Fixed packages 136
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | bpftool-debuginfo | 0:7.2.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-64k-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-64k-debug-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-64k-debug-devel-matched | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-64k-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-64k-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-64k-devel-matched | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debug-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debug-devel-matched | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo-common-aarch64 | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo-common-ppc64le | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo-common-s390x | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo-common-x86_64 | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-devel-matched | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-doc | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-tools-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-zfcpdump-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-zfcpdump-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-zfcpdump-devel-matched | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | libperf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | perf | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | python3-perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | rtla | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | rv | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | bpftool | 0:7.2.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | bpftool-debuginfo | 0:7.2.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-debug | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-debug-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-debug-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-debug-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-debug-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-64k-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-abi-stablelists | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-uki-virt | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo-common-aarch64 | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo-common-ppc64le | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo-common-s390x | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo-common-x86_64 | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-tools | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-tools-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-tools-libs | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-uki-virt | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | libperf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | python3-perf | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | python3-perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | bpftool-debuginfo | 0:7.2.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-64k-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-64k-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo-common-aarch64 | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo-common-ppc64le | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo-common-s390x | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo-common-x86_64 | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-tools-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-tools-libs-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-zfcpdump-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | libperf | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | libperf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | python3-perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | bpftool-debuginfo | 0:7.2.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-debuginfo-common-x86_64 | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debug | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debug-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debug-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debug-kvm | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debug-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debug-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debug-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-kvm | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-rt-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | kernel-tools-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | libperf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::nfv | python3-perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | bpftool-debuginfo | 0:7.2.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-debuginfo-common-x86_64 | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-debug | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-debug-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-debug-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-debug-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-debug-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-debug-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-debug-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-devel | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-modules | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-modules-core | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-rt-modules-extra | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | kernel-tools-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | libperf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
| Red Hat · RHEL 9 enterprise_linux:9::realtime | python3-perf-debuginfo | 0:5.14.0-362.8.1.el9_3 |
Vulnerabilities 500
-
Critical 9.8
cifs: Fix oops due to uncleared server->smbd_conn in reconnect
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uncleared server->smbd_conn in reconnect In smbd_destroy(), clear the server->smbd_conn pointer after freeing the smbd_connection struct that it points to so that reconn…
-
Critical 9.8
nvmet: avoid potential UAF in nvmet_req_complete()
In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid potential UAF in nvmet_req_complete() An nvme target ->queue_response() operation implementation may free the request passed as argument. Such implementation potentially could re…
-
Critical 9.8
tipc: do not update mtu if msg_max is too small in mtu negotiation
In the Linux kernel, the following vulnerability has been resolved: tipc: do not update mtu if msg_max is too small in mtu negotiation When doing link mtu negotiation, a malicious peer may send Activate msg with a very small mtu, e.g. 4 in Shuang's testing, w…
-
Critical 9.8
ceph: fix potential use-after-free bug when trimming caps
In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session->s_cap_lock' is released in ceph_iterate_session_caps() the cap maybe removed by a…
-
Critical 9.8
SUNRPC: double free xprt_ctxt while still in use
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: double free xprt_ctxt while still in use When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is…
-
Critical 9.1
bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself sock_map proto callbacks should never call themselves by design. Protect against bugs like [1] and break out of the recursi…
-
High 8.8
mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths
In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths Any codepath that zaps page table entries must invoke MMU notifiers to ensure that secondary MMUs (like KVM) don't keep access…
-
High 8.8
wifi: mt76: connac: do not check WED status for non-mmio devices
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: connac: do not check WED status for non-mmio devices WED is supported just for mmio devices, so do not check it for usb or sdio devices. This patch fixes the crash reported below:…
-
High 8.8
scsi: ses: Handle enclosure with just a primary component gracefully
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling…
-
High 8.8
scsi: ses: Fix possible desc_ptr out-of-bounds accesses
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix possible desc_ptr out-of-bounds accesses Sanitize possible desc_ptr out-of-bounds accesses in ses_enclosure_data_process().
-
High 8.8
wifi: ath12k: Handle lock during peer_id find
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Handle lock during peer_id find ath12k_peer_find_by_id() requires that the caller hold the ab->base_lock. Currently the WBM error path does not hold the lock and calling that fu…
-
High 8.8
ice: fix wrong fallback logic for FDIR
In the Linux kernel, the following vulnerability has been resolved: ice: fix wrong fallback logic for FDIR When adding a FDIR filter, if ice_vc_fdir_set_irq_ctx returns failure, the inserted fdir entry will not be removed and if ice_vc_fdir_write_fltr returns…
-
High 8.8
iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
In the Linux kernel, the following vulnerability has been resolved: iommufd: Do not add the same hwpt to the ioas->hwpt_list twice The hwpt is added to the hwpt_list only during its creation, it is never added again. This hunk is some missed leftover from rew…
