CVE-2026-90143

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser program. Hold the RCU read lock while running the program.

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmsmac: Fix dma_free_coherent() size

dma_alloc_consistent() may change the size to align it. The new size is saved in alloced.

Change the free size to match the allocation size.(CVE-2026-31661)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Validate GPIO pin LUT table size before iterating

[Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table header itself fits within the BIOS image. If the VBIOS reports a structuresize larger than the actual mapped data, the loop reads past the end of the BIOS image, causing an out-of-bounds read.

Fix this by calling bios_get_image() to validate that the full claimed structuresize is accessible within the BIOS image before entering the loop in both functions.

(cherry picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3)(CVE-2026-64097)

In the Linux kernel, the following vulnerability has been resolved:

usbip: vudc: fix NULL deref in vep_dequeue()

vep_alloc_request() wasn't initializing vrequest->udc, so cancellations on the FunctionFS AIO path were arriving in vep_dequeue without a valid UDC reference.

Since vrequest->udc is never actually properly used anywhere, we opt to remove it, and update vep_dequeue to obtain a reference to the udc with ep_to_vudc(), consistent with the other vep_ ops.

AFAICT this bug has existed for ~10 years. Seems that nobody has really stressed the FunctionFS AIO path on usbip's vudc.

I tested this fix in a QEMU aarch64 guest driving FunctionFS endpoints via AIO. Before the fix, running usbip attach from the host would cause the guest to oops with the following backtrace:

Call trace: vep_dequeue+0x1c/0xe4 (P) usb_ep_dequeue+0x14/0x20 ffs_aio_cancel+0x24/0x34 __arm64_sys_io_cancel+0xb0/0x124 do_el0_svc+0x68/0x100 el0_svc+0x18/0x5c el0t_64_sync_handler+0x98/0xdc el0t_64_sync+0x154/0x158(CVE-2026-64331)

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: bnep: pin L2CAP connection during netdev registration

bnep_add_connection() reads the L2CAP connection without holding the channel lock, then passes its HCI device to register_netdev(). Controller teardown can clear and release that connection concurrently, leaving the network device registration path to dereference a freed parent device.

Take a reference to the L2CAP connection while holding the channel lock. Retain it until register_netdev() has taken the parent device reference.(CVE-2026-64408)

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: set new_stream to NULL after release

In dm_update_crtc_state(), the skip_modeset path releases new_stream via dc_stream_release() but does not set the pointer to NULL.

If a later error (e.g., color management failure) triggers the fail label, the error path calls dc_stream_release() again on the same dangling pointer, causing a double release and potential use-after-free.

Fix this by setting new_stream to NULL after the initial release.

(cherry picked from commit 99f3af19073b3ddbfd96e789124cce12c4277b28)(CVE-2026-68236)

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix Route Information option length validation

rt6_route_rcv() validates the Route Information option (RFC 4191) length against the prefix length, but both checks are off by one.

rinfo->length is the ND option length in units of 8 octets and it includes the 8-byte option header, so an option carrying N bytes of prefix has length == 1 + N/8. RFC 4191 section 2.3 requires length 3 when Prefix Length is greater than 64, and 2 or 3 when it is greater than 0. The code…

In the Linux kernel, the following vulnerability has been resolved: net: kcm: Hold RCU read lock while running BPF parser kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser program. Hold the RCU read lock while running the program.

In the Linux kernel, the following vulnerability has been resolved:

net: kcm: Hold RCU read lock while running BPF parser

kcm_parse_func_strparser() calls bpf_prog_run_pin_on_cpu() which prevents CPU migration, but does not establish an RCU read-side critical section. Consequently, BPF map operations can trigger WARN_ON_ONCE(!bpf_rcu_lock_held()) when called from the KCM strparser program.

Hold the RCU read lock while running the program.

