UbuntuUpdates.org

Package "linux-image-unsigned-5.4.0-206-generic"

This package belongs to a PPA: Canonical Kernel Team

Name: linux-image-unsigned-5.4.0-206-generic

Description:

Linux kernel image for version 5.4.0 on 64 bit x86 SMP
Latest version: 5.4.0-206.226
Release: focal (20.04)
Level: base
Repository: main
Head package: linux

Links

All versions of this package
Bug fixes

Repository home page

Download "linux-image-unsigned-5.4.0-206-generic"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "linux-image-unsigned-5.4.0-206-generic" in Focal

No other version of this package is available in the Focal release.

Changelog

Version: 5.4.0-206.226 2025-01-13 12:09:02 UTC

 linux (5.4.0-206.226) focal; urgency=medium
 .
   * focal/linux: 5.4.0-206.226 -proposed tracker (LP: #2093785)
 .
   * nouveau keeps showing `disp: ctrl 00000080` and crippling the system
     (LP: #2078011)
     - drm/nouveau/disp/gv100-: halt NV_PDISP_FE_RM_INTR_STAT_CTRL_DISP_ERROR
       storms
     - drm/nouveau/kms/gv100-: move window ownership setup into modesetting path
     - drm/nouveau/kms/gv100-: avoid sending a core update until the first modeset
 .
   * CVE-2024-43863
     - drm/vmwgfx: Fix a deadlock in dma buf fence polling
 .
   * CVE-2024-40911
     - wifi: cfg80211: Lock wiphy in cfg80211_get_station
 .
   * CVE-2024-35896
     - netfilter: validate user input for expected length
     - netfilter: complete validation of user input
 .
   * CVE-2023-52458
     - block: add check that partition length needs to be aligned with block size
 .
   * kernel:nft "Could not process rule: Device or resource busy" on unreferenced
     chain (LP: #2089699)
     - SAUCE: netfilter: nf_tables: Fix EBUSY on deleting unreferenced chain
 .
   * CVE-2024-35887
     - lockdep: Add preemption enabled/disabled assertion APIs
     - timers: Don't block on ->expiry_lock for TIMER_IRQSAFE timers
     - Documentation: Remove bogus claim about del_timer_sync()
     - ARM: spear: Do not use timer namespace for timer_shutdown() function
     - clocksource/drivers/arm_arch_timer: Do not use timer namespace for
       timer_shutdown() function
     - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown()
       function
     - timers: Get rid of del_singleshot_timer_sync()
     - timers: Replace BUG_ON()s
     - timers: Rename del_timer() to timer_delete()
     - Documentation: Replace del_timer/del_timer_sync()
     - timers: Silently ignore timers with a NULL function
     - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode
     - timers: Add shutdown mechanism to the internal functions
     - timers: Provide timer_shutdown[_sync]()
     - timers: Update the documentation to reflect on the new timer_shutdown() API
     - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
 .
   * CVE-2024-40965
     - clk: Add a devm variant of clk_rate_exclusive_get()
     - clk: Provide !COMMON_CLK dummy for devm_clk_rate_exclusive_get()
     - i2c: lpi2c: Avoid calling clk_get_rate during transfer
 .
   * CVE-2024-40982
     - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
 .
   * CVE-2024-41066
     - ibmvnic: Add tx check to prevent skb leak
 .
   * CVE-2024-42252
     - closures: Change BUG_ON() to WARN_ON()
 .
   * CVE-2024-46731
     - drm/amd/pm: fix the Out-of-bounds read warning
 .
   * Focal update: v5.4.286 upstream stable release (LP: #2089558)
     - arm64: dts: rockchip: Fix rt5651 compatible value on rk3399-sapphire-
       excavator
     - arm64: dts: rockchip: Remove hdmi's 2nd interrupt on rk3328
     - arm64: dts: rockchip: Fix bluetooth properties on Rock960 boards
     - arm64: dts: rockchip: Remove #cooling-cells from fan on Theobroma lion
     - ARM: dts: rockchip: fix rk3036 acodec node
     - ARM: dts: rockchip: drop grf reference from rk3036 hdmi
     - ARM: dts: rockchip: Fix the spi controller on rk3036
     - ARM: dts: rockchip: Fix the realtek audio codec on rk3036-kylin
     - enetc: simplify the return expression of enetc_vf_set_mac_addr()
     - net: enetc: set MAC address to the VF net_device
     - can: c_can: fix {rx,tx}_errors statistics
     - media: stb0899_algo: initialize cfr before using it
     - media: dvb_frontend: don't play tricks with underflow values
     - media: adv7604: prevent underflow condition when reporting colorspace
     - ALSA: firewire-lib: fix return value on fail in amdtp_tscm_init()
     - pwm: imx-tpm: Use correct MODULO value for EPWM mode
     - drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported
     - dm cache: correct the number of origin blocks to match the target length
     - dm cache: optimize dirty bit checking with find_next_bit when resizing
     - dm-unstriped: cast an operand to sector_t to prevent potential uint32_t
       overflow
     - mtd: rawnand: protect access to rawnand devices while in suspend
     - spi: fix use-after-free of the add_lock mutex
     - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in
       uvc_parse_format
     - fs/proc: fix compile warning about variable 'vmcore_mmap_ops'
     - USB: serial: qcserial: add support for Sierra Wireless EM86xx
     - USB: serial: option: add Fibocom FG132 0x0112 composition
     - USB: serial: option: add Quectel RG650V
     - irqchip/gic-v3: Force propagation of the active state with a read-back
     - ALSA: usb-audio: Support jack detection on Dell dock
     - ALSA: usb-audio: Add quirks for Dell WD19 dock
     - NFSD: Fix NFSv4's PUTPUBFH operation
     - ALSA: usb-audio: Add endianness annotations
     - 9p: Avoid creating multiple slab caches with the same name
     - HID: multitouch: Add quirk for HONOR MagicBook Art 14 touchpad
     - bpf: use kvzmalloc to allocate BPF verifier environment
     - sound: Make CONFIG_SND depend on INDIRECT_IOMEM instead of UML
     - powerpc/powernv: Free name on error in opal_event_init()
     - fs: Fix uninitialized value issue in from_kuid and from_kgid
     - net: usb: qmi_wwan: add Fibocom FG132 0x0112 composition
     - md/raid10: improve code of mrdev in raid10_sync_request
     - mm: clarify a confusing comment for remap_pfn_range()
     - mm: fix ambiguous comments for better code readability
     - mm/memory.c: make remap_pfn_range() reject unaligned addr
     - mm: add remap_pfn_range_notrack
     - 9p: fix slab cache name creation for real
     - Linux 5.4.286
 .
   * Focal update: v5.4.286 upstream stable release (LP: #2089558) //
     CVE-2024-47674
     - mm: avoid leaving partial pfn mappings around in error case
 .
   * Focal update: v5.4.286 upstream stable release (LP: #2089558) //
     CVE-2024-38588
     - ftrace:
Source diff to previous version
2078011 nouveau keeps showing `disp: ctrl 00000080` and crippling the system
2089699 kernel:nft \
2089558 Focal update: v5.4.286 upstream stable release
2086606 Add list of source files to linux-buildinfo
