Summary
[5.4.17-2136.350.3.1]
- Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38744458]
- fbcon: fix integer overflow in font allocation (Samasth Norway Ananda) [Orabug: 38744453]
[5.4.17-2136.350.3]
- net/rds: Fix rs_recv_pending counting issue (Gerd Rausch) [Orabug: 38506370]
[5.4.17-2136.350.2]
- LTS tag: v5.4.301 (Alok Tiwari)
- net: rtnetlink: fix module reference count leak issue in rtnetlink_rcv_msg (Zhengchao Shao)
- media: s5p-mfc: remove an unused/uninitialized variable (Arnd Bergmann)
- NFSD: Fix last write offset handling in layoutcommit (Sergey Bashirov)
- NFSD: Minor cleanup in layoutcommit processing (Sergey Bashirov)
- padata: Reset next CPU when reorder sequence wraps around (Xiao Liang)
- KEYS: trusted_tpm1: Compare HMAC values in constant time (Eric Biggers)
- NFSD: Define a proc_layoutcommit for the FlexFiles layout type (Chuck Lever) [Orabug: 38601819] {CVE-2025-40087}
- vfs: Don't leak disconnected dentries on umount (Jan Kara) [Orabug: 38601924] {CVE-2025-40105}
- jbd2: ensure that all ongoing I/O complete before freeing blocks (Zhang Yi)
- ext4: detect invalid INLINE_DATA + EXTENTS flag combination (Deepanshu Kartikey) [Orabug: 38649223] {CVE-2025-40167}
- drm/amdgpu: use atomic functions with memory barriers for vm fault info (Gui-Dong Han)
- ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() (Theodore Ts'O) [Orabug: 38649412] {CVE-2025-40198}
- spi: cadence-quadspi: Flush posted register writes before DAC access (Pratyush Yadav)
- spi: cadence-quadspi: Flush posted register writes before INDAC access (Pratyush Yadav)
- memory: samsung: exynos-srom: Fix of_iomap leak in exynos_srom_probe (Zhen Ni)
- memory: samsung: exynos-srom: Correct alignment (Krzysztof Kozlowski)
- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Rutland)
- arm64: cputype: Add Neoverse-V3AE definitions (Mark Rutland)
- comedi: fix divide-by-zero in comedi_buf_munge() (Deepanshu Kartikey)
- binder: remove 'invalid inc weak' check (Alice Ryhl)
- xhci: dbc: enable back DbC in resume if it was enabled before suspend (Mathias Nyman)
- usb/core/quirks: Add Huawei ME906S to wakeup quirk (Tim Guttzeit)
- USB: serial: option: add Telit FN920C04 ECM compositions (Li Qingwu)
- USB: serial: option: add Quectel RG255C (Reinhard Speyerer)
- USB: serial: option: add UNISOC UIS7720 (Renjun Wang)
- net: ravb: Ensure memory write completes before ringing TX doorbell (Lad Prabhakar)
- net: usb: rtl8150: Fix frame padding (Michal Pecio)
- ocfs2: clear extent cache after moving/defragmenting extents (Deepanshu Kartikey) [Orabug: 38730547] {CVE-2025-40233}
- MIPS: Malta: Fix keyboard resource preventing i8042 driver from registering (Maciej W. Rozycki)
- Revert 'cpuidle: menu: Avoid discarding useful information' (Rafael J. Wysocki)
- net: bonding: fix possible peer notify event loss or dup issue (Tonghao Zhang)
- sctp: avoid NULL dereference when chunk data buffer is missing (Alexey Simakov) [Orabug: 38730567] {CVE-2025-40240}
- arm64, mm: avoid always making PTE dirty in pte_mkwrite() (Huang, Ying)
- net: enetc: correct the value of ENETC_RXB_TRUESIZE (Wei Fang)
- rtnetlink: Allow deleting FDB entries in user namespace (Johannes Wiesboeck)
- net: rtnetlink: add NLM_F_BULK support to rtnl_fdb_del (Nikolay Aleksandrov)
- net: add ndo_fdb_del_bulk (Nikolay Aleksandrov)
- net: rtnetlink: add bulk delete support flag (Nikolay Aleksandrov)
- net: netlink: add NLM_F_BULK delete request modifier (Nikolay Aleksandrov)
- net: rtnetlink: use BIT for flag values (Nikolay Aleksandrov)
- net: rtnetlink: add helper to extract msg type's kind (Nikolay Aleksandrov)
