The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.

The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.

kernel: File descriptors passed over unix sockets are not properly accounted kernel: Information leak when truncating of compressed/inlined extents on BTRFS kernel: IPv6 connect causes DoS via NULL pointer dereference kernel: when NFSv4 migration is executed, kernel oops occurs at NFS client kernel: CXGB3: Logic bug in return code handling prematurely frees key structures causing Use after free or kernel panic. kernel: incorrect restoration of machine specific registers from userspace kernel: incorrect restoration of machine specific registers from userspace kernel: NULL dereference in RFCOMM bind callback kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature() kernel: race condition in the TLB flush logic kernel: Kernel memory leakage to ethernet frames due to buffer overflow in ethernet drivers kernel: double-free in usb-audio triggered by invalid USB descriptor kernel: pipe: limit the per-user amount of pages allocated in pipes kernel: Infinite loop vulnerability in KVM kernel: Null pointer dereference in trace_writeback_dirty_page() kernel: ipv4: denial of service when destroying a network interface kernel: ACPI table override allowed when securelevel is enabled kernel: use-after-free via crafted IPV6 sendmsg for raw / tcp / udp / l2tp sockets. kernel: Information leak in Linux sound module in timer.c kernel: Information leak in events in timer.c kernel: Slave being first propagated copy causes oops in propagate_mnt kernel: Use afte…

kernel: File descriptors passed over unix sockets are not properly accounted kernel: Information leak when truncating of compressed/inlined extents on BTRFS kernel: IPv6 connect causes DoS via NULL pointer dereference kernel: when NFSv4 migration is executed, kernel oops occurs at NFS client kernel: CXGB3: Logic bug in return code handling prematurely frees key structures causing Use after free or kernel panic. kernel: incorrect restoration of machine specific registers from userspace kernel: incorrect restoration of machine specific registers from userspace kernel: NULL dereference in RFCOMM bind callback kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature() kernel: race condition in the TLB flush logic kernel: Kernel memory leakage to ethernet frames due to buffer overflow in ethernet drivers kernel: double-free in usb-audio triggered by invalid USB descriptor kernel: pipe: limit the per-user amount of pages allocated in pipes kernel: Null pointer dereference in trace_writeback_dirty_page() kernel: ipv4: denial of service when destroying a network interface kernel: ACPI table override allowed when securelevel is enabled kernel: use-after-free via crafted IPV6 sendmsg for raw / tcp / udp / l2tp sockets. kernel: Information leak in Linux sound module in timer.c kernel: Information leak in events in timer.c kernel: Slave being first propagated copy causes oops in propagate_mnt kernel: Use after free in array_map_alloc kernel: Heap buff…

Security update for the Linux Kernel

Affected: Ubuntu:14.04:LTS: linux, Ubuntu:14.04:LTS: linux-lts-utopic, Ubuntu:14.04:LTS: linux-lts-vivid, Ubuntu:14.04:LTS: linux-lts-wily, Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-raspi2, Ubuntu:16.04:LTS: linux-snapdragon

The atl2_probe function in drivers/net/ethernet/atheros/atlx/atl2.c in the Linux kernel through 4.5.2 incorrectly enables scatter/gather I/O, which allows remote attackers to obtain sensitive information from kernel memory by reading packet data.