zombieload mitigation

tcp: limit payload size of sacked skbs

tcp: tcp_fragment() should apply sane memory limits

tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()

kpatch adaptation - sysctl handle for minimal MSS

tcp: limit payload size of sacked skbs

idr: fix backtrack logic in idr_remove_all

idr: fix top layer handling

[net] tcp: pass previous skb to tcp_shifted_skb()

[crypto] salsa20 - fix blkcipher_walk API usage

[mm] mincore.c: make mincore() more conservative

[fs] proc: restrict kernel stack dumps to root

[x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations

map kpatch code that patch .entry.text section code

net: Set sk_prot_creator when cloning sockets to the right proto

scsi: megaraid_sas: return error when create DMA pool failed

host: make sure log_num < in_num

kvm: mmu: ITLB_MULTIHIT mitigation (adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [1/13]

fixed possible memory corruption or privilege escalation for i915 gpu [2/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [3/13]

fixed possible memory corruption or privilege escalation for i915 gpu [4/13]

fixed possible memory corruption or privilege escalation for i915 gpu [5/13]

fixed possible memory corruption or privilege escalation for i915 gpu [6/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [7/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [8/13]

fixed possible memory corruption or privilege escalation for i915 gpu [9/13]

fixed possible memory corruption or privilege escalation for i915 gpu [10/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [11/13] (kcare adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [12/13] (kcare adaptation)

fixed possible hw level crash if MMIO registers were read while the i915 GPU was in a low-power state [1/2] (kcare adaptation)

fixed possible hw level crash if MMIO registers were read while the i915 GPU was in a low-power state [2/2]

introduce vhost_exceeds_weight() (adaptation for CVE-2019-3900 dependency)

fix possible infinite loop in drivers/vhost/net.c (adaptation)

fixed possible memory corruption or privilege escalation for i915 gpu [13/13]

KVM: MMIO: Lock coalesced device when checking for available entry

KVM: coalesced_mmio: add bounds checking

mISDN: enforce CAP_NET_RAW for raw sockets

cfg80211: wext: avoid copying malformed SSIDs

binfmt_elf: use ELF_ET_DYN_BASE only for PIE

rtlwifi: Fix potential overflow on P2P code

netlabel: cope with NULL catmap

keys: prevent KEYCTL_READ on negative key

x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation

mm: mempolicy: require at least one nodeid for MPOL_PREFERRED

vhost: Check docket sk_family instead of call getname

more overflows in marvell wifi driver

kernel: Null pointer dereference in search_keyring

prevent page refcount overflow

Out of scope as the patch is for x86_32 arch only, x86_64 is not affected

sysfs: Add sysfs_emit and sysfs_emit_at to format sysfs output

scsi: iscsi: Restrict sessions and handles to admin capabilities

scsi: iscsi: Verify lengths on passthrough PDU

scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE

tty: Fix ->pgrp locking in tiocspgrp()

af_unix: fix struct pid memory leak

netfilter: x_tables: fix compat match/target pad out-of-bound write

seq_file: Disallow extremely large seq buffer allocations

Mitigation is made with intel firmware update, el8 kernels also need 'i915.enable_guc' specified in cmdline to be affected

futex: Handle faults correctly for PI futexes

futex: Provide and use pi_state_update_owner()

Input: joydev - use memdup_user() to duplicate memory from user-space

Input: joydev - fix possible ERR_PTR() dereferencing

Input: joydev - prevent potential read overflow in ioctl

Input: joydev - prevent use of not validated data in JSIOCSBTNMAP ioctl

PCI: rpadlpar: Fix potential drc_name corruption in store functions

nfsd: make local functions static

nfsd: make local functions static

nfsd: fix compose_entry_fh() failure exits

nfsd4: readdirplus shouldn't return parent of export

net: xilinx_emaclite: Do not print real IOMEM pointer

hso: fix a use after free condition

bluetooth: eliminate the potential race condition

Bluetooth: use correct lock to prevent UAF of hdev object

virtio_console: Assure used length from device is limited

can: bcm: fix infoleak in struct bcm_msg_head

RDMA/ucma: Put a lock around every call to the rdma_cm layer

RDMA/ucma: Put a lock around every call to the rdma_cm layer (adaptation)

RDMA/cma: Add missing locking to rdma_accept()

RDMA/ucma: Fix the locking of ctx->file

RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy

epoll: Keep a reference on files added to the check list

af_unix: fix garbage collect vs MSG_PEEK

af_unix: fix garbage collect vs MSG_PEEK (adaptation)

xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like

cgroup-v1: Require capabilities to set release_agent

cgroup-v1: Require capabilities to set release_agent (adaptation)

KVM: do not allow mapping valid but non-reference-counted pages

An introduction of required changes through KernelCare could cause unavoidable problems to applications which use unprivileged eBPF.

proc: avoid integer type confusion in get_proc_long

proc: proc_skip_spaces() shouldn't think it is working on C strings

net/sched: sch_qfq: account for stab overhead in qfq_enqueue

net/sched: cls_fw: Fix improper refcount update leads to use-after-free

net: sched: sch_qfq: Fix UAF in qfq_dequeue()

net: sched: sch_qfq: prevent slab-out-of-bounds in

media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format

Restrict access to pagemap/kpageflags/kpagecount

N/A

vmx_vcpu_run wrapper