2089233 Focal update: v5.4.285 upstream stable release
CVE-2024-43863 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the
CVE-2024-40911 In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Lock wiphy in cfg80211_get_station Wiphy should be locked befor
CVE-2024-35896 In the Linux kernel, the following vulnerability has been resolved: netfilter: validate user input for expected length I got multiple syzbot report
CVE-2023-52458 In the Linux kernel, the following vulnerability has been resolved: block: add check that partition length needs to be aligned with block size Befo
CVE-2024-35887 In the Linux kernel, the following vulnerability has been resolved: ax25: fix use-after-free bugs caused by ax25_ds_del_timer When the ax25 device
CVE-2024-40965 In the Linux kernel, the following vulnerability has been resolved: i2c: lpi2c: Avoid calling clk_get_rate during transfer Instead of repeatedly ca
CVE-2024-40982 In the Linux kernel, the following vulnerability has been resolved: ssb: Fix potential NULL pointer dereference in ssb_device_uevent() The ssb_devi
CVE-2024-41066 In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Add tx check to prevent skb leak Below is a summary of how the driver
CVE-2024-42252 In the Linux kernel, the following vulnerability has been resolved: closures: Change BUG_ON() to WARN_ON() If a BUG_ON() can be hit in the wild, it
CVE-2024-46731 In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix the Out-of-bounds read warning using index i - 1U may beyond el
CVE-2024-47674 In the Linux kernel, the following vulnerability has been resolved: mm: avoid leaving partial pfn mappings around in error case As Jann points out,
CVE-2024-38588 In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix possible use-after-free issue in ftrace_location() KASAN reports a
CVE-2024-50265 In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove entry once instead of null-ptr-dereference in ocfs2_xa_remove() S
CVE-2024-50267 In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_edgeport: fix use after free in debug printk The "dev_dbg(&urb-
CVE-2024-50269 In the Linux kernel, the following vulnerability has been resolved: usb: musb: sunxi: Fix accessing an released usb phy Commit 6ed05c68cbca ("usb:
CVE-2021-47469 In the Linux kernel, the following vulnerability has been resolved: spi: Fix deadlock when adding SPI controllers on SPI buses Currently we have a
CVE-2024-50273 In the Linux kernel, the following vulnerability has been resolved: btrfs: reinitialize delayed ref list after deleting it from the list At insert_
CVE-2024-53066 In the Linux kernel, the following vulnerability has been resolved: nfs: Fix KMSAN warning in decode_getfattr_attrs() Fix the following KMSAN warni
CVE-2024-50278 In the Linux kernel, the following vulnerability has been resolved: dm cache: fix potential out-of-bounds access on the first resume Out-of-bounds
CVE-2024-50279 In the Linux kernel, the following vulnerability has been resolved: dm cache: fix out-of-bounds access to the dirty bitset when resizing dm-cache c
CVE-2024-50282 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() Avoid a pos
CVE-2024-50287 In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: prevent the risk of a division by zero As reported by Coverity
CVE-2024-50290 In the Linux kernel, the following vulnerability has been resolved: media: cx24116: prevent overflows on SNR calculus as reported by Coverity, if r
CVE-2024-53061 In the Linux kernel, the following vulnerability has been resolved: media: s5p-jpeg: prevent buffer overflows The current logic allows word to be l
CVE-2024-53063 In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: prevent the risk of out of memory access The dvbdev contains a s
CVE-2024-50296 In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when uninstalling driver When the driver is uninsta
CVE-2024-50299 In the Linux kernel, the following vulnerability has been resolved: sctp: properly validate chunk size in sctp_sf_ootb() A size validation fix simi
CVE-2024-50301 In the Linux kernel, the following vulnerability has been resolved: security/keys: fix slab-out-of-bounds in key_task_permission KASAN reports an o
CVE-2024-50302 In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by
CVE-2024-50230 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of checked flag Syzbot reported
CVE-2024-50218 In the Linux kernel, the following vulnerability has been resolved: ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow Syzbot reported a kerne
CVE-2024-50229 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential deadlock with newly created symlinks Syzbot reported that
CVE-2024-50233 In the Linux kernel, the following vulnerability has been resolved: staging: iio: frequency: ad9832: fix division by zero in ad9832_calc_freqreg()
CVE-2024-50234 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: Clear stale interrupts before resuming device iwl4965 fails upo
CVE-2024-50236 In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Fix memory leak in management tx In the current logic, memory is
CVE-2024-50237 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Avoid p
CVE-2024-50251 In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_payload: sanitize offset and length before calling skb_checksum()
CVE-2024-50262 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds write in trie_get_next_key() trie_get_next_key() allocat
CVE-2024-53059 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() 1. The
CVE-2024-50142 In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This
CVE-2024-50116 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug due to missing clearing of buffer delay flag Syzbot repo
CVE-2024-50117 In the Linux kernel, the following vulnerability has been resolved: drm/amd: Guard against bad data for ATIF ACPI method If a BIOS provides bad dat
CVE-2024-50205 In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: Avoid division by zero in apply_constraint_to_size() The st
CVE-2024-50127 In the Linux kernel, the following vulnerability has been resolved: net: sched: fix use-after-free in taprio_change() In 'taprio_change()', 'admin'
CVE-2024-50167 In the Linux kernel, the following vulnerability has been resolved: be2net: fix potential memory leak in be_xmit() The be_xmit() returns NETDEV_TX_
CVE-2024-50168 In the Linux kernel, the following vulnerability has been resolved: net/sun3_82586: fix potential memory leak in sun3_82586_send_packet() The sun3_
CVE-2024-50131 In the Linux kernel, the following vulnerability has been resolved: tracing: Consider the NULL character when validating the event length strlen()
CVE-2024-50143 In the Linux kernel, the following vulnerability has been resolved: udf: fix uninit-value use in udf_get_fileshortad Check for overflow when comput
