- xen/xenbus: don't let xenbus_grant_ring() remove grants in error case {CVE-2022-23040} - xen/xenbus: Fix granting of vmalloc'd memory - xen/blkfront: don't use gnttab_query_foreign_access() for mapped status {CVE-2022-23036} - xen/grant-table: add gnttab_try_end_foreign_access() {CVE-2022-23036} - xen/blkfront: don't trust the backend response data blindly - xen/blkfront: don't take local copy of a request from the ring page - xen/blkfront: read response from backend only once - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128} - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128} - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4128} - media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 {CVE-2022-45919} - media: dvb-core: Fix use-after-free due on race condition at dvb_net {CVE-2022-45886} - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283} - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() {CVE-2023-4387} - tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() {CVE-2022-1462} - tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() - mmu_gather: Force tlb-flush VM_PFNMAP vmas {CVE-2022-39188} - net/sched: cls_u32: Fix reference counter leak leading to overflow {CVE-2023-3609} - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE {CVE-2023-3117} - relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268} - xfs: verify buffer contents when we skip log replay {CVE-2023-2124} - netfilter: nf_tables: stricter validation of element data {CVE-2022-34918} - tpm: fix reference counting for struct tpm_chip {CVE-2022-2977} - drm/virtio: Fix compile warnings (ents/nents) {CVE-2023-22998} - drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling {CVE-2023-22998} - drm/virtio: Fix NULL vs IS_ERR checking in virtio_gpu_object_shmem_init {CVE-2023-22998} - gfs2: Don't deref jdesc in evict {CVE-2023-3212} - drm/i915/gvt: fix double free bug in split_2MB_gtt_entry {CVE-2022-3707} - drm/amdkfd: Check for null pointer after calling kmemdup {CVE-2022-3108} - hv_netvsc: Add check for kvmalloc_array {CVE-2022-3107} - sfc_ef100: potential dereference of null pointer {CVE-2022-3106} - RDMA/uverbs: Check for null return of kmalloc_array {CVE-2022-3105} - drm: use the lookup lock in drm_is_current_master {CVE-2022-1280} - drm: add a locked version of drm_is_current_master {CVE-2022-1280} - drm: serialize drm_file.master with a new spinlock {CVE-2022-1280} - drm/vmwgfx: fix potential UAF in vmwgfx_surface.c {CVE-2022-1280} - drm: protect drm_master pointers in drm_lease.c {CVE-2022-1280} - KVM: avoid NULL pointer dereference in kvm_dirty_ring_push {CVE-2022-1263}