- net: rtnetlink: add msg kind names (Nikolay Aleksandrov)
- net: rtnetlink: remove redundant assignment to variable err (Colin Ian King)
- m68k: bitops: Fix find_*_bit() signatures (Geert Uytterhoeven)
- hfsplus: return EIO when type of hidden directory mismatch in hfsplus_fill_super() (Yangtao Li)
- hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() (Viacheslav Dubeyko)
- dlm: check for defined force value in dlm_lockspace_release (Alexander Aring)
- hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() (Viacheslav Dubeyko)
- hfs: validate record offset in hfsplus_bmap_alloc (Yang Chenzhi)
- hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() (Viacheslav Dubeyko)
- hfs: make proper initalization of struct hfs_find_data (Viacheslav Dubeyko)
- hfs: clear offset and space out of valid records in b-tree node (Viacheslav Dubeyko)
- exec: Fix incorrect type for ret (Xichao Zhao)
- hfsplus: fix slab-out-of-bounds read in hfsplus_strcasecmp() (Viacheslav Dubeyko)
- ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Randy Dunlap)
- sched/fair: Fix pelt lost idle time detection (Vincent Guittot)
- sched/balancing: Rename newidle_balance() => sched_balance_newidle() (Ingo Molnar)
- sched/fair: Trivial correction of the newidle_balance() comment (Barry Song)
- sched: Make newidle_balance() static again (Chen Yu)
- tls: don't rely on tx_work during send() (Sabrina Dubroca)
- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca)
- tg3: prevent use of uninitialized remote_adv and local_adv variables (Alexey Simakov)
- tcp: fix tcp_tso_should_defer() vs large RTT (Eric Dumazet)
- amd-xgbe: Avoid spurious link down messages during interface toggle (Raju Rangoju)
- net/ip6_tunnel: Prevent perpetual tunnel growth (Dmitry Safonov) [Orabug: 38649261] {CVE-2025-40173}
- net: dlink: handle dma_map_single() failure properly (Moon Yeounsu)
- net: dl2k: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
- media: pci: ivtv: Add missing check after DMA map (Thomas Fourier)
- media: pci/ivtv: switch from 'pci_' to 'dma_' API (Christophe Jaillet)
- xen/events: Update virq_to_irq on migration (Jason Andryuk)
- media: lirc: Fix error handling in lirc_register() (Ma Ke)
- media: rc: Directly use ida_free() (Keliu)
- drm/exynos: exynos7_drm_decon: remove ctx->suspended (K
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | kernel-uek | 0:5.4.17-2136.350.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-container | 0:5.4.17-2136.350.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-container-debug | 0:5.4.17-2136.350.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-debug | 0:5.4.17-2136.350.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-debug-devel | 0:5.4.17-2136.350.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-devel | 0:5.4.17-2136.350.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-doc | 0:5.4.17-2136.350.3.1.el8uek |
| Oracle Linux · 7 | kernel-uek-tools | 0:5.4.17-2136.350.3.1.el7uek |
Vulnerabilities 65
-
High 8.8
i40e: fix validation of VF state in get resources
In the Linux kernel, the following vulnerability has been resolved: i40e: fix validation of VF state in get resources VF state I40E_VF_STATE_ACTIVE is not the only state in which VF is actually active so it should not be used to determine if a VF is allowed t…
-
High 8.8
i40e: fix input validation logic for action_meta
In the Linux kernel, the following vulnerability has been resolved: i40e: fix input validation logic for action_meta Fix condition to check 'greater or equal' to prevent OOB dereference.