-
High 8.8
wifi: rtw88: use work to update rate to avoid RCU warning
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: use work to update rate to avoid RCU warning The ieee80211_ops::sta_rc_update must be atomic, because ieee80211_chan_bw_change() holds rcu_read lock while calling drv_sta_rc_upda…
-
High 8.8
KVM: s390: pv: fix index value of replaced ASCE
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the …
-
High 8.8
net/mlx5e: Don't clone flow post action attributes second time
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Don't clone flow post action attributes second time The code already clones post action attributes in mlx5e_clone_flow_attr_for_post_act(). Creating another copy in mlx5e_tc_post_a…
-
High 8.4
bus: mhi: host: Range check CHDBOFF and ERDBOFF
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Range check CHDBOFF and ERDBOFF If the value read from the CHDBOFF and ERDBOFF registers is outside the range of the MHI register space then an invalid address might be comput…
-
High 8.3
wifi: mt7601u: fix an integer underflow
In the Linux kernel, the following vulnerability has been resolved: wifi: mt7601u: fix an integer underflow Fix an integer underflow that leads to a null pointer dereference in 'mt7601u_rx_skb_from_seg()'. The variable 'dma_len' in the URB packet could be man…
-
High 8.2
Kernel: ebpf: insufficient stack type checks in dynptr
An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF …
-
High 8.2
netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one Eric Dumazet says: nf_conntrack_dccp_packet() has an unique: dh = skb_header_pointer(skb, dataoff, sizeof(_d…
-
High 8.2
sctp: fix a potential overflow in sctp_ifwdtsn_skip
In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data le…
-
High 8.2
netfilter: conntrack: fix wrong ct->timeout value
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: fix wrong ct->timeout value (struct nf_conn)->timeout is an interval before the conntrack confirmed. After confirmed, it becomes a timestamp. It is observed that timeout…
-
High 8.2
ipv6: Fix out-of-bounds access in ipv6_find_tlv()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bounds access in ipv6_find_tlv() optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on be…
-
High 8.1
wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info-…
-
High 8.1
scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043…
-
High 7.8
perf: Fix perf_pending_task() UaF
In the Linux kernel, the following vulnerability has been resolved: perf: Fix perf_pending_task() UaF Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases: - the task_work was already q…
-
High 7.8
memcg: fix possible use-after-free in memcg_write_event_control()
In the Linux kernel, the following vulnerability has been resolved: memcg: fix possible use-after-free in memcg_write_event_control() memcg_write_event_control() accesses the dentry->d_name of the specified control fd to route the write call. As a cgroup inte…
-
High 7.8
mm/hugetlb: fix PTE marker handling in hugetlb_change_protection()
In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix PTE marker handling in hugetlb_change_protection() Patch series "mm/hugetlb: uffd-wp fixes for hugetlb_change_protection()". Playing with virtio-mem and background snapshots (…
-
High 7.8
KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache
In the Linux kernel, the following vulnerability has been resolved: KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache Reject kvm_gpc_check() and kvm_gpc_refresh() if the cache is inactive. Not checking the active flag during refresh is part…
-
High 7.8
virtio-blk: Avoid use-after-free on suspend/resume
In the Linux kernel, the following vulnerability has been resolved: virtio-blk: Avoid use-after-free on suspend/resume hctx->user_data is set to vq in virtblk_init_hctx(). However, vq is freed on suspend and reallocated on resume. So, hctx->user_data is inval…
-
High 7.8
NFSv4/pnfs: Fix a use-after-free bug in open
In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: Fix a use-after-free bug in open If someone cancels the open RPC call, then we must not try to free either the open slot or the layoutget operation arguments, since they are likel…
-
High 7.8
firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails When scpi probe fails, at any point, we need to ensure that the scpi_info is not set and will remain NULL until the pro…
-
High 7.8
selinux: Add boundary check in put_entry()
In the Linux kernel, the following vulnerability has been resolved: selinux: Add boundary check in put_entry() Just like next_entry(), boundary check is necessary to prevent memory out-of-bound access.
-
High 7.8
io_uring/af_unix: defer registered files gc to io_uring release
In the Linux kernel, the following vulnerability has been resolved: io_uring/af_unix: defer registered files gc to io_uring release Instead of putting io_uring's registered files in unix_gc() we want it to be done by io_uring itself. The trick here is to cons…
-
High 7.8
drm/amdkfd: Fix double release compute pasid
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix double release compute pasid If kfd_process_device_init_vm returns failure after vm is converted to compute vm and vm->pasid set to compute pasid, KFD will not take pdd->drm_f…
-
High 7.8
block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq Commit 64dc8c732f5c ("block, bfq: fix possible uaf for 'bfqq->bic'") will access 'bic->bfqq' in bic_set_bfqq(), however, bfq_exit_icq_bfqq() …
-
High 7.8
cifs: fix oops during encryption
In the Linux kernel, the following vulnerability has been resolved: cifs: fix oops during encryption When running xfstests against Azure the following oops occurred on an arm64 system Unable to handle kernel write to read-only memory at virtual address ffff00…
-
High 7.8
drm/amdkfd: Fix kfd_process_device_init_vm error handling
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kfd_process_device_init_vm error handling Should only destroy the ib_mem and let process cleanup worker to free the outstanding BOs. Reset the pointer in pdd->qpd structure, t…
-
High 7.8
drm/amdgpu: SDMA update use unlocked iterator
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: SDMA update use unlocked iterator SDMA update page table may be called from unlocked context, this generate below warning. Use unlocked iterator to handle this case. WARNING: CPU:…
-
High 7.8
iomap: iomap: fix memory corruption when recording errors during writeback
In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00…
-
High 7.8
drm: bridge: adv7511: unregister cec i2c device after cec adapter
In the Linux kernel, the following vulnerability has been resolved: drm: bridge: adv7511: unregister cec i2c device after cec adapter cec_unregister_adapter() assumes that the underlying adapter ops are callable. For example, if the CEC adapter currently has …
-
High 7.8
ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage()
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() There is an use-after-free reported by KASAN: BUG: KASAN: use-after-free in acpi_ut_remove_reference+0x3b/0x82 Read of size 1…
-
High 7.8
drm/vmwgfx: Validate the box size for the snooped cursor
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Validate the box size for the snooped cursor Invalid userspace dma surface copies could potentially overflow the memcpy from the surface to the snooped image leading to crashes. T…
-
High 7.8
block, bfq: fix possible uaf for 'bfqq->bic'
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible uaf for 'bfqq->bic' Our test report a uaf for 'bfqq->bic' in 5.10: ================================================================== BUG: KASAN: use-after-free in bf…
-
High 7.8
drm/amdkfd: Fix memory leakage
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leakage This patch fixes potential memory leakage and seg fault in _gpuvm_import_dmabuf() function
-
High 7.8
bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data In tcp_bpf_send_verdict() redirection, the eval variable is assigned to __SK_REDIRECT after the apply_bytes data is sent,…
-
High 7.8
RDMA/rxe: Fix mr->map double free
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix mr->map double free rxe_mr_cleanup() which tries to free mr->map again will be called when rxe_mr_init_user() fails: CPU: 0 PID: 4917 Comm: rdma_flush_serv Kdump: loaded Not tai…
-
High 7.8
mm: hugetlb: fix UAF in hugetlb_handle_userfault
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: fix UAF in hugetlb_handle_userfault The vma_lock and hugetlb_fault_mutex are dropped before handling userfault and reacquire them again after handle_userfault(), but reacquire th…
-
High 7.8
bpf: Fix reference state management for synchronous callbacks
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference state management for synchronous callbacks Currently, verifier verifies callback functions (sync and async) as if they will be executed once, (i.e. it explores execution st…
-
High 7.8
drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure In case mipi_dsi_attach() fails, call drm_panel_remove() to avoid memory leak.