CVE-2024-50134 In the Linux kernel, the following vulnerability has been resolved: drm/vboxvideo: Replace fake VLA at end of vbva_mouse_pointer_shape with real VLA
CVE-2024-50194 In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Fix uprobes for big-endian kernels The arm64 uprobes code is bro
CVE-2024-50148 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix wild-memory-access in proto_unregister There's issue as fo
CVE-2024-50150 In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmode should keep reference to parent The altmode device release
CVE-2024-50151 In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOBs when building SMB2_IOCTL request When using encryption, e
CVE-2024-50171 In the Linux kernel, the following vulnerability has been resolved: net: systemport: fix potential memory leak in bcm_sysport_xmit() The bcm_syspor
CVE-2024-50202 In the Linux kernel, the following vulnerability has been resolved: nilfs2: propagate directory read errors from nilfs_find_entry() Syzbot reported
CVE-2024-50074 In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out
CVE-2024-50082 In the Linux kernel, the following vulnerability has been resolved: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race We're seeing
CVE-2024-40953 In the Linux kernel, the following vulnerability has been resolved: KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin() Use {READ,WRITE
CVE-2024-50199 In the Linux kernel, the following vulnerability has been resolved: mm/swapfile: skip HugeTLB pages for unuse_vma I got a bad pud error and lost a
CVE-2024-50099 In the Linux kernel, the following vulnerability has been resolved: arm64: probes: Remove broken LDR (literal) uprobe support The simulate_ldr_lite
CVE-2024-50195 In the Linux kernel, the following vulnerability has been resolved: posix-clock: Fix missing timespec64 check in pc_clock_settime() As Andrew point
CVE-2024-50096 In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: Fix vulnerability in migrate_to_ram upon copy error The `nouveau_
CVE-2024-50024 In the Linux kernel, the following vulnerability has been resolved: net: Fix an unsafe loop on the list The kernel may crash when deleting a genetl
CVE-2024-49878 In the Linux kernel, the following vulnerability has been resolved: resource: fix region_intersects() vs add_memory_driver_managed() On a system wi
CVE-2024-50033 In the Linux kernel, the following vulnerability has been resolved: slip: make slhc_remember() more robust against malicious packets syzbot found t
CVE-2024-50035 In the Linux kernel, the following vulnerability has been resolved: ppp: fix ppp_async_encode() illegal access syzbot reported an issue in ppp_asyn
CVE-2024-50039 In the Linux kernel, the following vulnerability has been resolved: net/sched: accept TCA_STAB only for root qdisc Most qdiscs maintain their backl
CVE-2024-50040 In the Linux kernel, the following vulnerability has been resolved: igb: Do not bring the device up after non-fatal error Commit 004d25060c78 ("igb
CVE-2024-50044 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change rfcomm_sk_st
CVE-2024-50045 In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: fix panic with metadata_dst skb Fix a kernel panic in
CVE-2024-38544 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix seg fault in rxe_comp_queue_pkt In rxe_comp_queue_pkt() an incomi
CVE-2024-50180 In the Linux kernel, the following vulnerability has been resolved: fbdev: sisfb: Fix strbuf array overflow The values of the variables xres and yr
CVE-2024-50184 In the Linux kernel, the following vulnerability has been resolved: virtio_pmem: Check device status before requesting flush If a pmem device is in
CVE-2024-50059 In the Linux kernel, the following vulnerability has been resolved: ntb: ntb_hw_switchtec: Fix use after free vulnerability in switchtec_ntb_remove
CVE-2024-49955 In the Linux kernel, the following vulnerability has been resolved: ACPI: battery: Fix possible crash when unregistering a battery hook When a batt
CVE-2024-49973 In the Linux kernel, the following vulnerability has been resolved: r8169: add tally counter fields added with RTL8125 RTL8125 added fields to the
CVE-2024-49975 In the Linux kernel, the following vulnerability has been resolved: uprobes: fix kernel info leak via "[uprobes]" vma xol_add_vma() maps the uninit
CVE-2024-49867 In the Linux kernel, the following vulnerability has been resolved: btrfs: wait for fixup workers before stopping cleaner kthread during umount Dur
CVE-2024-49868 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix a NULL pointer dereference when failed to start a new trasacntion [B
CVE-2024-49981 In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free bug in venus_remove due to race condition in v
CVE-2024-49982 In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-202
CVE-2024-49877 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate When doing clea
CVE-2024-49957 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix null-ptr-deref when journal load failed. During the mounting process
CVE-2024-49965 In the Linux kernel, the following vulnerability has been resolved: ocfs2: remove unreasonable unlock in ocfs2_read_blocks Patch series "Misc fixes
CVE-2024-49966 In the Linux kernel, the following vulnerability has been resolved: ocfs2: cancel dqi_sync_work before freeing oinfo ocfs2_global_read_info() will
CVE-2024-49958 In the Linux kernel, the following vulnerability has been resolved: ocfs2: reserve space for inline xattr before attaching reflink tree One of our
CVE-2024-49959 In the Linux kernel, the following vulnerability has been resolved: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error In
CVE-2024-49879 In the Linux kernel, the following vulnerability has been resolved: drm: omapdrm: Add missing check for alloc_ordered_workqueue As it may return NU
CVE-2024-49882 In the Linux kernel, the following vulnerability has been resolved: ext4: fix double brelse() the buffer of the extents path In ext4_ext_try_to_mer
CVE-2024-49883 In the Linux kernel, the following vulnerability has been resolved: ext4: aovid use-after-free in ext4_ext_insert_extent() As Ojaswin mentioned in
CVE-2024-49985 In the Linux kernel, the following vulnerability has been resolved: i2c: stm32f7: Do not prepare/unprepare clock during runtime suspend/resume In c
CVE-2024-50006 In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_data_sem unlock order in ext4_ind_migrate() Fuzzing reports a possi
CVE-2024-49892 In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Initialize get_bytes_per_element's default to 1 Variables, use
CVE-2024-49894 In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation
CVE-2024-49896 In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check stream before comparing them [WHAT & HOW] amdgpu_dm can
