Summary
[6.12.0-109.67.6]
- net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 39027305]
[6.12.0-109.67.5]
- uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158]
- Revert 'net/rds: fix crash by expanding kref coverage to rds_incoming.i_conn' (Sharath Srinivasan) [Orabug: 38945524]
- Revert 'net/rds: expand kref coverage to rds_notifier->n_conn' (Sharath Srinivasan) [Orabug: 38945524]
[6.12.0-109.67.4]
- KVM: x86: conditionally clear masterclock request for uek=exadata (Dongli Zhang) [Orabug: 38905553]
- Partial backport of 'KVM: x86: Fix software TSC upscaling in kvm_update_guest_time()' (Dongli Zhang) [Orabug: 38905553]
- ext4/jbd2: skip sb flush when EIO happened (Wengang Wang) [Orabug: 38916907]
- jbd2: store more accurate errno in superblock when possible (Wengang Wang) [Orabug: 38916907]
- net/rds: fix rds_message memleak in rds_send_xmit (Sharath Srinivasan) [Orabug: 38923495]
- Revert 'IB/mlx5: Implement clear counters' (Sharath Srinivasan) [Orabug: 38923518]
- Revert 'IB/core: Implement clear counters' (Sharath Srinivasan) [Orabug: 38923518]
- net/rds: fix rds_message memleak in rds_send_queue_rm (Sharath Srinivasan) [Orabug: 38928269]
- net/rds: rds_send_xmit should INIT_LIST_HEAD(&to_be_dropped) on restart (Sharath Srinivasan) [Orabug: 38928271]
- net/rds: wait_event_timeout until zero connections during rmmod (Sharath Srinivasan) [Orabug: 38928273]
[6.12.0-109.67.3]
- RAS/AMD/ATL: Require PRM support for future systems (Yazen Ghannam) [Orabug: 38869580]
- ACPI: PRM: Add acpi_prm_handler_available() (Yazen Ghannam) [Orabug: 38869580]
- Documentation: add documentation for MFD_MF_KEEP_UE_MAPPED (William Roche) [Orabug: 38768984]
- selftests/mm: test userspace MFR for HugeTLB hugepage (William Roche) [Orabug: 38768984]
- mm: memfd/hugetlb: introduce memfd-based userspace MFR policy (William Roche) [Orabug: 38768984]
- mm/memory-failure: teach kill_accessing_process to accept hugetlb tail page pfn (Jane Chu) [Orabug: 38768984]
- mm/memory-failure: fix missing ->mf_stats count in hugetlb poison (Jane Chu) [Orabug: 38768984]
- Reapply 'cpuidle: menu: Avoid discarding useful information' (Harshvardhan Jha) [Orabug: 38741180]
[6.12.0-109.67.2]
- net: mana: Reduce waiting time if HWC not responding (Haiyang Zhang) [Orabug: 38881615]
[6.12.0-109.67.1]
- LTS version: v6.12.67 (Jack Vogel)
- mm/fake-numa: handle cases with no SRAT info (Bruno Faccini)
- mm/page_alloc: prevent pcp corruption with SMP=n (Vlastimil Babka) [Orabug: 38914772] {CVE-2026-23025}
- mm/page_alloc: batch page freeing in decay_pcp_high (Joshua Hahn)
- mm/page_alloc/vmstat: simplify refresh_cpu_vm_stats change detection (Joshua Hahn)
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Zhen Ni)
- phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() (Xu Wang) [Orabug: 38914781] {CVE-2026-23030}
- phy: phy-rockchip-inno-usb2: Use dev_err_probe() in the probe path (Dragan Simic)
for 'numa_nodes_parsed' (Ben Dooks)
- mm/fake-numa: allow later numa node hotplug (Bruno Faccini)
- mm: kmsan: fix poisoning of high-order non-compound pages (Ryan Roberts)
- selftests/bpf: Test invalid narrower ctx load (Paul Chaignon)
- bpf: Reject narrower access to pointer ctx fields (Paul Chaignon) [Orabug: 38335080] {CVE-2025-38591}
- mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure (Seongjae Park) [Orabug: 38970289] {CVE-2026-23142}
- mm/damon/sysfs-scheme: cleanup quotas subdirs on scheme dir setup failure (Seongjae Park)
- xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster)
- btrfs: fix deadlock in wait_current_trans() due to ignored transaction type (Robbie Ko) [Orabug: 38930778] {CVE-2025-71194}
- HID: intel-ish-hid: Fix -Wcast-function-type-strict in devm_ishtp_alloc_workqueue() (Nathan Chancellor)
- HID: intel-ish-hid: Use dedicated unbound workqueues to prevent resume blocking (Zhang Lixu)
- dmaengine: ti: k3-udma: fix device leak on udma lookup (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation (Johan Hovold)
- dmaengine: ti: dma-crossbar: fix device leak on dra7x route allocation (Johan Hovold)
- dmaengine: stm32: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: stm32: dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: sh: rz-dmac: Fix rz_dmac_terminate_all() (Biju Das)
- dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config() (Miaoqian Lin)
- dmaengine: lpc32xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: lpc18xx-dmamux: fix device leak on route allocation (Johan Hovold)
- dmaengine: idxd: fix device leaks on compat bind and unbind (Johan Hovold)
- dmaengine: dw: dmamux: fix OF node leak on route allocation failure (Johan Hovold)
- dmaengine: bcm-sba-raid: fix device leak on probe (Johan Hovold) [Orabug: 38914727] {CVE-2025-71190}
- dmaengine: at_hdmac: fix device leak on of_dma_xlate() (Johan Hovold)
- dmaengine: apple-admac: Add 'apple,t8103-admac' compatible (Janne Grunau)
- LoongArch: dts: loongson-2k2000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Fix i2c-gpio node names (Binbin Zhou)
