MGASA-2021-0348

This kernel-linus update is based on upstream 5.10.48 and fixes at least the following security issues:

The Linux kernel through 5.8.13 does not properly enforce the Secure Boot Forbidden Signature Database (aka dbx) protection mechanism. This affects certs/blacklist.c and certs/system_keyring.c (CVE-2020-26541).

An issue was discovered in Linux: KVM through Improper handling of VMIO| VMPFNMAP vmas in KVM can bypass RO checks and can lead to pages being freed while still accessible by the VMM and guest. This allows users with the ability to start and control a VM to read/write random pages of memory and can result in local privilege escalation (CVE-2021-22543).

kernel/module.c in the Linux kernel before 5.12.14 mishandles Signature Verification. Without CONFIGMODULESIG, verification that a kernel module is signed, for loading via initmodule, does not occur for a module.sigenforce=1 command-line argument (CVE-2021-35039).

For other upstream fixes, see the referenced changelogs.