CVE-2024-49900 In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of new_ea in ea_buffer syzbot reports that lzo1x_1
CVE-2024-49902 In the Linux kernel, the following vulnerability has been resolved: jfs: check if leafidx greater than num leaves per dmap tree syzbot report a out
CVE-2024-49903 In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uaf in dbFreeBits [syzbot reported] ==================================
CVE-2024-49924 In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after free in pxafb_task() In the pxafb_probe fu
CVE-2024-50007 In the Linux kernel, the following vulnerability has been resolved: ALSA: asihpi: Fix potential OOB array access ASIHPI driver stores some values i
CVE-2024-50008 In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_s
CVE-2024-49995 In the Linux kernel, the following vulnerability has been resolved: tipc: guard against string buffer overrun Smatch reports that copying media_nam
CVE-2024-49962 In the Linux kernel, the following vulnerability has been resolved: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_packag
CVE-2024-49938 In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit Syzbo
CVE-2024-47740 In the Linux kernel, the following vulnerability has been resolved: f2fs: Require FMODE_WRITE for atomic write ioctls The F2FS ioctls for starting
CVE-2024-49944 In the Linux kernel, the following vulnerability has been resolved: sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start In sct
CVE-2024-49948 In the Linux kernel, the following vulnerability has been resolved: net: add more sanity checks to qdisc_pkt_len_init() One path takes care of SKB_
CVE-2024-49949 In the Linux kernel, the following vulnerability has been resolved: net: avoid potential underflow in qdisc_pkt_len_init() with UFO After commit 7c
CVE-2024-49997 In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the bu
CVE-2024-49952 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prevent nf_skb_duplicated corruption syzbot found that nf
CVE-2024-50179 In the Linux kernel, the following vulnerability has been resolved: ceph: remove the incorrect Fw reference check when dirtying pages When doing th
CVE-2024-49963 In the Linux kernel, the following vulnerability has been resolved: mailbox: bcm2835: Fix timeout during suspend mode During noirq suspend phase th
CVE-2024-46849 In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: axg-card: fix 'use-after-free' Buffer 'card->dai_link' is realloca
CVE-2024-47679 In the Linux kernel, the following vulnerability has been resolved: vfs: fix race between evice_inodes() and find_inode()&iput() Hi, all Recently
CVE-2024-49860 In the Linux kernel, the following vulnerability has been resolved: ACPI: sysfs: validate return type of _STR method Only buffer objects are valid
CVE-2024-47742 In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Block path traversal Most firmware names are hardcoded strings
CVE-2024-47684 In the Linux kernel, the following vulnerability has been resolved: tcp: check skb is non-NULL in tcp_rto_delta_us() We have some machines running
CVE-2024-47747 In the Linux kernel, the following vulnerability has been resolved: net: seeq: Fix use after free vulnerability in ether3 Driver Due to Race Conditi
CVE-2024-47685 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() syzbot reported that
CVE-2024-47692 In the Linux kernel, the following vulnerability has been resolved: nfsd: return -EINVAL when namelen is 0 When we have a corrupted main.sqlite in
CVE-2024-47737 In the Linux kernel, the following vulnerability has been resolved: nfsd: call cache_put if xdr_reserve_space returns NULL If not enough buffer spa
CVE-2023-52917 In the Linux kernel, the following vulnerability has been resolved: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() The debugfs_c
CVE-2024-47749 In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Added NULL check for lookup_atid The lookup_atid() function can ret
CVE-2024-47696 In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency In the com
CVE-2024-47756 In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Fix if-statement expression in ks_pcie_quirk() This code acciden
CVE-2024-47697 In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error Ensure
CVE-2024-47698 In the Linux kernel, the following vulnerability has been resolved: drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error Ensure
CVE-2024-47757 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential oob read in nilfs_btree_check_delete() The function nilfs
CVE-2024-47699 In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential null-ptr-deref in nilfs_btree_insert() Patch series "nilf
CVE-2024-47701 In the Linux kernel, the following vulnerability has been resolved: ext4: avoid OOB when system.data xattr changes underneath the filesystem When l
CVE-2024-49851 In the Linux kernel, the following vulnerability has been resolved: tpm: Clean up TPM space after command failure tpm_dev_transmit prepares the TPM
CVE-2024-47723 In the Linux kernel, the following vulnerability has been resolved: jfs: fix out-of-bounds in dbNextAG() and diAlloc() In dbNextAG() , there is no
CVE-2024-47706 In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible UAF for bfqq->bic with merge chain 1) initial state, t
CVE-2024-47709 In the Linux kernel, the following vulnerability has been resolved: can: bcm: Clear bo->bcm_proc_read after remove_proc_entry(). syzbot reported a
CVE-2024-47710 In the Linux kernel, the following vulnerability has been resolved: sock_map: Add a cond_resched() in sock_hash_free() Several syzbot soft lockup r
CVE-2024-47712 In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param
CVE-2024-47713 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() Since '__d
CVE-2024-47671 In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: prevent kernel-usb-infoleak The syzbot reported a kernel-usb-infol
CVE-2024-44931 In the Linux kernel, the following vulnerability has been resolved: gpio: prevent potential speculation leaks in gpio_device_get_desc() Userspace m
CVE-2024-41016 In the Linux kernel, the following vulnerability has been resolved: ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry() xattr in oc
CVE-2024-47670 In the Linux kernel, the following vulnerability has been resolved: ocfs2: add bounds checking to ocfs2_xattr_find_entry() Add a paranoia check to
CVE-2024-47672 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't wait for tx queues if firmware is dead There is a WAR
CVE-2024-46853 In the Linux kernel, the following vulnerability has been resolved: spi: nxp-fspi: fix the KASAN report out-of-bounds bug Change the memcpy length
CVE-2024-46854 In the Linux kernel, the following vulnerability has been resolved: net: dpaa: Pad packets to ETH_ZLEN When sending packets under 60 bytes, up to t

