Most latest bugs are reported by syzbot and are listed here and on the dashboard. Additional USB bugs are here.
newer first
- bpf: BPF_PROG_TEST_RUN leads to unkillable process
- timer_settime leads to unkillable process
- UBSAN: Undefined behaviour in drivers/scsi/sr_ioctl.c
- KASAN: use-after-free Read in ata_scsi_mode_select_xlat
- UBSAN: Undefined behaviour in fs/f2fs/extent_cache.c
- UBSAN: Undefined behaviour in drivers/input/misc/uinput.c
- general protection fault in spk_ttyio_ldisc_close
- rtnetlink: give a user socket to get_target_net() CVE-2018-14646
- tipc: NULL deref in tipc_net_finalize
- Kernel crash at i2cdev_ioctl_rdwr in drivers/i2c/i2c-dev.c
- UBSAN: Undefined behaviour in drivers/input/mousedev.c
- UBSAN: Undefined behaviour in mm/page_alloc.c
- WARNING in pkt setup dev
- UBSAN: Undefined behaviour in drivers/net/ppp/ppp_generic.c
- KASAN: use-after-free Read in raw_cmd_done
- KMSAN: uninit-value in selinux_socket_bind, selinux_socket_connect_helper
- UBSAN: Undefined behaviour in drivers/block/floppy.c
- net: BUG still has locks held in unix_stream_splice_read
- general protection fault in sockfs_setattr CVE-2018-12232
- KASAN: slab out of bounds Write in __jfs_setxattr CVE-2018-12233
- RDMA/mlx5: Fix NULL dereference while accessing XRC_TGT QPslogin
- KASAN: use-after-free Read in set_page_dirty_lock
- System freeze and NULL pointer dereference
- RDS: WARNING in rds_recv_hs_exthdrs
- RDS: slab-out-of-bounds Read in rds_rdma_extra_size
- netfilter: fix out-of-bounds accesses in clusterip_tg_check()
- net: hang in unregister_netdevice: waiting for lo to become free
- scsi: sg: assorted memory corruptions
- kcm: memory leak in kcm_sendmsg
- AF_KEY: memory leak in key_notify_policy
- sctp: memory leak in sctp_endpoint_init
- tipc: memory leak in tipc_nl_node_get_link
- tun: memory leak in tun_set_iff
- net/8021q: memory leak in register_vlan_dev
- net: memory leak in socket
- scsi: memory leak in sg_start_req
- sunrpc: infinite unkillable console spam in xs_tcp_setup_socket
- fs: possible deadlock in do_iter_write/do_splice
- net/ipv6: warning in __alloc_pages_slowpath/ipip6_tunnel_get_prl
- net/ipv6: GPF in rt6_ifdown
- net/ipv4: trying to register non-static key in ip_mc_clear_src
- net/can: trying to register non-static key in can_rx_register
- net: general protection fault in deactivate_slab
- net/ipv4: use-after-free in add_grec
- net/ipv6: use-after-free in ip6_dst_ifdown
- tty: possible deadlock in tty_buffer_flush
- net/ipv6: general protection fault in skb_release_data CVE-2017-9242
- drivers/net/hamradio: divide error in hdlcdrv_ioctl
- tty: fix port buffer locking
- kvm: warning in kvm_load_guest_fpu
- drivers/scsi: GPF in sg_read
- net/ipv4: use-after-free in ip_mc_drop_socket CVE-2017-8890 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077
- net/ipv6: GPF in rt6_device_match
- x86: warning: kernel stack regs has bad 'bp' value
- net/key: slab-out-of-bounds in pfkey_compile_policy
- net/ipv6: warning in inet6_ifa_finish_destroy
- net/ipv6: use-after-free in __call_rcu/in6_dev_finish_destroy_rcu
- net/ipv6: slab-out-of-bounds in ip6_tnl_xmit
- net/rose: null-ptr-deref in rose_route_frame
- time: hang due to timer_create/timer_settime
- net/core: BUG in unregister_netdevice_many
- net/xfrm: stack-out-of-bounds in xfrm_state_find
- net/bonding: stack-out-of-bounds in bond_enslave
- net: ipv6: RTF_PCPU should not be settable from userspace
- fs/notify/inotify: slab-out-of-bounds write in strcpy CVE-2017-7533
- net/ipv6: slab-out-of-bounds read in seg6_validate_srh
- kernel BUG at mm/hugetlb.c:742!