-
High 7.8
nvme-pci: fix mempool alloc size
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix mempool alloc size Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many…
-
High 7.8
RDMA/restrack: Release MR restrack when delete
In the Linux kernel, the following vulnerability has been resolved: RDMA/restrack: Release MR restrack when delete The MR restrack also needs to be released when delete it, otherwise it cause memory leak as the task struct won't be released.
-
High 7.8
A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations s…
-
High 7.8CVE-2023-3609 Public exploit
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. If tcf_change_indev() fails, u32_set_parms() will immediately return an error after incrementing or decrementing the refe…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_route component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instanc…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_fw component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of th…
-
High 7.8
Use-after-free in Linux kernel's net/sched: cls_u32 component
A use-after-free vulnerability in the Linux kernel's net/sched: cls_u32 component can be exploited to achieve local privilege escalation. When u32_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of …
-
High 7.8
sched/psi: Fix use-after-free in ep_remove_wait_queue()
In the Linux kernel, the following vulnerability has been resolved: sched/psi: Fix use-after-free in ep_remove_wait_queue() If a non-root cgroup gets removed when there is a thread that registered trigger and is polling on a pressure file within the cgroup, t…
-
High 7.8
drm/i915: Avoid potential vm use-after-free
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Avoid potential vm use-after-free Adding the vm to the vm_xa table makes it visible to userspace, which could try to race with us to close the vm. So we need to take our extra refer…
-
High 7.8
drm/i915: Fix request ref counting during error capture & debugfs dump
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix request ref counting during error capture & debugfs dump When GuC support was added to error capture, the reference counting around the request object was broken. Fix it up. The…
-
High 7.8
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative inde…
-
High 7.8
drm/amdkfd: Add sync after creating vram bo
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add sync after creating vram bo There will be data corruption on vram allocated by svm if the initialization is not complete and application is writting on the memory. Adding sync…
-
High 7.8
RDMA/core: Fix ib block iterator counter overflow
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix ib block iterator counter overflow When registering a new DMA MR after selecting the best aligned page size for it, we iterate over the given sglist to split each entry to smal…
-
High 7.8
Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()"
In the Linux kernel, the following vulnerability has been resolved: Revert "wifi: mac80211: fix memory leak in ieee80211_if_add()" This reverts commit 13e5afd3d773c6fc6ca2b89027befaaaa1ea7293. ieee80211_if_free() is already called from free_netdev(ndev) becau…
-
High 7.8
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Fix potential use-after-free in work function When a reset notify IPC message is received, the ISR schedules a work function and passes the ISHTP device to it via a g…
-
High 7.8
perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output syzkaller reportes a KASAN issue with stack-out-of-bounds. The call trace is as follows: dump_stack+…
-
High 7.8
mptcp: use the workqueue to destroy unaccepted sockets
In the Linux kernel, the following vulnerability has been resolved: mptcp: use the workqueue to destroy unaccepted sockets Christoph reported a UaF at token lookup time after having refactored the passive socket initialization part: BUG: KASAN: use-after-free…
-
High 7.8
drm/shmem-helper: Remove another errant put in error path
In the Linux kernel, the following vulnerability has been resolved: drm/shmem-helper: Remove another errant put in error path drm_gem_shmem_mmap() doesn't own reference in error code path, resulting in the dma-buf shmem GEM object getting prematurely freed le…
-
High 7.8
drm/i915/active: Fix misuse of non-idle barriers as fence trackers
In the Linux kernel, the following vulnerability has been resolved: drm/i915/active: Fix misuse of non-idle barriers as fence trackers Users reported oopses on list corruptions when using i915 perf with a number of concurrently running graphics applications. …
-
High 7.8
mptcp: fix UaF in listener shutdown
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix UaF in listener shutdown As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path is prone to an UaF issue. BUG: KASAN: …
-
High 7.8
drm/amdkfd: Fix an illegal memory access
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix an illegal memory access In the kfd_wait_on_events() function, the kfd_event_waiter structure is allocated by alloc_event_waiters(), but the event field of the waiter structur…
-
High 7.8
ext4: fix WARNING in ext4_update_inline_data
In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in ext4_update_inline_data Syzbot found the following issue: EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. fscr…
-
High 7.8
ice: xsk: disable txq irq before flushing hw
In the Linux kernel, the following vulnerability has been resolved: ice: xsk: disable txq irq before flushing hw ice_qp_dis() intends to stop a given queue pair that is a target of xsk pool attach/detach. One of the steps is to disable interrupts on these que…
-
High 7.8
veth: Fix use after free in XDP_REDIRECT
In the Linux kernel, the following vulnerability has been resolved: veth: Fix use after free in XDP_REDIRECT Commit 718a18a0c8a6 ("veth: Rework veth_xdp_rcv_skb in order to accept non-linear skb") introduced a bug where it tried to use pskb_expand_head() if t…
-
High 7.8
rxrpc: Make it so that a waiting process can be aborted
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Make it so that a waiting process can be aborted When sendmsg() creates an rxrpc call, it queues it to wait for a connection and channel to be assigned and then waits before it can sta…
-
High 7.8
cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
In the Linux kernel, the following vulnerability has been resolved: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels The cacheinfo sets up the shared_cpu_map by checking whether the caches with the same index are shared between CPUs. …
-
High 7.8
scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() The function mpi3mr_get_all_tgt_info() has four issues: 1) It calculates valid entry length in alltgt_info assuming the header part of th…
-
High 7.8
PCI: Fix use-after-free in pci_bus_release_domain_nr()
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free in pci_bus_release_domain_nr() Commit c14f7ccc9f5d ("PCI: Assign PCI domain IDs by ida_alloc()") introduced a use-after-free bug in the bus removal cleanup. The issue …
-
High 7.8
scsi: mpi3mr: Use number of bits to manage bitmap sizes
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use number of bits to manage bitmap sizes To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bit…
-
High 7.8
scsi: ufs: core: Fix device management cmd timeout flow
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix device management cmd timeout flow In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times…
-
High 7.8
mlx5: fix possible ptp queue fifo use-after-free
In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possib…
-
High 7.8
netfilter: nf_tables: do not ignore genmask when looking up chain by id
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not ignore genmask when looking up chain by id When adding a rule to a chain referring to its ID, if that chain had been deleted on the same batch, the rule might end…
-
High 7.8
iavf: Fix use-after-free in free_netdev
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix use-after-free in free_netdev We do netif_napi_add() for all allocated q_vectors[], but potentially do netif_napi_del() for part of them, then kfree q_vectors and leave invalid poin…
-
High 7.8
netfilter: nft_set_rbtree: fix null deref on element insertion
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix null deref on element insertion There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem(): general protection fault, probably for non-ca…
-
High 7.8
scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed"
In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed" The "atomic_inc(&cmd->device->iorequest_cnt)" in scsi_queue_rq() would cause kernel panic because cmd…
-
High 7.8
ext4: fix possible double unlock when moving a directory
In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible double unlock when moving a directory
-
High 7.8
nvme-tcp: don't access released socket during error recovery
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery While the error recovery work is temporarily failing reconnect attempts, running the 'nvme list' command causes a kernel NULL poin…
-
High 7.8
drm/i915/perf: add sentinel to xehp_oa_b_counters
In the Linux kernel, the following vulnerability has been resolved: drm/i915/perf: add sentinel to xehp_oa_b_counters Arrays passed to reg_in_range_table should end with empty record. The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-…
-
High 7.8
tcp: fix skb_copy_ubufs() vs BIG TCP
In the Linux kernel, the following vulnerability has been resolved: tcp: fix skb_copy_ubufs() vs BIG TCP David Ahern reported crashes in skb_copy_ubufs() caused by TCP tx zerocopy using hugepages, and skb length bigger than ~68 KB. skb_copy_ubufs() assumed it…
-
High 7.8
drm/amd/display: fix mapping to non-allocated address
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix mapping to non-allocated address [Why] There is an issue mapping non-allocated location of memory. It would allocate gpio registers from an array out of bounds. [How] Pat…
-
High 7.8
iommufd: IOMMUFD_DESTROY should not increase the refcount
In the Linux kernel, the following vulnerability has been resolved: iommufd: IOMMUFD_DESTROY should not increase the refcount syzkaller found a race where IOMMUFD_DESTROY increments the refcount: obj = iommufd_get_object(ucmd->ictx, cmd->id, IOMMUFD_OBJ_ANY);…
-
High 7.8
drm/amdkfd: fix potential kgd_mem UAFs
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix potential kgd_mem UAFs kgd_mem pointers returned by kfd_process_device_translate_handle are only guaranteed to be valid while p->mutex is held. As soon as the mutex is unlocke…
-
High 7.8
ASoC: soc-compress: Reposition and add pcm_mutex
In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-compress: Reposition and add pcm_mutex If panic_on_warn is set and compress stream(DPCM) is started, then kernel panic occurred because card->pcm_mutex isn't held appropriately. In …
-
High 7.8
net/mlx5e: Use correct encap attribute during invalidation
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use correct encap attribute during invalidation With introduction of post action infrastructure most of the users of encap attribute had been modified in order to obtain the correc…
-
High 7.8
blk-cgroup: hold queue_lock when removing blkg->q_node
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: hold queue_lock when removing blkg->q_node When blkg is removed from q->blkg_list from blkg_free_workfn(), queue_lock has to be held, otherwise, all kinds of bugs(list corruption,…
-
High 7.8
netfilter: nf_tables: always release netdev hooks from notifier
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always release netdev hooks from notifier This reverts "netfilter: nf_tables: skip netdev events generated on netns removal". The problem is that when a veth device is r…
-
High 7.8
drm/i915: fix race condition UAF in i915_perf_add_config_ioctl
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if …
-
High 7.8
net/sched: flower: fix filter idr initialization
In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: fix filter idr initialization The cited commit moved idr initialization too early in fl_change() which allows concurrent users to access the filter that is still being init…
-
High 7.8
net/mlx5e: TC, Fix using eswitch mapping in nic mode
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix using eswitch mapping in nic mode Cited patch is using the eswitch object mapping pool while in nic mode where it isn't initialized. This results in the trace below [0]. Fi…
-
High 7.8
scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization Commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") introduced an array mrioc->evtack_cmds but initialization of t…
-
High 7.8
mlx5: fix skb leak while fifo resync and push
In the Linux kernel, the following vulnerability has been resolved: mlx5: fix skb leak while fifo resync and push During ptp resync operation SKBs were poped from the fifo but were never freed neither by napi_consume nor by dev_kfree_skb_any. Add call to napi…
-
High 7.8
ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Create card with device-managed snd_devm_card_new() snd_card_ymfpci_remove() was removed in commit c6e6bb5eab74 ("ALSA: ymfpci: Allocate resources with device-managed APIs"), bu…
-
High 7.8
