← zurück zur Übersicht
6.12.108 (longterm, Branch 6.12)
99 Commits, davon ca. 81 Fixes
Linux 6.12.108 is a longterm maintenance release focused heavily on hardening and fixing use-after-free, out-of-bounds, and race-condition bugs across USB, ALSA, HID, networking (netfilter, xfrm, TCP-AO, SMC, Bluetooth), crypto, filesystems (jfs, nilfs2, exfat, fuse), and SELinux subsystems. Notable security-relevant fixes include the SELinux policy-parsing hardening (stricter permission/class validation to prevent malicious policy exploitation), several xfrm/IPsec fixes closing use-after-free and memory-leak issues in ESP-in-TCP and NAT keepalive handling, RDMA/rxe fixes for out-of-bounds access and use-after-free in responder QP handling, and multiple USB/HID driver fixes (e.g., USB serial OOB read, HID pidff OOB write, magicmouse recursion) addressing exploitable memory corruption from untrusted device input. Other important changes touch KVM (s390 vsie crypto bit clearing, arm64 vCPU event access, x86 MMU write tracking), TCP-AO key lifecycle fixes, and CAN j1939 netdevice unregistration handling. Overall, this release is a broad stability and security-hardening update rather than introducing new features.
Betroffene Bereiche
Bereich Commits HID 11 selinux 8 crypto 7 usb 6 xfrm 6 smc 4 USB 3 KVM 3
Änderungen (99)
usb: usbfs: fix use-after-free of usb_device in usbdev_release()
wifi: mt76: mt7925: ensure tx headroom in usb_sdio_tx_prepare_skb
USB: c67x00: fix use-after-free in c67x00_add_iso_urb()
USB: serial: spcp8x5: drop broken carrier detect support
USB: serial: option: fix slab OOB read in interrupt URB callback
ALSA: usb-audio: Complete cleanup after system-resume errors
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
usb: core: Strengthen error handling in hub_hub_status()
usb: core: Add lock to usb_wakeup_notification()
KVM: s390: vsie: zero stale crypto bits
crypto: qce - Remove unsafe/deprecated algorithms
crypto: mxs-dcp - fix source scatterlist length access
crypto: qce - fix CCM AAD buffer underallocation
crypto: atmel-tdes - use scatterlist length before DMA mapping
crypto: qcom-rng - Remove crypto_rng interface
crypto: qcom-rng - Allow zero as a random number
crypto: qcom-rng - Enable clock in hwrng case
mm/swap: reject swapon() on filesystem-level encrypted files
netfilter: nf_tables: don't queue packet path object notifications
vxlan: keep the last remote linked during FDB flush
batman-adv: reject unrepresentable multicast TVLV offsets
ipv6: seg6: clear IPv4 control block on IPIP decapsulation
net: bridge: mcast: fix use-after-free of a master VLAN's multicast context
xfrm: bound nat keepalive state collection
xfrm: fix xfrm_state_construct() auth-trunc leak
xfrm: ah6: validate routing header segments_left
xfrm: avoid lock inversion in nat keepalive work
xfrm: drop ESP-in-TCP packets with no ingress device
xfrm: espintcp: fix UAF during close
net/tcp-ao: fix use-after-free of current_key on reconnect to another peer
tcp: fix AO info use-after-free in tcp_ao_connect_init()
net/tcp: fix TCP-AO key deletion in VRFs
x86/CPU/AMD: Carve out a Zen5 models range
gtp: serialize PDP context updates
tls: device: fix out-of-bounds write in tls_append_frag()
usb: gadget: f_tcm: keep port count until LUN teardown completes
usb: usbtest: disable dynamic ID support
fuse: fix invalidate lock leak on open O_TRUNC DAX failure
fuse: fix invalidate lock leak on setattr writeback failure
xhci: dbgtty: Fix unregister on tty_alloc_driver() failure
xhci: dbgtty: Fix unregister on tty_register_driver() failure
usb: xhci: Handle USB3 port events when there is one roothub
accessibility: speakup: unregister tty ldisc on later init failures
fpga: dfl: fme: add error handling
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
Bluetooth: hci_sync: Fix accept list UAF during suspend
Bluetooth: hci_sync: Use bt_dev_err() to log error message in hci_update_event_filter_sync()
HID: uclogic: fix use-after-free of inrange_timer on remove
HID: ft260: fix stack-use-after-return write in I2C read race
HID: ft260: validate i2c input report length
HID: asus: fix missing hid_is_usb() check
HID: asus: simplify RGB init sequence
HID: pidff: fix OOB write when hid->inputs is empty
HID: pidff: clang-format pass
HID: pidff: Use ARRAY_SIZE macro instead of sizeof
HID: pidff: Rework pidff_set_time() to fix warnings
nfc: nci: add data_len bound checks to activation parameter extractors
nilfs2: reject invalid block index in GC ioctl
nilfs2: correct return value kernel-doc descriptions for ioctl functions
ksmbd: harden file lifetime during session teardown
powerpc/hv-gpci: fix preempt count leak in sysfs show paths
veth: fix OOB txq access in veth_poll() with asymmetric queue counts
ring buffer: Propagate __rb_map_vma return value to caller
selinux: switch two allocations to use kzalloc_objs()
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_vlan_by_tcpsk().
ASoC: nau8821: Cancel pending work before suspend
Revert "PM: sleep: Use complete() in device_pm_sleep_init()"
riscv: Fix register corruption from uninitialized cregs on error
bpf: Fix use-after-free in offloaded map/prog info fill
ASoC: nau8821: Cancel delayed work on component remove
smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
smc: Use __sk_dst_get() and dst_dev_rcu() in in smc_clc_prfx_set().
KVM: arm64: Prevent access to vCPU events before init
smc: Fix use-after-free in __pnet_find_base_ndev().
can: j1939: make j1939_sk_bind() fail if device is no longer registered
can: j1939: add missing calls in NETDEV_UNREGISTER notification handler
can: j1939: implement NETDEV_UNREGISTER notification handler
mISDN: hfcpci: Fix warning when deleting uninitialized timer
media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
exfat: fix double free in delayed_free
jfs: Fix null-ptr-deref in jfs_ioc_trim
ibmvnic: Use kernel helpers for hex dumps
jfs: add check read-only before txBeginAnon() call
jfs: add check read-only before truncation in jfs_truncate_nolock()
perf: Reject exited events as group leaders
selinux: require a class's permission values to cover its permission count
selinux: reject a permission value exceeding the class permission count
selinux: more strict policy parsing
selinux: use u16 for security classes
selinux: make more use of str_read() when loading the policy
selinux: avoid unnecessary indirection in struct level_datum
selinux: use known type instead of void pointer
HID: uhid: convert to hid_safe_input_report()
nvme-tcp: fix usage of page_frag_cache
io_uring/io-wq: fix worker accounting when canceling creation callbacks
ext4: don't enable DAX on new encrypted files
KVM: x86/mmu: Check write tracking in all address spaces
RDMA/rxe: Fix OOB in free_rd_atomic_resources()
RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
generiert von kernel-watch