Multiple integer overflows in the (1) agp_allocate_memory and (2) agp_create_user_memory functions in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allow local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via vectors related to calls that specify a large number of memory pages.

Multiple integer overflows in the (1) agp_allocate_memory and (2) agp_create_user_memory functions in drivers/char/agp/generic.c in the Linux kernel before 2.6.38.5 allow local users to trigger buffer overflows, and consequently cause a denial of service (system crash) or possibly have unspecified other impact, via vectors related to calls that specify a large number of memory pages.

kernel: IB/uverbs: Handle large number of entries in poll CQ kernel: panic in ib_cm:cm_work_handler kernel: xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 kernel: IB/uverbs: Handle large number of entries in poll CQ kernel signal spoofing issue kernel: sctp: fix to calc the INIT/INIT-ACK chunk length correctly to set kernel: net: Fix memory leak/corruption on VLAN GRO_DROP kernel: proc: signedness issue in next_pidmap() kernel: agp: insufficient pg_start parameter checking in AGPIOC_BIND and AGPIOC_UNBIND ioctls kernel: agp: insufficient page_count parameter checking in agp_allocate_memory() kernel: validate size of EFI GUID partition entries kernel: xen: vmx: insecure cpuid vmexit kernel: agp: insufficient pg_start parameter checking in AGPIOC_BIND and AGPIOC_UNBIND ioctls kernel: inet_diag: insufficient validation kernel: bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace

Security update for Kernel