Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.

Integer signedness error in the drm_modeset_ctl function in (1) drivers/gpu/drm/drm_irq.c in the Direct Rendering Manager (DRM) subsystem in the Linux kernel before 2.6.38 and (2) sys/dev/pci/drm/drm_irq.c in the kernel in OpenBSD before 4.9 allows local users to trigger out-of-bounds write operations, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via a crafted num_crtcs (aka vb_num) structure member in an ioctl argument.

kernel: inotify memory leak kernel: CAN info leak kernel: IB/uverbs: Handle large number of entries in poll CQ kernel: ima: fix add LSM rule bug kernel: xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 kernel: ALSA: caiaq - Fix possible string-buffer overflow kernel: proc: protect mm start_code/end_code in /proc/pid/stat kernel: drm_modeset_ctl signedness issue kernel: drm/radeon/kms: check AA resolve registers on r300 kernel: CAP_SYS_MODULE bypass via CAP_NET_ADMIN kernel: IB/uverbs: Handle large number of entries in poll CQ kernel: bnep device field missing NULL terminator kernel: ebtables stack infoleak kernel: dccp: fix oops on Reset after close kernel: sctp: fix to calc the INIT/INIT-ACK chunk length correctly to set

Security update for Kernel