Found bugs
August 24, 2020 ยท View on GitHub
Most latest bugs are reported by syzbot and are listed here and on the dashboard. Additional USB bugs are here.
newer first
- KASAN: use-after-free Read in screen_glyph_unicode
- KASAN: use-after-free Read in vc_do_resize
- KASAN: use-after-free in usb_hcd_unlink_urb
- KASAN: slab-out-of-bounds Read in gadget_dev_desc_UDC_store
- KASAN: use-after-free Write in snd_rawmidi_kernel_write1
- KASAN: use-after-free Write in config_item_get
- KASAN: use-after-free Read in f_hidg_poll
- KASAN: use-after-free Read in printer_ioctl
- KASAN: null-ptr-deref Read in tty_wakeup
- KASAN: use-after-free in afs_wake_up_async_call
- KASAN: use-after-free Read in gs_flush_chars
- kernel BUG at net/core/skbuff.c
- io_uring: avoid page allocation warnings
- io_uring: free allocated io_memory once
- io_uring: fix SQPOLL cpu validation
- locks: use-after-free in perf_trace_lock_acquire CVE-2019-19769
- cirrusfb: divide errors in cirrusfb_check_var/cirrusfb_check_pixclock/cirrusfb_set_par_foo
- floppy: fix out-of-bounds read in copy_buffer
- floppy: fix invalid pointer dereference in drive_name
- floppy: fix out-of-bounds read in next_valid_format
- floppy: fix div-by-zero in setup_format_params
- bpf: BPF_PROG_TEST_RUN leads to unkillable process
- timer_settime leads to unkillable process
- UBSAN: Undefined behaviour in drivers/scsi/sr_ioctl.c
- KASAN: use-after-free Read in ata_scsi_mode_select_xlat
- UBSAN: Undefined behaviour in fs/f2fs/extent_cache.c
- UBSAN: Undefined behaviour in drivers/input/misc/uinput.c
- general protection fault in spk_ttyio_ldisc_close
- rtnetlink: give a user socket to get_target_net() CVE-2018-14646
- tipc: NULL deref in tipc_net_finalize
- Kernel crash at i2cdev_ioctl_rdwr in drivers/i2c/i2c-dev.c
- UBSAN: Undefined behaviour in drivers/input/mousedev.c
- UBSAN: Undefined behaviour in mm/page_alloc.c
- WARNING in pkt setup dev
- UBSAN: Undefined behaviour in drivers/net/ppp/ppp_generic.c
- KASAN: use-after-free Read in raw_cmd_done
- KMSAN: uninit-value in selinux_socket_bind, selinux_socket_connect_helper
- UBSAN: Undefined behaviour in drivers/block/floppy.c
- net: BUG still has locks held in unix_stream_splice_read
- general protection fault in sockfs_setattr CVE-2018-12232
- KASAN: slab out of bounds Write in __jfs_setxattr CVE-2018-12233
- RDMA/mlx5: Fix NULL dereference while accessing XRC_TGT QPslogin
- KASAN: use-after-free Read in set_page_dirty_lock
- System freeze and NULL pointer dereference
- RDS: WARNING in rds_recv_hs_exthdrs
- RDS: slab-out-of-bounds Read in rds_rdma_extra_size
- netfilter: fix out-of-bounds accesses in clusterip_tg_check()
- net: hang in unregister_netdevice: waiting for lo to become free
- scsi: sg: assorted memory corruptions
- kcm: memory leak in kcm_sendmsg
- AF_KEY: memory leak in key_notify_policy
- sctp: memory leak in sctp_endpoint_init
- tipc: memory leak in tipc_nl_node_get_link
- tun: memory leak in tun_set_iff
- net/8021q: memory leak in register_vlan_dev
- net: memory leak in socket
- scsi: memory leak in sg_start_req
- sunrpc: infinite unkillable console spam in xs_tcp_setup_socket
- fs: possible deadlock in do_iter_write/do_splice
- net/ipv6: warning in __alloc_pages_slowpath/ipip6_tunnel_get_prl
- net/ipv6: GPF in rt6_ifdown
- net/ipv4: trying to register non-static key in ip_mc_clear_src
- net/can: trying to register non-static key in can_rx_register
