_laddr_check

ath9k: protect tid->sched check

mac80211: fix AP powersave TX vs. wakeup race

ve/net/netfilter/ipset: prohibit ipset from the inside CT (PSBM-27792, #2644)

auditsc: audit_krule mask accesses need bounds checking

sctp: Fix sk_ack_backlog wrap-around problem

vm: add vm_iomap_memory() helper function

vm: convert fb_mmap to vm_iomap_memory() helper

mm: try_to_unmap_cluster() should lock_page() before mlocking

lib/lzo: Update LZO compression to current upstream version

lzo: properly check for overruns

A vulnerability in the RHEL6-based kernel discovered during internal security audit could allow access to the host filesystem from inside a Container. Only the kernels from 2.6.32-042stab057.1 to 2.6.32-042stab093.5 are affected.

KVM: x86: Improve thread safety in pit

kvm/vmx: handle invept and invvpid vm exits gracefully

kvm/vmx: handle invept and invvpid vm exits gracefully

USB: whiteheat: Added bounds checking for bulk command response

net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks

net: sctp: fix panic on duplicate ASCONF chunks

net: sctp: fix remote memory pressure from excessive queueing

net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks

ve/net/ppp: fixed oops in oops in ppp_register_net_channel()

x86_64, traps: Stop using IST for #SS

x86_64, traps: Stop using IST for #SS

udf: Avoid infinite loop when processing indirect ICBs

net: guard tcp_set_keepalive() to tcp sockets

isofs: Fix unbounded recursion when processing relocated directories

ALSA: control: Make sure that id->index does not overflow

ALSA: control: ALSA: control: Handle numid overflow

kernel: infiniband: uverbs: unprotected physical memory access

kernel: splice: lack of generic write checks

netfilter: conntrack: disable generic tracking for known protocols

security: selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID

sctp: fix slab corruption from use after free on INIT collisions

kvm: vmx: invalid host cr4 handling across vm entries

kvm: vmx: invalid host cr4 handling across vm entries

kernel: insufficient syscall number validation in perf and ftrace subsystems

KEYS: close race between key lookup and freeing

isofs: Fix unchecked printing of ER records

ttusb-dec: buffer overflow in ioctl

kernel: pipe: iovec overrun leading to memory corruption

x86_64, switch_to(): Load TLS descriptors before switching DS and ES

isofs: Fix infinite looping over CE entries

fs: do not allow to escape bind mount root from inside ve

kernel: net: incorrect processing of checksums in UDP implementation

TTY: drop driver reference in tty_open fail path

ipv4: Missing sk_nulls_node_init() in ping_unhash().

ASLR: fix stack randomization on 64-bit systems

x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization

x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization

ipv6: Don't reduce hop limit for an interface

mm: add !pte_present() check on existing hugetlb_entry callbacks

eCryptfs: Remove buggy and unnecessary write in file name decode

fs: take i_mutex during prepare_binprm for set[ug]id executables

HID: fix a couple of off-by-ones

kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS

kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS

kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS

kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS

mac80211: fix fragmentation code, particularly for encryption

kernel: kvm: insufficient sysenter emulation when invoked from 16-bit code

proc: reject ve context change of perms of node's proc files (PSBM-27933)

hrtimer: Backport CLOCK_BOOTTIME feature

hrtimer: Backport CLOCK_BOOTTIME feature

vfs: Test for and handle paths that are unreachable from their mnt_root

AT_EMPTY_PATH support for fstatat() with empty relative pathnames

fix for performance degradation starting systemd-based containers

fix for performance degradation starting systemd-based containers

keys: Fix race between key destruction and finding a keyring by name

keys: Fix crash when attempt to garbage collect an uninstantiated keyring

keys: Don't permit request_key() to construct a new keyring

virt: guest to host DoS by triggering an infinite loop in microcode

svm: unconditionally intercept DB

CVE-2015-5307 and CVE-2015-8104 kpatch adaptation

KEYS: Fix race between read and revoke

Fix pipe buffer state corruption.