• CVE-2026-90205
  • ocfs2: validate orphan slot during inode read {CVE-2026-90205}
• CVE-2026-93054
  • uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
• CVE-2026-93103
  • RDMA/hfi1: Preserve unit 0 on allocation failure {CVE-2026-93103}
• CVE-2026-89833
  • f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
• CVE-2026-89878
  • media: s2255: check firmware size before reading trailing marker {CVE-2026-89878}
• CVE-2026-90037
  • NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037}
• CVE-2026-90296
  • cpufreq: imx6q: fix devres accumulation across driver rebind {CVE-2026-90296}
• CVE-2026-90415
  • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• CVE-2026-90081
  • net/rds: use wq_has_sleeper() in rds_cong_map_updated() {CVE-2026-90081}
• CVE-2026-90420
  • nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420}
• CVE-2026-90116
  • ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-89845
  • scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845}
• CVE-2026-89944
  • ASoC: hdac_hda: Fix hlink refcount leak on component registration failure {CVE-2026-89944}
• CVE-2026-90018
  • staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() {CVE-2026-90018}
• CVE-2026-89860
  • scsi: qla2xxx: Initialize NVMe abort_work once at submission {CVE-2026-89860}
• CVE-2026-90007
  • scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007}
• CVE-2026-90044
  • usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044}
• CVE-2026-68289
  • tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
• CVE-2026-90143
  • net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
• CVE-2026-90111
  • ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111}
• CVE-2026-90283
  • hugetlbfs: release subpool on fill_super failure {CVE-2026-90283}
• CVE-2026-92521
  • ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521}
• CVE-2026-93048
  • mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
• CVE-2026-93160
  • crypto: atmel-ecc - reject hardware ECDH without a public key {CVE-2026-93160}
• CVE-2026-93199
  • i3c: master: Do not treat master device as a duplicate target {CVE-2026-93199}
• CVE-2026-89953
  • mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953}
• CVE-2026-89822
  • drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
• CVE-2026-89937
  • iio: chemical: sgp30: Handle IAQ thread creation failure {CVE-2026-89937}
• CVE-2026-89993
  • dmaengine: dw-edma: Initialize IRQ data before requesting IRQs {CVE-2026-89993}
• CVE-2026-89972
  • nvme: add missing SRCU grace period in error path {CVE-2026-89972}
• CVE-2026-89892
  • media: em28xx: defer audio-only extension registration {CVE-2026-89892}
• CVE-2026-90023
  • usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023}
• CVE-2026-90020
  • USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020}
• CVE-2026-90017
  • staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017}
• CVE-2026-90016
  • staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016}
• CVE-2026-90329
  • HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} *…

• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-92522
  • ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522}
• CVE-2026-90337
  • serial: core: do fallible allocations before the console can be registered {CVE-2026-90337}
• CVE-2026-90245
  • fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245}
• CVE-2026-90106
  • net: bridge: arp/nd proxy: fix reading neigh ha {CVE-2026-90106}
• CVE-2026-90150
  • pnfs/blocklayout: Fix device leaks on parse failure {CVE-2026-90150}
• CVE-2026-90222
  • nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222}
• CVE-2026-90235
  • sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
• CVE-2026-92499
  • ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
• CVE-2026-90259
  • btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() {CVE-2026-90259}
• CVE-2026-90418
  • nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418}
• CVE-2026-93053
  • speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053}
• CVE-2026-90189
  • null_blk: register configfs subsystem after creating default devices {CVE-2026-90189}
• CVE-2026-90194
  • ACPI: scan: fix bus ID cleanup on device_add() failures {CVE-2026-90194}
• CVE-2026-93037
  • RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037}
• CVE-2026-90225
  • nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225}
• CVE-2026-90138
  • vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138}
• CVE-2026-90141
  • ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141}
• CVE-2026-90286
  • drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286}
• CVE-2026-90058
  • net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058}
• CVE-2026-93188
  • HID: roccat: bound device-supplied profile index {CVE-2026-93188}
• CVE-2026-90053
  • net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053}
• CVE-2026-90416
  • RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416}
• CVE-2026-90419
  • nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419}
• CVE-2026-90226
  • nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226}
• CVE-2026-90403
  • wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403}
• CVE-2026-90415
  • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• CVE-2026-53176
  • IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• CVE-2026-90055
  • usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055}
• CVE-2026-90088
  • Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088}
• CVE-2026-90318
  • fat: release buffer head after rebuilding parent {CVE-2026-90318}
• CVE-2026-90073
  • net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073}
• CVE-2026-90216
  • ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-93120
  • usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120}
• CVE-2026-90143
  • net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
• CVE-2026-90104 -…