- net: general protection fault in deactivate_slab
- net/ipv4: use-after-free in add_grec
- net/ipv6: use-after-free in ip6_dst_ifdown
- tty: possible deadlock in tty_buffer_flush
- net/ipv6: general protection fault in skb_release_data CVE-2017-9242
- drivers/net/hamradio: divide error in hdlcdrv_ioctl
- tty: fix port buffer locking
- kvm: warning in kvm_load_guest_fpu
- drivers/scsi: GPF in sg_read
- net/ipv4: use-after-free in ip_mc_drop_socket CVE-2017-8890 CVE-2017-9075 CVE-2017-9076 CVE-2017-9077
- net/ipv6: GPF in rt6_device_match
- x86: warning: kernel stack regs has bad 'bp' value
- net/key: slab-out-of-bounds in pfkey_compile_policy
- net/ipv6: warning in inet6_ifa_finish_destroy
- net/ipv6: use-after-free in __call_rcu/in6_dev_finish_destroy_rcu
- net/ipv6: slab-out-of-bounds in ip6_tnl_xmit
- net/rose: null-ptr-deref in rose_route_frame
- time: hang due to timer_create/timer_settime
- net/core: BUG in unregister_netdevice_many
- net/xfrm: stack-out-of-bounds in xfrm_state_find
- net/bonding: stack-out-of-bounds in bond_enslave
- net: ipv6: RTF_PCPU should not be settable from userspace
- fs/notify/inotify: slab-out-of-bounds write in strcpy CVE-2017-7533
- net/ipv6: slab-out-of-bounds read in seg6_validate_srh
- kernel BUG at mm/hugetlb.c:742!
- net/key: slab-out-of-bounds in parse_ipsecrequests
- net/ipv4: use-after-free in ipv4_datagram_support_cmsg
- net/ipv4: use-after-free in ip_queue_xmit
- net: use-after-free in __ns_get_path
- net/ipv4: use-after-free in ip_check_mc_rcu
- net/ipv6: use-after-free in ipv6_sock_ac_close
- net/ipv4: use-after-free in ipv4_mtu
- net/dccp: BUG in tfrc_rx_hist_sample_rtt
- net/sctp: list double add warning in sctp_endpoint_add_asoc
- kvm: use-after-free in srcu_reschedule
- ata: WARNING in ata_bmdma_qc_issue
- net/sched: GPF in qdisc_hash_add
- sg: random memory corruptions
- fs: GPF in deactivate_locked_super
- loop: WARNING in sysfs_remove_group
- lib, fs, cgroup: WARNING in percpu_ref_kill_and_confirm
- ata: WARNING in ata_qc_issue
- security, hugetlbfs: write to user memory in hugetlbfs_destroy_inode
- netlink: NULL timer crash
- kvm: use-after-free function call in kvm_io_bus_destroy
- sound: use-after-free in snd_seq_cell_alloc
- usb: use-after-free write in usb_hcd_link_urb_to_ep
- net/kcm: double free of kcm inode
- crypto: out-of-bounds write in pre_crypt
- security: double-free in superblock_doinit
- kvm: WARNING in kvm_apic_accept_events
- tcp: fix potential double free issue for fastopen_req
- net/udp: slab-out-of-bounds Read in udp_recvmsg
- net: deadlock between ip_expire/sch_direct_xmit
- srcu: BUG in __synchronize_srcu
- net/sctp: recursive locking in sctp_do_peeloff
- kvm: WARNING in vmx_handle_exit
- futex: use-after-free in futex_wait_requeue_pi
- kvm/arm64: use-after-free in kvm_vm_ioctl/vmacache_update
- kvm/arm64: use-after-free in kvm_unmap_hva_handler/unmap_stage2_pmds
- local privilege escalation flaw in n_hdlc CVE-2017-2636
- netlink: GPF in netlink_unicast
- perf: use-after-free in perf_release
- net/ipv6: null-ptr-deref in ip6mr_sk_done
- bpf: kernel NULL pointer dereference in map_get_next_key
- crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex
- kvm: use-after-free in vmx_check_nested_events/vmcs12_guest_cr0
- sound: another deadlock in snd_seq_pool_done
- rcu: WARNING in rcu_seq_end
- fs: use-after-free in path_lookupat
- ucount: use-after-free read in inc_ucount & dec_ucount