dm flakey: don't corrupt the zero page
In the Linux kernel, the following vulnerability has been resolved: dm flakey: don't corrupt the zero page When we need to zero some range on a block device, the function __blkdev_issue_zero_pages submits a write bio with the bio vector pointing to the zero p…
-
High 7.6
wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace A received TKIP key may be up to 32 bytes because it may contain MIC rx/tx keys too. These are not used by iwl and copy…
-
High 7.5
seg6: fix the iif in the IPv6 socket control block
In the Linux kernel, the following vulnerability has been resolved: seg6: fix the iif in the IPv6 socket control block When an IPv4 packet is received, the ip_rcv_core(...) sets the receiving interface index into the IPv4 socket control block (v5.16-rc4, net/…
-
High 7.5
xprtrdma: treat all calls not a bcall when bc_serv is NULL
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: treat all calls not a bcall when bc_serv is NULL When a rdma server returns a fault format reply, nfs v3 client may treats it as a bcall when bc service is not exist. The debug mess…
-
High 7.5
IB/mad: Don't call to function that might sleep while in atomic context
In the Linux kernel, the following vulnerability has been resolved: IB/mad: Don't call to function that might sleep while in atomic context Tracepoints are not allowed to sleep, as such the following splat is generated due to call to ib_query_pkey() in atomic…
-
High 7.5
RDMA/rxe: Fix "kernel NULL pointer dereference" error
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix "kernel NULL pointer dereference" error When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized. Because of cr…
-
High 7.5
wifi: ath10k: Delay the unmapping of the buffer
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still proces…
-
High 7.5
tcp: fix a signed-integer-overflow bug in tcp_add_backlog()
In the Linux kernel, the following vulnerability has been resolved: tcp: fix a signed-integer-overflow bug in tcp_add_backlog() The type of sk_rcvbuf and sk_sndbuf in struct sock is int, and in tcp_add_backlog(), the variable limit is caculated by adding sk_r…
-
High 7.5
RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix NULL-ptr-deref in rxe_qp_do_cleanup() when socket create failed There is a null-ptr-deref when mount.cifs over rdma: BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup+0x2f3/0x360 …
-
High 7.5
net: fix NULL pointer in skb_segment_list
In the Linux kernel, the following vulnerability has been resolved: net: fix NULL pointer in skb_segment_list Commit 3a1296a38d0c ("net: Support GRO/GSO fraglist chaining.") introduced UDP listifyed GRO. The segmentation relies on frag_list being untouched wh…
-
High 7.5
net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL sndbuf_desc in smc_cdc_tx_handler() When performing a stress test on SMC-R by rmmod mlx5_ib driver during the wrk/nginx test, we found that there is a probability of trigger…
-
High 7.5
udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated().
In the Linux kernel, the following vulnerability has been resolved: udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). syzbot reported [0] a null-ptr-deref in sk_get_rmem0() while using IPPROTO_UDPLITE (0x88): 14:25:52 executing program 1: r…
-
High 7.5
mptcp: fix NULL pointer dereference on fastopen early fallback
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer dereference on fastopen early fallback In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock …
-
High 7.5
net: tls: avoid hanging tasks on the tx_lock
In the Linux kernel, the following vulnerability has been resolved: net: tls: avoid hanging tasks on the tx_lock syzbot sent a hung task report and Eric explains that adversarial receiver may keep RWIN at 0 for a long time, so we are not guaranteed to make fo…
-
High 7.3
KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
In the Linux kernel, the following vulnerability has been resolved: KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler We do check for target CPU == -1, but this might change at the time we are going to use it. Hold the physical target …
-
High 7.3
ASoC: lpass: Fix for KASAN use_after_free out of bounds
In the Linux kernel, the following vulnerability has been resolved: ASoC: lpass: Fix for KASAN use_after_free out of bounds When we run syzkaller we get below Out of Bounds error. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace o…
-
High 7.3
drm/i915/gvt: fix gvt debugfs destroy
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gvt: fix gvt debugfs destroy When gvt debug fs is destroyed, need to have a sane check if drm minor's debugfs root is still available or not, otherwise in case like device remove thr…
-
High 7.1
wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921s: fix slab-out-of-bounds access in sdio host SDIO may need addtional 511 bytes to align bus operation. If the tailroom of this skb is not big enough, we would access invali…
-
High 7.1CVE-2023-1380 EPSS 16%
A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/c…
-
High 7.1
A use-after-free flaw was found in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel.…
-
High 7.1
A use-after-free flaw was found in r592_remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. Thi…
-
High 7.1
An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c …
-
High 7.1
wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta Avoid potential data corruption issues caused by uninitialized driver private data structures.
-
High 7.1
octeontx2-af: Add validation for lmac type
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac…
-
High 7.1
crypto: qat - fix out-of-bounds read
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix out-of-bounds read When preparing an AER-CTR request, the driver copies the key provided by the user into a data structure that is accessible by the firmware. If the target …
-
High 7.0
tpm: fix reference counting for struct tpm_chip
In the Linux kernel, the following vulnerability has been resolved: tpm: fix reference counting for struct tpm_chip The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM com…
-
High 7.0
ipmi: fix use after free in _ipmi_destroy_user()
In the Linux kernel, the following vulnerability has been resolved: ipmi: fix use after free in _ipmi_destroy_user() The intf_free() function frees the "intf" pointer so we cannot dereference it again on the next line.
-
High 7.0
Kernel: use after free bug in btsdio_remove due to race condition
A use-after-free flaw was found in btsdio_remove in drivers\bluetooth\btsdio.c in the Linux Kernel. A call to btsdio_remove with an unfinished job may cause a race problem which leads to a UAF on hdev devices.