-
High 8.8
i40e: fix idx validation in config queues msg
In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in config queues msg Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_vc_config_queues_msg().
-
High 8.8
i40e: fix idx validation in i40e_validate_queue_map
In the Linux kernel, the following vulnerability has been resolved: i40e: fix idx validation in i40e_validate_queue_map Ensure idx is within range of active/initialized TCs when iterating over vf->ch[idx] in i40e_validate_queue_map().
-
High 8.8
i40e: add validation for ring_len param
In the Linux kernel, the following vulnerability has been resolved: i40e: add validation for ring_len param The `ring_len` parameter provided by the virtual function (VF) is assigned directly to the hardware memory context (HMC) without any validation. To add…
-
High 8.8
net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast
In the Linux kernel, the following vulnerability has been resolved: net: usb: Remove disruptive netif_wake_queue in rtl8150_set_multicast syzbot reported WARNING in rtl8150_start_xmit/usb_submit_urb. This is the sequence of events that leads to the warning: r…
-
High 8.1
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a listener is close()d while a TFO socket is being processed in tc…
-
High 8.1
sctp: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved: sctp: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
-
High 7.9
KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O When completing emulation of instruction that generated a userspace exit for I/O, don't recheck L1 intercepts as KVM has …
-
High 7.8
cnic: Fix use-after-free bugs in cnic_delete_task
In the Linux kernel, the following vulnerability has been resolved: cnic: Fix use-after-free bugs in cnic_delete_task The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(), which does not guarantee that the delayed work item 'delete_task' ha…
-
High 7.8
fbcon: fix integer overflow in fbcon_do_set_font
In the Linux kernel, the following vulnerability has been resolved: fbcon: fix integer overflow in fbcon_do_set_font Fix integer overflow vulnerabilities in fbcon_do_set_font() where font size calculations could overflow when handling user-controlled font par…
-
High 7.8
media: rc: fix races with imon_disconnect()
In the Linux kernel, the following vulnerability has been resolved: media: rc: fix races with imon_disconnect() Syzbot reports a KASAN issue as below: BUG: KASAN: use-after-free in __create_pipe include/linux/usb.h:1945 [inline] BUG: KASAN: use-after-free in …
-
High 7.8
mm/hugetlb: fix folio is still mapped when deleted
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix folio is still mapped when deleted Migration may be raced with fallocating hole. remove_inode_single_folio will unmap the folio if the folio is still mapped. However, it's cal…
-
High 7.8
ipvs: Defer ip_vs_ftp unregister during netns cleanup
In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregister ip_vs_ftp before connections with valid cp->app pointers are flushed, leadin…
-
High 7.8
net/9p: fix double req put in p9_fd_cancelled
In the Linux kernel, the following vulnerability has been resolved: net/9p: fix double req put in p9_fd_cancelled Syzkaller reports a KASAN issue as below: general protection fault, probably for non-canonical address 0xfbd59c0000000021: 0000 [#1] PREEMPT SMP …
-
High 7.8
fs: udf: fix OOB read in lengthAllocDescs handling
In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or…
-
High 7.8
perf: arm_spe: Prevent overflow in PERF_IDX2OFF()
In the Linux kernel, the following vulnerability has been resolved: perf: arm_spe: Prevent overflow in PERF_IDX2OFF() Cast nr_pages to unsigned long to avoid overflow when handling large AUX buffer sizes (>= 2 GiB).
