CVE-2015-8215

net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.51 to receive various security and bugfixes.

Following features were added:

• hwrng: Add a driver for the hwrng found in power7+ systems (fate#315784).

Following security bugs were fixed:

• CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. (bsc#955354)
• CVE-2015-5156: The virtnet_probe function in drivers/net/virtio_net.c in the Linux kernel attempted to support a FRAGLIST feature without proper memory allocation, which allowed guest OS users to cause a denial of service (buffer overflow and memory corruption) via a crafted sequence of fragmented packets (bnc#940776).
• CVE-2015-7872: The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel allowed local users to cause a denial of service (OOPS) via crafted keyctl commands (bnc#951440).
• CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936).
• CVE-2015-2925: The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a 'double-chroot attack (bnc#926238).
• CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#952384).

The following non-security bugs were fixed:

• af_iucv: avoid path quiesce of severed path in shutdown() (bnc#954986, LTC#131684).
• alsa: hda - Disable 64bit address for Creative HDA controllers (bnc#814440).
• alsa: hda - Fix noise problems on Thinkpad T440s (boo#958504).
• alsa: hda - Fix noise problems on Thinkpad T440s (boo#958504).
• apparmor: allow SYS_CAP_RESOURCE to be sufficient to prlimit another task (bsc#921949).
• audit: correctly record file names with different path name types (bsc#950013).
• audit: create private file name copies when auditing inodes (bsc#950013).
• bcache: Add btree_insert_node() (bnc#951638).
• bcache: Add explicit keylist arg to btree_insert() (bnc#951638).
• bcache: backing device set to clean after finishing detach (bsc#951638).
• bcache: backing device set to clean after finishing detach (bsc#951638).
• bcache: Clean up keylist code (bnc#951638).
• bcache: Convert btree_insert_check_key() to btree_insert_node() (bnc#951638).
• bcache: Convert bucket_wait to wait_queue_head_t (bnc#951638).
• bcache: Convert try_wait to wait_queue_head_t (bnc#951638).
• bcache: Explicitly track btree node's parent (bnc#951638).
• bcache: Fix a bug when detaching (bsc#951638).
• bcache: Fix a lockdep splat in an error path (bnc#951638).
• bcache: Fix a shutdown bug (bsc#951638).
• bcache: Fix more early shutdown bugs (bsc#951638).
• bcache: Fix sysfs splat on shutdown with flash only devs (bsc#951638).
• bcache: Insert multiple keys at a time (bnc#951638).
• bcache: kill closure locking usage (bnc#951638).
• bcache: Refactor journalling flow control (bnc#951638).
• bcache: Refactor request_write() (bnc#951638).
• bcache: Use blkdev_issue_discard() (bnc#951638).
• btrfs: Adjust commit-transaction condition to avoid NO_SPACE more (bsc#958647).
• btrfs: Adjust commit-transaction condition to avoid NO_SPACE more (bsc#958647).
• btrfs: cleanup: remove no-used alloc_chunk in btrfs_check_data_free_space() (bsc#958647).
• btrfs: cleanup: remove no-used alloc_chunk in…

The SUSE Linux Enterprise 11 SP4 kernel was updated to receive various security and bugfixes.

Following security bugs were fixed:

• CVE-2015-7509: Mounting ext4 filesystems in no-journal mode could hav lead to a system crash (bsc#956709).
• CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936).
• CVE-2015-8104: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c (bnc#954404).
• CVE-2015-5307: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c (bnc#953527).
• CVE-2015-7990: RDS: There was no verification that an underlying transport exists when creating a connection, causing usage of a NULL pointer (bsc#952384).
• CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux kernel on the x86_64 platform mishandled IRET faults in processing NMIs that occurred during userspace execution, which might have allowed local users to gain privileges by triggering an NMI (bnc#938706).
• CVE-2015-7872: The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel allowed local users to cause a denial of service (OOPS) via crafted keyctl commands (bnc#951440).
• CVE-2015-0272: Missing checks allowed remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215 (bnc#944296).
• CVE-2015-6937: The __rds_conn_create function in net/rds/connection.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound (bnc#945825).

