Wei Chen

The issue is related to a double-free vulnerability in the ext4 file system, specifically in the `ext4 move extents()` function. This vulnerability can cause a denial of service when the `trim` command is executed, due to a zero-division bug triggered in `mb update avg fragment size()`. The problem arises when the `moved len` variable is not updated after successfully moving some extents, leading to the freeing of overlapped extents twice in `ext4 mb release inode pa()` and `ext4 process freed data()`. This results in `bb free` being incremented twice, causing the zero-division bug when `trim` is executed.

An out-of-bounds write issue was found in the Linux kernel's SLIMpro I2C device driver. The `data->block[0]` variable from userspace was not limited to a value between 0-255 and was used as the size of a `memcpy()`, possibly writing beyond the end of `dma buffer`. This could allow a local privileged user to crash the system or potentially achieve code execution.

The vulnerability is related to the `TCA MPLS LABEL` attribute in the Linux kernel, which has an invalid combination of type `NLA U32` and validation type `NLA VALIDATE FUNCTION`. This can trigger a warning in `nla get range unsigned()` when validation of the attribute fails. The associated `min`/`max` fields in the policy are negative as they are aliased by the `validate` field. The fix involves changing the attribute type to `NLA BINARY`, which is consistent with the comment above `struct nla policy` and all other users of `NLA POLICY VALIDATE FN()`. As a result, the length validation is moved to the validation function.

The issue is related to the Infiniband driver in the Linux Kernel, specifically with the compare netdev and ip function in the drivers/infiniband/core/cma.c module. It involves improper cleanup, resulting in an out-of-boundary read. A local user can exploit this to crash the system or escalate their privileges.

The issue is related to a NULL pointer dereference in the `can rcv filter` function. This occurs due to a missing initialization of `ml priv` in the receive path of CAN frames. The problem arose after a commit introduced a CAN-specific pointer in the `struct net device`, making the check for `dev->type` to be `ARPHRD CAN` insufficient. This is because bonding or tun netdevices claim to be CAN devices but do not initialize `ml priv` accordingly. The vulnerability can be exploited to cause a denial of service.

The issue is related to a null pointer dereference in the can protocol in the net/can/af can.c module of the Linux kernel. This occurs because `ml priv` may not be initialized in the receive path of CAN frames. A local user could exploit this to crash the system or potentially cause a denial of service.

The issue is related to a NULL pointer dereference in the `sk user ns()` function, which is caused by the newly allocated `skb` not having `sk` in the `unix diag get exact()` function. This can lead to a denial of service. The `unix diag get exact()` function is used to get the exact socket information. The `sk diag fill()` function is also involved, which fills the socket information. The `NETLINK CB(in skb).sk` is used to get the user namespace.

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dvb-usb/az6027.c. The issue arises because messages from user space are not properly checked before being transferred into the device. This flaw allows a local user to crash the system or potentially cause a denial of service. The vulnerability is related to the function `az6027 i2c xfer()` and is caused by a null pointer dereference.

The issue is related to a data race flaw in the Linux kernel's implementation of the TIPC protocol, which can lead to a NULL pointer dereference. This flaw is located between where `con` is allocated and `con->sock` is set, specifically when accessing `con->sock->sk` in `net/tipc/topsrv.c`. The exploitation of this issue may allow a remote attacker to cause a denial of service.

A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream sched.c. If `stream in` allocation fails, `stream out` is freed and would further be accessed. This could allow a local user to crash the system or potentially cause a denial of service.