- net/key: slab-out-of-bounds in parse_ipsecrequests
- net/ipv4: use-after-free in ipv4_datagram_support_cmsg
- net/ipv4: use-after-free in ip_queue_xmit
- net: use-after-free in __ns_get_path
- net/ipv4: use-after-free in ip_check_mc_rcu
- net/ipv6: use-after-free in ipv6_sock_ac_close
- net/ipv4: use-after-free in ipv4_mtu
- net/dccp: BUG in tfrc_rx_hist_sample_rtt
- net/sctp: list double add warning in sctp_endpoint_add_asoc
- kvm: use-after-free in srcu_reschedule
- ata: WARNING in ata_bmdma_qc_issue
- net/sched: GPF in qdisc_hash_add
- sg: random memory corruptions
- fs: GPF in deactivate_locked_super
- loop: WARNING in sysfs_remove_group
- lib, fs, cgroup: WARNING in percpu_ref_kill_and_confirm
- ata: WARNING in ata_qc_issue
- security, hugetlbfs: write to user memory in hugetlbfs_destroy_inode
- netlink: NULL timer crash
- kvm: use-after-free function call in kvm_io_bus_destroy
- sound: use-after-free in snd_seq_cell_alloc
- usb: use-after-free write in usb_hcd_link_urb_to_ep
- net/kcm: double free of kcm inode
- crypto: out-of-bounds write in pre_crypt
- security: double-free in superblock_doinit
- kvm: WARNING in kvm_apic_accept_events
- tcp: fix potential double free issue for fastopen_req
- net/udp: slab-out-of-bounds Read in udp_recvmsg
- net: deadlock between ip_expire/sch_direct_xmit
- srcu: BUG in __synchronize_srcu
- net/sctp: recursive locking in sctp_do_peeloff
- kvm: WARNING in vmx_handle_exit
- futex: use-after-free in futex_wait_requeue_pi
- kvm/arm64: use-after-free in kvm_vm_ioctl/vmacache_update
- kvm/arm64: use-after-free in kvm_unmap_hva_handler/unmap_stage2_pmds
- local privilege escalation flaw in n_hdlc CVE-2017-2636
- netlink: GPF in netlink_unicast
- perf: use-after-free in perf_release
- net/ipv6: null-ptr-deref in ip6mr_sk_done
- bpf: kernel NULL pointer dereference in map_get_next_key
- crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex
- kvm: use-after-free in vmx_check_nested_events/vmcs12_guest_cr0
- sound: another deadlock in snd_seq_pool_done
- rcu: WARNING in rcu_seq_end
- fs: use-after-free in path_lookupat
- ucount: use-after-free read in inc_ucount & dec_ucount
- net/ipv4: division by 0 in tcp_select_window
- net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone
- mm: use-after-free in zap_page_range
- net/kcm: use-after-free in kcm_wq
- idr: use-after-free write in ida_get_new_above
- sg: stack out-of-bounds write in sg_write CVE-2017-7187
- cgroup: WARNING in cgroup_kill_sb
- net/rds: use-after-free in rds_find_bound/memcmp
- net: sleeping function called from invalid context in net_enable_timestamp
- net: use-after-free in neigh_timer_handler/sock_wfree
- net/sctp: use-after-free in sctp_association_put
- fs: use-after-free in userfaultfd_exit
- net/ipv4: inconsistent lock state in tcp_conn_request/inet_ehash_insert
- net/ipv4: suspicious RCU usage in ip_ra_control
- net/ipv4: deadlock in ip_ra_control
- net/dccp: dccp_create_openreq_child freed held lock
- nested_vmx_merge_msr_bitmap
- ipc: use-after-free in shm_get_unmapped_area
- sounds: deadlocked processed in snd_seq_pool_done
- net/atm: vcc_sendmsg calls kmem_cache_alloc in non-blocking context
- ata: WARNING in ata_sff_qc_issue