-
High 7.0CVE-2023-3640 Public exploit
Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space
A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize p…
-
High 7.0
virtio_net: Fix error unwinding of XDP initialization
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix error unwinding of XDP initialization When initializing XDP in virtnet_open(), some rq xdp initialization may hit an error causing net device open failed. However, previous rq…
-
Medium 6.8
A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconn…
-
Medium 6.7
Kernel: vmwgfx: race condition leading to information disclosure vulnerability
A race condition vulnerability was found in the vmwgfx driver in the Linux kernel. The flaw exists within the handling of GEM objects. The issue results from improper locking when performing operations on an object. This flaw allows a local privileged user to…
-
Medium 6.7
Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects
A double-free vulnerability was found in handling vmw_buffer_object objects in the vmwgfx driver in the Linux kernel. This issue occurs due to the lack of validating the existence of an object prior to performing further free operations on the object, which m…
-
Medium 6.6
A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a…
-
Medium 6.5
Information exposure through microarchitectural state after transient execution in certain vector execution units for s…
-
Medium 6.5
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency…
-
Medium 6.4
The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/net/ethernet/qualcomm/emac/e…
-
Medium 6.3
There is an UAF vulnerability in vmwgfx driver
A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the…
-
Medium 6.3
There is an UAF vulnerability in vmwgfx driver
A use-after-free(UAF) vulnerability was found in function 'vmw_execbuf_tie_context' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account …
-
Medium 6.3
A use-after-free flaw was found in xgene_hwmon_remove in drivers/hwmon/xgene-hwmon.c in the Hardware Monitoring Linux K…
-
Medium 6.0
Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entry
A flaw was found in the exFAT driver of the Linux kernel. The vulnerability exists in the implementation of the file name reconstruction function, which is responsible for reading file name entries from a directory index and merging file name parts belonging …
-
Medium 5.5
rtc: pl031: fix rtc features null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: rtc: pl031: fix rtc features null pointer dereference When there is no interrupt line, rtc alarm feature is disabled. The clearing of the alarm feature bit was being done prior to allocations…
-
Medium 5.5
NFSv4: Don't hold the layoutget locks across multiple RPC calls
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Don't hold the layoutget locks across multiple RPC calls When doing layoutget as part of the open() compound, we have to be careful to release the layout locks before we can call any f…
-
Medium 5.5
regulator: scmi: Fix refcount leak in scmi_regulator_probe
In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: Fix refcount leak in scmi_regulator_probe of_find_node_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when done. Add missing of…
-
Medium 5.5
mm/mempolicy: fix uninit-value in mpol_rebind_policy()
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix uninit-value in mpol_rebind_policy() mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_m…
-
Medium 5.5
i2c: piix4: Fix a memory leak in the EFCH MMIO support
In the Linux kernel, the following vulnerability has been resolved: i2c: piix4: Fix a memory leak in the EFCH MMIO support The recently added support for EFCH MMIO regions introduced a memory leak in that code path. The leak is caused by the fact that release…
-
Medium 5.5
irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions of_find_node_by_phandle() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need an…
-
Medium 5.5
irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions of_get_child_by_name() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anym…
-
Medium 5.5
ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo()
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() In an unlikely (and probably wrong?) case that the 'ppi' parameter of ata_host_alloc_pinfo() points to an array starting wit…
-
Medium 5.5
dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
In the Linux kernel, the following vulnerability has been resolved: dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init If the function sdma_load_context() fails, the sdma_desc will be freed, but the allocated desc->bd is forgot to be freed.…
-
Medium 5.5
perf/x86/amd: fix potential integer overflow on shift of a int
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd: fix potential integer overflow on shift of a int The left shift of int 32 bit integer constant 1 is evaluated using 32 bit arithmetic and then passed as a 64 bit function argume…
-
Medium 5.5
cpufreq: CPPC: Add u64 casts to avoid overflowing
In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Add u64 casts to avoid overflowing The fields of the _CPC object are unsigned 32-bits values. To avoid overflows while using _CPC's values, add 'u64' casts.
-
Medium 5.5
device property: fix of node refcount leak in fwnode_graph_get_next_endpoint()
In the Linux kernel, the following vulnerability has been resolved: device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() The 'parent' returned by fwnode_graph_get_port_parent() with refcount incremented when 'prev' is not NULL, it ne…
-
Medium 5.5
VMCI: Use threaded irqs instead of tasklets
In the Linux kernel, the following vulnerability has been resolved: VMCI: Use threaded irqs instead of tasklets The vmci_dispatch_dgs() tasklet function calls vmci_read_data() which uses wait_event() resulting in invalid sleep in an atomic context (and theref…
-
Medium 5.5
bpf: Fix memory leaks in __check_func_call
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memory leaks in __check_func_call kmemleak reports this issue: unreferenced object 0xffff88817139d000 (size 2048): comm "test_progs", pid 33246, jiffies 4307381979 (age 45851.820s) h…
-
Medium 5.5
scsi: scsi_transport_sas: Fix error handling in sas_phy_add()
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_transport_sas: Fix error handling in sas_phy_add() If transport_add_device() fails in sas_phy_add(), the kernel will crash trying to delete the device in transport_remove_device() …
-
Medium 5.5
net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfg
In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix memory leak in ipc_pcie_read_bios_cfg ipc_pcie_read_bios_cfg() is using the acpi_evaluate_dsm() to obtain the wwan power state configuration from BIOS but is not freeing …
-
Medium 5.5
drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram()
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix NULL pointer dereference in svm_migrate_to_ram() ./drivers/gpu/drm/amd/amdkfd/kfd_migrate.c:985:58-62: ERROR: p is NULL but dereferenced.
-
Medium 5.5
bpf: Fix wrong reg type conversion in release_reference()
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix wrong reg type conversion in release_reference() Some helper functions will allocate memory. To avoid memory leaks, the verifier requires the eBPF program to release these memories b…
-
Medium 5.5
bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE
In the Linux kernel, the following vulnerability has been resolved: bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE When using bpftool to pin {PROG, MAP, LINK} without FILE, segmentation fault will occur. The reson is that the la…
-
Medium 5.5
bpf, verifier: Fix memory leak in array reallocation for stack state
In the Linux kernel, the following vulnerability has been resolved: bpf, verifier: Fix memory leak in array reallocation for stack state If an error (NULL) is returned by krealloc(), callers of realloc_array() were setting their allocation pointers to NULL, b…
-
Medium 5.5
ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
In the Linux kernel, the following vulnerability has been resolved: ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() Change num_ghes from int to unsigned int, preventing an overflow and causing subsequent vmalloc() to fail. The overflow happens in…
-
Medium 5.5
floppy: Fix memory leak in do_floppy_init()
In the Linux kernel, the following vulnerability has been resolved: floppy: Fix memory leak in do_floppy_init() A memory leak was reported when floppy_alloc_disk() failed in do_floppy_init(). unreferenced object 0xffff888115ed25a0 (size 8): comm "modprobe", p…
-
Medium 5.5
cifs: Fix xid leak in cifs_create()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_create() If the cifs already shutdown, we should free the xid before return, otherwise, the xid will be leaked.