- LoongArch: dts: loongson-2k1000: Add default interrupt controller address cells (Binbin Zhou)
- LoongArch: dts: loongson-2k0500: Add default interrupt controller address cells (Binbin Zhou)
- drm/vmwgfx: Fix an error return check in vmw_compat_shader_add() (Haoxiang Li)
- drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel (Marek Vasut) [Orabug: 38930828] {CVE-2026-23049}
- drm/nouveau/disp/nv50-: Set lock_core in curs507a_prepare (Lyude Paul)
- drm/amdkfd: fix a memory leak in device_queue_manager_init() (Haoxiang Li)
- drm/amd: Clean up kfd node on surprise disconnect (Mario Limonciello)
- drm/amd/display: Bump the HDMI clock to 340MHz (Mario Limonciello)
-
Fixed packages 35
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | kernel-uek | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-core | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-core | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-devel | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-core | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-deprecated | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-desktop | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-extra-netfilter | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-usb | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-debug-modules-wireless | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-devel | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-doc | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-modules | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-core | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-deprecated | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-desktop | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-extra-netfilter | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-usb | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-modules-wireless | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek-tools | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-core | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-devel | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-core | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-deprecated | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-desktop | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-extra-netfilter | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-usb | 0:6.12.0-109.67.6.el10uek |
| Oracle Linux · 9 | kernel-uek64k-modules-wireless | 0:6.12.0-109.67.6.el10uek |
Vulnerabilities 58
-
Critical 9.8
libceph: prevent potential out-of-bounds reads in handle_auth_done()
In the Linux kernel, the following vulnerability has been resolved: libceph: prevent potential out-of-bounds reads in handle_auth_done() Perform an explicit bounds check on payload_len to avoid a possible out-of-bounds access in the callout. [ idryomov: chang…
-
Critical 9.1
btrfs: always detect conflicting inodes when logging inode refs
In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs After rename exchanging (either with the rename exchange operation or regular renames in multiple non-atomic steps) two inodes …
-
High 7.8CVE-2025-38248 Public exploit
bridge: mcast: Fix use-after-free during router port configuration
In the Linux kernel, the following vulnerability has been resolved: bridge: mcast: Fix use-after-free during router port configuration The bridge maintains a global list of ports behind which a multicast router resides. The list is consulted during forwarding…
-
High 7.8
tpm2-sessions: Fix out of range indexing in name_size
In the Linux kernel, the following vulnerability has been resolved: tpm2-sessions: Fix out of range indexing in name_size 'name_size' does not have any range checks, and it just directly indexes with TPM_ALG_ID, which could lead into memory corruption at wors…
-
High 7.8
nfsd: provide locking for v4_end_grace
In the Linux kernel, the following vulnerability has been resolved: nfsd: provide locking for v4_end_grace Writing to v4_end_grace can race with server shutdown and result in memory being accessed after it was freed - reclaim_str_hashtbl in particularly. We c…
-
High 7.8
arp: do not assume dev_hard_header() does not change skb->head
In the Linux kernel, the following vulnerability has been resolved: arp: do not assume dev_hard_header() does not change skb->head arp_create() is the only dev_hard_header() caller making assumption about skb->head being unchanged. A recent commit broke this …
-
High 7.8
net/sched: sch_qfq: do not free existing class in qfq_change_class()
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: do not free existing class in qfq_change_class() Fixes qfq_change_class() error case. cl->qdisc and cl should only be freed if a new class and qdisc were allocated, or we …
-
High 7.8CVE-2026-23001 Public exploit
macvlan: fix possible UAF in macvlan_forward_source()
