Andrea Righi

The vulnerability is related to a stack out-of-bounds access in the `elantech change report id()` function. The `param[]` array in `elantech change report id()` must be at least 3 bytes, but it is defined as an array of 2 bytes, leading to a potential stack out-of-bounds access. This issue is confirmed by KASAN. The vulnerability can be exploited to cause a denial of service.

The issue concerns the Linux kernel, where various PV features (Async PF, PV EOI, steal time) work through memory shared with the hypervisor. When restoring from hibernation, these features must be properly torn down to prevent the hypervisor from writing to stale locations after jumping to the previously hibernated kernel. The job is already done for secondary CPUs by kvm cpu down prepare(), and syscore ops are registered to do the same for the boot CPU.

A race condition exists in the `scan get next rmap item` function in `mm/ksm.c` when Kernel SamePage Merging (KSM) is enabled. This issue allows local users to cause a denial of service, potentially resulting in a NULL pointer dereference, or possibly have other unspecified impacts via a crafted application.