The following non-security bugs were fixed:

• ALSA: hda - Disable 64bit address for Creative HDA controllers (bnc#814440).
• Driver: Vmxnet3: Fix ethtool -S to return correct rx queue stats (bsc#950750).
• Drivers: hv: do not do hypercalls when hypercall_page is NULL.
• Drivers: hv: kvp: move poll_channel() to hyperv_vmbus.h.
• Drivers: hv: util: move kvp/vss function declarations to hyperv_vmbus.h.
• Drivers: hv: vmbus: Get rid of some unused definitions.
• Drivers: hv: vmbus: Implement the protocol for tearing down vmbus state.
• Drivers: hv: vmbus: add special crash handler (bnc#930770).
• Drivers: hv: vmbus: add special kexec handler.
• Drivers: hv: vmbus: kill tasklets on module unload.
• Drivers: hv: vmbus: prefer '^A' notification chain to 'panic'.
• Drivers: hv: vmbus: remove hv_synic_free_cpu() call from hv_synic_cleanup().
• Drivers: hv: vmbus: unregister panic notifier on module unload.
• IB/srp: Avoid skipping srp_reset_host() after a transport error (bsc#904965).
• IB/srp: Fix a sporadic crash triggered by cable pulling (bsc#904965).
• KEYS: Fix race between key destruction and finding a keyring by name (bsc#951440).
• Make sure XPRT_CONNECTING gets cleared when needed (bsc#946309).
• NFSv4: Fix two infinite loops in the mount code (bsc#954628).
• PCI: Add VPD function 0 quirk for Intel Ethernet devices (bnc#943786).
• PCI: Add dev_flags bit to access VPD through function 0 (bnc#943786).
• PCI: Clear NumVFs when disabling SR-IOV in sriov_init() (bnc#952084).
• PCI: Refresh First VF Offset and VF Stride when updating NumVFs (bnc#952084).
• PCI: Update NumVFs register when disabling SR-IOV (bnc#952084).
• PCI: delay configuration of SRIOV capability (bnc#952084).
• PCI: set pci sriov page size before reading SRIOV BAR (bnc#952084).
• SCSI: hosts: update to use ida_simple for host_no (bsc#939926)
• SUNRPC refactor rpcauth_checkverf error returns…

The SUSE Linux Enterprise 11 SP4 Realtime kernel was updated to receive various security and bugfixes.

Following security bugs were fixed:

• CVE-2015-7509: Mounting a prepared ext2 filesystem as ext4 could lead to a local denial of service (crash) (bsc#956709).
• CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936).
• CVE-2015-8104: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c (bnc#954404).
• CVE-2015-5307: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c (bnc#953527).
• CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#952384).
• CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux kernel on the x86_64 platform mishandled IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI (bnc#937969 937970 938706 939207).
• CVE-2015-7872: The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel allowed local users to cause a denial of service (OOPS) via crafted keyctl commands (bnc#951440).
• CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product. (bnc#955354).
• CVE-2015-6937: The __rds_conn_create function in net/rds/connection.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound (bnc#945825).

The following non-security bugs were fixed:

• af_xhci: avoid path quiesce of severed path in shutdown() (bnc#946214, LTC#131684).
• ahci: Add Device ID for Intel Sunrise Point PCH (bsc#953799).
• alsa: hda - Disable 64bit address for Creative HDA controllers (bnc#814440).
• blktap: also call blkif_disconnect() when frontend switched to closed (bsc#952976).
• blktap: refine mm tracking (bsc#952976).
• cachefiles: Avoid deadlocks with fs freezing (bsc#935123).
• dm: do not start current request if it would've merged with the previous (bsc#904348).
• dm: impose configurable deadline for dm_request_fn's merge heuristic (bsc#904348).
• dm-snap: avoid deadock on s->lock when a read is split (bsc#939826).
• dm sysfs: introduce ability to add writable attributes (bsc#904348).
• drivers: hv: do not do hypercalls when hypercall_page is NULL.
• drivers: hv: kvp: move poll_channel() to hyperv_vmbus.h.
• drivers: hv: util: move kvp/vss function declarations to hyperv_vmbus.h.
• drivers: hv: vmbus: add special crash handler (bnc#930770).
• drivers: hv: vmbus: add special kexec handler.
• drivers: hv: vmbus: Get rid of some unused definitions.
• drivers: hv: vmbus: Implement the protocol for tearing down vmbus state.
• drivers: hv: vmbus: kill tasklets on module unload.
• drivers: hv: vmbus: prefer 'die' notification chain to 'panic'.
• drivers: hv: vmbus: remove hv_synic_free_cpu() call from hv_synic_cleanup().
• drivers: hv: vmbus: unregister panic notifier on module unload.
• driver: Vmxnet3: Fix ethtool -S to…

The SUSE Linux Enterprise 11 SP3 Realtime kernel was updated to receive various security and bugfixes.