In the Linux kernel, the following vulnerability has been resolved: macvlan: fix possible UAF in macvlan_forward_source() Add RCU protection on (struct macvlan_source_entry)->vlan. Whenever macvlan_hash_del_source() is called, we must clear entry->vlan pointe…
-
High 7.8CVE-2026-23010 Public exploit
ipv6: Fix use-after-free in inet6_addr_del().
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before…
-
High 7.5
libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
In the Linux kernel, the following vulnerability has been resolved: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() If the osdmap is (maliciously) corrupted such that the incremental osdmap epoch is different from what is expected, there is …
-
High 7.5
libceph: make free_choose_arg_map() resilient to partial allocation
In the Linux kernel, the following vulnerability has been resolved: libceph: make free_choose_arg_map() resilient to partial allocation free_choose_arg_map() may dereference a NULL pointer if its caller fails after a partial allocation. For example, in decode…
-
High 7.5
libceph: return the handler error from mon_handle_auth_done()
In the Linux kernel, the following vulnerability has been resolved: libceph: return the handler error from mon_handle_auth_done() Currently any error from ceph_auth_handle_reply_done() is propagated via finish_auth() but isn't returned from mon_handle_auth_do…
-
High 7.5
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts Since j1939_session_deactivate_activate_next() in j1939_tp_rxtimer() is called only when t…
-
High 7.5
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec Commit efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length") added ttag bounds checking…
-
High 7.5CVE-2026-23003 Public exploit
ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() Blamed commit did not take care of VLAN encapsulations as spotted by syzbot [1]. Use skb_vlan_inet_prepare() instead of pskb_inet_ma…
-
High 7.5
libceph: reset sparse-read state in osd_fault()
In the Linux kernel, the following vulnerability has been resolved: libceph: reset sparse-read state in osd_fault() When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of …
-
High 7.5
netfilter: nf_conncount: update last_gc only when GC has been performed
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: update last_gc only when GC has been performed Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wa…
-
High 7.1
wifi: mac80211: Discard Beacon frames to non-broadcast address
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required to be sent to the broadcast address, see IEEE Std 802.11-2020, 11.1.3.1 ("The Address 1 field of the …
-
Unscored —
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat be…
-
Unscored —
bpf: Reject narrower access to pointer ctx fields
In the Linux kernel, the following vulnerability has been resolved: bpf: Reject narrower access to pointer ctx fields The following BPF program, simplified from a syzkaller repro, causes a kernel warning: r0 = *(u8 *)(r1 + 169); exit; With pointer field sk be…
-
Unscored —
mptcp: fallback earlier on simult connection
In the Linux kernel, the following vulnerability has been resolved: mptcp: fallback earlier on simult connection Syzkaller reports a simult-connect race leading to inconsistent fallback status: WARNING: CPU: 3 PID: 33 at net/mptcp/subflow.c:1515 subflow_data_…
-
Unscored —
mm/page_alloc: change all pageblocks migrate type on coalescing
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: change all pageblocks migrate type on coalescing When a page is freed it coalesces with a buddy into a higher order page while possible. When the buddy page migrate type differ…
-
Unscored —
mptcp: ensure context reset on disconnect()
In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() After the blamed commit below, if the MPC subflow is already in TCP_CLOSE status or has fallback to TCP at mptcp_disconnect() time, mptcp_do_fastcl…
-
Unscored —
netfilter: nf_tables: avoid chain re-validation if possible
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid chain re-validation if possible Hamza Mahfooz reports cpu soft lock-ups in nft_chain_validate(): watchdog: BUG: soft lockup - CPU#1 stuck for 27s! [iptables-nft-re…
-
Unscored —
can: j1939: make j1939_session_activate() fail if device is no longer registered
In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot is still reporting unregister_netdevice: waiting for vcan0 to become free. Usage count = 2 even after c…
-
Unscored —
btrfs: fix NULL dereference on root when tracing inode eviction
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL dereference on root when tracing inode eviction When evicting an inode the first thing we do is to setup tracing for it, which implies fetching the root's id. But in btrfs_evi…
-
Unscored —
dmaengine: bcm-sba-raid: fix device leak on probe
In the Linux kernel, the following vulnerability has been resolved: dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop the reference taken when looking up the mailbox device during probe on probe failures and on driver unbind.