• CVE-2026-90267
  • scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
• CVE-2026-90307
  • RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
• CVE-2026-92522
  • ACPI: processor: validate MADT IOAPIC entry bounds {CVE-2026-92522}
• CVE-2026-90337
  • serial: core: do fallible allocations before the console can be registered {CVE-2026-90337}
• CVE-2026-90245
  • fbdev: kyro: Validate overlay viewport coordinates {CVE-2026-90245}
• CVE-2026-90106
  • net: bridge: arp/nd proxy: fix reading neigh ha {CVE-2026-90106}
• CVE-2026-90150
  • pnfs/blocklayout: Fix device leaks on parse failure {CVE-2026-90150}
• CVE-2026-90222
  • nfc: pn533: hold a reference to the request skb during send_frame {CVE-2026-90222}
• CVE-2026-90235
  • sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE {CVE-2026-90235}
• CVE-2026-92499
  • ext4: validate readdir offset before accessing dirent {CVE-2026-92499}
• CVE-2026-90259
  • btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data() {CVE-2026-90259}
• CVE-2026-90418
  • nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch {CVE-2026-90418}
• CVE-2026-93053
  • speakup: keyhelp: guard letter_offsets possible out-of-range indexing {CVE-2026-93053}
• CVE-2026-90189
  • null_blk: register configfs subsystem after creating default devices {CVE-2026-90189}
• CVE-2026-90194
  • ACPI: scan: fix bus ID cleanup on device_add() failures {CVE-2026-90194}
• CVE-2026-93037
  • RDMA/hfi1: Propagate sdma_txinit_ahg() errors {CVE-2026-93037}
• CVE-2026-90225
  • nfc: llcp: read llcp_sock->local under the socket lock in getsockopt {CVE-2026-90225}
• CVE-2026-90138
  • vsock: don't check the listener's sk_err in vsock_accept() {CVE-2026-90138}
• CVE-2026-90141
  • ipvs: fix integer overflow in ftp helper port/address parsing {CVE-2026-90141}
• CVE-2026-90286
  • drm/amdgpu/gfx6: Use PFP on the compute queues too {CVE-2026-90286}
• CVE-2026-90058
  • net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup {CVE-2026-90058}
• CVE-2026-93188
  • HID: roccat: bound device-supplied profile index {CVE-2026-93188}
• CVE-2026-90053
  • net/sched: sch_htb: limit htb_classify inner-class filter hops {CVE-2026-90053}
• CVE-2026-90416
  • RDMA/mlx5: Fix stack out-of-bounds read in cc_params debugfs {CVE-2026-90416}
• CVE-2026-90419
  • nilfs2: prevent out-of-bounds read in super root block parsing {CVE-2026-90419}
• CVE-2026-90226
  • nfc: llcp: avoid userspace overflow on invalid optlen {CVE-2026-90226}
• CVE-2026-90403
  • wifi: rtlwifi: pci: fix error path in rtl_pci_probe() {CVE-2026-90403}
• CVE-2026-90415
  • RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
• CVE-2026-53176
  • IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN {CVE-2026-53176}
• CVE-2026-90055
  • usb: atm: usbatm: fix invalid ci_range initialization {CVE-2026-90055}
• CVE-2026-90088
  • Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop {CVE-2026-90088}
• CVE-2026-90318
  • fat: release buffer head after rebuilding parent {CVE-2026-90318}
• CVE-2026-90073
  • net/sched: hhf: clamp quantum before hhf_change() to avoid overflow {CVE-2026-90073}
• CVE-2026-90216
  • ubi: Fix rollback for explicit UBI device numbers {CVE-2026-90216}
• CVE-2026-90070
  • tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
• CVE-2026-93120
  • usb: gadget: configfs: fix out-of-bounds read of qw_sign {CVE-2026-93120}
• CVE-2026-90143
  • net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
• CVE-2026-90104 -…

These are all security issues fixed in the kernel-devel-7.2.7-1.1 package on the GA media of openSUSE Tumbleweed.

