Changelog 5.10.269 (longterm)

5.10.269 (longterm, Branch 5.10)

43 Commits, davon ca. 37 Fixes

Linux 5.10.269 (longterm) delivers a broad round of stability and security hardening across USB, networking, crypto, filesystem, and virtualization subsystems, fixing numerous use-after-free, out-of-bounds, and uninitialized-memory bugs. Among the most notable security fixes are the USB serial "option" driver slab OOB read in its interrupt URB callback, the ALSA usb-audio OOB write in snd_usbmidi_novation_output(), the xfrm ESP-in-TCP use-after-free during socket close, and the IPv6 MLD multicast use-after-free when processing queries. The update also touches core kernel infrastructure such as BPF (UAF in offloaded map/prog info, lwt_seg6local fix), KVM (s390 vsie stale crypto bits, arm64 vCPU event access before init), and io_uring/io-wq worker accounting. Additional fixes address filesystem robustness (ext4, jfs, nilfs2, xfs-related nfc/nfct checks), along with several reverted patches that had introduced regressions in SMB, MTD, and PM sleep handling.

Bereich	Commits
usb	5
xfrm	4
USB	3
KVM	2
crypto	2
ipv6	2
HID	2
nfc	2

Bereich

Commits

usb

xfrm

USB

KVM

crypto

ipv6

HID

nfc

Änderungen (43)

usb: usbfs: fix use-after-free of usb_device in usbdev_release()

USB: c67x00: fix use-after-free in c67x00_add_iso_urb()

USB: serial: spcp8x5: drop broken carrier detect support

USB: serial: option: fix slab OOB read in interrupt URB callback

ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()

usb: core: Strengthen error handling in hub_hub_status()

usb: core: Add lock to usb_wakeup_notification()

KVM: s390: vsie: zero stale crypto bits

crypto: mxs-dcp - fix source scatterlist length access

crypto: atmel-tdes - use scatterlist length before DMA mapping

mm/swap: reject swapon() on filesystem-level encrypted files

ipv6: seg6: clear IPv4 control block on IPIP decapsulation

xfrm: fix xfrm_state_construct() auth-trunc leak

xfrm: ah6: validate routing header segments_left

xfrm: drop ESP-in-TCP packets with no ingress device

xfrm: espintcp: fix UAF during close

usb: gadget: f_tcm: keep port count until LUN teardown completes

usb: usbtest: disable dynamic ID support

accessibility: speakup: unregister tty ldisc on later init failures

fpga: dfl: fme: add error handling

HID: input: read battery capacity from its actual report offset

nvmet-tcp: bound SGL data length before allocating command buffers

nfc: nci: add data_len bound checks to activation parameter extractors

HID: magicmouse: do not keep a stale msc->input if no input is claimed

nfc: nci: fix uninit-value in the RF discover/activated NTF handlers

nilfs2: reject invalid block index in GC ioctl

ext4: propagate errors from fast commit range replay

kcov: fix data corruption and race conditions on PREEMPT_RT

ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

Revert "smb: client: use kvzalloc() for megabyte buffer in simple fallocate"

Revert "mtd: maps: vmu-flash: fix fault in unaligned fixup"

selinux: switch two allocations to use kzalloc_objs()

Revert "PM: sleep: Use complete() in device_pm_sleep_init()"

bpf: Fix use-after-free in offloaded map/prog info fill

KVM: arm64: Prevent access to vCPU events before init

jfs: add check read-only before txBeginAnon() call

jfs: add check read-only before truncation in jfs_truncate_nolock()

bpf: Remove tst_run from lwt_seg6local_prog_ops.

io_uring/io-wq: fix worker accounting when canceling creation callbacks

ipvs: reload ip header after head reallocation

ext4: don't enable DAX on new encrypted files

ipv6: mcast: Fix use-after-free when processing MLD queries

RDMA/rxe: Fix OOB in free_rd_atomic_resources()

5.10.269 (longterm, Branch 5.10)

Betroffene Bereiche

Änderungen (43)