-
Unscored —
btrfs: fix deadlock in wait_current_trans() due to ignored transaction type
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_current_trans() is called during start_transaction(), it currently waits for a blocked transaction withou…
-
Unscored —
net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix NULL deref when deactivating inactive aggregate in qfq_reset `qfq_class->leaf_qdisc->q.qlen > 0` does not imply that the class itself is active. Two qfq_class objects …
-
Unscored —
net: sock: fix hardened usercopy panic in sock_recv_errqueue
In the Linux kernel, the following vulnerability has been resolved: net: sock: fix hardened usercopy panic in sock_recv_errqueue skbuff_fclone_cache was created without defining a usercopy region, [1] unlike skbuff_head_cache which properly whitelists the cb[…
-
Unscored —
wifi: avoid kernel-infoleak from struct iw_point
In the Linux kernel, the following vulnerability has been resolved: wifi: avoid kernel-infoleak from struct iw_point struct iw_point has a 32bit hole on 64bit arches. struct iw_point { void __user *pointer; /* Pointer to the data (in user space) */ __u16 leng…
-
Unscored —
net: fix memory leak in skb_segment_list for GRO packets
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in skb_segment_list for GRO packets When skb_segment_list() is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, t…
-
Unscored —
nfsd: check that server is running in unlock_filesystem
In the Linux kernel, the following vulnerability has been resolved: nfsd: check that server is running in unlock_filesystem If we are trying to unlock the filesystem via an administrative interface and nfsd isn't running, it crashes the server. This happens c…
-
Unscored —
bpf: Fix reference count leak in bpf_prog_test_run_xdp()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that …
-
Unscored —
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails, mlx5e_priv in mlx5e_dev devlink private is us…
-
Unscored —
net/mlx5e: Fix crash on profile change rollback failure
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix crash on profile change rollback failure mlx5e_netdev_change_profile can fail to attach a new profile and can fail to rollback to old profile, in such case, we could end up wit…
-
Unscored —CVE-2026-23002 Public exploit
lib/buildid: use __kernel_read() for sleepable context
In the Linux kernel, the following vulnerability has been resolved: lib/buildid: use __kernel_read() for sleepable context Prevent a "BUG: unable to handle kernel NULL pointer dereference in filemap_read_folio". For the sleepable context, convert freader to u…
-
Unscored —CVE-2026-23005 Public exploit
x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 When loading guest XSAVE state via KVM_SET_XSAVE, and when updating XFD in response to a guest WRMSR, clear XFD-disabled fea…
-
Unscored —
ipv4: ip_gre: make ipgre_header() robust
In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_gre: make ipgre_header() robust Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust") Over the years, syzbot found many ways to crash the kernel in ipgre_header() [1…
-
Unscored —
net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
In the Linux kernel, the following vulnerability has been resolved: net: 3com: 3c59x: fix possible null dereference in vortex_probe1() pdev can be null and free_ring: can be called in 1297 with a null pdev.