- net/ipv4: division by 0 in tcp_select_window
- net: heap out-of-bounds in fib6_clean_node/rt6_fill_node/fib6_age/fib6_prune_clone
- mm: use-after-free in zap_page_range
- net/kcm: use-after-free in kcm_wq
- idr: use-after-free write in ida_get_new_above
- sg: stack out-of-bounds write in sg_write CVE-2017-7187
- cgroup: WARNING in cgroup_kill_sb
- net/rds: use-after-free in rds_find_bound/memcmp
- net: sleeping function called from invalid context in net_enable_timestamp
- net: use-after-free in neigh_timer_handler/sock_wfree
- net/sctp: use-after-free in sctp_association_put
- fs: use-after-free in userfaultfd_exit
- net/ipv4: inconsistent lock state in tcp_conn_request/inet_ehash_insert
- net/ipv4: suspicious RCU usage in ip_ra_control
- net/ipv4: deadlock in ip_ra_control
- net/dccp: dccp_create_openreq_child freed held lock
- nested_vmx_merge_msr_bitmap
- ipc: use-after-free in shm_get_unmapped_area
- sounds: deadlocked processed in snd_seq_pool_done
- net/atm: vcc_sendmsg calls kmem_cache_alloc in non-blocking context
- ata: WARNING in ata_sff_qc_issue
- net/rds: use-after-free in inet_create
- mm: fault in __do_fault
- kvm: WARNING in nested_vmx_vmexit
- net: GPF in rt6_nexthop_info
- sound: spinlock lockup in snd_timer_user_tinterrupt
- mm: GPF in bdi_put
- net/sctp: use-after-free in sctp_hash_transport
- net/bridge: warning in br_fdb_find
- net/ipv6: null-ptr-deref in ip6_route_del/lock_acquire
- net: possible deadlock in skb_queue_tail
- DCCP double-free vulnerability (local root) CVE-2017-6074
- net: warning in inet_sock_destruct
- net/pptp: use-after-free in dst_release
- net/udp: slab-out-of-bounds in udp_recvmsg/do_csum CVE-2017-6347
- WARNING in skb_warn_bad_offload
- tty: panic in tty_ldisc_restore
- net: BUG in __skb_gso_segment
- net/dccp: use-after-free in dccp_feat_activate_values
- net/kcm: GPF in kcm_sendmsg
- net/xfrm: stack out-of-bounds in xfrm_flowi_sport
- net/llc: BUG in llc_sap_state_process/skb_set_owner_r CVE-2017-6345
- net/llc: bug in llc_pdu_init_as_xid_cmd/skb_over_panic
- net/packet: use-after-free in packet_rcv_fanout
- net: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected in skb_array_produce
- net/ipv4: null-ptr-deref in udp_rmem_release/sk_memory_allocated_sub
- net/sctp: null-ptr-deref in sctp_put_port/sctp_endpoint_destroy
- net/ipv4: warning in nf_nat_ipv4_fn
- net/ipv6: double free in ipip6_dev_free
- sound: use-after-free in snd_seq_queue_alloc
- loop: divide error in transfer_xor
- net/xfrm: use of uninit spinlock in xfrm_policy_flush
- mm: double-free in cgwb_bdi_init
- packet: round up linear to header len
- net/icmp: null-ptr-deref in ping_v4_push_pending_frames
- net/kcm: WARNING in kcm_write_msgs
- tcp: avoid infinite loop in tcp_splice_read() CVE-2017-6214
- tun: read vnet_hdr_sz once
- macvtap: read vnet_hdr_size once
- udp: properly cope with csum errors
- ipv6: tcp: add a missing tcp_v6_restore_cb()
- ip6_gre: fix ip6gre_err() invalid reads CVE-2017-5897
- ipv4: keep skb->dst around in presence of IP options CVE-2017-5970
- net: use a work queue to defer net_disable_timestamp() work
- netlabel: out of bound access in cipso_v4_validate()
- ipv6: pointer math error in ip6_tnl_parse_tlv_enc_lim()
- net: heap out-of-bounds in ip6_fragment CVE-2017-9074
- tcp: fix 0 divide in __tcp_select_window()
- keys: GPF in request_key
- net/tcp: warning in tcp_try_coalesce/skb_try_coalesce