-
Medium 5.5
net: sched: sfb: fix null pointer access issue when sfb_init() fails
In the Linux kernel, the following vulnerability has been resolved: net: sched: sfb: fix null pointer access issue when sfb_init() fails When the default qdisc is sfb, if the qdisc of dev_queue fails to be inited during mqprio_init(), sfb_reset() is invoked t…
-
Medium 5.5
usb: dwc3: core: fix some leaks in probe
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: fix some leaks in probe The dwc3_get_properties() function calls: dwc->usb_psy = power_supply_get_by_name(usb_psy_name); so there is some additional clean up required on thes…
-
Medium 5.5
wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init()
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: add missing unregister_netdev() in wilc_netdev_ifc_init() Fault injection test reports this issue: kernel BUG at net/core/dev.c:10731! invalid opcode: 0000 [#1] PREEMPT SMP KA…
-
Medium 5.5
drm/vkms: Fix null-ptr-deref in vkms_release()
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix null-ptr-deref in vkms_release() A null-ptr-deref is triggered when it tries to destroy the workqueue in vkms->output.composer_workq in vkms_release(). KASAN: null-ptr-deref in …
-
Medium 5.5
cifs: Fix memory leak when build ntlmssp negotiate blob failed
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory leak when build ntlmssp negotiate blob failed There is a memory leak when mount cifs: unreferenced object 0xffff888166059600 (size 448): comm "mount.cifs", pid 51391, jiffies…
-
Medium 5.5
tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak
In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak In crb_acpi_add(), we get the TPM2 table to retrieve information like start method, and then assign them to the priv data, so …
-
Medium 5.5
drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning ca…
-
Medium 5.5
mm/mempolicy: fix memory leak in set_mempolicy_home_node system call
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix memory leak in set_mempolicy_home_node system call When encountering any vma in the range with policy other than MPOL_BIND or MPOL_PREFERRED_MANY, an error is returned witho…
-
Medium 5.5
irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init()
In the Linux kernel, the following vulnerability has been resolved: irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() If of_iomap() failed, 'aic' should be freed before return. Otherwise there is a memory leak.
-
Medium 5.5
A flaw possibility of memory leak in the Linux kernel cpu_entry_area mapping of X86 CPU data to memory was found in the…
-
Medium 5.5
A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a us…
-
Medium 5.5
A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion …
-
Medium 5.5
A use-after-free flaw was found in the Linux kernel’s core dump subsystem. This flaw allows a local user to crash the s…
-
Medium 5.5
A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height gr…
-
Medium 5.5
A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub (ISH) driver. This issue could allow a…
-
Medium 5.5
Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to directly dereference a NULL pointer in xfrm_update_ae_params(), leading to a possible kernel …
-
Medium 5.5
Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, lea…
-
Medium 5.5
Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid
A flaw was found in the Linux kernel's TUN/TAP functionality. This issue could allow a local user to bypass network filters and gain unauthorized access to some resources. The original patches fixing CVE-2023-1076 are incorrect or incomplete. The problem is t…
-
Medium 5.5
HV: hv_balloon: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: HV: hv_balloon: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things si…
-
Medium 5.5
usb: typec: ucsi: Don't attempt to resume the ports before they exist
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Don't attempt to resume the ports before they exist This will fix null pointer dereference that was caused by the driver attempting to resume ports that were not yet registe…
-
Medium 5.5
net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is not freed when an allocation of a key fails. BUG: memory …
-
Medium 5.5
x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
In the Linux kernel, the following vulnerability has been resolved: x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL Baoquan reported that after triggering a crash the subsequent crash-kernel fails to boot about half of the time. It triggers a NULL pointe…
-
Medium 5.5
acpi: Fix suspend with Xen PV
In the Linux kernel, the following vulnerability has been resolved: acpi: Fix suspend with Xen PV Commit f1e525009493 ("x86/boot: Skip realmode init code when running as Xen PV guest") missed one code path accessing real_mode_header, leading to dereferencing …
-
Medium 5.5
drm/i915: Fix a memory leak with reused mmap_offset
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix a memory leak with reused mmap_offset drm_vma_node_allow() and drm_vma_node_revoke() should be called in balanced pairs. We call drm_vma_node_allow() once per-file everytime a u…
-
Medium 5.5
ptdma: pt_core_execute_cmd() should use spinlock
In the Linux kernel, the following vulnerability has been resolved: ptdma: pt_core_execute_cmd() should use spinlock The interrupt handler (pt_core_irq_handler()) of the ptdma driver can be called from interrupt context. The code flow in this function can lea…
-
Medium 5.5
dmaengine: tegra: Fix memory leak in terminate_all()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix memory leak in terminate_all() Terminate vdesc when terminating an ongoing transfer. This will ensure that the vdesc is present in the desc_terminated list The descripto…
-
Medium 5.5
HID: betop: check shape of output reports
In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields.…
-
Medium 5.5
driver core: location: Free struct acpi_pld_info *pld before return false
In the Linux kernel, the following vulnerability has been resolved: driver core: location: Free struct acpi_pld_info *pld before return false struct acpi_pld_info *pld should be freed before the return of allocation failure, to prevent memory leak, add the AC…
-
Medium 5.5
ext4: Fix function prototype mismatch for ext4_feat_ktype
In the Linux kernel, the following vulnerability has been resolved: ext4: Fix function prototype mismatch for ext4_feat_ktype With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected functio…
-
Medium 5.5
net/smc: fix deadlock triggered by cancel_delayed_work_syn()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix deadlock triggered by cancel_delayed_work_syn() The following LOCKDEP was detected: Workqueue: events smc_lgr_free_work [smc] WARNING: possible circular locking dependency detect…
-
Medium 5.5
nfsd: call op_release, even when op_func returns an error
In the Linux kernel, the following vulnerability has been resolved: nfsd: call op_release, even when op_func returns an error For ops with "trivial" replies, nfsd4_encode_operation will shortcut most of the encoding work and skip to just marshalling up the st…
-
Medium 5.5
scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to connect Fibre Channel LUNs to the host system and present them in a guest VM as a SCSI device. I/…
-
Medium 5.5