- net/rds: use-after-free in inet_create
- mm: fault in __do_fault
- kvm: WARNING in nested_vmx_vmexit
- net: GPF in rt6_nexthop_info
- sound: spinlock lockup in snd_timer_user_tinterrupt
- mm: GPF in bdi_put
- net/sctp: use-after-free in sctp_hash_transport
- net/bridge: warning in br_fdb_find
- net/ipv6: null-ptr-deref in ip6_route_del/lock_acquire
- net: possible deadlock in skb_queue_tail
- DCCP double-free vulnerability (local root) CVE-2017-6074
- net: warning in inet_sock_destruct
- net/pptp: use-after-free in dst_release
- net/udp: slab-out-of-bounds in udp_recvmsg/do_csum CVE-2017-6347
- WARNING in skb_warn_bad_offload
- tty: panic in tty_ldisc_restore
- net: BUG in __skb_gso_segment
- net/dccp: use-after-free in dccp_feat_activate_values
- net/kcm: GPF in kcm_sendmsg
- net/xfrm: stack out-of-bounds in xfrm_flowi_sport
- net/llc: BUG in llc_sap_state_process/skb_set_owner_r CVE-2017-6345
- net/llc: bug in llc_pdu_init_as_xid_cmd/skb_over_panic
- net/packet: use-after-free in packet_rcv_fanout
- net: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected in skb_array_produce
- net/ipv4: null-ptr-deref in udp_rmem_release/sk_memory_allocated_sub
- net/sctp: null-ptr-deref in sctp_put_port/sctp_endpoint_destroy
- net/ipv4: warning in nf_nat_ipv4_fn
- net/ipv6: double free in ipip6_dev_free
- sound: use-after-free in snd_seq_queue_alloc
- loop: divide error in transfer_xor
- net/xfrm: use of uninit spinlock in xfrm_policy_flush
- mm: double-free in cgwb_bdi_init
- packet: round up linear to header len
- net/icmp: null-ptr-deref in ping_v4_push_pending_frames
- net/kcm: WARNING in kcm_write_msgs
- tcp: avoid infinite loop in tcp_splice_read() CVE-2017-6214
- tun: read vnet_hdr_sz once
- macvtap: read vnet_hdr_size once
- udp: properly cope with csum errors
- ipv6: tcp: add a missing tcp_v6_restore_cb()
- ip6_gre: fix ip6gre_err() invalid reads CVE-2017-5897
- ipv4: keep skb->dst around in presence of IP options CVE-2017-5970
- net: use a work queue to defer net_disable_timestamp() work
- netlabel: out of bound access in cipso_v4_validate()
- ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
- net: heap out-of-bounds in ip6_fragment CVE-2017-9074
- tcp: fix 0 divide in __tcp_select_window()
- keys: GPF in request_key
- net/tcp: warning in tcp_try_coalesce/skb_try_coalesce
- crypto: NULL deref in sha512_mb_mgr_get_comp_job_avx2
- sound: unable to handle kernel paging request snd_seq_prioq_cell_out
- scsi: BUG in scsi_init_io
- mm: sleeping function called from invalid context shmem_undo_range
- timerfd: use-after-free in timerfd_remove_cancel
- scsi: use-after-free in sg_start_req
- mm: deadlock between get_online_cpus/pcpu_alloc
- BUG at net/sctp/socket.c:7425
- kvm: use-after-free in irq_bypass_register_consumer
- net: suspicious RCU usage in nf_hook
- kvm: fix page struct leak in handle_vmon CVE-2017-2596
- ipv6: fix ip6_tnl_parse_tlv_enc_lim()
- kvm: WARNING in mmu_spte_clear_track_bits
- perf: use-after-free in perf_event_for_each
- net: use-after-free in tw_timer_handler
- namespace: deadlock in dec_pid_namespaces
- sctp: kernel memory overwrite attempt detected in sctp_getsockopt_assoc_stats
