kernel: multiple vulnerabilities

From the Debian advisory:

CVE-2015-8816 - A use-after-free vulnerability was discovered in the USB hub driver. This may be used by a physically present user for privilege escalation.

CVE-2015-8830 - Ben Hawkes of Google Project Zero reported that the AIO interface permitted reading or writing 2 GiB of data or more in a single chunk, which could lead to an integer overflow when applied to certain filesystems, socket or device types. The full security impact has not been evaluated.

CVE-2016-2543 - Dmitry Vyukov found that the core sound sequencer driver (snd-seq) lacked a necessary check for a null pointer, allowing a user with access to a sound sequencer device to cause a denial-of- service (crash).

CVE-2016-2544, CVE-2016-2546, CVE-2016-2547, CVE-2016-2548 - Dmitry Vyukov found various race conditions in the sound subsystem (ALSA)'s management of timers. A user with access to sound devices could use these to cause a denial-of-service (crash or hang) or possibly for privilege escalation.

CVE-2016-2545 - Dmitry Vyukov found a flaw in list manipulation in the sound subsystem (ALSA)'s management of timers. A user with access to sound devices could use this to cause a denial-of-service (crash or hang) or possibly for privilege escalation.

CVE-2016-2549 - Dmitry Vyukov found a potential deadlock in the sound subsystem (ALSA)'s use of high resolution timers. A user with access to sound devices could use this to cause a denial-of-service (hang).