Fixed packages 43
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::baseos | bpftool | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | bpftool-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-abi-stablelists | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-core | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-core | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-devel | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-modules | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debug-modules-extra | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo-common-aarch64 | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo-common-ppc64le | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo-common-s390x | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-debuginfo-common-x86_64 | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-devel | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-doc | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-modules | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-modules-extra | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-tools | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-tools-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-tools-libs | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-core | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-devel | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-modules | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | kernel-zfcpdump-modules-extra | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | perf | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | perf-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | python3-perf | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::baseos | python3-perf-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | bpftool-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debug-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debuginfo-common-aarch64 | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debuginfo-common-ppc64le | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-debuginfo-common-x86_64 | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-tools-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | kernel-tools-libs-devel | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | perf-debuginfo | 0:4.18.0-477.10.1.el8_8 |
| Red Hat · RHEL 8 enterprise_linux:8::crb | python3-perf-debuginfo | 0:4.18.0-477.10.1.el8_8 |
Vulnerabilities 199
-
Critical 9.8
NFSD: Protect against send buffer overflow in NFSv2 READDIR
In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READDIR Restore the previous limit on the @count argument to prevent a buffer overflow attack.
-
Critical 9.8
scsi: target: iscsi: Fix a race condition between login_work and the login thread
In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix a race condition between login_work and the login thread In case a malicious initiator sends some random data immediately after a login PDU; the iscsi_target_sk_data_…
-
Critical 9.8
NFSD: Protect against send buffer overflow in NFSv2 READ
In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffer…
-
High 8.8
scsi: libfc: Fix use after free in fc_exch_abts_resp()
In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in …
-
High 8.8
mt76: fix use-after-free by removing a non-RCU wcid pointer
In the Linux kernel, the following vulnerability has been resolved: mt76: fix use-after-free by removing a non-RCU wcid pointer Fixes an issue caught by KASAN about use-after-free in mt76_txq_schedule by protecting mtxq->wcid with rcu_lock between mt76_txq_sc…
-
High 8.8
wifi: mac80211: fix use-after-free in chanctx code
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free in chanctx code In ieee80211_vif_use_reserved_context(), when we have an old context and the new context's replace_state is set to IEEE80211_CHANCTX_REPLACE…
-
High 8.8
rtw89: cfo: check mac_id to avoid out-of-bounds
In the Linux kernel, the following vulnerability has been resolved: rtw89: cfo: check mac_id to avoid out-of-bounds Somehow, hardware reports incorrect mac_id and pollute memory. Check index before we access the array. UBSAN: array-index-out-of-bounds in rtw8…
-
High 8.8
ath10k: skip ath10k_halt during suspend for driver state RESTARTING
In the Linux kernel, the following vulnerability has been resolved: ath10k: skip ath10k_halt during suspend for driver state RESTARTING Double free crash is observed when FW recovery(caused by wmi timeout/crash) is followed by immediate suspend event. The FW …
-
High 8.8
Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu Fix the race condition between the following two flows that run in parallel: 1. l2cap_reassemble_sdu -> chan->ops->recv (l2…
-
High 8.8
wifi: mac80211: Fix UAF in ieee80211_scan_rx()
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Fix UAF in ieee80211_scan_rx() ieee80211_scan_rx() tries to access scan_req->flags after a null check, but a UAF is observed when the scan is completed and __ieee80211_scan_co…
-
High 8.8
wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue After successfull station association, if station queues are disabled for some reason, the related lists are not emptied. …
-
High 8.8
scsi: qla2xxx: Fix crash when I/O abort times out
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash when I/O abort times out While performing CPU hotplug, a crash with the following stack was seen: Call Trace: qla24xx_process_response_queue+0x42a/0x970 [qla2xxx] qla…
-
High 8.1
An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer o…
-
High 7.8
An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17. Unprivileged guest users can compromi…
-
High 7.8
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before …
-
High 7.8
scsi: mpt3sas: Fix use-after-free warning
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399…
-
High 7.8
net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent A user is able to configure an arbitrary number of rx queues when creating an interface via netlink. This doesn't work …
-
High 7.8
fbdev: defio: fix the pagelist corruption
In the Linux kernel, the following vulnerability has been resolved: fbdev: defio: fix the pagelist corruption Easily hit the below list corruption: == list_add corruption. prev->next should be next (ffffffffc0ceb090), but was ffffec604507edc8. (prev=ffffec604…
-
High 7.8
ALSA: usb-audio: Cancel pending work at closing a MIDI substream
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime…
-
High 7.8
dma-buf/dma-resv: check if the new fence is really later
In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: check if the new fence is really later Previously when we added a fence to a dma_resv object we always assumed the the newer than all the existing fences. With Jason's work …
-
High 7.8
netfilter: flowtable: fix stuck flows on cleanup due to pending work
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1) gc_step work is stopped t…
-
High 7.8
drivers:md:fix a potential use-after-free bug
In the Linux kernel, the following vulnerability has been resolved: drivers:md:fix a potential use-after-free bug In line 2884, "raid5_release_stripe(sh);" drops the reference to sh and may cause sh to be released. However, sh is subsequently used in lines 28…
