In the Linux kernel, the following vulnerability has been resolved:
bcachefs: Fix sbfielddowngrade validation
bch2sbdowngrade_validate() wasn't checking for a downgrade entry extending past the end of the superblock section
foreachdowngradeentry() is used in totext() and needs to work on malformed input; it also was missing a check for a field extending past the end of the section