An use after free flaw was found in the Linux kernel SCTP implementation handled auth keys reference counting during INIT collisions.

A remote user could use this flaw to crash the system or, though unlikely, escalate their privileges on the system.

Upstream patch:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=600ddd6825543962fb807884169e57b580dba208

Acknowledgements:

This issue was discovered by Sun Baoliang of Red Hat.

Buffer overflow in the lbsprocessbss function in drivers/net/wireless/libertas/scan.c in the libertas subsystem in the Linux kernel before 2.6.27.5 allows remote attackers to have an unknown impact via an "invalid beacon/probe response."

Buffer overflow in nfsd in the Linux kernel before 2.6.26.4, when NFSv4 is enabled, allows remote attackers to have an unknown impact via vectors related to decoding an NFSv4 acl.