-
High 7.8
drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex If amdgpu_cs_vm_handling returns r != 0, then it will unlock the bo_list_mutex inside the function amdgpu_cs_vm_handling and again on am…
-
High 7.8
netfilter: nf_tables: possible module reference underflow in error path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: possible module reference underflow in error path dst->ops is set on when nft_expr_clone() fails, but module refcount has not been bumped yet, therefore nft_expr_destroy…
-
High 7.8
mptcp: do not queue data on closed subflows
In the Linux kernel, the following vulnerability has been resolved: mptcp: do not queue data on closed subflows Dipanjan reported a syzbot splat at close time: WARNING: CPU: 1 PID: 10818 at net/ipv4/af_inet.c:153 inet_sock_destruct+0x6d0/0x8e0 net/ipv4/af_ine…
-
High 7.8
RDMA/irdma: Fix a window for use-after-free
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix a window for use-after-free During a destroy CQ an interrupt may cause processing of a CQE after CQ resources are freed by irdma_cq_free_rsrc(). Fix this by moving the call to…
-
High 7.8
drm/fb-helper: Fix out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: Fix out-of-bounds access Clip memory range to screen-buffer size to avoid out-of-bounds access in fbdev deferred I/O's damage handling. Fbdev's deferred I/O can only track page…
-
High 7.8
sctp: handle the error returned from sctp_auth_asoc_init_active_key
In the Linux kernel, the following vulnerability has been resolved: sctp: handle the error returned from sctp_auth_asoc_init_active_key When it returns an error from sctp_auth_asoc_init_active_key(), the active_key is actually not updated. The old sh_key will…
-
High 7.8
ASoC: Intel: avs: Fix potential RX buffer overflow
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix potential RX buffer overflow If an event caused firmware to return invalid RX size for LARGE_CONFIG_GET, memcpy_fromio() could end up copying too many bytes. Fix by util…
-
High 7.8
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.…
-
High 7.8
RDMA/rxe: Fix mr->map double free
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix mr->map double free rxe_mr_cleanup() which tries to free mr->map again will be called when rxe_mr_init_user() fails: CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tai…
-
High 7.8
xfrm: Update ipcomp_scratches with NULL when freed
In the Linux kernel, the following vulnerability has been resolved: xfrm: Update ipcomp_scratches with NULL when freed Currently if ipcomp_alloc_scratches() fails to allocate memory ipcomp_scratches holds obsolete address. So when we try to free the percpu sc…
-
High 7.8
net/mlx5: Fix possible use-after-free in async command interface
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_async_ctx should return only after all its callback handlers were completed. Before this patch, the below rac…
-
High 7.8
md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
In the Linux kernel, the following vulnerability has been resolved: md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed: =================================…
-
High 7.8CVE-2023-0461 Public exploit
Use-after-free vulnerability in the Linux Kernel
There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation. To reach the vulnerability kernel configuration flag CONFIG_TLS or CONFIG_XFRM_ESPINTCP has to be configured, but the operation does not …
-
High 7.8
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) and held indefinitely a…
-
High 7.5
tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
In the Linux kernel, the following vulnerability has been resolved: tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd syzbot got a new report [1] finally pointing to a very old bug, added in initial support for MTU probing. tcp_mtu_probe() has checks about st…
-
High 7.5
net: gso: fix panic on frag_list with mixed head alloc types
In the Linux kernel, the following vulnerability has been resolved: net: gso: fix panic on frag_list with mixed head alloc types Since commit 3dcbdb134f32 ("net: gso: Fix skb_segment splat when splitting gso_size mangled skb having linear-headed frag_list"), …
-
High 7.5
RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event If siw_recv_mpa_rr returns -EAGAIN, it means that the MPA reply hasn't been received completely, and should not report IW_CM_…
-
High 7.5
RDMA/rxe: Fix "kernel NULL pointer dereference" error
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix "kernel NULL pointer dereference" error When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized. Because of cr…
-
High 7.1
regmap: spi: Reserve space for register address/padding
In the Linux kernel, the following vulnerability has been resolved: regmap: spi: Reserve space for register address/padding Currently the max_raw_read and max_raw_write limits in regmap_spi struct do not take into account the additional size of the transmitte…
-
High 7.0CVE-2022-3522 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigat…
-
High 7.0
drm/amd/display: Check correct bounds for stream encoder instances for DCN303
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check correct bounds for stream encoder instances for DCN303 [Why & How] eng_id for DCN303 cannot be more than 1, since we have only two instances of stream encoders. Check t…
-
High 7.0
RDMA/srpt: Fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Fix a use-after-free Change the LIO port members inside struct srpt_port from regular members into pointers. Allocate the LIO port data structures from inside srpt_make_tport() and…
-
Medium 6.7
drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client …
-
Medium 6.6
A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user conn…
-
Medium 5.8
Speculative execution attacks in KVM VMX
A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support…
-
Medium 5.5
net: stmmac: fix tc flower deletion for VLAN priority Rx steering
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix tc flower deletion for VLAN priority Rx steering To replicate the issue:- 1) Add 1 flower filter for VLAN Priority based frame steering:- $ IFDEVNAME=eth0 $ tc qdisc add dev …
-
Medium 5.5CVE-2022-3564 Public exploit
Linux Kernel Bluetooth l2cap_core.c l2cap_reassemble_sdu use after free
A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommende…
-
Medium 5.5
An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a…
-
Medium 5.5
A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resou…
-
Medium 5.5CVE-2022-41218 Public exploit
In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount ra…
-
Medium 5.5
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can…
-
Medium 5.5
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could…
-
Medium 5.5
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A…
-
Medium 5.5
In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivilege…
-
Medium 5.5
drm/amd/display: Check if modulo is 0 before dividing.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check if modulo is 0 before dividing. [How & Why] If a value of 0 is read, then this will cause a divide-by-0 panic.