Version: 5.4.0-202.222 2024-11-08 20:08:35 UTC

 linux (5.4.0-202.222) focal; urgency=medium
 .
   * focal/linux: 5.4.0-202.222 -proposed tracker (LP: #2086451)
     - [Packaging] resync git-ubuntu-log
 .
   * CVE-2021-47501
     - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
 .
   * CVE-2024-46724
     - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
 .
   * CVE-2024-42240
     - x86/bhi: Avoid warning in #DB handler due to BHI mitigation
 .
   * CVE-2024-42077
     - ocfs2: fix DIO failure due to insufficient transaction credits
 .
   * CVE-2024-42068
     - bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
 .
   * CVE-2024-36968
     - Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init()
 .
   * CVE-2024-35904
     - selinux: avoid dereference of garbage after mount failure
 .
   * CVE-2023-52498
     - PM: sleep: Avoid calling put_device() under dpm_list_mtx
     - PM: sleep: Fix error handling in dpm_prepare()
     - async: Split async_schedule_node_domain()
     - async: Introduce async_schedule_dev_nocall()
     - PM: sleep: Fix possible deadlocks in core system-wide PM code
 .
   * CVE-2023-52488
     - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO
 .
   * CVE-2022-48938
     - CDC-NCM: avoid overflow in sanity checking
 .
   * CVE-2024-42156
     - s390/pkey: Wipe copies of clear-key structures on failure
 .
   * CVE-2024-44942
     - f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC
 .
   * CVE-2024-38538
     - net: bridge: xmit: make sure we have at least eth header len bytes
 .
   * CVE-2021-47076
     - RDMA/rxe: Return CQE error if invalid lkey was supplied
 .
   * CVE-2024-36938
     - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue
 .
   * CVE-2024-44940
     - fou: remove warn in gue_gro_receive on unsupported protocol
 .
   * CVE-2024-35951
     - drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr()
 .
   * CVE-2023-52497
     - erofs: fix lz4 inplace decompression
 .
   * CVE-2024-36953
     - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr()
 .
   * CVE-2022-48943
     - KVM: x86/mmu: make apf token non-zero to fix bug
 .
   * CVE-2024-26947
     - ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
 .
   * CVE-2022-48733
     - btrfs: fix use-after-free after failure to create a snapshot
 .
   * CVE-2023-52639
     - KVM: s390: vsie: fix race during shadow creation

Source diff to previous version
CVE-2021-47501 In the Linux kernel, the following vulnerability has been resolved: i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc When trying to dump VF
CVE-2024-46724 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number Check the fb_chann
CVE-2024-42240 In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation
CVE-2024-42077 In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix DIO failure due to insufficient transaction credits The code in ocfs
CVE-2024-42068 In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() set_
CVE-2024-36968 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() l2cap_le_flowctl_i
CVE-2024-35904 In the Linux kernel, the following vulnerability has been resolved: selinux: avoid dereference of garbage after mount failure In case kern_mount()
CVE-2023-52498 In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported th
CVE-2023-52488 In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: convert from _raw_ to _noinc_ regmap functions for FIFO The
CVE-2022-48938 In the Linux kernel, the following vulnerability has been resolved: CDC-NCM: avoid overflow in sanity checking A broken device may give an extreme
CVE-2024-42156 In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive da
CVE-2024-44942 In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on F2FS_INLINE_DATA flag in inode during GC syzbot
CVE-2024-38538 In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot trigg
CVE-2021-47076 In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Return CQE error if invalid lkey was supplied RXE is missing update o
CVE-2024-36938 In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue Fix NU
CVE-2024-44940 In the Linux kernel, the following vulnerability has been resolved: fou: remove warn in gue_gro_receive on unsupported protocol Drop the WARN_ON_ON
CVE-2024-35951 In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix the error path in panfrost_mmu_map_fault_addr() Subject: [PAT
CVE-2023-52497 In the Linux kernel, the following vulnerability has been resolved: erofs: fix lz4 inplace decompression Currently EROFS can map another compressed
CVE-2024-36953 In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() vgic_v2_pa
CVE-2022-48943 In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault log
CVE-2024-26947 In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Sin
CVE-2022-48733 In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after failure to create a snapshot At ioctl.c:create_
CVE-2023-52639 In the Linux kernel, the following vulnerability has been resolved: KVM: s390: vsie: fix race during shadow creation Right now it is possible to se

Version: 5.4.0-200.220 2024-09-27 18:08:50 UTC

 linux (5.4.0-200.220) focal; urgency=medium
 .
   * focal/linux: 5.4.0-200.220 -proposed tracker (LP: #2082937)
 .
   * Packaging resync (LP: #1786013)
     - [Packaging] debian.master/dkms-versions -- update from kernel-versions
       (main/2024.09.30)
 .
   * CVE-2024-26800
     - tls: rx: coalesce exit paths in tls_decrypt_sg()
     - tls: separate no-async decryption request handling from async
     - tls: fix use-after-free on failed backlog decryption
 .
   * CVE-2024-26641
     - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
 .
   * CVE-2021-47212
     - net/mlx5: Update error handler for UCTX and UMEM
 .
   * wbt:wbt_* trace event NULL pointer dereference with GENHD_FL_HIDDEN disks
     (LP: #2081085)
     - bdi: use bdi_dev_name() to get device name
 .
   * Focal update: v5.4.284 upstream stable release (LP: #2081278)
     - drm: panel-orientation-quirks: Add quirk for OrangePi Neo
     - i2c: Fix conditional for substituting empty ACPI functions
     - net: usb: qmi_wwan: add MeiG Smart SRM825L
     - drm/amdgpu: Fix uninitialized variable warning in amdgpu_afmt_acr
     - drm/amdgpu: fix overflowed array index read warning
     - drm/amd/display: Check gpio_id before used as array index
     - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
     - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
     - drm/amd/display: Fix Coverity INTEGER_OVERFLOW within
       dal_gpio_service_create
     - drm/amdgpu: fix ucode out-of-bounds read warning
     - drm/amdgpu: fix mc_data out-of-bounds read warning
     - drm/amdkfd: Reconcile the definition and use of oem_id in struct
       kfd_topology_device
     - apparmor: fix possible NULL pointer dereference
     - ionic: fix potential irq name truncation
     - usbip: Don't submit special requests twice
     - usb: typec: ucsi: Fix null pointer dereference in trace
     - smack: tcp: ipv4, fix incorrect labeling
     - wifi: cfg80211: make hash table duplicates more survivable
     - drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
     - media: uvcvideo: Enforce alignment of frame and interval
     - block: initialize integrity buffer to zero before writing it to media
     - net: set SOCK_RCU_FREE before inserting socket into hashtable
     - virtio_net: Fix napi_skb_cache_put warning
     - udf: Limit file size to 4TB
     - i2c: Use IS_REACHABLE() for substituting empty ACPI functions
     - sch/netem: fix use after free in netem_dequeue
     - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
     - ALSA: hda/conexant: Add pincfg quirk to enable top speakers on Sirius
       devices
     - ata: libata: Fix memory leak for error path in ata_host_alloc()
     - irqchip/gic-v2m: Fix refcount leak in gicv2m_of_init()
     - mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K
     - mmc: sdhci-of-aspeed: fix module autoloading
     - fuse: update stats for pages in dropped aux writeback list
     - fuse: use unsigned type for getxattr/listxattr size truncation
     - reset: hi6220: Add support for AO reset controller
     - clk: hi6220: use CLK_OF_DECLARE_DRIVER
     - clk: qcom: clk-alpha-pll: Fix the pll post div mask
     - clk: qcom: clk-alpha-pll: Fix the trion pll postdiv set rate API
     - ila: call nf_unregister_net_hooks() sooner
     - sched: sch_cake: fix bulk flow accounting logic for host fairness
     - nilfs2: fix missing cleanup on rollforward recovery error
     - nilfs2: fix state management in error path of log writing function
     - ALSA: hda: Add input value sanity checks to HDMI channel map controls
     - smack: unix sockets: fix accept()ed socket label
     - irqchip/armada-370-xp: Do not allow mapping IRQ 0 and 1
     - af_unix: Remove put_pid()/put_cred() in copy_peercred().
     - netfilter: nf_conncount: fix wrong variable type
     - udf: Avoid excessive partition lengths
     - wifi: brcmsmac: advertise MFP_CAPABLE to enable WPA3
     - usb: uas: set host status byte on data completion error
     - PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
     - media: qcom: camss: Add check for v4l2_fwnode_endpoint_parse
     - pcmcia: Use resource_size function on resource object
     - can: bcm: Remove proc entry when dev is unregistered.
     - igb: Fix not clearing TimeSync interrupts for 82580
     - platform/x86: dell-smbios: Fix error path in dell_smbios_init()
     - tcp_bpf: fix return value of tcp_bpf_sendmsg()
     - cx82310_eth: re-enable ethernet mode after router reboot
     - drivers/net/usb: Remove all strcpy() uses
     - net: usb: don't write directly to netdev->dev_addr
     - usbnet: modern method to get random MAC
     - net: bridge: fdb: convert is_local to bitops
     - net: bridge: fdb: convert is_static to bitops
     - net: bridge: fdb: convert is_sticky to bitops
     - net: bridge: fdb: convert added_by_user to bitops
     - net: bridge: fdb: convert added_by_external_learn to use bitops
     - net: bridge: br_fdb_external_learn_add(): always set EXT_LEARN
     - net: dsa: vsc73xx: fix possible subblocks range of CAPT block
     - ASoC: topology: Properly initialize soc_enum values
     - dm init: Handle minors larger than 255
     - iommu/vt-d: Handle volatile descriptor status read
     - cgroup: Protect css->cgroup write under css_set_lock
     - um: line: always fill *error_out in setup_one_line()
     - devres: Initialize an uninitialized struct member
     - pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
     - hwmon: (adc128d818) Fix underflows seen when writing limit attributes
     - hwmon: (lm95234) Fix underflows seen when writing limit attributes
     - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes
     - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes
     - libbpf: Add NULL checks to bpf_object__{prev_map,next_map}
     - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
     - smp: Add