-
Unscored —
net: usb: pegasus: fix memory leak in update_eth_regs_async()
In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: fix memory leak in update_eth_regs_async() When asynchronously writing to the device registers and if usb_submit_urb() fail, the code fail to release allocated to this poin…
-
Unscored —
idpf: fix memory leak in idpf_vport_rel()
In the Linux kernel, the following vulnerability has been resolved: idpf: fix memory leak in idpf_vport_rel() Free vport->rx_ptype_lkup in idpf_vport_rel() to avoid leaking memory during a reset. Reported by kmemleak: unreferenced object 0xff450acac838a000 (s…
-
Unscored —
mm/page_alloc: prevent pcp corruption with SMP=n
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: prevent pcp corruption with SMP=n The kernel test robot has reported: BUG: spinlock trylock failure on UP on CPU#0, kcompactd0/28 lock: 0xffff888807e35ef0, .magic: dead4ead, .o…
-
Unscored —
phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe()
In the Linux kernel, the following vulnerability has been resolved: phy: rockchip: inno-usb2: Fix a double free bug in rockchip_usb2phy_probe() The for_each_available_child_of_node() calls of_node_put() to release child_np in each success loop. After breaking…
-
Unscored —
can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak
In the Linux kernel, the following vulnerability has been resolved: can: gs_usb: gs_usb_receive_bulk_callback(): fix URB memory leak In gs_can_open(), the URBs for USB-in transfers are allocated, added to the parent->rx_submitted anchor and submitted. In the …
-
Unscored —
null_blk: fix kmemleak by releasing references to fault configfs items
In the Linux kernel, the following vulnerability has been resolved: null_blk: fix kmemleak by releasing references to fault configfs items When CONFIG_BLK_DEV_NULL_BLK_FAULT_INJECTION is enabled, the null-blk driver sets up fault injection support by creating…
-
Unscored —
net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv mlx5e_priv is an unstable structure that can be memset(0) if profile attaching fails. Pass netdev to mlx5e_destroy_netdev() to g…
-
Unscored —
pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node()
In the Linux kernel, the following vulnerability has been resolved: pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() In nfs4_ff_alloc_deviceid_node(), if the allocation for ds_versions fails, the function jumps to the out_scratch label without…
-
Unscored —
libceph: make calc_target() set t->paused, not just clear it
In the Linux kernel, the following vulnerability has been resolved: libceph: make calc_target() set t->paused, not just clear it Currently calc_target() clears t->paused if the request shouldn't be paused anymore, but doesn't ever set t->paused even though it…
-
Unscored —
drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel
In the Linux kernel, the following vulnerability has been resolved: drm/panel-simple: fix connector type for DataImage SCF0700C48GGU18 panel The connector type for the DataImage SCF0700C48GGU18 panel is missing and devm_drm_panel_bridge_add() requires connect…
-
Unscored —
pNFS: Fix a deadlock when returning a delegation during open()
In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix a deadlock when returning a delegation during open() Ben Coddington reports seeing a hang in the following stack trace: 0 [ffffd0b50e1774e0] __schedule at ffffffff9ca05415 1 [ffffd0…
-
Unscored —
NFS: Fix a deadlock involving nfs_release_folio()
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a deadlock involving nfs_release_folio() Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery waiting on kthreadd, which is attempting to reclaim memory by calling nfs_r…
-
Unscored —
net: hv_netvsc: reject RSS hash key programming without RX indirection table
In the Linux kernel, the following vulnerability has been resolved: net: hv_netvsc: reject RSS hash key programming without RX indirection table RSS configuration requires a valid RX indirection table. When the device reports a single receive queue, rndis_fil…
-
Unscored —
bpf, test_run: Subtract size of xdp_frame from allowed metadata size
In the Linux kernel, the following vulnerability has been resolved: bpf, test_run: Subtract size of xdp_frame from allowed metadata size The xdp_frame structure takes up part of the XDP frame headroom, limiting the size of the metadata. However, in bpf_test_r…
-
Unscored —
btrfs: send: check for inline extents in range_is_hole_in_parent()
In the Linux kernel, the following vulnerability has been resolved: btrfs: send: check for inline extents in range_is_hole_in_parent() Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent. This …
-
Unscored —
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure When a DAMOS-scheme DAMON sysfs directory setup fails after setup of access_pattern/ directory, subdirectorie…
-
Unscored —
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are…
-
Unscored —
ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref
In the Linux kernel, the following vulnerability has been resolved: ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.