net: add validation for the socket syscall protocol argument

netfilter: x_tables: deal with bogus nextoffset values

Disable modification of LDT by userspace processes.

sctp: Prevent soft lockup when sctp_accept() is called during a timeout event

kvm: inject #UD if instruction emulation fails and exit to userspace

kvm: inject #UD if instruction emulation fails and exit to userspace (KernelCare adoptation)

kvm: x86: Don't report guest userspace emulation error to userspace

x86, kvm: Clear paravirt_enabled on KVM guests for espfix32's benefit

x86, kvm: Clear paravirt_enabled on KVM guests for espfix32's benefit

ext4: make orphan functions be no-op in no-journal mode

ext4: avoid hang when mounting non-journal filesystems with orphan list

netfilter: x_tables: validate e->target_offset early

netfilter: x_tables: make sure e->next_offset covers remaining blob size

netfilter: x_tables: check for bogus target offset

IB/security: Restrict use of the write() interface

KEYS: potential uninitialized variable

HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands

enable ipproto_icmp inside containers

mm: remove gup_flags FOLL_WRITE games from __get_user_pages()

count shared memory in used memory(PSBM-42024)

cpt/rst scm user

proc: prevent stacking filesystems on top

eCryptFS: allocate open requests on stack

eCryptFS: forbid opening files without mmap handler

tcp: fix use after free in tcp_xmit_retransmit_queue()

dccp: fix freeing skb too early for IPV6_RECVPKTINFO

[kernel] audit: fix a double fetch in audit_log_single_execve_arg()

[net] sctp: validate chunk len before actually using it

tty: n_hdlc: get rid of racy n_hdlc.tbuf

udp: properly support MSG_PEEK with truncated buffers

x86/mm: Add barriers and document switch_mm()-vs-flush synchronization

ALSA: usb-audio: avoid freeing umidi object twice

aacraid: Check size values after double-fetch from user

posix_acl: Clear SGID bit when setting file permissions

net: ping: check minimum size on ICMP header length

sg_write()/bsg_write() is not fit to be called under KERNEL_DS

ipv6: stop sending PTB packets for MTU < 1280

KEYS: Fix short sprintf buffer in /proc/keys show function

ipv6: Prevent overrun when parsing v6 header options

ipv6: Check ip6_find_1stfragopt() return value properly.

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

ipv6: avoid overflow of offset in ip6_find_1stfragopt

dccp/tcp - do not inherit mc_list from parent

sctp - do not inherit ipv6_{mc|ac|fl}_list from parent

ipv6/dccp - do not inherit ipv6_mc_list from parent

nfsd: stricter decoding of write-like NFSv2/v3 ops

tcp: avoid infinite loop in tcp_splice_read()

mm: enlarge stack guard gap

net/packet: fix overflow in check for tp_reserve

net-packet: fix race in packet_set_ring on PACKET_RESERVE

udp: consistently apply ufo or fragmentation

mqueue: fix a use-after-free in sys_mq_notify()

tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0

Bluetooth: Properly check L2CAP config option output buffer length

fs/binfmt_elf.c: fix bug in loading of PIE binaries

KEYS: fix dereferencing NULL payload with nonzero length

[sound] alsa: seq: Fix use-after-free at creating a port

cpt: fix possible crash when restoring container with active NFS mount (PSBM-76898)

dccp: fix use-after-free (CVE-2017-8824)

kcpti: adjust context

add kernel page table isolation feature(aka KAISER)

kcpti: undo context adjustment

kcpti: remove trace IDT mapping

kcpti: check present flag when removing global pte flag

kcpti: ignore AMD processors

kcpti: apply patch to Xen PV domains

ipsec: Fix aborted xfrm policy dump crash (kpatch adaptation)

spectre: prevent speculative execution

nfsd: check for oversized NFSv2/v3 arguments

netfilter: xt_TCPMSS: add more sanity tests on tcph->doff

[x86] msr: add 64bit _on_cpu access functions

[kernel] bitops: Introduce BIT_ULL

[x86] microcode: Share native MSR accessing variants

[x86] cpuid: Cleanup cpuid_regs definitions

[x86] cpuid: Provide get_scattered_cpuid_leaf()

