The kernel packages contain the Linux kernel, the core of any Linux operating system. Security fixes: * a NULL pointer dereference flaw was found in the sctp_rcv_ootb function in the Linux kernel Stream Control Transmission Protocol implementation. A remote attacker could send a specially-crafted SCTP packet to a target system, resulting in a denial of service. * a missing boundary check was found in the do_move_pages function in the memory migration functionality in the Linux kernel. A local user could use this flaw to cause a local denial of service or an information leak. * a NULL pointer dereference flaw was found in the ip6_dst_lookup_tail function in the Linux kernel. An attacker on the local network could trigger this flaw by sending IPv6 traffic to a target system, leading to a system crash if dst->neighbour is NULL on the target system when receiving an IPv6 packet. * a NULL pointer dereference flaw was found in the ext4 file system code in the Linux kernel. A local attacker could use this flaw to trigger a local denial of service by mounting a specially-crafted, journal-less ext4 file system, if that file system forced an EROFS error. * an information leak was found in the print_fatal_signal implementation in the Linux kernel. When "/proc/sys/kernel/print-fatal-signals" is set to 1 , memory that is reachable by the kernel could be leaked to user-space. This issue could also result in a system crash. Note that this flaw only affected the i386 architecture. * missing capability checks were found in the ebtables implementation, used for creating an Ethernet bridge firewall. This could allow a local, unprivileged user to bypass intended capability restrictions and modify ebtables rules. Bug fixes: * a bug prevented Wake on LAN being enabled on certain Intel hardware. * a race issue in the Journaling Block Device. * programs compiled on x86, and that also call sched_rr_get_interval, were silently corrupted when run on 64-bit systems. * the RHSA-2010:0019 update introduced a regression, preventing WoL from working for network devices using the e1000e driver. * adding a bonding interface in mode balance-alb to a bridge was not functional. * some KVM guests experienced slow performance after suspend/resume. * on some systems, VF cannot be enabled in dom0. * on systems with certain network cards, a system crash occurred after enabling GRO. * for x86 KVM guests with pvclock enabled, the boot clocks were registered twice, possibly causing KVM to write data to a random memory area during the guest"s life. * serious performance degradation for 32-bit applications, that map thousands of small files, when run on a 64-bit system. * improved kexec/kdump handling. Previously, on some systems under heavy load, kexec/kdump was not functional. * dom0 was unable to boot when using the Xen hypervisor on a system with a large number of logical CPUs. * a fix for a bug that could potentially cause file system corruption. * a bug caused infrequent cluster issues for users of GFS2. * gfs2_delete_inode failed on read-only file systems. Users should upgrade to these updated packages, which contain backported patches to correct these issues. The system must be rebooted for this update to take effect.