-cxgb3: prevent reading uninitialized stack memory to fix xgb_extension_ioctl infoleak (Eugene Teo) [633153] {CVE-2010-3296}
-mlx4: disable MSI-X by default (Andy Gospodarek) [530596]
-ext3: call fs's invalidatepage instead of block_invalidatepage (Josef Bacik) [488611]
-av7110: check for negative array offset (Mauro Carvalho Chehab) [672400] {CVE-2011-0521}
-ext3: don't dirty unmapped data buffers (Josef Bacik) [488611]
-net: clear heap allocations for privileged ethtool actions (Jiri Pirko) [672431] {CVE-2010-4655}

-unix: fix local socket dos (Neil Horman) [656757 656758] {CVE-2010-4249}
-serial: clean data before filling it (Mauro Carvalho Chehab) [648808 648809]
-net: fix reception of completely page backed sk_buffs (Andy Gospodarek) [664667 500921]
-net: filter: make sure filters dont read uninitialized memory (Jiri Pirko) [651700 651701] {CVE-2010-4158}

-net: sctp: do not reset the packet during sctp_packet_config() (Jiri Pirko) [637864 637865] {CVE-2010-3432}

-netpoll: fix more local_bh_enable() related badness warnings and infinite loop (Neil Horman) [637729 516076]
-netpoll: fix badness warnings as bottom halves are enabled but interrupts are not (Neil Horman) [637729 516076]
-aio: check for multiplication overflow in io_submit (Jeff Moyer) [629446 629447] {CVE-2010-3067}
-fs: buffer.c: fix race in __block_prepare_write (Jeff Moyer) [633968 480404]
-net: fix info leak in police code (Neil Horman) [636389 636390] {CVE-2010-3477}
-udp: use memory barrier in datagram_poll (Flavio Leitner) [640117 546251]

- [misc] make compat_alloc_user_space incorporate access_ok (Don Howard) [634461 634462] {CVE-2010-3081}

-mm: keep a guard page below a grow-down stack segment (Don Howard) [607855 607856] {CVE-2010-2240}
-mm: accept an abutting stack segment (Don Howard) [607855 607856] {CVE-2010-2240}
-mm: fix up some user-visible effects of stack guard page (Don Howard) [607855 607856] {CVE-2010-2240}

-sky2: fix 88e803x transmit lockup on Yukon-FE chipset (Don Howard) [617353 614559]
-nfsd4: bug in read_buf when it is called to move over to next page (Jiri Olsa) [612032 612033] {CVE-2010-2521}
-cifs: fix a kernel BUG with remote OS/2 server (Eugene Teo) [608585 608586] {CVE-2010-2248}

-pci: fix reference to dev->bus->pad2 in pcix_set_mmrbc() (Dean Nelson) [596374 499355]
-pci: cleanup error return for pcix get and set mmrbc functions (Dean Nelson) [596374 499355]
-pci: fix access of pci_x_cmd by pcix get and set mmrbc functions (Dean Nelson) [596374 499355]
-pci: fix return value from pcix_get_max_mmrbc (Dean Nelson) [596374 499355]
-sctp: fix skb_over_panic from processing too many unknown params (Neil Horman) [584655 584656] {CVE2010-1173}
-kernel: keyrings: find_keyring_by_name() can gain the freed keyring (Vitaly Mayatskikh) [585097 585098] {CVE-2010-1437}
-virtio: net refill on out of memory (Herbert Xu) [597310 589897]
-net: pkt_sched: fix sfq qdisc crashes with limit of 2 packets (Jiri Pirko) [597312 587644]
-nfs: make sure client returns updated d_type info in getdents responses (Jeff Layton) [596372 577378]
-vfs: force reval of target when following last_bind symlinks (Jeff Layton) [533118 533119] {CVE-2009-3726}
-nfsv4: fix a problem whereby a buggy server can oops the kernel (Jeff Layton) [533118 533119] {CVE-2009-3726}
-nfsd4: move special stateid processing to nfs4_preprocess_stateid_op() (Jeff Layton) [597314 517162]
-nfsd4: move nfserr_openmode checking from nfsd_read/write into nfs4_preprocess_stateid_op() (Jeff Layton) [597314 517162]
-time drift due to incorrect accounting of lost ticks if tick_divider > 1 (Ulrich Obergfell) [590551 579716]
-jbd: properly discard freed buffers after commit (Josef Bacik) [589155 571546]