Source diff to previous version
1786013 Packaging resync
2081085 wbt:wbt_* trace event NULL pointer dereference with GENHD_FL_HIDDEN disks
2081278 Focal update: v5.4.284 upstream stable release
2080595 Focal update: v5.4.283 upstream stable release
2078388 Focal update: v5.4.282 upstream stable release
2076097 Focal update: v5.4.281 upstream stable release
CVE-2024-26800 In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request g
CVE-2024-26641 In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip
CVE-2021-47212 In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Update error handler for UCTX and UMEM In the fast unload flow, the d
CVE-2024-42244 In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: seri
CVE-2024-40929 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: check n_ssids before accessing the ssids In some versions o
CVE-2024-41073 In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retrie
CVE-2024-41071 In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Avoid address calculations via out of bounds array indexing req
CVE-2024-42229 In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 spe
CVE-2024-38611 In the Linux kernel, the following vulnerability has been resolved: media: i2c: et8ek8: Don't strip remove function when driver is builtin Using __
CVE-2024-38602 In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issues of ax25_dev The ax25_addr_ax25dev() and a
CVE-2024-35848 In the Linux kernel, the following vulnerability has been resolved: eeprom: at24: fix memory corruption race condition If the eeprom is not accessi
CVE-2024-26669 In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a ne
CVE-2024-26668 In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow Reject
CVE-2024-26640 In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages in
CVE-2024-26607 In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash ha
CVE-2023-52614 In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overflow in trans_stat_show Fix buffer overflow in tra
CVE-2023-52531 In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is k
CVE-2022-36402 An integer overflow vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file
CVE-2024-27051 In the Linux kernel, the following vulnerability has been resolved: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value cpuf
CVE-2024-26891 In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected Fo
CVE-2024-26885 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches The devmap code allocates
CVE-2024-45016 In the Linux kernel, the following vulnerability has been resolved: netem: fix return value if duplicate enqueue fails There is a bug in netem_enqu
CVE-2024-38630 In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the
CVE-2024-27397 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use timestamp to check for set element timeout Add a time
CVE-2024-26960 In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previo