- crypto: NULL deref in sha512_mb_mgr_get_comp_job_avx2
- sound: unable to handle kernel paging request snd_seq_prioq_cell_out
- scsi: BUG in scsi_init_io
- mm: sleeping function called from invalid context shmem_undo_range
- timerfd: use-after-free in timerfd_remove_cancel
- scsi: use-after-free in sg_start_req
- mm: deadlock between get_online_cpus/pcpu_alloc
- BUG at net/sctp/socket.c:7425
- kvm: use-after-free in irq_bypass_register_consumer
- net: suspicious RCU usage in nf_hook
- kvm: fix page struct leak in handle_vmon CVE-2017-2596
- ipv6: fix ip6_tnl_parse_tlv_enc_lim()
- kvm: WARNING in mmu_spte_clear_track_bits
- perf: use-after-free in perf_event_for_each
- net: use-after-free in tw_timer_handler
- namespace: deadlock in dec_pid_namespaces
- sctp: kernel memory overwrite attempt detected in sctp_getsockopt_assoc_stats
- kvm: deadlock in kvm_vgic_map_resources
- net/atm: warning in alloc_tx/__might_sleep
- net/ipv6: use-after-free in sock_wfree
- kvm: kvm: BUG in loaded_vmcs_init
- kvm: NULL deref in vcpu_enter_guest
- kvm: use-after-free in complete_emulated_mmio CVE-2017-2584
- kvm: BUG in kvm_unload_vcpu_mmu
- x86: warning in unwind_get_return_address
- ipc: BUG: sem_unlock unlocks non-locked lock
- kvm: WARNING in mmu_spte_clear_track_bits
- sctp: suspicious rcu_dereference_check() usage in sctp_epaddr_lookup_transport
- kvm: use-after-free in process_srcu
- kvm: assorted bugs after OOMs
- kvm: deadlock between kvm_io_bus_register_dev/kvm_hv_set_msr_common
- netlink: GPF in netlink_dump
- fs, net: deadlock between bind/splice on af_unix
- net: use-after-free in worker_thread
- net: signed overflows in SO_{SND|RCV}BUFFORCE sockopts CVE-2016-9793 CVE-2012-6704
- net/can: warning in raw_setsockopt/__alloc_pages_slowpath
- net/ipv6: null-ptr-deref in ip6_rt_cache_alloc
- net/dccp: use-after-free in dccp_invalid_packet
- net/sctp: vmalloc allocation failure in sctp_setsockopt/xt_alloc_table_info
- net: BUG in unix_notinflight
- net: GPF in eth_header CVE-2016-9755
- net: deadlock on genl_mutex
- net: GPF in rt6_get_cookie
- netlink: GPF in sock_sndtimeo
- scsi: use-after-free in bio_copy_from_iter CVE-2016-9576
- net/udp: bug in skb_pull_rcsum
- net/icmp: null-ptr-deref in icmp6_send CVE-2016-9919
- net/can: use-after-free in bcm_rx_thr_flush
- kvm: slab-out-of-bounds write in __apic_accept_irq CVE-2016-9777
- mm: BUG in pgtable_pmd_page_dtor
- logfs: GPF in logfs_alloc_inode
- mm, floppy: unkillable task faulting on fd0
- kvm: deadlock between kvm_vm_ioctl_get_dirty_log/kvm_hv_set_msr_common/kvm_create_pit
- kvm: WARNING in em_jmp_far CVE-2016-9756
- kvm: WARNING in rtc_status_pending_eoi_check_valid
- kvm: GPF in kvm_ioapic_set_irq
- mm: BUG in munlock_vma_pages_range
- kvm: WARNING in kvm_arch_vcpu_ioctl_run
- kvm: use-after-free/GPF in kvm_irq_delivery_to_apic_fast
- kvm: out-of-bounds write in __rtc_irq_eoi_tracking_restore_one
- kvm: BUG in pte_list_remove
- kvm: recursive lock in kvm_clear_async_pf_completion_queue
- kvm: WARNING in em_ret_far
- kvm: GPF in irqfd_shutdown/eventfd_ctx_remove_wait_queue
- kvm: GPF in gfn_to_rmap
- kvm: paging fault in kvm_gfn_to_hva_cache_init
- kvm: suspicious RCU usage/missed lock in kvm_lapic_set_vapic_addr
- kvm: use-after-free in irq_bypass_register_consumer
- kvm: WARNING in kvm_load_guest_fpu
- kvm: GPF in kvm_pic_set_irq
- kvm: GPF in irq_bypass_unregister_consumer
