kernel: multiple vulnerabilities

A flaw was found in the CXGB3 kernel driver when the network was considered congested. The kernel would incorrectly misinterpret the congestion as an error condition and incorrectly free/clean up the skb. When the device would then send the skb's queued, these structures would be referenced and may panic the system or allow an attacker to escalate privileges in a use-after-free scenario. (CVE-2015-8812)

When ctx access is used, the kernel often needs to expand/rewrite instructions, so after that patching, branch offsets have to be adjusted for both forward and backward jumps in the new eBPF program, but for backward jumps it fails to account the delta. Meaning, for example, if the expansion happens exactly on the insn that sits at the jump target, it doesn't fix up the back jump offset. (CVE-2016-2383)

A vulnerability was found in the Linux kernel. There is a possibility of double-free on 'umidi' object. The 'umidi' object will be free'd on the error path by snd_usbmidi_free() when tearing down the rawmidi interface causing the system panic. (CVE-2016-2384)

A flaw was found in the Linux kernel's hugetlbfs handling of punching holes in hugetlbfs files with either truncate or fallocate. When truncating a hugetlbfs file, this bug could prevent some pages from being unmapped. If pages are not properly unmapped during truncate, the kernel bug is hit which leads the system to panic. In the fallocate hole punch case, this bug could prevent pages from being unmapped as in the truncate case also. However, for hole punch the result is that unmapped pages will not be removed during the operation. For hole punch, it is also possible that more pages than desired will be unmapped. This unnecessary unmapping will cause page faults to reestablish the mappings on subsequent page access. (CVE-2016-0617)