Version: 5.4.0-197.217 2024-09-13 17:08:34 UTC

 linux (5.4.0-197.217) focal; urgency=medium
 .
   * focal/linux: 5.4.0-197.217 -proposed tracker (LP: #2080615)
 .
   * Packaging resync (LP: #1786013)
     - [Packaging] debian.master/dkms-versions -- update from kernel-versions
       (main/2024.09.02)
 .
   * Focal update: v5.4.283 upstream stable release (LP: #2080595)
     - fuse: Initialize beyond-EOF page contents before setting uptodate
     - ALSA: usb-audio: Support Yamaha P-125 quirk entry
     - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
     - s390/dasd: fix error recovery leading to data corruption on ESE devices
     - arm64: ACPI: NUMA: initialize all values of acpi_early_node_map to
       NUMA_NO_NODE
     - dm resume: don't return EINVAL when signalled
     - dm persistent data: fix memory allocation failure
     - vfs: Don't evict inode under the inode lru traversing context
     - bitmap: introduce generic optimized bitmap_size()
     - fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
     - selinux: fix potential counting error in avc_add_xperms_decision()
     - drm/amdgpu: Actually check flags for all context ops.
     - memcg_write_event_control(): fix a user-triggerable oops
     - overflow.h: Add flex_array_size() helper
     - overflow: Implement size_t saturating arithmetic helpers
     - s390/cio: rename bitmap_size() -> idset_bitmap_size()
     - btrfs: rename bitmap_set_bits() -> btrfs_bitmap_set_bits()
     - s390/uv: Panic for set and remove shared access UVC errors
     - net/mlx5e: Correctly report errors for ethtool rx flows
     - atm: idt77252: prevent use after free in dequeue_rx()
     - net: axienet: Fix DMA descriptor cleanup path
     - net: axienet: Improve DMA error handling
     - net: axienet: Factor out TX descriptor chain cleanup
     - net: axienet: Check for DMA mapping errors
     - net: axienet: Drop MDIO interrupt registers from ethtools dump
     - net: axienet: Wrap DMA pointer writes to prepare for 64 bit
     - net: axienet: Upgrade descriptors to hold 64-bit addresses
     - net: axienet: Autodetect 64-bit DMA capability
     - net: axienet: Fix register defines comment description
     - net: dsa: vsc73xx: pass value in phy_write operation
     - net: hns3: fix a deadlock problem when config TC during resetting
     - ALSA: hda/realtek: Fix noise from speakers on Lenovo IdeaPad 3 15IAU7
     - ssb: Fix division by zero issue in ssb_calc_clock_rate
     - wifi: cw1200: Avoid processing an invalid TIM IE
     - i2c: riic: avoid potential division by zero
     - media: radio-isa: use dev_name to fill in bus_info
     - staging: ks7010: disable bh on tx_dev_lock
     - binfmt_misc: cleanup on filesystem umount
     - scsi: spi: Fix sshdr use
     - gfs2: setattr_chown: Add missing initialization
     - wifi: iwlwifi: abort scan when rfkill on but device enabled
     - IB/hfi1: Fix potential deadlock on &irq_src_lock and &dd->uctxt_lock
     - powerpc/xics: Check return value of kasprintf in icp_native_map_one_cpu
     - nvmet-trace: avoid dereferencing pointer too early
     - ext4: do not trim the group with corrupted block bitmap
     - quota: Remove BUG_ON from dqget()
     - media: pci: cx23885: check cx23885_vdev_init() return
     - fs: binfmt_elf_efpic: don't use missing interpreter's properties
     - scsi: lpfc: Initialize status local variable in lpfc_sli4_repost_sgl_list()
     - net/sun3_82586: Avoid reading past buffer in debug output
     - drm/lima: set gp bus_stop bit before hard reset
     - virtiofs: forbid newlines in tags
     - md: clean up invalid BUG_ON in md_ioctl
     - x86: Increase brk randomness entropy for 64-bit systems
     - powerpc/boot: Handle allocation failure in simple_realloc()
     - powerpc/boot: Only free if realloc() succeeds
     - btrfs: change BUG_ON to assertion when checking for delayed_node root
     - btrfs: handle invalid root reference found in may_destroy_subvol()
     - btrfs: send: handle unexpected data in header buffer in begin_cmd()
     - btrfs: delete pointless BUG_ON check on quota root in
       btrfs_qgroup_account_extent()
     - f2fs: fix to do sanity check in update_sit_entry
     - usb: gadget: fsl: Increase size of name buffer for endpoints
     - nvme: clear caller pointer on identify failure
     - Bluetooth: bnep: Fix out-of-bound access
     - nvmet-tcp: do not continue for invalid icreq
     - NFS: avoid infinite loop in pnfs_update_layout.
     - openrisc: Call setup_memory() earlier in the init sequence
     - s390/iucv: fix receive buffer virtual vs physical address confusion
     - usb: dwc3: core: Skip setting event buffers for host only controllers
     - irqchip/gic-v3-its: Remove BUG_ON in its_vpe_irq_domain_alloc
     - ext4: set the type of max_zeroout to unsigned int to avoid overflow
     - nvmet-rdma: fix possible bad dereference when freeing rsps
     - hrtimer: Prevent queuing of hrtimer without a function callback
     - gtp: pull network headers in gtp_dev_xmit()
     - block: use "unsigned long" for blk_validate_block_size().
     - media: solo6x10: replace max(a, min(b, c)) by clamp(b, a, c)
     - dm mpath: pass IO start time to path selector
     - dm: do not use waitqueue for request-based DM
     - dm suspend: return -ERESTARTSYS instead of -EINTR
     - Bluetooth: Make use of __check_timeout on hci_sched_le
     - Bluetooth: hci_core: Fix not handling link timeouts propertly
     - Bluetooth: hci_core: Fix LE quote calculation
     - tc-testing: don't access non-existent variable on exception
     - kcm: Serialise kcm_sendmsg() for the same socket.
     - netfilter: nft_counter: Synchronize nft_counter_reset() against reader.
     - net: dsa: mv88e6xxx: global2: Expose ATU stats register
     - net: dsa: mv88e6xxx: global1_atu: Add helper for get next
     - net: dsa: mv88e6xxx: read FID when handling ATU violations
     - net: dsa: mv88e6xxx: replace ATU violation prints with trace points
     - net: dsa: mv88e6xxx: Fix out-o
Source diff to previous version
1786013 Packaging resync
2080595 Focal update: v5.4.283 upstream stable release
2078388 Focal update: v5.4.282 upstream stable release
2076097 Focal update: v5.4.281 upstream stable release
CVE-2024-38630 In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the
CVE-2024-27051 In the Linux kernel, the following vulnerability has been resolved: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value cpuf
CVE-2024-26891 In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected Fo
CVE-2024-27397 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: use timestamp to check for set element timeout Add a time
CVE-2024-26960 In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previo
CVE-2024-26885 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches The devmap code allocates
CVE-2024-39494 In the Linux kernel, the following vulnerability has been resolved: ima: Fix use-after-free on a dentry's dname.name ->d_name.name can change on re
CVE-2024-42160 In the Linux kernel, the following vulnerability has been resolved: f2fs: check validation of fault attrs in f2fs_build_fault_attr() - It missed to
CVE-2024-38570 In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is rel
CVE-2024-42228 In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc In
CVE-2022-48791 In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted TMF sas_task Currently a use-after
CVE-2024-26787 In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: stm32: fix DMA API overlapping mappings warning Turning on CONFIG_DM
CVE-2024-27012 In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: restore set elements when delete set fails From abort pat
CVE-2022-48863 In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates d
CVE-2021-47188 In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Improve SCSI abort handling The following has been observed on
CVE-2024-26677 In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix delayed ACKs to not set the reference serial number Fix the construc