-
Medium 5.5
iommu/arm-smmu-v3: check return value after calling platform_get_resource()
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.
-
Medium 5.5
iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe()
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() It will cause null-ptr-deref when using 'res', if platform_get_resource() returns NULL, so move using 'res' after devm_i…
-
Medium 5.5
drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq() The > ARRAY_SIZE() should be >= ARRAY_SIZE() to prevent an out of bounds access.
-
Medium 5.5
driver core: fix deadlock in __device_attach
In the Linux kernel, the following vulnerability has been resolved: driver core: fix deadlock in __device_attach In __device_attach function, The lock holding logic is as follows: ... __device_attach device_lock(dev) // get lock dev async_schedule_dev(__devic…
-
Medium 5.5
scsi: sd: Fix potential NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix potential NULL pointer dereference If sd_probe() sees an early error before sdkp->device is initialized, sd_zbc_release_disk() is called. This causes a NULL pointer dereference …
-
Medium 5.5
iavf: Fix handling of dummy receive descriptors
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix handling of dummy receive descriptors Fix memory leak caused by not handling dummy receive descriptor properly. iavf_get_rx_buffer now sets the rx_buffer return value for dummy rece…
-
Medium 5.5
drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector()
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() If drm_connector_init fails, intel_connector_free will be called to take care of proper free. So it is necessary to drop…
-
Medium 5.5
i2c: piix4: Fix a memory leak in the EFCH MMIO support
In the Linux kernel, the following vulnerability has been resolved: i2c: piix4: Fix a memory leak in the EFCH MMIO support The recently added support for EFCH MMIO regions introduced a memory leak in that code path. The leak is caused by the fact that release…
-
Medium 5.5
Bluetooth: L2CAP: Fix memory leak in vhci_write
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix memory leak in vhci_write Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810d81ac00 (size …
-
Medium 5.5
RDMA/core: Fix null-ptr-deref in ib_core_cleanup()
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix null-ptr-deref in ib_core_cleanup() KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f] CPU: 1 PID: 379 Hardware name:…
-
Medium 5.5
md: fix a crash in mempool_free
In the Linux kernel, the following vulnerability has been resolved: md: fix a crash in mempool_free There's a crash in mempool_free when running the lvm test shell/lvchange-rebuild-raid.sh. The reason for the crash is this: * super_written calls atomic_dec_an…
-
Medium 5.5
wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() mhi_alloc_controller() allocates a memory space for mhi_ctrl. When gets some error, mhi_ctrl should be freed with mhi_fre…
-
Medium 5.5
A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in…
-
Medium 5.5
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction …
-
Medium 5.5
A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel. The issue …
-
Medium 5.5
A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel. If …
-
Medium 5.5
In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table …
-
Medium 5.5
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (sl…
-
Medium 5.5
Drivers: vmbus: Check for channel allocation before looking up relids
In the Linux kernel, the following vulnerability has been resolved: Drivers: vmbus: Check for channel allocation before looking up relids relid2channel() assumes vmbus channel array to be allocated when called. However, in cases such as kdump/kexec, not all r…
-
Medium 5.5
RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device Currently, when mlx5_ib_get_hw_stats() is used for device (port_num = 0), there is a special handling in order to use the correct coun…
-
Medium 5.0
Linux Kernel BPF gup.c follow_page_pte race condition
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remo…
-
Medium 4.7
udp: Fix a data-race around sysctl_udp_l3mdev_accept.
In the Linux kernel, the following vulnerability has been resolved: udp: Fix a data-race around sysctl_udp_l3mdev_accept. While reading sysctl_udp_l3mdev_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader.