- kvm: GPF in __get_kvmclock_ns
- kvm: WARNING In kvm_apic_accept_events
- kvm: WARNING in __x86_set_memory_region
- tcp: take care of truncations done by sk_filter()
- net/l2tp: use-after-free write in l2tp_ip6_close
- net/sctp: null-ptr-deref in sctp_inet_listen
- net/tcp: warning in tcp_recvmsg
- net/netlink: another global-out-of-bounds in genl_family_rcv_msg/validate_nla
- bpf: kernel BUG in htab_elem_free
- net/netlink: global-out-of-bounds in genl_family_rcv_msg/validate_nla
- net/ipv6: null-ptr-deref in inet6_bind
- net/dccp: null-ptr-deref in dccp_parse_options
- net/dccp: null-ptr-deref in dccp_v4_rcv/selinux_socket_sock_rcv_skb
- net/tcp: null-ptr-deref in __inet_lookup_listener/inet_exact_dif_match
- net/dccp: warning in dccp_feat_clone_sp_val/__might_sleep
- net/can: warning in bcm_connect/proc_register
- net/ipv4: warning in inet_sock_destruct
- net/sctp: slab-out-of-bounds in sctp_sf_ootb CVE-2016-9555
- net/dccp: warning in dccp_set_state
- net/netlink: bad unlock balance in netlink_diag_dump
- net/netlink: null-ptr-deref in netlink_dump/lock_acquire
- net/ipx: null-ptr-deref in ipxrtr_route_packet
- net/sctp: use-after-free in __sctp_connect
- fs: WARNING in locks_unlink_lock_ctx (not holding proper lock)
- kernel BUG in dio_get_page
- drm: GPF in drm_getcap
- fs: GPF in bd_mount
- tty, fbcon: use-after-free in fbcon_invert_region
- drm: NULL pointer dereference in drm_mode_object_find()
- 6pack: stack-out-of-bounds in sixpack_receive_buf
- logfs: GPF in logfs_init_inode
- tty: use-after-free in n_tty_receive_buf_fast
- sound: divide by 0 in snd_hrtimer_callback (or hang)
- mm: GPF in __insert_vmap_area
- fs, tty: WARNING in devpts_get_priv
- fanotify: unkillable hanged processes
- drm: GPF in drm_context_switch_complete
- drm: GPF in drm_legacy_lock_free
- sound: division by 0 in snd_hrtimer_callback
- perf: WARNING in perf_event_read
- drm: WARNING in drm_irq_by_busid
- dri: WARNING in idr_remove
- mm: use-after-free in collapse_huge_page
- kcm: use-after-free in fput of kcm socket
- bdev: fix NULL pointer dereference in sync()/close() race
- bdev: fix NULL pointer dereference
- BUG: sleeping function called from invalid context at mm/mempolicy.c:553
- use-after-free in ppp_unregister_channel
- net/tipc: NULL-ptr dereference in tipc_nl_publ_dump
- HID: i2c-hid: fix OOB write in i2c_hid_set_or_send_report()
- mm: memory corruption on mmput
- perf: WARNING in perf_event_read
- 9p2000.L stat/unlink race (WARNING: fs/inode.c:280 drop_nlink)
- mm: page fault in __do_huge_pmd_anonymous_page
- usb: memory allocation WARNING in hcd_buffer_alloc
- dccp: potential deadlock in dccp_v4_ctl_send_reset
- mm: GPF in find_get_pages_tag
- mm: BUG in page_move_anon_rmap
- block: GPF in get_task_ioprio
- tty: stall in n_tty_ioctl/inq_canon
- random: negative entropy/overflow: pool input count -40000
- bpf: use after free in array_map_alloc CVE-2016-4794
- kvm: use-after-free in kvm_irqfd_release
- kvm: GPF in kvm_lapic_set_tpr
- sound: use-after-free in hrtimer_cancel
- sound: hang in snd_timer_interrupt
- sound: deadlock involving snd_hrtimer_callback
- fs: GPF in locked_inode_to_wb_and_lock_list
- x86: bad pte in pageattr_test
- tty: memory leak in tty_open
- net: memory leak due to CLONE_NEWNET
- lockdep WARNING in get_online_cpus
- mm: BUG in khugepaged_scan_mm_slot
- sound: use-after-free in snd_timer_interrupt
- scsi: machine hang due to write to /dev/sg0
