Vasily Averin

The issue is related to the net dma code in the tcp recvmsg() function, which is thread-unsafe. This can be exploited by an unprivileged multi-threaded userspace application calling recvmsg() for the same network socket in parallel on ioatdma-enabled hardware with net dma enabled, potentially leading to memory leaks, host crashes, denial-of-service, or random memory corruption.

A denial of service situation can be created by an attacker with local access via a NULL pointer dereference in the `ovl posix acl create` function in `fs/overlayfs/dir.c`. This allows attackers who can create directories on overlayfs to crash the kernel, resulting in a denial of service. The issue is related to errors in pointer dereferencing in the `ovl posix acl create` function.

The issue is related to the cleancache subsystem of the Linux kernel, which incorrectly initializes new files. This can allow an attacker to expose protected information. The problem occurs when the cleancache subsystem clears an inode after the final file truncation, and a new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one.

The issue is related to an out-of-bounds memory write flaw in the Linux kernel's Voice Over IP H.323 connection tracking functionality when handling connections on ipv6 port 1720. This flaw allows an unauthenticated remote user to crash the system, causing a denial of service, and poses a threat to confidentiality, integrity, and system availability. The flaw is also associated with a possible out of bounds write due to a missing bounds check in nf conntrack helper q931 of nf conntrack h323 main.c, which could lead to local escalation of privilege without requiring additional execution privileges or user interaction.

The issue allows local users to cause a denial of service, resulting in a system hang, via a specific system call. Additionally, multiple vulnerabilities in the kernel-kdumppae package of the SUSE Linux Enterprise operating system can lead to disruption of protected information availability, and these vulnerabilities can be exploited remotely.

The issue arises from the block prepare write function in fs/buffer.c, which fails to properly clear buffers during certain error conditions. This allows local users to read portions of files that have been unlinked.