-
High 7.8
vfs: Don't leak disconnected dentries on umount
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't leak disconnected dentries on umount When user calls open_by_handle_at() on some inode that is not cached, we will create disconnected dentry for it. If such dentry is a directory,…
-
High 7.8
drm/vmwgfx: Fix Use-after-free in validation
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix Use-after-free in validation Nodes stored in the validation duplicates hashtable come from an arena allocator that is cleared at the end of vmw_execbuf_process. All nodes are …
-
High 7.8
scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod
In the Linux kernel, the following vulnerability has been resolved: scsi: pm80xx: Fix array-index-out-of-of-bounds on rmmod Since commit f7b705c238d1 ("scsi: pm80xx: Set phy_attached to zero when device is gone") UBSAN reports: UBSAN: array-index-out-of-bound…
-
High 7.8
ext4: detect invalid INLINE_DATA + EXTENTS flag combination
In the Linux kernel, the following vulnerability has been resolved: ext4: detect invalid INLINE_DATA + EXTENTS flag combination syzbot reported a BUG_ON in ext4_es_cache_extent() when opening a verity file on a corrupted ext4 filesystem mounted without a jour…
-
High 7.8
net/ip6_tunnel: Prevent perpetual tunnel growth
In the Linux kernel, the following vulnerability has been resolved: net/ip6_tunnel: Prevent perpetual tunnel growth Similarly to ipv4 tunnel, ipv6 version updates dev->needed_headroom, too. While ipv4 tunnel headroom adjustment growth was limited in commit 5a…
-
High 7.8
ext4: guard against EA inode refcount underflow in xattr update
In the Linux kernel, the following vulnerability has been resolved: ext4: guard against EA inode refcount underflow in xattr update syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref…
-
High 7.8
ext4: avoid potential buffer over-read in parse_apply_sb_mount_options()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid potential buffer over-read in parse_apply_sb_mount_options() Unlike other strings in the ext4 superblock, we rely on tune2fs to make sure s_mount_opts is NUL terminated. Harden pa…
-
High 7.8
btrfs: avoid potential out-of-bounds in btrfs_encode_fh()
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid potential out-of-bounds in btrfs_encode_fh() The function btrfs_encode_fh() does not properly account for the three cases it handles. Before writing to the file handle (fh), the …
-
High 7.8
ocfs2: clear extent cache after moving/defragmenting extents
In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can become stale when extents are moved or defragmented, causing subsequent operations to see outdated extent…
-
High 7.5
uio_hv_generic: Let userspace take care of interrupt mask
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Let userspace take care of interrupt mask Remove the logic to set interrupt mask by default in uio_hv_generic driver as the interrupt mask value is supposed to be controlled c…
-
High 7.5
NFSD: Define a proc_layoutcommit for the FlexFiles layout type
In the Linux kernel, the following vulnerability has been resolved: NFSD: Define a proc_layoutcommit for the FlexFiles layout type Avoid a crash if a pNFS client should happen to send a LAYOUTCOMMIT operation on a FlexFiles layout.
-
High 7.5
net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce()
In the Linux kernel, the following vulnerability has been resolved: net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() If new_asoc->peer.adaptation_ind=0 and sctp_ulpevent_make_authkey=0 and sctp_ulpevent_make_authkey() returns 0, then …
-
High 7.5
sctp: avoid NULL dereference when chunk data buffer is missing
In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dereferenced in the if-block where it's supposed to be NULL only. chunk->skb can only be NULL if chunk->he…
-
High 7.3
i40e: add max boundary check for VF filters
In the Linux kernel, the following vulnerability has been resolved: i40e: add max boundary check for VF filters There is no check for max filters that VF can request. Add it.
-
High 7.3
media: tuner: xc5000: Fix use-after-free in xc5000_release
In the Linux kernel, the following vulnerability has been resolved: media: tuner: xc5000: Fix use-after-free in xc5000_release The original code uses cancel_delayed_work() in xc5000_release(), which does not guarantee that the delayed work item timer_sleep ha…
-
High 7.1
scsi: target: target_core_configfs: Add length check to avoid buffer overflow
In the Linux kernel, the following vulnerability has been resolved: scsi: target: target_core_configfs: Add length check to avoid buffer overflow A buffer overflow arises from the usage of snprintf to write into the buffer "buf" in target_lu_gp_members_show f…
-
Unscored —
device-dax: correct pgoff align in dax_set_mapping()
In the Linux kernel, the following vulnerability has been resolved: device-dax: correct pgoff align in dax_set_mapping() pgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise, vmf->address not aligned to fault_size will be aligned to the ne…
-
Unscored —
udp: Fix memory accounting leak.