-
Medium 4.7
A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel. This issue m…
-
Medium 4.6
Linux Kernel TCP tcp_setsockopt race condition
A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161. This impacts the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. Such manipulation leads to race condition. A high complexity level is associated wit…
-
Medium 4.6
Linux Kernel IPv6 inet6_dgram_ops race condition
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch …
-
Medium 4.6
Linux Kernel IPsec devlink.c devlink_param_get use after free
A vulnerability was found in Linux Kernel. It has been classified as critical. This affects the function devlink_param_set/devlink_param_get of the file net/core/devlink.c of the component IPsec. The manipulation leads to use after free. It is recommended to …
-
Medium 4.3
Linux Kernel IPv6 ipv6_renew_options memory leak
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is …
-
Low 3.5
Linux Kernel Bluetooth l2cap_core.c l2cap_recv_acldata memory leak
A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to memory leak. It is recommende…
-
Unscored —
Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakag…
-
Unscored —
When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.
-
Unscored —
When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.
-
Unscored —
mm/slub: actually fix freelist pointer vs redzoning
In the Linux kernel, the following vulnerability has been resolved: mm/slub: actually fix freelist pointer vs redzoning It turns out that SLUB redzoning ("slub_debug=Z") checks from s->object_size rather than from s->inuse (which is normally bumped to make ro…
-
Unscored —
An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers …
-
Unscored —CVE-2022-1679 Public exploit
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9…
-
Unscored —
With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed wi…
-
Unscored —
In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking. This could lead to local esca…
-
Unscored —CVE-2022-25265 Public exploit
In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approxi…
-
Unscored —
An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly m…
-
Unscored —
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple c…
-
Unscored —CVE-2022-30594 Public exploit
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass in…
-
Unscored —
A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for …
-
Unscored —
An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unma…
-
Unscored —CVE-2022-42703 Public exploit
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
-
Unscored —
In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 sta…
-
Unscored —
ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less tha…
-
Unscored —
net/mlx5: Fix command stats access after free
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix command stats access after free Command may fail while driver is reloading and can't accept FW commands till command interface is reinitialized. Such command failure is being lo…
-
Unscored —
ASoC: soc-pcm: Add NULL check in BE reparenting
In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: Add NULL check in BE reparenting Add NULL check in dpcm_be_reparent API, to handle kernel NULL pointer dereference error. The issue occurred in fuzzing test.
-
Unscored —
hwmon: (coretemp) Check for null before removing sysfs attrs
In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Check for null before removing sysfs attrs If coretemp_add_core() gets an error then pdata->core_data[indx] is already NULL and has been kfreed. Don't pass that to sysfs_rem…
-
Unscored —
net/mlx5: E-Switch, pair only capable devices
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, pair only capable devices OFFLOADS paring using devcom is possible only on devices that support LAG. Filter based on lag capabilities. This fixes an issue where mlx5_get_n…
-
Unscored —
net: ipv6: unexport __init-annotated seg6_hmac_init()
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: unexport __init-annotated seg6_hmac_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot …
-
Unscored —
tcp: tcp_rtx_synack() can be called from process context
In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_rtx_synack() can be called from process context Laurent reported the enclosed report [1] This bug triggers with following coditions: 0) Kernel built with CONFIG_DEBUG_PREEMPT=y 1) A …
-
Unscored —
RDMA/hfi1: Prevent panic when SDMA is disabled
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Prevent panic when SDMA is disabled If the hfi1 module is loaded with HFI1_CAP_SDMA off, a call to hfi1_write_iter() will dereference a NULL pointer and panic. A typical stack fram…
-
Unscored —
cpufreq: governor: Use kobject release() method to free dbs_data
In the Linux kernel, the following vulnerability has been resolved: cpufreq: governor: Use kobject release() method to free dbs_data The struct dbs_data embeds a struct gov_attr_set and the struct gov_attr_set embeds a kobject. Since every kobject must have a…
-
Unscored —
rtw89: ser: fix CAM leaks occurring in L2 reset
In the Linux kernel, the following vulnerability has been resolved: rtw89: ser: fix CAM leaks occurring in L2 reset The CAM, meaning address CAM and bssid CAM here, will get leaks during SER (system error recover) L2 reset process and ieee80211_restart_hw() w…