Following security bugs were fixed:

• CVE-2015-8104: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c (bnc#954404).
• CVE-2015-5307: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c (bnc#953527).
• CVE-2015-7990: RDS: Verify the underlying transport exists before creating a connection, preventing possible DoS (bsc#952384, CVE-2015-7990).
• CVE-2015-5157: arch/x86/entry/entry_64.S in the Linux kernel on the x86_64 platform mishandled IRET faults in processing NMIs that occurred during userspace execution, which might allow local users to gain privileges by triggering an NMI (bnc#937969 bnc#937970 bnc#938706 bnc#939207).
• CVE-2015-7872: The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel allowed local users to cause a denial of service (OOPS) via crafted keyctl commands (bnc#951440).
• CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product. (bnc#955354).
• CVE-2015-6937: The __rds_conn_create function in net/rds/connection.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound (bnc#945825).
• CVE-2015-6252: The vhost_dev_ioctl function in drivers/vhost/vhost.c in the Linux kernel allowed local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation (bnc#942367).

The following non-security bugs were fixed:

• alsa: hda - Disable 64bit address for Creative HDA controllers (bnc#814440).
• btrfs: fix hang when failing to submit bio of directIO (bnc#942688).
• btrfs: fix memory corruption on failure to submit bio for direct IO (bnc#942688).
• btrfs: fix put dio bio twice when we submit dio bio fail (bnc#942688).
• dm: do not start current request if it would've merged with the previous (bsc#904348).
• dm: impose configurable deadline for dm_request_fn's merge heuristic (bsc#904348).
• dm-snap: avoid deadock on s->lock when a read is split (bsc#939826).
• dm sysfs: introduce ability to add writable attributes (bsc#904348).
• drm/i915: Add bit field to record which pins have received HPD events (v3) (bsc#942938).
• drm/I915: Add enum hpd_pin to intel_encoder (bsc#942938).
• drm/i915: add hotplug activation period to hotplug update mask (bsc#953980).
• drm/i915: Add HPD IRQ storm detection (v5) (bsc#942938).
• drm/i915: Add messages useful for HPD storm detection debugging (v2) (bsc#942938).
• drm/i915: Add Reenable Timer to turn Hotplug Detection back on (v4) (bsc#942938).
• drm/i915: assert_spin_locked for pipestat interrupt enable/disable (bsc#942938).
• drm/i915: Avoid race of intel_crt_detect_hotplug() with HPD interrupt (bsc#942938).
• drm/i915: Avoid race of intel_crt_detect_hotplug() with HPD interrupt, v2 (bsc#942938).
• drm/i915: clear crt hotplug compare voltage field before setting (bsc#942938).
• drm/i915: close tiny race in the ilk pcu even interrupt setup (bsc#942938).
• drm/i915: Convert HPD interrupts to make use of HPD pin assignment in encoders (v2) (bsc#942938). -…

The SUSE Linux Enterprise 12 SP1 kernel was updated to 3.12.53 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls (bnc#955654).
• CVE-2015-5707: Integer overflow in the sg_start_req function in drivers/scsi/sg.c in the Linux kernel allowed local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request (bnc#940338).
• CVE-2015-7550: The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel did not properly use a semaphore, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls (bnc#958951).
• CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936).
• CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that was (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272 (bnc#955354).
• CVE-2015-8539: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c (bnc#958463).
• CVE-2015-8543: The networking implementation in the Linux kernel did not validate protocol identifiers for certain protocol families, which allowed local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application (bnc#958886).
• CVE-2015-8550: Optimizations introduced by the compiler could have lead to double fetch vulnerabilities, potentially possibly leading to arbitrary code execution in backend (bsc#957988).
• CVE-2015-8551: Xen PCI backend driver did not perform proper sanity checks on the device's state, allowing for DoS (bsc#957990).
• CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959190).
• CVE-2015-8575: The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959399).
• CVE-2015-8660: The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel attempted to merge distinct setattr operations, which allowed local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application (bnc#960281).
• CVE-2015-8767: net/sctp/sm_sideeffect.c in the Linux kernel did not properly manage the relationship between a lock and a socket, which allowed local users to cause a denial of service (deadlock) via a crafted sctp_accept call (bnc#961509).
• CVE-2015-8785: The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel…

