In the Linux kernel, the following vulnerability has been resolved:

net: macb: drop in-flight Tx SKBs on close

The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue->txskb which gets freed without remorse nor checking.

macbfreeconsistent() gets called in a few codepaths, but only close will trigger the added expressions. In macbopen() and macballocconsistent() failure cases, queues' txskb just got allocated and are empty.

In the Linux kernel, the following vulnerability has been resolved:

USB: serial: keyspan: fix missing indat transfer sanity check

Add the missing sanity check on the size of usa49wg indat transfers to avoid parsing stale or uninitialised slab data.