-
Unscored —
net: stmmac: fix dma queue left shift overflow issue
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma queue left shift overflow issue When queue number is > 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1. If CONFIG_…
-
Unscored —
vlan: fix memory leak in vlan_newlink()
In the Linux kernel, the following vulnerability has been resolved: vlan: fix memory leak in vlan_newlink() Blamed commit added back a bug I fixed in commit 9bbd917e0bec ("vlan: fix memory leak in vlan_dev_set_egress_priority") If a memory allocation fails in…
-
Unscored —
net: stmmac: dwc-qos: Disable split header for Tegra194
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwc-qos: Disable split header for Tegra194 There is a long-standing issue with the Synopsys DWC Ethernet driver for Tegra194 where random system crashes have been observed [0]. T…
-
Unscored —
wifi: mac80211: fix queue selection for mesh/OCB interfaces
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix queue selection for mesh/OCB interfaces When using iTXQ, the code assumes that there is only one vif queue for broadcast packets, using the BE queue. Allowing non-BE queue…
-
Unscored —
tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() Recently added debug in commit f9aefd6b2aa3 ("net: warn if mac header was not set") caught a bug in skb_tunnel_check_pmtu()…
-
Unscored —
erspan: do not assume transport header is always set
In the Linux kernel, the following vulnerability has been resolved: erspan: do not assume transport header is always set Rewrite tests in ip6erspan_tunnel_xmit() and erspan_fb_xmit() to not assume transport header is set. syzbot reported: WARNING: CPU: 0 PID:…
-
Unscored —
drm/i915/reset: Fix error_state_read ptr + offset use
In the Linux kernel, the following vulnerability has been resolved: drm/i915/reset: Fix error_state_read ptr + offset use Fix our pointer offset usage in error_state_read when there is no i915_gpu_coredump but buf offset is non-zero. This fixes a kernel page …
-
Unscored —
clocksource: hyper-v: unexport __init-annotated hv_init_clocksource()
In the Linux kernel, the following vulnerability has been resolved: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence,…
-
Unscored —
sock: redo the psock vs ULP protection check
In the Linux kernel, the following vulnerability has been resolved: sock: redo the psock vs ULP protection check Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") has moved the inet_csk_has_ulp(sk) check from sk_psock_init() to the n…
-
Unscored —
USB: core: Prevent nested device-reset calls
In the Linux kernel, the following vulnerability has been resolved: USB: core: Prevent nested device-reset calls Automatic kernel fuzzing revealed a recursive locking violation in usb-storage: ============================================ WARNING: possible rec…
-
Unscored —
wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected When we are not connected to a channel, sending channel "switch" announcement doesn't make any sense. The BSS list is …
-
Unscored —
firmware_loader: Fix use-after-free during unregister
In the Linux kernel, the following vulnerability has been resolved: firmware_loader: Fix use-after-free during unregister In the following code within firmware_upload_unregister(), the call to device_unregister() could result in the dev_release function freei…
-
Unscored —
net/sched: fix netdevice reference leaks in attach_default_qdiscs()
In the Linux kernel, the following vulnerability has been resolved: net/sched: fix netdevice reference leaks in attach_default_qdiscs() In attach_default_qdiscs(), if a dev has multiple queues and queue 0 fails to attach qdisc because there is no memory in at…
-
Unscored —
openvswitch: fix memory leak at failed datapath creation
In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix memory leak at failed datapath creation ovs_dp_cmd_new()->ovs_dp_change()->ovs_dp_set_upcall_portids() allocates array via kmalloc. If for some reason new_vport() fails durin…
-
Unscored —
drm/i915: fix null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix null pointer dereference Asus chromebook CX550 crashes during boot on v5.17-rc1 kernel. The root cause is null pointer defeference of bi_next in tgl_get_bw_info() in drivers/gpu…
-
Unscored —
xhci: Fix null pointer dereference in remove if xHC has only one roothub
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix null pointer dereference in remove if xHC has only one roothub The remove path in xhci platform driver tries to remove and put both main and shared hcds even if only a main hcd exis…
-
Unscored —
arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level
In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level Though acpi_find_last_cache_level() always returned signed value and the document states it will return a…
-
Unscored —
drm/amd/pm: add missing ->fini_xxxx interfaces for some SMU13 asics
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: add missing ->fini_xxxx interfaces for some SMU13 asics Without these, potential memory leak may be induced.
-
Unscored —
drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid To avoid any potential memory leak.