-net: fix an unexpectedly freed skb in tcp (Amerigo Wang) [577715 577716] {CVE-2010-1188}
-net: fixup problems with vlan tagging and bonding driver option arp_validate=3 (Jiri Pirko) [580842 555070]
-virtio_net: fix tx wakeup race condition (Herbert Xu) [580089 574785]
-vfs: turn bad_inode_ops into an inode_operations_ext (Jeff Layton) [582908 544381]
-oprofile: Support arch_perfmon in Oprofile (John Villalovos) [582913 553745]
-oprofile: Fix name collision issue in Oprofile (John Villalovos) [582913 553745]
-oprofile: Fixes for the perf counter reservation system in Oprofile (John Villalovos) [582913 553745]
-oprofile: Enable use of the perf counter reservation system into the oprofile driver (John Villalovos) [582913 553745]
-oprofile: final bits to support oprofile on Nehalem-EP (John Villalovos) [582241 509423]
-virt: fix i386 virtio driver crash (Chris Lalancette) [582911 509220]
-xen: fix pv guest crash when host has more than 64g ram (Chris Lalancette) [574392 504988]

-e1000e: fix broken wake up on LAN functionality due to other e1000e patch (Andy Gospodarek) [565496 558607]

-improved rx length check for r8169 (Neil Horman) [556406 550911]
-isdn: hfc_usb: fix read buffer overflow in collect_rx_frame() (Danny Feng) [539436 539437] {CVE-2009-4005}
-megaraid_sas: fix dbg_lvl and poll_mode_io file permissions in sysfs (Danny Feng) [537310 537311] {CVE-2009-3889 CVE-2009-3939}
-hfs: fix a potential buffer overflow (Amerigo Wang) [540738 540739] {CVE-2009-4020}
-gdth: prevent negative offsets in ioctl (Amerigo Wang) [539418 539419] {CVE-2009-3080}
-ptrace: ptrace_detach can leak a zombie (Oleg Nesterov) [555869 539506]
-strace: strace hangs when the mt tracee does coredump (Oleg Nesterov) [555869 539506]

-net: fix rx length check errors in e1000e (Cong Wang) [551218 551214] {CVE-2009-e1000e}
-net: fix rx length check errors in e1000 and r8169 (Neil Horman) [550910 550907] {CVE-2009-e1000} {CVE-2009-r8169}

-i8042: regression fix: disable and enable aux port at close (Mauro Carvalho Chehab) [537344 531192]
-r8169: balance pci_map/unmap pair, use hw padding (Ivan Vecera) [529141 529142] {CVE-2009-3613}
-forcedeth: add phy_power_down parameter, leave phy powered up by default (Ivan Vecera) [534112 532593]
-fusion: mptctl module dereferences a userspace address, triggering a crash (Rob Evers) [533798 528066]
-net: ipv4: make ip_append_data handle null routing table (Jiri Pirko) [537016 520299]
-bnx2x: fix bnx2x failing when iptables is on (Stanislaw Gruszka) [537013 527656]
-nlm: don't try to reclaim locks on -o nolock mounts (Jeff Layton) [537017 176848]

-fs: fix pipe null pointer dereference (Jeff Moyer) [530936 530937] {CVE-2009-3547}

-fix typo in "-net: netlink: fix numerous padding memleaks" (Jiri Pirko) [521602 521603] {CVE-2005-4881}

-execve: must clear current->clear_child_tid (Oleg Nesterov) [515427 515428] {CVE-2009-2848}
-kernel: fix information leak in do_sigaltstack() (Vitaly Mayatskikh) [515394 515395] {CVE-2009-2847}
-build with fno-delete-null-pointer-checks (Danny Feng) [517964 511183]
-lpfc: update emulex lpfc driver to 8.0.16.47 with memory leak fix (Rob Evers) [513192 507680]
-mpt fusion: fix typo in mpt fusion makefile (Tomas Henzl) [516184 496120]
-implement mmap_min_addr infrastructure (Vitaly Mayatskikh) [517904 512641]
-kernel: personality handling: fix per_clear_on_setid (Vitaly Mayatskikh) [511172 508843] {CVE-2009-1895}
-megaraid: fix megaraid SAS tape input/output errors on mt_erase (Tomas Henzl) [517965 504080]
-kernel: missing capability check in z90crypt (Hans-Joachim Picht) [505985 505986] {CVE-2009-1883}
-qla2xxx: fix hang when using management tools (Marcus Barrow) [519428 503489]
-kernel: random: make get_random_int more random (Amerigo Wang) [519692 499785]
-fix __ptrace_unlink and zap_threads interaction (Oleg Nesterov) [519446 506875]
-fix soft lockups due to infinite loops in posix_locks_deadlock (Amerigo Wang) [519429 504279]