In the Linux kernel, the following vulnerability has been resolved: udp: Fix memory accounting leak. Matt Dowling reported a weird UDP memory usage issue. Under normal operation, the UDP memory usage reported in /proc/net/sockstat remains close to zero. Howev…
-
Unscored —
net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod.
In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repro [0] and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a nul…
-
Unscored —
mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory When I did memory failure tests, below panic occurs: page dumped because: VM_BUG_ON_PAGE(PagePoisoned(page)) ker…
-
Unscored —
ocfs2: fix recursive semaphore deadlock in fiemap call
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix recursive semaphore deadlock in fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on a FS_IOC_FIEMAP of the extent list on a specially crafted mmap file. contex…
-
Unscored —
i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path
In the Linux kernel, the following vulnerability has been resolved: i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path If request_irq() in i40e_vsi_request_irq_msix() fails in an iteration later than the first, the error path wants to free the IRQs…
-
Unscored —CVE-2025-39913 Public exploit
tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork.
In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. syzbot reported the splat below. [0] The repro does the following: 1. Load a sk_msg prog that calls bpf_…
-
Unscored —
dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees
In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom: bam_dma: Fix DT error handling for num-channels/ees When we don't have a clock specified in the device tree, we have no way to ensure the BAM is on. This is often the case fo…
-
Unscored —
cgroup: split cgroup_destroy_wq into 3 workqueues
In the Linux kernel, the following vulnerability has been resolved: cgroup: split cgroup_destroy_wq into 3 workqueues A hung task can occur during [1] LTP cgroup testing when repeatedly mounting/unmounting perf_event and net_prio controllers with systemd.unif…
-
Unscored —
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().
In the Linux kernel, the following vulnerability has been resolved: tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). syzbot reported the splat below where a socket had tcp_sk(sk)->fastopen_rsk in the TCP_ESTABLISHED state. [0] syzbot reused the server…
-
Unscored —
media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe
In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix use-after-free bugs caused by orphan timer in probe The state->timer is a cyclic timer that schedules work_i2c_poll and delayed_work_enable_hotplug, while rearming i…
-
Unscored —
media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove
In the Linux kernel, the following vulnerability has been resolved: media: b2c2: Fix use-after-free causing by irq_check_work in flexcop_pci_remove The original code uses cancel_delayed_work() in flexcop_pci_remove(), which does not guarantee that the delayed…
-
Unscored —
scsi: mvsas: Fix use-after-free bugs in mvs_work_queue
In the Linux kernel, the following vulnerability has been resolved: scsi: mvsas: Fix use-after-free bugs in mvs_work_queue During the detaching of Marvell's SAS/SATA controller, the original code calls cancel_delayed_work() in mvs_free() to cancel the delayed…
-
Unscored —
drm/gma500: Fix null dereference in hdmi teardown
In the Linux kernel, the following vulnerability has been resolved: drm/gma500: Fix null dereference in hdmi teardown pci_set_drvdata sets the value of pdev->driver_data to NULL, after which the driver_data obtained from the same dev is dereferenced in oaktra…
-
Unscored —CVE-2025-40019 Public exploit
crypto: essiv - Check ssize for decryption and in-place encryption
In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aead_crypt so that it's also checked for decryption and in-place encryption.