- kvm: deadlock in kvm_vgic_map_resources
- net/atm: warning in alloc_tx/__might_sleep
- net/ipv6: use-after-free in sock_wfree
- kvm: kvm: BUG in loaded_vmcs_init
- kvm: NULL deref in vcpu_enter_guest
- kvm: use-after-free in complete_emulated_mmio CVE-2017-2584
- kvm: BUG in kvm_unload_vcpu_mmu
- x86: warning in unwind_get_return_address
- ipc: BUG: sem_unlock unlocks non-locked lock
- kvm: WARNING in mmu_spte_clear_track_bits
- sctp: suspicious rcu_dereference_check() usage in sctp_epaddr_lookup_transport
- kvm: use-after-free in process_srcu
- kvm: assorted bugs after OOMs
- kvm: deadlock between kvm_io_bus_register_dev/kvm_hv_set_msr_common
- netlink: GPF in netlink_dump
- fs, net: deadlock between bind/splice on af_unix
- net: use-after-free in worker_thread
- net: signed overflows in SO_{SND|RCV}BUFFORCE sockopts CVE-2016-9793 CVE-2012-6704
- net/can: warning in raw_setsockopt/__alloc_pages_slowpath
- net/ipv6: null-ptr-deref in ip6_rt_cache_alloc
- net/dccp: use-after-free in dccp_invalid_packet
- net/sctp: vmalloc allocation failure in sctp_setsockopt/xt_alloc_table_info
- net: BUG in unix_notinflight
- net: GPF in eth_header CVE-2016-9755
- net: deadlock on genl_mutex
- net: GPF in rt6_get_cookie
- netlink: GPF in sock_sndtimeo
- scsi: use-after-free in bio_copy_from_iter CVE-2016-9576
- net/udp: bug in skb_pull_rcsum
- net/icmp: null-ptr-deref in icmp6_send CVE-2016-9919
- net/can: use-after-free in bcm_rx_thr_flush
- kvm: slab-out-of-bounds write in __apic_accept_irq CVE-2016-9777
- mm: BUG in pgtable_pmd_page_dtor
- logfs: GPF in logfs_alloc_inode
- mm, floppy: unkillable task faulting on fd0
- kvm: deadlock between kvm_vm_ioctl_get_dirty_log/kvm_hv_set_msr_common/kvm_create_pit
- kvm: WARNING in em_jmp_far CVE-2016-9756
- kvm: WARNING in rtc_status_pending_eoi_check_valid
- kvm: GPF in kvm_ioapic_set_irq
- mm: BUG in munlock_vma_pages_range
- kvm: WARNING in kvm_arch_vcpu_ioctl_run
- kvm: use-after-free/GPF in kvm_irq_delivery_to_apic_fast
- kvm: out-of-bounds write in __rtc_irq_eoi_tracking_restore_one
- kvm: BUG in pte_list_remove
- kvm: recursive lock in kvm_clear_async_pf_completion_queue
- kvm: WARNING in em_ret_far
- kvm: GPF in irqfd_shutdown/eventfd_ctx_remove_wait_queue
- kvm: GPF in gfn_to_rmap
- kvm: paging fault in kvm_gfn_to_hva_cache_init
- kvm: suspicious RCU usage/missed lock in kvm_lapic_set_vapic_addr
- kvm: use-after-free in irq_bypass_register_consumer
- kvm: WARNING in kvm_load_guest_fpu
- kvm: GPF in kvm_pic_set_irq
- kvm: GPF in irq_bypass_unregister_consumer
- kvm: GPF in __get_kvmclock_ns
- kvm: WARNING In kvm_apic_accept_events
- kvm: WARNING in __x86_set_memory_region
- tcp: take care of truncations done by sk_filter()
- net/l2tp: use-after-free write in l2tp_ip6_close
- net/sctp: null-ptr-deref in sctp_inet_listen
- net/tcp: warning in tcp_recvmsg
- net/netlink: another global-out-of-bounds in genl_family_rcv_msg/validate_nla
- bpf: kernel BUG in htab_elem_free
- net/netlink: global-out-of-bounds in genl_family_rcv_msg/validate_nla
- net/ipv6: null-ptr-deref in inet6_bind
- net/dccp: null-ptr-deref in dccp_parse_options
- net/dccp: null-ptr-deref in dccp_v4_rcv/selinux_socket_sock_rcv_skb