-
Unscored —
drm/amd/display: clear optc underflow before turn off odm clock
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: clear optc underflow before turn off odm clock [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock …
-
Unscored —
drm/amd/pm: Fix a potential gpu_metrics_table memory leak
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix a potential gpu_metrics_table memory leak Memory is allocated for gpu_metrics_table in smu_v13_0_4_init_smc_tables(), but not freed in smu_v13_0_4_fini_smc_tables(). This may …
-
Unscored —
media: pvrusb2: fix memory leak in pvr_probe
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix memory leak in pvr_probe The error handling code in pvr2_hdw_create forgets to unregister the v4l2 device. When pvr2_hdw_create returns back to pvr2_context_create, it cal…
-
Unscored —
udmabuf: Set the DMA mask for the udmabuf device (v2)
In the Linux kernel, the following vulnerability has been resolved: udmabuf: Set the DMA mask for the udmabuf device (v2) If the DMA mask is not set explicitly, the following warning occurs when the userspace tries to access the dma-buf via the CPU as reporte…
-
Unscored —
scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq storvsc_error_wq workqueue should not be marked as WQ_MEM_RECLAIM as it doesn't need to make forward progress under memory pressure.…
-
Unscored —
netfilter: nft_tproxy: restrict to prerouting hook
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tproxy: restrict to prerouting hook TPROXY is only allowed from prerouting, but nft_tproxy doesn't check this. This fixes a crash (null dereference) when using tproxy from e.g.…
-
Unscored —
net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY Only set MLX5_LAG_FLAG_NDEVS_READY if both netdevices are registered. Doing so guarantees that both ldev->pf[MLX5_LAG_P0].dev and ldev-…
-
Unscored —
xfrm: fix refcount leak in __xfrm_policy_check()
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix refcount leak in __xfrm_policy_check() The issue happens on an error path in __xfrm_policy_check(). When the fetching process of the object `pols[1]` fails, the function simply retu…
-
Unscored —
ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_R…
-
Unscored —
ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FW_READY…
-
Unscored —
drm/i915/ttm: don't leak the ccs state
In the Linux kernel, the following vulnerability has been resolved: drm/i915/ttm: don't leak the ccs state The kernel only manages the ccs state with lmem-only objects, however the kernel should still take care not to leak the CCS state from the previous user…
-
Unscored —
stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove()
In the Linux kernel, the following vulnerability has been resolved: stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() Commit 09f012e64e4b ("stmmac: intel: Fix clock handling on error and remove paths") removed this clk_disabl…
-
Unscored —
ice: Fix call trace with null VSI during VF reset
In the Linux kernel, the following vulnerability has been resolved: ice: Fix call trace with null VSI during VF reset During stress test with attaching and detaching VF from KVM and simultaneously changing VFs spoofcheck and trust there was a call trace in ic…
-
Unscored —
net: qrtr: start MHI channel after endpoit creation
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: start MHI channel after endpoit creation MHI channel may generates event/interrupt right after enabling. It may leads to 2 race conditions issues. 1) Such event may be dropped by q…
-
Unscored —
ASoC: DPCM: Don't pick up BE without substream
In the Linux kernel, the following vulnerability has been resolved: ASoC: DPCM: Don't pick up BE without substream When DPCM tries to add valid BE connections at dpcm_add_paths(), it doesn't check whether the picked BE actually supports for the given stream d…
-
Unscored —
ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may resu…
-
Unscored —
ASoC: Intel: avs: Fix potential buffer overflow by snprintf()
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in…
-
Unscored —
drm/ttm: Fix dummy res NULL ptr deref bug
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix dummy res NULL ptr deref bug Check the bo->resource value before accessing the resource mem_type. v2: Fix commit description unwrapped warning <log snip> [ 40.191227][ T184] gene…
-
Unscored —
iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE)
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) KASAN reports: [ 4.668325][ T0] BUG: KASAN: wild-memory-access in dmar_parse_one_rhsa (arch/x86/include/asm/bitops.h:214 …
-
Unscored —
sched/core: Do not requeue task on CPU excluded from cpus_mask
In the Linux kernel, the following vulnerability has been resolved: sched/core: Do not requeue task on CPU excluded from cpus_mask The following warning was triggered on a large machine early in boot on a distribution kernel but the same problem should also a…
-
Unscored —
ASoC: mt6359: Fix refcount leak bug
In the Linux kernel, the following vulnerability has been resolved: ASoC: mt6359: Fix refcount leak bug In mt6359_parse_dt() and mt6359_accdet_parse_dt(), we should call of_node_put() for the reference returned by of_get_child_by_name() which has increased th…
-
Unscored —
ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type()
In the Linux kernel, the following vulnerability has been resolved: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type() We should call of_node_put() for the reference before its replacement as it returned by of_get_parent() which has increase…
-
Unscored —
RDMA/rxe: Fix error unwind in rxe_create_qp()
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix error unwind in rxe_create_qp() In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like the spin locks are not setup until rxe_qp_…
-
Unscored —
staging: fbtft: core: set smem_len before fb_deferred_io_init call
In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: core: set smem_len before fb_deferred_io_init call The fbtft_framebuffer_alloc() calls fb_deferred_io_init() before initializing info->fix.smem_len. It is set to zero by the f…
-
Unscored —
usb: xhci_plat_remove: avoid NULL dereference
In the Linux kernel, the following vulnerability has been resolved: usb: xhci_plat_remove: avoid NULL dereference Since commit 4736ebd7fcaff1eb8481c140ba494962847d6e0a ("usb: host: xhci-plat: omit shared hcd if either root hub has no ports") xhci->shared_hcd …
-
Unscored —
RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup The function rxe_create_qp calls rxe_qp_from_init. If some error occurs, the error handler of function rxe_qp_from_init will set …
-
Unscored —
RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr()
In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() __qedr_alloc_mr() allocates a memory chunk for "mr->info.pbl_table" with init_mr_info(). When rdma_alloc_tid() and rdma_register_tid(…
-
Unscored —
driver core: fix potential deadlock in __driver_attach
In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential deadlock in __driver_attach In __driver_attach function, There are also AA deadlock problem, like the commit b232b02bf3c2 ("driver core: fix deadlock in __device_at…
-
Unscored —
mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg
In the Linux kernel, the following vulnerability has been resolved: mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg Free the skb if mt76u_bulk_msg fails in __mt76x02u_mcu_send_msg routine.