-
Unscored —
can: peak_usb: fix shift-out-of-bounds issue
In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used for its shifting is 32 (which is the case for PC CAN FD interfaces supported by thi…
-
Unscored —
pinctrl: check the return value of pinmux_ops::get_function_name()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: check the return value of pinmux_ops::get_function_name() While the API contract in docs doesn't specify it explicitly, the generic implementation of the get_function_name() callback…
-
Unscored —
Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak Struct ff_effect_compat is embedded twice inside uinput_ff_upload_compat, contains internal padding. In particular, …
-
Unscored —
tracing: Fix race condition in kprobe initialization causing NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix race condition in kprobe initialization causing NULL pointer dereference There is a critical race condition in kprobe initialization that can lead to NULL pointer dereference and…
-
Unscored —
Squashfs: fix uninit-value in squashfs_get_parent
In the Linux kernel, the following vulnerability has been resolved: Squashfs: fix uninit-value in squashfs_get_parent Syzkaller reports a "KMSAN: uninit-value in squashfs_get_parent" bug. This is caused by open_by_handle_at() being called with a file handle c…
-
Unscored —
ocfs2: fix double free in user_cluster_connect()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix double free in user_cluster_connect() user_cluster_disconnect() frees "conn->cc_private" which is "lc" but then the error handling frees "lc" a second time. Set "lc" to NULL on thi…
-
Unscored —
pps: fix warning in pps_register_cdev when register device fail
In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook …
-
Unscored —
bpf: Explicitly check accesses to bpf_sock_addr
In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: e…
-
Unscored —
scsi: mpt3sas: Fix crash in transport port remove by using ioc_info()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix crash in transport port remove by using ioc_info() During mpt3sas_transport_port_remove(), messages were logged with dev_printk() against &mpt3sas_port->port->dev. At this …
-
Unscored —
blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx
In the Linux kernel, the following vulnerability has been resolved: blk-mq: check kobject state_in_sysfs before deleting in blk_mq_unregister_hctx In __blk_mq_update_nr_hw_queues() the return value of blk_mq_sysfs_register_hctxs() is not checked. If sysfs cre…
-
Unscored —
dm: fix NULL pointer dereference in __dm_suspend()
In the Linux kernel, the following vulnerability has been resolved: dm: fix NULL pointer dereference in __dm_suspend() There is a race condition between dm device suspend and table load that can lead to null pointer dereference. The issue occurs when suspend …
-
Unscored —
mm: hugetlb: avoid soft lockup when mprotect to large memory area
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: avoid soft lockup when mprotect to large memory area When calling mprotect() to a large hugetlb memory area in our customer's workload (~300GB hugetlb memory), soft lockup was ob…
-
Unscored —
pid: Add a judgment for ns null in pid_nr_ns
In the Linux kernel, the following vulnerability has been resolved: pid: Add a judgment for ns null in pid_nr_ns __task_pid_nr_ns ns = task_active_pid_ns(current); pid_nr_ns(rcu_dereference(*task_pid_ptr(task, type)), ns); if (pid && ns->level <= pid->level) …
-
Unscored —
cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request()
In the Linux kernel, the following vulnerability has been resolved: cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() The cpufreq_cpu_put() call in update_qos_request() takes place too early because the latter subsequently calls freq_q…
-
Unscored —
media: mc: Clear minor number before put device
In the Linux kernel, the following vulnerability has been resolved: media: mc: Clear minor number before put device The device minor should not be cleared after the device is released.
-
Unscored —
Squashfs: reject negative file sizes in squashfs_read_inode()
In the Linux kernel, the following vulnerability has been resolved: Squashfs: reject negative file sizes in squashfs_read_inode() Syskaller reports a "WARNING in ovl_copy_up_file" in overlayfs. This warning is ultimately caused because the underlying Squashfs…
-
Unscored —
PCI/IOV: Fix race between SR-IOV enable/disable and hotplug
In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV: Add PCI rescan-remove locking when enabling/disabling SR-IOV") tried to fix a race between the VF re…