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Memory management;
• Multiple devices driver;
• ARM64 architecture;
• EROFS file system;
• Networking core;
• eXpress Data Path;
• ARM32 architecture;
• M68K architecture;
• MIPS architecture;
• OpenRISC architecture;
• PA-RISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Compute Acceleration Framework;
• Intel NPU Driver;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Micron PCIe SSD driver;
• Null block device driver;
• Ublk userspace block driver;
• Compressed RAM block device driver;
• Bluetooth drivers;
• Bus devices;
• AMD CDX bus driver;
• Hardware random number generator core;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• CPU idle management framework;
• Hardware crypto device drivers;
• CXL (Compute Express Link) drivers;
• DAX dirext access to differentiated memory framework;
• DIBS (Direct Internal Buffer Sharing) drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Qualcomm firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Microsoft Hyper-V drivers;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• Industry Pack bus drivers;
• IRQ chip drivers;
• Mailbox framework;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• Amazon Nitro Secure Module driver;
• SGI GRU driver;
• MMC subsystem;
• MTD block device drivers;
• Network drivers;
• Ethernet bonding driver;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• Operating Performance Points (OPP) driver;
• PA-RISC drivers;
• PCI subsystem;
• Performance monitor drivers;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• MediaTek PM domains;
• Power sequencing drivers;
• Power supply drivers;
• Powercap sysfs driver;
• PTP clock framework;
• PWM drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• MPAM driver;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• ASPEED SoC drivers;
• Samsung SoC drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Trusted Execution Environment drivers;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• UFS subsystem;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• Xen hypervisor drivers;
• 9P distributed file system;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system; …

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• ARM32 architecture;
• ARM64 architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• x86 architecture;
• Block layer subsystem;
• Speakup Console Speech Driver;
• ACPI drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• Bluetooth drivers;
• Character device driver;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DMA engine subsystem;
• EDAC drivers;
• Google firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• InfiniBand drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• Multiple devices driver;
• Media drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• STMicroelectronics network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Realtek RTL8723BS SDIO drivers;
• TCM subsystem;
• Thermal drivers;
• Thunderbolt and USB4 drivers;
• TTY drivers;
• Userspace I/O drivers;
• USB DSL drivers;
• Cypress C67X00 USB driver;
• USB core drivers;
• USB Host Controller drivers;
• Mustek MDC800 USB digital camera driver;
• USB Serial drivers;
• USB Mass Storage drivers;
• USB Type-C Connector System Software Interface driver;
• USB over IP driver;
• vDPA drivers;
• VFIO drivers;
• Virtio Host (VHOST) subsystem;
• Framebuffer layer;
• W1 Dallas's 1-wire bus driver;
• Watchdog drivers;
• File systems infrastructure;
• BFS file system;
• BTRFS file system;
• Ceph distributed file system;
• eCrypt file system;
• EROFS file system;
• Ext4 file system;
• F2FS file system;
• FAT file system;
• FUSE (File system in Userspace);
• HFS+ file system;
• HugeTLB file system;
• JFS file system;
• Network file system (NFS) client;
• Network file system (NFS) server daemon;
• NILFS2 file system;
• File system notification infrastructure;
• NTFS3 file system;
• OCFS2 file system;
• OrangeFS file system;
• SMB network file system;
• SquashFS file system;
• UBI file system;
• UDF file system;
• XFS file system;
• BPF subsystem;
• IPv4 networking;
• Internal shared memory driver;
• Networking core;
• Scheduler infrastructure;
• Sun RPC protocol;
• Virtio network driver;
• Amateur Radio drivers;
• IP tunnels definitions;
• Network…

