nfsd: check for oversized NFSv2/v3 arguments

netfilter: xt_TCPMSS: add more sanity tests on tcph->doff

fix for use-after-free bug via crafted system calls in mm/mempolicy.c:do_get_mempolicy()

x86/entry/64: Don't use IST entry for #BP stack

x86/entry/64: Don't use IST entry for #BP stack (kpatch adaptation)

mqueue: fix a use-after-free in sys_mq_notify()

ipv6: Prevent overrun when parsing v6 header options

ipv6: Check ip6_find_1stfragopt() return value properly.

ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt()

ipv6: avoid overflow of offset in ip6_find_1stfragopt

bluetooth: Prevent stack info leak from the EFS element.

media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic

media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup

Add disable SMT knob

N/A

N/A

Setup L1TF bug bit

Add ability to flush l1d cache on vmexit

ext4: use __GFP_NOFAIL in ext4_free_blocks()

ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors

[sound] alsa: seq: Fix use-after-free at creating a port

[sound] alsa: pcm: prevent UAF in snd_pcm_info (CVE-2017-0861)

[kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301)

[kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (kpatch adaptation)

[net] tcp: avoid collapses in tcp_prune_queue() if possible

[net] tcp: detect malicious patterns in tcp_collapse_ofo_queue()

posix-timer: Properly check sigevent->sigev_notify

eCryptFS: allocate open requests on stack

eCryptFS: forbid opening files without mmap handler

firewire: net: guard against rx buffer overflows

Limit arg stack to at most 75% of _STK_LIM

Revert "net: increase fragment memory usage limits"

Revert "net: increase fragment memory usage limits"

binfmt_elf: switch to new creds when switching to new mm

tcp: enhance tcp collapsing

tcp: avoid order-1 allocations on wifi and tx path

tcp: enhance tcp_collapse_retrans() with skb_shift()

tcp: limit payload size of sacked skbs

tcp: enhance tcp collapsing

tcp: tcp_fragment() should apply sane memory limits

tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()

kpatch adaptation - sysctl handle for minimal MSS

tcp: limit payload size of sacked skbs

ALSA: rawmidi: Change resized buffers atomically

zombieload mitigation

map kpatch code that patch .entry.text section code

ALSA: rawmidi: Change resized buffers atomically

idr: fix backtrack logic in idr_remove_all

idr: fix top layer handling

tcp: check skb tailroom before collapsing

[crypto] salsa20 - fix blkcipher_walk API usage

[mm] mincore.c: make mincore() more conservative

[fs] proc: restrict kernel stack dumps to root

N/A

N/A

[x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations

N/A

N/A

N/A

host: make sure log_num < in_num

scsi: megaraid_sas: return error when create DMA pool failed

net: Set sk_prot_creator when cloning sockets to the right proto

mISDN: enforce CAP_NET_RAW for raw sockets

cfg80211: wext: avoid copying malformed SSIDs

kvm: mmu: ITLB_MULTIHIT mitigation (adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [1/13]

fixed possible memory corruption or privilege escalation for i915 gpu [2/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [4/13]

fixed possible memory corruption or privilege escalation for i915 gpu [5/13]

fixed possible memory corruption or privilege escalation for i915 gpu [6/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [7/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [8/13]

fixed possible memory corruption or privilege escalation for i915 gpu [11/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [12/13] (kcare adaptation)

fixed possible hw level crash if MMIO registers were read while the i915 GPU was in a low-power state [1/2] (kcare adaptation)

KVM: MMIO: Lock coalesced device when checking for available entry

KVM: coalesced_mmio: add bounds checking

KEYS: Change the name of the dead type to ".dead" to prevent user access

KEYS: Change the name of the dead type to ".dead" to prevent user access (kpatch adaptation)

netfilter: x_tables: fix compat match/target pad out-of-bound write

sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output

scsi: iscsi: Restrict sessions and handles to admin capabilities

scsi: iscsi: Verify lengths on passthrough PDU

scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE

tty: Fix ->pgrp locking in tiocspgrp()

af_unix: fix struct pid memory leak

more overflows in marvell wifi driver

RDMA/ucma: Put a lock around every call to the rdma_cm layer

RDMA/ucma: Put a lock around every call to the rdma_cm layer (adaptation)

RDMA/cma: Add missing locking to rdma_accept()

RDMA/ucma: Fix the locking of ctx->file

RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy

bluetooth: eliminate the potential race condition

epoll: Keep a reference on files added to the check list

af_unix: fix garbage collect vs MSG_PEEK

af_unix: fix garbage collect vs MSG_PEEK (adaptation)

xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like

cgroup-v1: Require capabilities to set release_agent

proc: avoid integer type confusion in get_proc_long

proc: proc_skip_spaces() shouldn't think it is working on C strings

x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation

prevent page refcount overflow

Out of scope as the patch is for x86_32 arch only, x86_64 is not affected

not affected without caused-by commit 058504edd026 fs/seq_file: fallback to vmalloc allocation

Mitigation is made with intel firmware update, el8 kernels also need 'i915.enable_guc' specified in cmdline to be affected

futex: Handle faults correctly for PI futexes

futex: Provide and use pi_state_update_owner()

KVM: do not allow mapping valid but non-reference-counted pages

An introduction of required changes through KernelCare could cause unavoidable problems to applications which use unprivileged eBPF.

net/sched: cls_fw: Fix improper refcount update leads to use-after-free

net: sched: sch_qfq: prevent slab-out-of-bounds in

mm: mempolicy: require at least one nodeid for MPOL_PREFERRED

vhost: Check docket sk_family instead of call getname

Restrict access to pagemap/kpageflags/kpagecount

vmx_vcpu_run wrapper

N/A