The SUSE Linux Enterprise 11 SP3 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2013-7446: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel allowed local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls (bnc#955654).
• CVE-2015-7509: fs/ext4/namei.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (system crash) via a crafted no-journal filesystem, a related issue to CVE-2013-2015 (bnc#956707).
• CVE-2015-7515: An out of bounds memory access in the aiptek USB driver could be used by physical local attackers to crash the kernel (bnc#956708).
• CVE-2015-7550: The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel did not properly use a semaphore, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls (bnc#958951).
• CVE-2015-7566: A malicious USB device could cause kernel crashes in the visor device driver (bnc#961512).
• CVE-2015-7799: The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel did not ensure that certain slot numbers are valid, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call (bnc#949936).
• CVE-2015-8215: net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel did not validate attempted changes to the MTU value, which allowed context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product (bnc#955354).
• CVE-2015-8539: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c (bnc#958463).
• CVE-2015-8543: The networking implementation in the Linux kernel did not validate protocol identifiers for certain protocol families, which allowed local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONE_NEWUSER support to execute a crafted SOCK_RAW application (bnc#958886).
• CVE-2015-8550: Optimizations introduced by the compiler could have lead to double fetch vulnerabilities, potentially possibly leading to arbitrary code execution in backend (bsc#957988). (bsc#957988 XSA-155).
• CVE-2015-8551: The PCI backend driver in Xen, when running on an x86 system and using Linux as the driver domain, allowed local guest administrators to hit BUG conditions and cause a denial of service (NULL pointer dereference and host OS crash) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and a crafted sequence of XEN_PCI_OP_* operations, aka 'Linux pciback missing sanity checks (bnc#957990).
• CVE-2015-8552: The PCI backend driver in Xen, when running on an x86 system and using Linux as the driver domain, allowed local guest administrators to generate a continuous stream of WARN messages and cause a denial of service (disk consumption) by leveraging a system with access to a passed-through MSI or MSI-X capable physical PCI device and XEN_PCI_OP_enable_msi operations, aka 'Linux pciback missing sanity checks (bnc#957990).
• CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect…

The SUSE Linux Enterprise 11 SP2 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2016-4486: Fixed 4 byte information leak in net/core/rtnetlink.c (bsc#978822).
• CVE-2016-3134: The netfilter subsystem in the Linux kernel did not validate certain offset fields, which allowed local users to gain privileges or cause a denial of service (heap memory corruption) via an IPT_SO_SET_REPLACE setsockopt call (bnc#971126).
• CVE-2016-2847: fs/pipe.c in the Linux kernel did not limit the amount of unread data in pipes, which allowed local users to cause a denial of service (memory consumption) by creating many pipes with non-default sizes (bnc#970948).
• CVE-2016-2188: The iowarrior_probe function in drivers/usb/misc/iowarrior.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970956).
• CVE-2016-3138: The acm_probe function in drivers/usb/class/cdc-acm.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both a control and a data endpoint descriptor (bnc#970911).
• CVE-2016-3137: drivers/usb/serial/cypress_m8.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a USB device without both an interrupt-in and an interrupt-out endpoint descriptor, related to the cypress_generic_port_probe and cypress_open functions (bnc#970970).
• CVE-2016-3140: The digi_port_init function in drivers/usb/serial/digi_acceleport.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970892).
• CVE-2016-2186: The powermate_probe function in drivers/input/misc/powermate.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970958).
• CVE-2016-2185: The ati_remote2_probe function in drivers/input/misc/ati_remote2.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971124).
• CVE-2016-3156: The IPv4 implementation in the Linux kernel mishandles destruction of device objects, which allowed guest OS users to cause a denial of service (host OS networking outage) by arranging for a large number of IP addresses (bnc#971360).
• CVE-2016-2184: The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio driver in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference or double free, and system crash) via a crafted endpoints value in a USB device descriptor (bnc#971125).
• CVE-2016-3139: The wacom_probe function in drivers/input/tablet/wacom_sys.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) via a crafted endpoints value in a USB device descriptor (bnc#970909).
• CVE-2016-2143: The fork implementation in the Linux kernel on s390 platforms mishandled the case of four page-table levels, which allowed local users to cause a denial of service (system crash) or possibly have unspecified other impact via a crafted application, related to arch/s390/include/asm/mmu_context.h and arch/s390/include/asm/pgalloc.h (bnc#970504).
• CVE-2016-2782: The treo_attach function in drivers/usb/serial/visor.c in the Linux kernel allowed physically proximate attackers to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by inserting a USB device that lacks a (1)…

net/ipv6/addrconf.c in the IPv6 stack in the Linux kernel before 4.0 does not validate attempted changes to the MTU value, which allows context-dependent attackers to cause a denial of service (packet loss) via a value that is (1) smaller than the minimum compliant value or (2) larger than the MTU of an interface, as demonstrated by a Router Advertisement (RA) message that is not validated by a daemon, a different vulnerability than CVE-2015-0272. NOTE: the scope of CVE-2015-0272 is limited to the NetworkManager product.