-net: prevent null pointer dereference in udp_sendmsg (Vitaly Mayatskikh) [518041 518042] {CVE-2009-2698}

-Revert: eliminate deadlock with echo 1 > /proc/sys/vm/drop_caches (Larry Woodman) [505649 495861]

-agp: zero pages before sending to userspace (Jiri Olsa) [497023 497024] {CVE-2009-1192}
-agp: fix boot issue with agp zero pages patch (Jiri Olsa) [497023 497024] {CVE-2009-1192}
-e1000: fix skb_over_panic (Neil Horman) [502982 502983] {CVE-2009-1385}
-kernel: proc: avoid information leaks to non privileged processes (Amerigo Wang) [499549 499548]
-netpoll: bust poll_lock when doing netdump (Neil Horman) [504565 494688]

-nmi watchdog: fix LAPIC mode detection on cpus with supported performance counters (John Villalovos) [497330 491338]

-respin: added missing patches from build 78.0.15

-net: fix unix socket panic patch missing hunk (Neil Horman) [473267 473268] {CVE-2008-5300}

-pwc: fix kernel pwc driver dos (Eugene Teo) [308501 308511] {CVE-2007-5093}
-[s390] prevent ptrace padding area read write in 31 bit mode (Jarod Wilson) [437932 438148] {CVE-2008-1514}
-ext[234]: avoid printk floods in the face of directory corruption (Eric Sandeen) [459598 459599] {CVE-2008-3528}
-kernel: open call allows setgid bit when user is not in new file's group (Eugene Teo) [463685 463686] {CVE-2008-4210}
-cifs: fix o_append on directio mounts (Jeff Layton) [464494 461005]
-ixgbe: remove device id for unsupported device (Andy Gospodarek) [465735 456533]
-aacraid: remove quirk aac_quirk_scsi_32 for some controllers (Tomas Henzl) [468151 457552]
-mptfusion: mpt causes panic if a raid 1 is configured (Tomas Henzl) [465265 469236]
-cpufreq: support for affected_cpus (Brian Maly) [469647 465366]

-alsa: use proper mask for shared IRQ in hda_intel (Brian Maly) [456163 456155]
-kernel: randomize udp port allocation (Eugene Teo) [454569 454570] {CVE-2008-1447}
-usb: fix front usb ports on dell r805 (Pete Zaitcev) [456297 454479]
-Revert "sys_times: Fix system unresponsiveness during many concurrent invocation of sys_times" (Vivek Goyal) [455074 453507]
-Revert "Minor code cleanup to sys_times() call" (Vivek Goyal) [455074 453507]

-alsa: Fix mic not working for HP XW series (Brian Maly) [453783]

-[revert] sys_times: Fix system unresponsiveness during many concurrent invocation of sys_times (Vitaly Mayatskikh) [449101 435280]

-x8664: copy_user doesn't zero tail bytes on page fault (Vitaly Mayatskikh) [451273 451274]

-fix kabi breakage in 67.0.14

-x86_64: Prevent iounmap from sleeping with a spinlock held (Larry Woodman) [433267]

-fix filesystem corruption by unprivileged user via directory truncation (Vitaly Mayatskikh) [428794] {CVE-2008-0001}
-ia64: fix panic caused by set_mempolicy with MPOL_BIND (Vitaly Mayatskikh) [293201] {CVE-2007-4130}

