Release v4.4.302-cip101
Hi,
the CIP kernel team has released Linux kernel v4.4.302-cip101. The linux-4.4.y-cip tree's base version has been updated to v4.4-st66. The trees are up-to-date with kernel 4.19-st6.
You can get this release via the git tree or as a tarball from https://mirrors.edge.kernel.org/pub/linux/kernel/projects/cip/4.4/
v4.4.302-cip101:
repository:
https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip.git
branch:
linux-4.4.y-cip
commit hash:
4668c6cf3c626dd03cd2211a68e6b01b322891d5
Fixed CVEs:
CVE-2023-53140: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
CVE-2024-49903: jfs: Fix uaf in dbFreeBits
CVE-2022-21546: scsi: target: Fix WRITE_SAME No Data Buffer crash
CVE-2022-48828: NFSD: Fix ia_size underflow
CVE-2022-48829: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
CVE-2025-37923: tracing: Fix oob write in trace_seq_to_buffer()
CVE-2025-37990: wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage()
CVE-2025-37995: module: ensure that kobject_put() is safe for module type kobjects
CVE-2025-37998: openvswitch: Fix unsafe attribute parsing in output_userspace()
CVE-2025-38037: vxlan: Annotate FDB data races
CVE-2025-38051: smb: client: Fix use-after-free in cifs_fill_dirent
CVE-2025-38058: __legitimize_mnt(): check for MNT_SYNC_UMOUNT should be under mount_lock
CVE-2025-38061: net: pktgen: fix access outside of user given buffer in pktgen_thread_write()
CVE-2025-38066: dm cache: prevent BUG_ON by blocking retries on failed device resumes
CVE-2025-38075: scsi: target: iscsi: Fix timeout on deleted connection
CVE-2025-38079: crypto: algif_hash - fix double free in hash_accept
CVE-2025-38086: net: ch9200: fix uninitialised access during mii_nway_restart
CVE-2025-38103: HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse()
CVE-2025-38115: net_sched: sch_sfq: fix a potential crash on gso_skb handling
CVE-2025-38157: wifi: ath9k_htc: Abort software beacon handling if disabled
CVE-2025-38180: net: atm: fix /proc/net/atm/lec handling
CVE-2025-38185: atm: atmtcp: Free invalid length skb in atmtcp_c_send().
CVE-2025-38194: jffs2: check that raw node were preallocated before writing summary
CVE-2025-38200: i40e: fix MMIO write access to an invalid page in i40e_clear_hw
CVE-2025-38203: jfs: Fix null-ptr-deref in jfs_ioc_trim
CVE-2025-38204: jfs: fix array-index-out-of-bounds read in add_missing_indices
CVE-2025-38212: ipc: fix to protect IPCS lookups using RCU
CVE-2025-38213: vgacon: Add check for vc_origin address range in vgacon_scroll()
CVE-2025-38222: ext4: inline: fix len overflow in ext4_prepare_inline_data
CVE-2025-38237: media: platform: exynos4-is: Add hardware sync wait to fimc_is_hw_change_mode()
CVE-2025-38286: pinctrl: at91: Fix possible out-of-boundary access
CVE-2025-38312: fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod()
CVE-2025-38323: net: atm: add lec_mutex
CVE-2025-38324: mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu().
CVE-2025-38328: jffs2: check jffs2_prealloc_raw_node_refs() result in few other places
CVE-2025-38336: ata: pata_via: Force PIO for ATAPI devices on VT6415/VT6330
CVE-2025-38344: ACPICA: fix acpi parse and parseext cache leaks
CVE-2025-38345: ACPICA: fix acpi operand cache leak in dswstate.c
CVE-2025-38348: wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()
CVE-2025-38352: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
CVE-2025-38415: Squashfs: check return result of sb_min_blocksize
CVE-2025-38416: NFC: nci: uart: Set tty->disc_data only in success path
CVE-2025-38420: wifi: carl9170: do not ping device which has failed to load firmware
CVE-2025-38428: Input: ims-pcu - check record size in ims_pcu_flash_firmware()
Best regards,
Ulrich Hecht