- net/tcp: null-ptr-deref in __inet_lookup_listener/inet_exact_dif_match
- net/dccp: warning in dccp_feat_clone_sp_val/__might_sleep
- net/can: warning in bcm_connect/proc_register
- net/ipv4: warning in inet_sock_destruct
- net/sctp: slab-out-of-bounds in sctp_sf_ootb CVE-2016-9555
- net/dccp: warning in dccp_set_state
- net/netlink: bad unlock balance in netlink_diag_dump
- net/netlink: null-ptr-deref in netlink_dump/lock_acquire
- net/ipx: null-ptr-deref in ipxrtr_route_packet
- net/sctp: use-after-free in __sctp_connect
- fs: WARNING in locks_unlink_lock_ctx (not holding proper lock)
- kernel BUG in dio_get_page
- drm: GPF in drm_getcap
- fs: GPF in bd_mount
- tty, fbcon: use-after-free in fbcon_invert_region
- drm: NULL pointer dereference in drm_mode_object_find()
- 6pack: stack-out-of-bounds in sixpack_receive_buf
- logfs: GPF in logfs_init_inode
- tty: use-after-free in n_tty_receive_buf_fast
- sound: divide by 0 in snd_hrtimer_callback (or hang)
- mm: GPF in __insert_vmap_area
- fs, tty: WARNING in devpts_get_priv
- fanotify: unkillable hanged processes
- drm: GPF in drm_context_switch_complete
- drm: GPF in drm_legacy_lock_free
- sound: division by 0 in snd_hrtimer_callback
- perf: WARNING in perf_event_read
- drm: WARNING in drm_irq_by_busid
- dri: WARNING in idr_remove
- mm: use-after-free in collapse_huge_page
- kcm: use-after-free in fput of kcm socket
- bdev: fix NULL pointer dereference in sync()/close() race
- bdev: fix NULL pointer dereference
- BUG: sleeping function called from invalid context at mm/mempolicy.c:553
- use-after-free in ppp_unregister_channel
- net/tipc: NULL-ptr dereference in tipc_nl_publ_dump
- HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()
- mm: memory corruption on mmput
- perf: WARNING in perf_event_read
- 9p2000.L stat/unlink race (WARNING: fs/inode.c:280 drop_nlink)
- mm: page fault in __do_huge_pmd_anonymous_page
- usb: memory allocation WARNING in hcd_buffer_alloc
- dccp: potential deadlock in dccp_v4_ctl_send_reset
- mm: GPF in find_get_pages_tag
- mm: BUG in page_move_anon_rmap
- block: GPF in get_task_ioprio
- tty: stall in n_tty_ioctl/inq_canon
- random: negative entropy/overflow: pool input count -40000
- bpf: use after free in array_map_alloc CVE-2016-4794
- kvm: use-after-free in kvm_irqfd_release
- kvm: GPF in kvm_lapic_set_tpr
- sound: use-after-free in hrtimer_cancel
- sound: hang in snd_timer_interrupt
- sound: deadlock involving snd_hrtimer_callback
- fs: GPF in locked_inode_to_wb_and_lock_list
- x86: bad pte in pageattr_test
- tty: memory leak in tty_open
- net: memory leak due to CLONE_NEWNET
- lockdep WARNING in get_online_cpus
- mm: BUG in khugepaged_scan_mm_slot
- sound: use-after-free in snd_timer_interrupt
- scsi: machine hang due to write to /dev/sg0
- AMD newest ucode 0x06000832 for Piledriver-based CPUs seems to behave in a problematic way
- sound: uninterruptible hang in snd_seq_oss_writeq_sync
- fs: uninterruptible hang in handle_userfault
- net: memory leak in N_6PACK driver
- net: memory leak in lapb_register
- net: memory leak in mkiss_open
- sound: list corruption in delete_and_unsubscribe_port
- kvm: GPF in kvm_pic_clear_all
- kvm: GPF in kvm_irq_map_gsi