- AMD newest ucode 0x06000832 for Piledriver-based CPUs seems to behave in a problematic way
- sound: uninterruptible hang in snd_seq_oss_writeq_sync
- fs: uninterruptible hang in handle_userfault
- net: memory leak in N_6PACK driver
- net: memory leak in lapb_register
- net: memory leak in mkiss_open
- sound: list corruption in delete_and_unsubscribe_port
- kvm: GPF in kvm_pic_clear_all
- kvm: GPF in kvm_irq_map_gsi
- tty: memory leak in tty_register_driver
- sound: memory leak in snd_seq_pool_init
- tty: deadlock between tty_buffer_flush/n_tracesink_open
- sound: heap out-of-bounds write in dummy_systimer_prepare
- fs: NULL deref in atime_needs_update
- sound: spinlock lockup in snd_seq_oss_write
- net: memory leak in ip_cmsg_send
- net/irda: BUG: looking up invalid subclass: 4294967295 CVE-2017-6348
- sound: use-after-free in snd_timer_start1
- tty: tty_struct memory leak
- gigaset: memory leak in gigaset_initcshw
- sound: out-of-bounds write in snd_rawmidi_kernel_write1
- mm: uninterruptable tasks hanged on mmap_sem
- sound: another WARNING in rawmidi_transmit_ack
- sound: use-after-free in snd_seq_deliver_single_event
- sound: WARNING in snd_rawmidi_kernel_write1
- sound: deadlock between snd_pcm_oss_write/snd_pcm_oss_mmap
- ata: BUG in ata_sff_hsm_move
- WARNING in set_restore_sigmask
- BUG: bad unlock balance detected in vma_unlock_anon_vma
- bluetooth: use-after-free in vhci_send_frame
- mm: another VM_BUG_ON_PAGE(PageTail(page))
- scsi: NULL deref in sg_start_req
- mm: BUG in expand_downwards
- sound: heap out-of-bounds write in dummy_systimer_prepare
- WARNING in do_jobctl_trap
- mm: VM_BUG_ON_PAGE(PageTail(page)) in mbind
- net/bluetooth: workqueue destruction WARNING in hci_unregister_dev
- gpu: kmalloc size WARNING in vga_arb_write
- net/rfkill: WARNING in rfkill_fop_read
- sound: use-after-free in _snd_timer_stop
- net/irda: use-after-free in ircomm_param_request
- net/sctp: out-of-bounds access in sctp_add_bind_addr
- ext4: BUG: scheduling while atomic in ext4_commit_super
- sound: WARNING in snd_rawmidi_transmit_ack
- floppy: GPF in floppy_rb0_cb
- tty: kmalloc size WARNING in vc_do_resize
- mm: WARNING in __delete_from_page_cache
- sound: WARNING in snd_seq_oss_synth_cleanup
- sound: deadlock between snd_rawmidi_kernel_open/snd_seq_port_connect
- net: GPF in netlink_getsockbyportid
- fs: use-after-free in link_path_walk
- fs: sandboxed process brings host down
- net: use-after-free in recvmmsg
- struct pid memory leak
- net: WARNING in dccp_set_state
- mm: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected in split_huge_page_to_list
- sound: BUG in snd_ctl_find_numid
- net: GPF in __netlink_ns_capable
- crypto: slab-out-of-bounds in skcipher_recvmsg
- net: hang in ip_finish_output
- kvm: access to invalid memory in mmu_zap_unsync_children
- kvm: using uninitialized var in tdp_page_fault
- sound: spinlock lockup in sound/core/timer.c
- sound: GPF in snd_timer_user_params
- sound: use-after-free in snd_timer_interrupt
- sound: use-after-free in snd_timer_user_ioctl
- crypto: use-after-free in skcipher_sock_destruct
- net/sctp: use-after-free in __sctp_connect
- net: WARNING in tcp_recvmsg
- sound: use-after-free in snd_timer_stop
- sound: GPF in snd_seq_fifo_clear
- crypto: ablk_decrypt causes BUG in scatterwalk
- kvm: GPF in native_set_debugreg
- kvm: GPF in kvm_lapic_latched_init
- kvm: WARNING in kvm_apic_accept_events