Version: 5.4.0-195.215 2024-08-02 23:08:57 UTC

 linux (5.4.0-195.215) focal; urgency=medium
 .
   * focal/linux: 5.4.0-195.215 -proposed tracker (LP: #2075954)
 .
   * Focal update: v5.4.280 upstream stable release (LP: #2075175)
     - Compiler Attributes: Add __uninitialized macro
     - drm/lima: fix shared irq handling on driver remove
     - media: dvb: as102-fe: Fix as10x_register_addr packing
     - media: dvb-usb: dib0700_devices: Add missing release_firmware()
     - IB/core: Implement a limit on UMAD receive List
     - scsi: qedf: Make qedf_execute_tmf() non-preemptible
     - drm/amdgpu: Initialize timestamp for some legacy SOCs
     - drm/amd/display: Skip finding free audio for unknown engine_id
     - media: dw2102: Don't translate i2c read into write
     - sctp: prefer struct_size over open coded arithmetic
     - firmware: dmi: Stop decoding on broken entry
     - Input: ff-core - prefer struct_size over open coded arithmetic
     - net: dsa: mv88e6xxx: Correct check for empty list
     - media: dvb-frontends: tda18271c2dd: Remove casting during div
     - media: s2255: Use refcount_t instead of atomic_t for num_channels
     - media: dvb-frontends: tda10048: Fix integer overflow
     - i2c: i801: Annotate apanel_addr as __ro_after_init
     - powerpc/64: Set _IO_BASE to POISON_POINTER_DELTA not 0 for CONFIG_PCI=n
     - orangefs: fix out-of-bounds fsid access
     - powerpc/xmon: Check cpu id in commands "c#", "dp#" and "dx#"
     - jffs2: Fix potential illegal address access in jffs2_free_inode
     - s390/pkey: Wipe sensitive data on failure
     - tcp: tcp_mark_head_lost is only valid for sack-tcp
     - tcp: add ece_ack flag to reno sack functions
     - net: tcp better handling of reordering then loss cases
     - UPSTREAM: tcp: fix DSACK undo in fast recovery to call tcp_try_to_open()
     - tcp_metrics: validate source addr length
     - wifi: wilc1000: fix ies_len type in connect path
     - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
     - selftests: fix OOM in msg_zerocopy selftest
     - selftests: make order checking verbose in msg_zerocopy selftest
     - inet_diag: Initialize pad field in struct inet_diag_req_v2
     - nilfs2: fix inode number range checks
     - nilfs2: add missing check for inode numbers on directory entries
     - mm: optimize the redundant loop of mm_update_owner_next()
     - can: kvaser_usb: Explicitly initialize family in leafimx driver_info struct
     - fsnotify: Do not generate events for O_PATH file descriptors
     - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(),
       again"
     - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
     - drm/amdgpu/atomfirmware: silence UBSAN warning
     - media: dw2102: fix a potential buffer overflow
     - i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
     - ALSA: hda/realtek: Enable headset mic of JP-IK LEAP W502 with ALC897
     - nvme-multipath: find NUMA path only for online numa-node
     - nilfs2: fix incorrect inode allocation from reserved inodes
     - filelock: fix potential use-after-free in posix_lock_inode
     - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading
     - vfs: don't mod negative dentry count when on shrinker list
     - tcp: add TCP_INFO status for failed client TFO
     - tcp: fix incorrect undo caused by DSACK of TLP retransmit
     - octeontx2-af: Fix incorrect value output on error path in
       rvu_check_rsrc_availability()
     - net: lantiq_etop: add blank line after declaration
     - net: ethernet: lantiq_etop: fix double free in detach
     - ppp: reject claimed-as-LCP but actually malformed packets
     - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
     - s390: Mark psw in __load_psw_mask() as __unitialized
     - ARM: davinci: Convert comma to semicolon
     - octeontx2-af: fix detection of IP layer
     - USB: serial: option: add Telit generic core-dump composition
     - USB: serial: option: add Telit FN912 rmnet compositions
     - USB: serial: option: add Fibocom FM350-GL
     - USB: serial: option: add support for Foxconn T99W651
     - USB: serial: option: add Netprisma LCUK54 series modules
     - USB: serial: option: add Rolling RW350-GL variants
     - USB: Add USB_QUIRK_NO_SET_INTF quirk for START BP-850k
     - usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
     - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the
       descriptor
     - hpet: Support 32-bit userspace
     - nvmem: meson-efuse: Fix return value of nvmem callbacks
     - ALSA: hda/realtek: Limit mic boost on VAIO PRO PX
     - libceph: fix race between delayed_work() and ceph_monc_stop()
     - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
     - tcp: refactor tcp_retransmit_timer()
     - net: tcp: fix unexcepted socket die when snd_wnd is 0
     - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out()
     - tcp: avoid too many retransmit packets
     - nilfs2: fix kernel bug on rename operation of broken directory
     - i2c: rcar: bring hardware to known state when probing
     - Linux 5.4.280
 .
   * [SRU] UBSAN warnings in bnx2x kernel driver (LP: #2074215) // Focal update:
     v5.4.280 upstream stable release (LP: #2075175)
     - bnx2x: Fix multiple UBSAN array-index-out-of-bounds
 .
   * Focal update: v5.4.279 upstream stable release (LP: #2073621)
     - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
     - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup()
     - wifi: cfg80211: pmsr: use correct nla_get_uX functions
     - wifi: iwlwifi: mvm: revert gen2 TX A-MPDU size to 64
     - wifi: iwlwifi: dbg_ini: move iwl_dbg_tlv_free outside of debugfs ifdef
     - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
     - ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
     - net: sched: sch_multiq: fix possible OOB write in multiq_tune()
     - vxlan: Fix regression when d
2075175 Focal update: v5.4.280 upstream stable release
2074215 [SRU] UBSAN warnings in bnx2x kernel driver
2073621 Focal update: v5.4.279 upstream stable release
CVE-2024-26921 In the Linux kernel, the following vulnerability has been resolved: inet: inet_defrag: prevent sk release while still in use ip_local_out() and oth
CVE-2024-26929 In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of fcport The server was crashing after LOGO bec
CVE-2024-39484 In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: Don't strip remove function when driver is builtin Using __exit f
CVE-2024-36901 In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent NULL dereference in ip6_output() According to syzbot, there is a
CVE-2024-26830 In the Linux kernel, the following vulnerability has been resolved: i40e: Do not allow untrusted VF to remove administratively set MAC Currently wh
CVE-2024-24860 A race condition was found in the Linux kernel's bluetooth device driver in {min,max}_key_size_set() function. This can result in a null pointer dere
CVE-2023-52760 In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in gfs2_qd_dealloc In gfs2_put_super(), whether w
CVE-2024-2201 Native Branch History Injection
CVE-2023-52629 In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The ori
CVE-2021-46926 In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: intel-sdw-acpi: harden detection of controller The existing code cur


About   -   Send Feedback to @ubuntu_updates