ipv6: account for fraggap on the paged allocation path

Linux Kernel Use-After-Free Vulnerability

Glibc: buffer overflow in ld.so leading to privilege escalation

Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen()

ipv6: mcast: Fix use-after-free when processing MLD queries

ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL

Bluetooth: serialize accept_q access

wifi: mac80211: remove station if connection prep fails

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN

Bluetooth: hci_event: fix potential UAF in SSP passkey handlers

net: skbuff: propagate shared-frag marker through frag-transfer helpers

fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath

wifi: brcmfmac: validate bsscfg indices in IF events

smb: client: validate the whole DACL before rewriting it in cifsacl

nfc: llcp: add missing return after LLCP_CLOSED checks

NFC: digital: Bounds check NFC-A cascade depth in SDD response handler

Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ

ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr

kprobes: Fix possible use-after-free issue on kprobe registration

wifi: wilc1000: fix RCU usage in connect path

Kernel: use after free in nvmet_tcp_free_crypto in nvme

Info Leak in l2cap_core in the Linux Kernel

A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN…

ksmbd: require 3 sub-authorities before reading sub_auth[2]

wifi: ath5k: do not access array OOB

ksmbd: require minimum ACE size in smb_check_perm_dacl()

netfilter: conntrack_irc: fix possible out-of-bounds read

isofs: validate Rock Ridge CE continuation extent against volume size

ipv4: icmp: validate reply type before using icmp_pointers

slip: bound decode() reads against the compressed packet length

A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size

Bluetooth: RFCOMM: validate skb length in MCC handlers

thunderbolt: Validate XDomain request packet size before type cast

net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path

smb: client: fix OOB reads parsing symlink error response

Potential Use-after-free in DANE Client Code

ipv6: use RCU in ip6_xmit()

arp: use RCU protection in arp_xmit()

ndisc: extend RCU protection in ndisc_send_skb()

An issue was discovered in the Linux kernel before 5.19.16

Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind()

Linux Kernel libbpf btf_dump.c btf_dump_name_dups use after free

posix-cpu-timers: Prevent UAF caused by non-leader exec() race

drm/i915/gem: Fix phys BO pread/pwrite with offset

dm cache policy smq: check allocation under invalidate lock

net/sched: act_api: use RCU with deferred freeing for action lifecycle

ALSA: PCM: Fix wait queue list corruption in snd_pcm_drain() on linked streams

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

netfilter: nft_tunnel: fix use-after-free on object destroy