-kernel ieee80211 off-by-two integer underflow (Anton Arapov) [346361] {CVE-2007-4997}
-fix for NFS attribute timeout handling (Fabio Leite) [371551]
-fix bad schedule_timeout() call causing excessive delay (Jonathan Brassow) [399661]
-do not return zero in mmap (Rik van Riel) [400811]
-fs: fix missing dput in do_lookup error case leaks dentries (Eric Sandeen) [363461] {CVE-2007-5494}
-s390: fix LTC39618-kernel panic making lcs interfaces online on LPAR (Hans-Joachim Picht) [400801]
-x86_64: Fix incorrect logic in AMD NMI code (Prarit Bhargava) [404741]
-scsi: fix diskdump performance regression on mpt fustion driver (Takao Indoh) [404781]

- update: deadlock from recursive call through netpoll_send_skb (Neil Horman) [328351]
- fix machine check errors with Clovertown G0-step CPU (Geoff Gustafson) [320791]
- fix disable block layer bouncing for most memory on 64bit systems (Jim Paradis) [330111]

- revert: all patches from 2.6.9-55.0.7

-revert: autofs4 fix for race between mount and expire [248126]

-cciss: fix size calculation in diskdump (Bryn Reeves) [243902]

-fix key serial number collision problem (David Howells) [227495] {CVE-2007-0006}
-fix audit panic on watched files (Eric Paris) [223129] {CVE-2007-0001}

-fix ext2 readdir f_pos revalidation logic (David Milburn) [193877]

-fix mprotect to not allow permission subversion (Jason Baron) [190073] {CVE-2006-2071}
-fix sys_perfmonctl() file descriptor reference count issue (Anil Keshavamurthy) [204360] {CVE-2006-3741}
-Fix hugepage crash on failing mmap (Larry Woodman) [165345] {CVE-2005-4811}
-sctp: create abort messages properly (Neil Horman) [204460] {CVE-2006-4535}
-fix oops occuring from malformed ULE packet (Neil Horman) [204912] {CVE-2006-4623}
-ipw2[12]00: restore get_wireless_stats pointer (John Linville) [198820]
-ipw2200: accept broadcast MAC traffic (John Linville) [203421]
-fix netfilter do_add_counters race (Thomas Graf) [191698] {CVE-2006-0039}
-fix ip over atm clip_mkip may dereference freed pointer (Thomas Graf) [206265]
-ppc64: Clear EN_ATTN bit in PPC970 HID0 (David Woodhouse) [201684] {CVE-2006-4093}

-sctp: Fix data overflow in iovec computation (Neil Horman) [202122]

-restrict prctl() syscall to setting PR_SET_DUMPABLE to 0 or 1 (Ernie Petrides) [195902] {CVE-2006-2451}

-ipv6: fix possible infinite loop condition (Thomas Graf) [170772] {CVE-2005-2973}
-fix incorrect inrement/decrement in atm module (Thomas Graf) [175769] {CVE-2005-3359}
-fix for ELF exec vulnerability on EM64T (Ernie Petrides) [183489 175663] {CVE-2006-0741 CVE-2006-0744}
-Keys: Fix oops when adding key to non-keyring (David Howells) [188466] {CVE-2006-1522}
-fix lsof causes kernel oops under heavy load (Adam Stokes) [189260]
-nfs: fix client panic using O_DIRECT (Steve Dickson) [181795] {CVE-2006-0555}
-Fix panic in ip_route_input() via inet_rtm_getroute() (Thomas Graf) [189346] {CVE-2006-1525}
-LSM: add missing hooks to readv/writev (James Morris) [191524]
-fix smbfs chroot issue (Peter Staubach) [189435] {CVE-2006-1864}
-sctp: fix fixes for various vulnerabilities (Neil Horman) [191201 191202 191258] {CVE-2006-2271 CVE-2006-2272 CVE-2006-2274}
-fix local crash by dio/mmap sg/st driver (Doug Ledford) [168791]
-remove incorrect choose_new_parent BUG() call (Jason Baron) [187841]
-fix bridge poisoning (Thomas Graf) [171383] {CVE-2005-3272}
-netfilter/sctp: fix lockup in sctp_new (Thomas Graf) [190460] {CVE-2006-1527}

-Resolve ACPI SCI sharing and IRQ re-assignment (Peter Martuccelli) [182387]

-prevent panic caused by invalid arguments to set_mempolicy (Larry Woodman) [175683] {CVE-2005-3358}
-fix auto-reap DoS (Peter Staubach) [174078] {CVE-2005-3784}
-fix kernel memory disclosure via /proc exploit (Jason Baron) [176812] {CVE-2005-4605}