- tty: memory leak in tty_register_driver
- sound: memory leak in snd_seq_pool_init
- tty: deadlock between tty_buffer_flush/n_tracesink_open
- sound: heap out-of-bounds write in dummy_systimer_prepare
- fs: NULL deref in atime_needs_update
- sound: spinlock lockup in snd_seq_oss_write
- net: memory leak in ip_cmsg_send
- net/irda: BUG: looking up invalid subclass: 4294967295 CVE-2017-6348
- sound: use-after-free in snd_timer_start1
- tty: tty_struct memory leak
- gigaset: memory leak in gigaset_initcshw
- sound: out-of-bounds write in snd_rawmidi_kernel_write1
- mm: uninterruptable tasks hanged on mmap_sem
- sound: another WARNING in rawmidi_transmit_ack
- sound: use-after-free in snd_seq_deliver_single_event
- sound: WARNING in snd_rawmidi_kernel_write1
- sound: deadlock between snd_pcm_oss_write/snd_pcm_oss_mmap
- ata: BUG in ata_sff_hsm_move
- WARNING in set_restore_sigmask
- BUG: bad unlock balance detected in vma_unlock_anon_vma
- bluetooth: use-after-free in vhci_send_frame
- mm: another VM_BUG_ON_PAGE(PageTail(page))
- scsi: NULL deref in sg_start_req
- mm: BUG in expand_downwards
- sound: heap out-of-bounds write in dummy_systimer_prepare
- WARNING in do_jobctl_trap
- mm: VM_BUG_ON_PAGE(PageTail(page)) in mbind
- net/bluetooth: workqueue destruction WARNING in hci_unregister_dev
- gpu: kmalloc size WARNING in vga_arb_write
- net/rfkill: WARNING in rfkill_fop_read
- sound: use-after-free in _snd_timer_stop
- net/irda: use-after-free in ircomm_param_request
- net/sctp: out-of-bounds access in sctp_add_bind_addr
- ext4: BUG: scheduling while atomic in ext4_commit_super
- sound: WARNING in snd_rawmidi_transmit_ack
- floppy: GPF in floppy_rb0_cb
- tty: kmalloc size WARNING in vc_do_resize
- mm: WARNING in __delete_from_page_cache
- sound: WARNING in snd_seq_oss_synth_cleanup
- sound: deadlock between snd_rawmidi_kernel_open/snd_seq_port_connect
- net: GPF in netlink_getsockbyportid
- fs: use-after-free in link_path_walk
- fs: sandboxed process brings host down
- net: use-after-free in recvmmsg
- struct pid memory leak
- net: WARNING in dccp_set_state
- mm: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected in split_huge_page_to_list
- sound: BUG in snd_ctl_find_numid
- net: GPF in __netlink_ns_capable
- crypto: slab-out-of-bounds in skcipher_recvmsg
- net: hang in ip_finish_output
- kvm: access to invalid memory in mmu_zap_unsync_children
- kvm: using uninitialized var in tdp_page_fault
- sound: spinlock lockup in sound/core/timer.c
- sound: GPF in snd_timer_user_params
- sound: use-after-free in snd_timer_interrupt
- sound: use-after-free in snd_timer_user_ioctl
- crypto: use-after-free in skcipher_sock_destruct
- net/sctp: use-after-free in __sctp_connect
- net: WARNING in tcp_recvmsg
- sound: use-after-free in snd_timer_stop
- sound: GPF in snd_seq_fifo_clear
- crypto: ablk_decrypt causes BUG in scatterwalk
- kvm: GPF in native_set_debugreg
- kvm: GPF in kvm_lapic_latched_init
- kvm: WARNING in kvm_apic_accept_events
- kvm: vmalloc allocation failure in kvm_vm_ioctl
- kvm: vmalloc allocation failure in kvm_vcpu_ioctl_set_cpuid
- kvm: WARNING in __x86_set_memory_region
- kvm: WARNING in exception_type
- mm: possible deadlock in mm_take_all_locks