[x86] feature: Enable the x86 feature to control Speculation

[x86] feature: Report presence of IBPB and IBRS control

[x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available

[x86] [kvm] Pad RSB on VM transition

[kvm] x86: clear registers on VM exit

[kvm] vmx: Set IBPB when running a different VCPU

[kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD

[kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD

[kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD

[kvm] x86: add SPEC_CTRL to MSR and CPUID lists

[x86] enter: MACROS to set/clear IBRS and set IBPB

[x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs

[x86] enter: Use IBRS on syscall and interrupts

[x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI

[x86] spec_ctrl: implement spec ctrl C methods

[x86] idle: Disable IBRS entering idle and enable it on wakeup

[x86] idle: Disable IBRS when offlining cpu and re-enable

[x86] mm: Set IBPB upon context switch

[x86] mm: Only set IBPB when the new thread cannot ptrace

[x86] entry: Stuff RSB for entry to kernel for non-SMEP platform

[x86] entry: Remove STUFF_RSB in error and interrupt code

[x86] spec_ctrl: move stuff_RSB in spec_ctrl.h

[x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland

[x86] Remove __cpuinitdata from some data & function

[x86] spec_ctrl: consolidate the spec control boot detection

[x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled

[x86] spec_ctrl: rescan cpuid after a late microcode update

[x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance

[x86] spec_ctrl: add noibrs noibpb boot options

[x86] spec_ctrl: Prevent unwanted speculation without IBRS

[x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths

[x86] entry: Fix 32-bit program crash with 64-bit kernel on AMD boxes

[x86] entry: Add back STUFF_RSB to interrupt and error paths

[x86] spec_ctrl: ibrs_enabled() is expected to return > 1

[x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER

[x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime

[x86] spec_ctrl: use IBRS_ENABLED instead of 1

[x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2

[x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs

[x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB

[x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS

[x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline

[x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled

[x86] spec_ctrl: remove irqs_disabled() check from intel_idle()

[x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing

[x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2

[x86] spec_ctrl: skip IBRS/CR3 restore when paranoid exception returns to userland

[x86] spec_ctrl: disable ibrs while in intel_idle()

[x86] spec_ctrl: skip CAP_SYS_PTRACE check to skip audit

[x86] spec_ctrl: Eliminate redundnat FEATURE Not Present messages

[x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional

[x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update

Spectre v4 (store by-passing) mitigation.

bluetooth: Prevent stack info leak from the EFS element.

media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic

media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup

dccp - check sk for closed state in dccp_sendmsg()

make AIO use the proper rw_verify_area() area helpers

mpi - Fix NULL ptr dereference in mpi_powm()

ping - implement proper locking

mm - tighten x86 /dev/mem with zeroing reads

fix unbalanced page refcounting in bio_map_user_iov

more bio_map_user_iov() leak fixes

mm - teach truncate_inode_pages_range() to handle non page aligned ranges

dm: fix race between dm_get_from_kobject() and __dm_destroy()

sctp - verify size of a new chunk in _sctp_make_chunk()

fix for use-after-free bug via crafted system calls in mm/mempolicy.c:do_get_mempolicy()

ALSA: seq: Fix racy pool initializations

x86/entry/64: Don't use IST entry for #BP stack

x86/entry/64: Don't use IST entry for #BP stack (kpatch adaptation)

prevents spectre v1 by sanitizing pointers from user-space and syscall numbers, \

addresses CVE-2018-3693 for 32bit processes.