- kvm: vmalloc allocation failure in kvm_vm_ioctl
- kvm: vmalloc allocation failure in kvm_vcpu_ioctl_set_cpuid
- kvm: WARNING in __x86_set_memory_region
- kvm: WARNING in exception_type
- mm: possible deadlock in mm_take_all_locks
- net/nfc: GPF in llcp_sock_getname
- net/netlink: memory leak in netlink_sendmsg
- net/tipc: memory leak in tipc_release
- memory leak in lapb_create_cb
- net/sctp: sctp_datamsg memory leak
- net/sctp: sock memory leak
- net/nfc: user-controllable kmalloc size in nfc_llcp_send_ui_frame
- tty: deadlock between n_tracerouter_receivebuf and flush_to_ldisc
- crypto: use-after-free in alg_bind
- crypto: deadlock in alg_setsockopt
- crypto: use-after-free in rng_recvmsg
- use-after-free in skcipher_bind
- 9p: sleeping function called from invalid context in v9fs_vfs_atomic_open_dotl
- fs: WARNING in locks_free_lock_context
- net: user-controllable kmalloc size in __sctp_setsockopt_connectx
- GPF in gf128mul_64k_bbe
- use-after-free in hash_sock_destruct
- GPF in lrw_crypt
- bad page state due to PF_ALG socket
- use-after-free in skcipher_sock_destruct
- use-after-free in sixpack_close
- net: heap-out-of-bounds in sock_setsockopt
- BUG_ON(!PageLocked(page)) in munlock_vma_page
- perf: stalls in perf_install_in_context/perf_remove_from_context
- Information leak in sco_sock_bind CVE-2015-8575
- Information leak in llcp_sock_bind/llcp_raw_sock_bind
- Information leak in pptp_bind
- use-after-free in pptp_connect
- GPF in keyctl CVE-2015-7550
- another use-after-free in sctp_do_sm
- use-after-free in inet6_destroy_sock
- WARNING in crypto_wait_for_test
- int overflow in io_getevents
- use-after-free in ip6_xmit
- use-after-free in __perf_install_in_context
- undefined shift in __bpf_prog_run
- signed integer overflow in ktime_add_safe
- jump label: negative count!
- memory leak in alloc_huge_page
- memory leak in do_ipv6_setsockopt
- heap out-of-bounds access in array_map_update_elem
- deadlock in perf_ioctl
- user-controllable kmalloc size in bpf syscall
- net: use after free in ip6_make_skb
- user-controllable kmalloc size in sctp_getsockopt_local_addrs
- use-after-free in ip6_setup_cork
- gigaset: freeing an active object
- Freeing active kobject in pps_device_destruct
- GPF in process_one_work (flush_to_ldisc)
- use-after-free in tty_check_change
- WARNING in tcp_recvmsg
- use-after-free in irtty_open
- use-after-free in sock_wake_async
- WARNING in handle_mm_fault
- WARNING in gsm_cleanup_mux
- use-after-free in sctp_do_sm
- yet another uninterruptable hang in sendfile
- GPF in add_key
- another uninterruptable hang in sendfile
- deadlock during fuseblk shutdown
- tty,net: use-after-free in x25_asy_open_tty
- deadlock between tty_write and tty_send_xchar
- WARNING in shmem_evict_inode
- Deadlock between setsockopt/getsockopt
- Deadlock between bind and splice
- Use-after-free in ipv4_conntrack_defrag
- Use-after-free in selinux_ip_postroute_compat
- Use-after-free in unshare
- GPF in tcp_sk_init/icmp_sk_init
- lockdep warning in ip_mc_msfget
- WARNING in task_participate_group_stop
- Resource leak in unshare
- Paging fault with hard IRQs disabled in getsockopt
- Unkillable processes due to PTRACE_TRACEME
- Use-after-free in ep_remove_wait_queue CVE-2013-7446
- GPF in shm_lock
- GPF in rt6_uncached_list_flush_dev
- Infinite loop in ip6_fragment
- Uninterruptable hang in sendfile
- GPF in keyring_destroy CVE-2015-7872