Duoming Zhou discovered race conditions in the AX.25 amateur radio protocol implementation in the Linux kernel, leading to use-after-free vulnerabilities. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-1205)

It was discovered that the i.MX clock driver in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-3114)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

• USB Gadget drivers;
• Networking core;
• User-space API (UAPI);
• ARM32 architecture;
• ARM64 architecture;
• MIPS architecture;
• OpenRISC architecture;
• PowerPC architecture;
• RISC-V architecture;
• S390 architecture;
• User-Mode Linux (UML);
• x86 architecture;
• Block layer subsystem;
• Cryptographic API;
• Speakup Console Speech Driver;
• ACPI drivers;
• Android drivers;
• Serial ATA and Parallel ATA drivers;
• Auxiliary display drivers;
• Drivers core;
• DRBD Distributed Replicated Block Device drivers;
• Rados block device (RBD) driver;
• Bluetooth drivers;
• Cdrom driver;
• Character device driver;
• Hardware random number generator core;
• TPM device driver;
• Clock framework and drivers;
• Clocksource drivers;
• Data acquisition framework and drivers;
• CPU frequency scaling framework;
• Hardware crypto device drivers;
• DAX dirext access to differentiated memory framework;
• Buffer Sharing and Synchronization framework;
• DMA engine subsystem;
• EDAC drivers;
• FireWire subsystem;
• Arm Firmware Framework for ARMv8-A(FFA);
• ARM SCMI message protocol;
• ARM SCPI message protocol;
• Google firmware drivers;
• Intel Stratix 10 firmware drivers;
• FPGA Framework;
• GPIO subsystem;
• GPU drivers;
• HID subsystem;
• HSI subsystem;
• Hardware monitoring drivers;
• CoreSight HW tracing drivers;
• Intel Trace Hub HW tracing drivers;
• I2C subsystem;
• I3C subsystem;
• IIO subsystem;
• IIO ADC drivers;
• IIO Magnetometer sensors drivers;
• InfiniBand drivers;
• Input Device core drivers;
• Input Device (Miscellaneous) drivers;
• Input Device (Mouse) drivers;
• On-Chip Interconnect management framework;
• IOMMU subsystem;
• IRQ chip drivers;
• LED subsystem;
• Multiple devices driver;
• Media drivers;
• MemoryStick subsystem;
• Multifunction device drivers;
• Analog Devices digital potentiometer driver;
• Broadcom VK accelerator driver;
• Fastrpc Driver;
• MMC subsystem;
• MTD block device drivers;
• Ethernet bonding driver;
• Network drivers;
• Mellanox network drivers;
• Microsoft Azure Network Adapter (MANA) driver;
• STMicroelectronics network drivers;
• Texas Instruments network drivers;
• MediaTek network drivers;
• Near Field Communication (NFC) drivers;
• NTB driver;
• NVDIMM (Non-Volatile Memory Device) drivers;
• NVME drivers;
• Device tree and open firmware driver;
• PA-RISC drivers;
• Parport drivers;
• PCI subsystem;
• PHY drivers;
• Pin controllers subsystem;
• Chrome hardware platform drivers;
• Mellanox platform drivers;
• Microsoft Surface platform drivers;
• x86 platform drivers;
• Generic PM domains;
• System reset/shutdown drivers;
• Power supply drivers;
• RapidIO drivers;
• Voltage and Current Regulator drivers;
• Remote Processor subsystem;
• Reset controller framework;
• RPMSG subsystem;
• Real Time Clock drivers;
• S/390 drivers;
• SCSI subsystem;
• SLIMbus drivers;
• SPI subsystem;
• small TFT LCD display modules;
• Greybus lights staging drivers;
• Media staging drivers;
• Media Oriented Systems Transport (MOST) driver;
• NVIDIA Tegra embedded controller (NVEC)…