- net/nfc: GPF in llcp_sock_getname
- net/netlink: memory leak in netlink_sendmsg
- net/tipc: memory leak in tipc_release
- memory leak in lapb_create_cb
- net/sctp: sctp_datamsg memory leak
- net/sctp: sock memory leak
- net/nfc: user-controllable kmalloc size in nfc_llcp_send_ui_frame
- tty: deadlock between n_tracerouter_receivebuf and flush_to_ldisc
- crypto: use-after-free in alg_bind
- crypto: deadlock in alg_setsockopt
- crypto: use-after-free in rng_recvmsg
- use-after-free in skcipher_bind
- 9p: sleeping function called from invalid context in v9fs_vfs_atomic_open_dotl
- fs: WARNING in locks_free_lock_context
- net: user-controllable kmalloc size in __sctp_setsockopt_connectx
- GPF in gf128mul_64k_bbe
- use-after-free in hash_sock_destruct
- GPF in lrw_crypt
- bad page state due to PF_ALG socket
- use-after-free in skcipher_sock_destruct
- use-after-free in sixpack_close
- net: heap-out-of-bounds in sock_setsockopt
- BUG_ON(!PageLocked(page)) in munlock_vma_page
- perf: stalls in perf_install_in_context/perf_remove_from_context
- Information leak in sco_sock_bind CVE-2015-8575
- Information leak in llcp_sock_bind/llcp_raw_sock_bind
- Information leak in pptp_bind
- use-after-free in pptp_connect
- GPF in keyctl CVE-2015-7550
- another use-after-free in sctp_do_sm
- use-after-free in inet6_destroy_sock
- WARNING in crypto_wait_for_test
- int overflow in io_getevents
- use-after-free in ip6_xmit
- use-after-free in __perf_install_in_context
- undefined shift in __bpf_prog_run
- signed integer overflow in ktime_add_safe
- jump label: negative count!
- memory leak in alloc_huge_page
- memory leak in do_ipv6_setsockopt
- heap out-of-bounds access in array_map_update_elem
- deadlock in perf_ioctl
- user-controllable kmalloc size in bpf syscall
- net: use after free in ip6_make_skb
- user-controllable kmalloc size in sctp_getsockopt_local_addrs
- use-after-free in ip6_setup_cork
- gigaset: freeing an active object
- Freeing active kobject in pps_device_destruct
- GPF in process_one_work (flush_to_ldisc)
- use-after-free in tty_check_change
- WARNING in tcp_recvmsg
- use-after-free in irtty_open
- use-after-free in sock_wake_async
- WARNING in handle_mm_fault
- WARNING in gsm_cleanup_mux
- use-after-free in sctp_do_sm
- yet another uninterruptable hang in sendfile
- GPF in add_key
- another uninterruptable hang in sendfile
- deadlock during fuseblk shutdown
- tty,net: use-after-free in x25_asy_open_tty
- deadlock between tty_write and tty_send_xchar
- WARNING in shmem_evict_inode
- Deadlock between setsockopt/getsockopt
- Deadlock between bind and splice
- Use-after-free in ipv4_conntrack_defrag
- Use-after-free in selinux_ip_postroute_compat
- Use-after-free in unshare
- GPF in tcp_sk_init/icmp_sk_init
- lockdep warning in ip_mc_msfget
- WARNING in task_participate_group_stop
- Resource leak in unshare
- Paging fault with hard IRQs disabled in getsockopt
- Unkillable processes due to PTRACE_TRACEME
- Use-after-free in ep_remove_wait_queue CVE-2013-7446
- GPF in shm_lock
- GPF in rt6_uncached_list_flush_dev
- Infinite loop in ip6_fragment
- Uninterruptable hang in sendfile
- GPF in keyring_destroy CVE-2015-7872