-
Unscored —
virtio-gpu: fix a missing check to avoid NULL dereference
In the Linux kernel, the following vulnerability has been resolved: virtio-gpu: fix a missing check to avoid NULL dereference 'cache_ent' could be set NULL inside virtio_gpu_cmd_get_capset() and it will lead to a NULL dereference by a lately use of it (i.e., …
-
Unscored —
drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() The last case label can write two buffers 'mc_reg_address[j]' and 'mc_data[j]' with 'j' offset equal to SMC_NISLANDS…
-
Unscored —
tools/power turbostat: Fix file pointer leak
In the Linux kernel, the following vulnerability has been resolved: tools/power turbostat: Fix file pointer leak Currently if a fscanf fails then an early return leaks an open file pointer. Fix this by fclosing the file before the return. Detected using stati…
-
Unscored —
md-raid10: fix KASAN warning
In the Linux kernel, the following vulnerability has been resolved: md-raid10: fix KASAN warning There's a KASAN warning in raid10_remove_disk when running the lvm test lvconvert-raid-reshape.sh. We fix this warning by verifying that the value "number" is val…
-
Unscored —
crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak For some sev ioctl interfaces, input may be passed that is less than or equal to SEV_FW_BLOB_MAX_SIZE, but lar…
-
Unscored —
ALSA: bcd2000: Fix a UAF bug on the error path of probing
In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix a UAF bug on the error path of probing When the driver fails in snd_card_register() at probe time, it will free the 'bcd2k->midi_out_urb' before killing it, which may cause…
-
Unscored —
vhost/vsock: Use kvmalloc/kvfree for larger packets.
In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: Use kvmalloc/kvfree for larger packets. When copying a large file over sftp over vsock, data size is usually 32kB, and kmalloc seems to fail to try to allocate 32 32kB regions. v…
-
Unscored —
md: Replace snprintf with scnprintf
In the Linux kernel, the following vulnerability has been resolved: md: Replace snprintf with scnprintf Current code produces a warning as shown below when total characters in the constituent block device names plus the slashes exceeds 200. snprintf() returns…
-
Unscored —
ASoC: qcom: Add checks for devm_kcalloc
In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Add checks for devm_kcalloc As the devm_kcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference.
-
Unscored —
perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() pci_get_device() will increase the reference count for the returned 'dev'. We need to call pci_dev_put() to decrease …
-
Unscored —
x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly When an extended state component is not present in fpstate, but in init state, the function copies from init_fpstate via copy_…
-
Unscored —
ALSA: ac97: fix possible memory leak in snd_ac97_dev_register()
In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() If device_register() fails in snd_ac97_dev_register(), it should call put_device() to give up reference, or the name allocated …
-
Unscored —
ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev()
In the Linux kernel, the following vulnerability has been resolved: ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() dev_set_name() in soundbus_add_one() allocates memory for name, it need be freed when of_device_register() fails, call soundbus…
-
Unscored —
scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID An error case exit from lpfc_cmpl_ct_cmd_gft_id() results in a call to lpfc_nlp_put() with a null pointer to a nodel…
-
Unscored —
iommu/vt-d: Clean up si_domain in the init_dmars() error path
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clean up si_domain in the init_dmars() error path A splat from kmem_cache_destroy() was seen with a kernel prior to commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mem…
-
Unscored —
ALSA: usb-audio: Fix potential memory leaks
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential memory leaks When the driver hits -ENOMEM at allocating a URB or a buffer, it aborts and goes to the error path that releases the all previously allocated resou…
-
Unscored —CVE-2022-50487 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
dm cache: Fix UAF in destroy()
In the Linux kernel, the following vulnerability has been resolved: dm cache: Fix UAF in destroy() Dm_cache also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in destroy().
