The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.

The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.

kernel: kvm: reporting emulation failures to userspace kernel: File descriptors passed over unix sockets are not properly accounted kernel: kvm: reporting emulation failures to userspace kernel: x86: espfix not working for 32-bit KVM paravirt guests kernel: buffer overflow with fraglist larger than MAX_SKB_FRAGS + 2 in virtio-net kernel: Mounting ext2 fs e2fsprogs/tests/f_orphan as ext4 crashes system kernel: MTU value is not validated in IPv6 stack causing packet loss kernel: Null pointer dereference when mounting ext4 kernel: IPv6 connect causes DoS via NULL pointer dereference kernel: use-after-free via crafted IPV6 sendmsg for raw / tcp / udp / l2tp sockets.

kernel: File descriptors passed over unix sockets are not properly accounted kernel: Information leak when truncating of compressed/inlined extents on BTRFS kernel: IPv6 connect causes DoS via NULL pointer dereference kernel: when NFSv4 migration is executed, kernel oops occurs at NFS client kernel: CXGB3: Logic bug in return code handling prematurely frees key structures causing Use after free or kernel panic. kernel: incorrect restoration of machine specific registers from userspace kernel: incorrect restoration of machine specific registers from userspace kernel: NULL dereference in RFCOMM bind callback kernel: Kernel panic and system lockup by triggering BUG_ON() in public_key_verify_signature() kernel: race condition in the TLB flush logic kernel: Kernel memory leakage to ethernet frames due to buffer overflow in ethernet drivers kernel: double-free in usb-audio triggered by invalid USB descriptor kernel: pipe: limit the per-user amount of pages allocated in pipes kernel: Infinite loop vulnerability in KVM kernel: Null pointer dereference in trace_writeback_dirty_page() kernel: ipv4: denial of service when destroying a network interface kernel: ACPI table override allowed when securelevel is enabled kernel: use-after-free via crafted IPV6 sendmsg for raw / tcp / udp / l2tp sockets. kernel: Information leak in Linux sound module in timer.c kernel: Information leak in events in timer.c kernel: Slave being first propagated copy causes oops in propagate_mnt kernel: Use afte…

Security update for the Linux Kernel

Affected: Ubuntu:14.04:LTS: linux, Ubuntu:14.04:LTS: linux-lts-utopic, Ubuntu:14.04:LTS: linux-lts-vivid, Ubuntu:14.04:LTS: linux-lts-wily

The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call.