The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.

The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.

kernel-debug-4.8.13-1.1 on GA media

kernel: race condition in the TLB flush logic kernel: double-free in usb-audio triggered by invalid USB descriptor kernel: scsi: aacraid: double fetch in ioctl_send_fib() kernel: Stack corruption while reading /proc/keys when gcc stack protector is enabled kernel: Setting a POSIX ACL via setxattr doesn't clear the setgid bit kernel: net: Out of bounds stack read in memcpy_fromiovec kernel: Use after free in SCSI generic device interface kernel: Use after free in SCSI generic device interface (CVE-2016-9576 regression) kernel - IPV6 fragmentation flaw kernel: S_ISGD is not cleared when setting posix ACLs in tmpfs (CVE-2016-7097 incomplete fix)

Security update for the Linux Kernel

Affected: Ubuntu:14.04:LTS: linux-lts-xenial, Ubuntu:16.04:LTS: linux, Ubuntu:16.04:LTS: linux-aws, Ubuntu:16.04:LTS: linux-hwe, Ubuntu:16.04:LTS: linux-raspi2, Ubuntu:16.04:LTS: linux-snapdragon

The blk_rq_map_user_iov function in block/blk-map.c in the Linux kernel before 4.8.14 does not properly restrict the type of iterator, which allows local users to read or write to arbitrary kernel memory locations or cause a denial of service (use-after-free) by leveraging access to a /dev/sg device.