-
Unscored —
fs: dlm: fix invalid derefence of sb_lvbptr
In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix invalid derefence of sb_lvbptr I experience issues when putting a lkbsb on the stack and have sb_lvbptr field to a dangled pointer while not using DLM_LKF_VALBLK. It will crash w…
-
Unscored —
tipc: fix an information leak in tipc_topsrv_kern_subscr
In the Linux kernel, the following vulnerability has been resolved: tipc: fix an information leak in tipc_topsrv_kern_subscr Use a 8-byte write to initialize sub.usr_handle in tipc_topsrv_kern_subscr(), otherwise four bytes remain uninitialized when issuing s…
-
Unscored —
dm thin: Use last transaction's pmd->root when commit failed
In the Linux kernel, the following vulnerability has been resolved: dm thin: Use last transaction's pmd->root when commit failed Recently we found a softlock up problem in dm thin pool btree lookup code due to corrupted metadata: Kernel panic - not syncing: s…
-
Unscored —
dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata
In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata Following concurrent processes: P1(drop cache) P2(kworker) drop_caches_sysctl_handler drop_slab shrink_slab down_read…
-
Unscored —
blk-mq: avoid double ->queue_rq() because of early timeout
In the Linux kernel, the following vulnerability has been resolved: blk-mq: avoid double ->queue_rq() because of early timeout David Jeffery found one double ->queue_rq() issue, so far it can be triggered in VM use case because of long vmexit latency or preem…
-
Unscored —
dm thin: Fix UAF in run_timer_softirq()
In the Linux kernel, the following vulnerability has been resolved: dm thin: Fix UAF in run_timer_softirq() When dm_resume() and dm_destroy() are concurrent, it will lead to UAF, as follows: BUG: KASAN: use-after-free in __run_timers+0x173/0x710 Write of size…
-
Unscored —
md/raid0, raid10: Don't set discard sectors for request queue
In the Linux kernel, the following vulnerability has been resolved: md/raid0, raid10: Don't set discard sectors for request queue It should use disk_stack_limits to get a proper max_discard_sectors rather than setting a value by stack drivers. And there is a …
-
Unscored —
perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() pci_get_device() will increase the reference count for the returned pci_dev, so snr_uncore_get_mc_dev() will return a …
-
Unscored —
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variable i is changed when setting random MAC address and causes invalid address access when printing the value of …
-
Unscored —
ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()
In the Linux kernel, the following vulnerability has been resolved: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() If clk_hw_register() fails, the corresponding clk should not be unregistered. To handle errors from loops, clean up part…
-
Unscored —
wifi: mt76: mt7921e: fix rmmod crash in driver reload test
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix rmmod crash in driver reload test In insmod/rmmod stress test, the following crash dump shows up immediately. The problem is caused by missing mt76_dev in mt7921_pci_…
-
Unscored —
md/raid1: stop mdx_raid1 thread when raid1 array run failed
In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdx_raid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdx_raid1 thread were not stop, Even if the associ…
-
Unscored —
bnxt_en: fix memory leak in bnxt_nvm_test()
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix memory leak in bnxt_nvm_test() Free the kzalloc'ed buffer before returning in the success path.
-
Unscored —
scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs During I/O and simultaneous cat of /sys/kernel/debug/lpfc/fnX/rx_monitor, a hard lockup similar to the call trace below ma…
-
Unscored —
scsi: smartpqi: Correct device removal for multi-actuator devices
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Correct device removal for multi-actuator devices Correct device count for multi-actuator drives which can cause kernel panics.
-
Unscored —
ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt I got a null-ptr-defer error report when I do the following tests on the qemu platform: make defconfig and CONFIG_PARPORT=m, CO…
-
Unscored —
wifi: rtw89: free unused skb to prevent memory leak
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: free unused skb to prevent memory leak This avoid potential memory leak under power saving mode.
-
Unscored —
ASoC: pxa: fix null-pointer dereference in filter()
In the Linux kernel, the following vulnerability has been resolved: ASoC: pxa: fix null-pointer dereference in filter() kasprintf() would return NULL pointer when kmalloc() fail to allocate. Need to check the return pointer before calling strcmp().
-
Unscored —
dm integrity: Fix UAF in dm_integrity_dtr()
In the Linux kernel, the following vulnerability has been resolved: dm integrity: Fix UAF in dm_integrity_dtr() Dm_integrity also has the same UAF problem when dm_resume() and dm_destroy() are concurrent. Therefore, cancelling timer again in dm_integrity_dtr(…
-
Unscored —
iavf: fix hang on reboot with ice
In the Linux kernel, the following vulnerability has been resolved: iavf: fix hang on reboot with ice When a system with E810 with existing VFs gets rebooted the following hang may be observed. Pid 1 is hung in iavf_remove(), part of a network driver: PID: 1 …
-
Unscored —
netfilter: ipset: Rework long task execution when adding/deleting entries
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Rework long task execution when adding/deleting entries When adding/deleting large number of elements in one step in ipset, it can take a reasonable amount of time and can r…
-
Unscored —
RDMA/irdma: Cap MSIX used to online CPUs + 1
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Cap MSIX used to online CPUs + 1 The irdma driver can use a maximum number of msix vectors equal to num_online_cpus() + 1 and the kernel warning stack below is shown if that numbe…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2055499
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2061703
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2078466
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2079311
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2084125
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2085300
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2090723
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2108691
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2108696
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2114937
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2116444
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2122228
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2122960
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2123056
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2123854
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2124788
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2127985
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2130141
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2131339
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2131391
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2133483
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2134377
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2134451
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2134506
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2134517
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2134528
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2137979
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2139728
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2140163
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2143893
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2143943
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2144720
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2150947
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2150960
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2150979
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2150999
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2151270