Add disable SMT knob

Setup L1TF bug bit

Add ability to flush l1d cache on vmexit

[sound] alsa: pcm: prevent UAF in snd_pcm_info (CVE-2017-0861)

[kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301)

[kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (kpatch adaptation)

[net] tcp: avoid collapses in tcp_prune_queue() if possible

[net] tcp: detect malicious patterns in tcp_collapse_ofo_queue()

RDS: verify the underlying transport exists before creating a connection

Complete earlier incomplete fix to CVE-2015-6937

net: Fix use after free in the recvmmsg exit path

KEYS: Fix handling of stored error in a negatively instantiated user key

block: fix use-after-free in seq file

keyctl_set_reqkey_keyring() leaks thread keyrings

ALSA: rawmidi: Change resized buffers atomically

ALSA: rawmidi: Change resized buffers atomically

binfmt_elf: switch to new creds when switching to new mm

zombieload mitigation

tcp: limit payload size of sacked skbs

tcp: tcp_fragment() should apply sane memory limits

tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()

kpatch adaptation - sysctl handle for minimal MSS

tcp: limit payload size of sacked skbs

idr: fix backtrack logic in idr_remove_all

idr: fix top layer handling

[net] tcp: pass previous skb to tcp_shifted_skb()

[crypto] salsa20 - fix blkcipher_walk API usage

[mm] mincore.c: make mincore() more conservative

[fs] proc: restrict kernel stack dumps to root

[x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations

map kpatch code that patch .entry.text section code

net: Set sk_prot_creator when cloning sockets to the right proto

scsi: megaraid_sas: return error when create DMA pool failed

host: make sure log_num < in_num

kvm: mmu: ITLB_MULTIHIT mitigation (adaptation)

introduce vhost_exceeds_weight() (adaptation for CVE-2019-3900 dependency)

fix possible infinite loop in drivers/vhost/net.c (adaptation)

KVM: MMIO: Lock coalesced device when checking for available entry

KVM: coalesced_mmio: add bounds checking

mISDN: enforce CAP_NET_RAW for raw sockets

cfg80211: wext: avoid copying malformed SSIDs

keys: prevent KEYCTL_READ on negative key

x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation

mm: mempolicy: require at least one nodeid for MPOL_PREFERRED

vhost: Check docket sk_family instead of call getname

kernel: Null pointer dereference in search_keyring

prevent page refcount overflow

tty: Fix ->pgrp locking in tiocspgrp()

af_unix: fix struct pid memory leak

netfilter: x_tables: fix compat match/target pad out-of-bound write

futex: Handle faults correctly for PI futexes

futex: Provide and use pi_state_update_owner()

Input: joydev - use memdup_user() to duplicate memory from user-space

Input: joydev - fix possible ERR_PTR() dereferencing

Input: joydev - prevent potential read overflow in ioctl

Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl

PCI: rpadlpar: Fix potential drc_name corruption in store functions

nfsd: make local functions static

nfsd: make local functions static

nfsd: fix compose_entry_fh() failure exits

nfsd4: readdirplus shouldn't return parent of export

net: xilinx_emaclite: Do not print real IOMEM pointer

hso: fix a use after free condition

bluetooth: eliminate the potential race condition

Bluetooth: use correct lock to prevent UAF of hdev object

virtio: console: rename cvq_lock to c_ivq_lock

virtio_console: Assure used length from device is limited

can: bcm: fix infoleak in struct bcm_msg_head

RDMA/ucma: Put a lock around every call to the rdma_cm layer

RDMA/ucma: Put a lock around every call to the rdma_cm layer (adaptation)

RDMA/cma: Add missing locking to rdma_accept()

RDMA/ucma: Fix the locking of ctx->file

RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy

epoll: Keep a reference on files added to the check list

af_unix: fix garbage collect vs MSG_PEEK

af_unix: fix garbage collect vs MSG_PEEK (adaptation)

xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like

cgroup-v1: Require capabilities to set release_agent

KVM: do not allow mapping valid but non-reference-counted pages

Restrict access to pagemap/kpageflags/kpagecount

vmx_vcpu_run wrapper

firewire: net: guard against rx buffer overflows

Limit arg stack to at most 75% of _STK_LIM