ASoC: fsl_mqs: move of_node_put() to the correct location
In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl_mqs: move of_node_put() to the correct location of_node_put() should have been done directly after mqs_priv->regmap = syscon_node_to_regmap(gpr_np); otherwise it creates a reference…
-
Medium 5.5
blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none After grabbing q->sysfs_lock, q->elevator may become NULL because of elevator switch. Fix the NULL dereference on q->elev…
-
Medium 5.5
sctp: check send stream number after wait_for_sndbuf
In the Linux kernel, the following vulnerability has been resolved: sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the client starts…
-
Medium 5.5
md/raid10: fix leak of 'r10bio->remaining' for recovery
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio->remaining' for recovery raid10_sync_request() will add 'r10bio->remaining' for both rdev and replacement rdev. However, if the read io fails, recovery_request_…
-
Medium 5.5
KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Handle kvm_arm_init failure correctly in finalize_pkvm Currently there is no synchronisation between finalize_pkvm() and kvm_arm_init() initcalls. The finalize_pkvm() proceeds hap…
-
Medium 5.5
USB: chipidea: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: USB: chipidea: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things sim…
-
Medium 5.5
USB: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: USB: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just…
-
Medium 5.5
block: be a bit more careful in checking for NULL bdev while polling
In the Linux kernel, the following vulnerability has been resolved: block: be a bit more careful in checking for NULL bdev while polling Wei reports a crash with an application using polled IO: PGD 14265e067 P4D 14265e067 PUD 47ec50067 PMD 0 Oops: 0000 [#1] S…
-
Medium 5.5
irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4
In the Linux kernel, the following vulnerability has been resolved: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 The T241 platform suffers from the T241-FABRIC-4 erratum which causes unexpected behavior in the GIC when multiple transactions are …
-
Medium 5.5
drivers: base: dd: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: drivers: base: dd: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things…
-
Medium 5.5
ALSA: hda: Fix Oops by 9.1 surround channel names
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with …
-
Medium 5.5
trace/blktrace: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: trace/blktrace: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things si…
-
Medium 5.5
drivers: base: component: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: drivers: base: component: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make…
-
Medium 5.5
USB: ULPI: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: USB: ULPI: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler…
-
Medium 5.5
wifi: iwlwifi: fw: fix memory leak in debugfs
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fw: fix memory leak in debugfs Fix a memory leak that occurs when reading the fw_info file all the way, since we return NULL indicating no more data, but don't free the status …
-
Medium 5.5
wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup Fix device unregister memory leak and alway cleanup all configured rx queues in mt76_dma_tx_cleanup routine.
-
Medium 5.5
net: add vlan_get_protocol_and_depth() helper
In the Linux kernel, the following vulnerability has been resolved: net: add vlan_get_protocol_and_depth() helper Before blamed commit, pskb_may_pull() was used instead of skb_header_pointer() in __vlan_get_protocol() and friends. Few callers depended on skb-…
-
Medium 5.5
media: uvcvideo: Handle cameras with invalid descriptors
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Handle cameras with invalid descriptors If the source entity does not contain any pads, do not create a link.
-
Medium 5.5
mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak
In the Linux kernel, the following vulnerability has been resolved: mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak In arizona_clk32k_enable(), we should use pm_runtime_resume_and_get() as pm_runtime_get_sync() will increase the refcnt ev…
-
Medium 5.5
Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.
A flaw was found in the blkgs destruction path in block/blk-cgroup.c in the Linux kernel, leading to a cgroup blkio memory leakage problem. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn(), which is called when th…
-
Medium 5.5
Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos
A denial of service vulnerability due to a deadlock was found in sctp_auto_asconf_init in net/sctp/socket.c in the Linux kernel’s SCTP subsystem. This flaw allows guests with local user privileges to trigger a deadlock and potentially crash the system.
-
Medium 5.3
Linux Kernel Driver memory.c use after free
A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. …
-
Medium 5.3
Linux Kernel BPF r8152.c intr_callback logging of excessive data
A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function intr_callback of the file drivers/net/usb/r8152.c of the component BPF. The manipulation leads to logging of excessive data. The att…
-
Medium 5.3
Sev-es / sev-snp vmgexit double fetch vulnerability
A flaw was found in KVM AMD Secure Encrypted Virtualization (SEV) in the Linux kernel. A KVM guest using SEV-ES or SEV-SNP with multiple vCPUs can trigger a double fetch race condition vulnerability and invoke the `VMGEXIT` handler recursively. If an attacker…
-
Medium 5.1
Info Leak in l2cap_core in the Linux Kernel
There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers remotely. We recommend upgrading past commit https://github.com/torvalds/linux/commit/b1a2cd50c0357f…
-
Medium 4.7
af_unix: Fix a data-race in unix_dgram_peer_wake_me().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). unix_dgram_poll() calls unix_dgram_peer_wake_me() without `other`'s lock held and check if its receive queue is full. Here we need to us…
-
Medium 4.7
In the Linux kernel before 6.1.13, there is a double free in net/mpls/af_mpls.c upon an allocation failure (for registe…
-
Medium 4.6
Linux Kernel Bluetooth l1oip_core.c del_timer use after free
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recomme…
-
Low 3.3
A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessin…
-
Unscored —
gpiolib: fix memory leak in gpiochip_setup_dev()
In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix memory leak in gpiochip_setup_dev() Here is a backtrace report about memory leak detected in gpiochip_setup_dev(): unreferenced object 0xffff88810b406400 (size 512): comm "python…
-
Unscored —
char: tpm: Protect tpm_pm_suspend with locks
In the Linux kernel, the following vulnerability has been resolved: char: tpm: Protect tpm_pm_suspend with locks Currently tpm transactions are executed unconditionally in tpm_pm_suspend() function, which may lead to races with other tpm accessors in the syst…
-
Unscored —
ixgbevf: Fix resource leak in ixgbevf_init_module()
In the Linux kernel, the following vulnerability has been resolved: ixgbevf: Fix resource leak in ixgbevf_init_module() ixgbevf_init_module() won't destroy the workqueue created by create_singlethread_workqueue() when pci_register_driver() failed. Add destroy…
-
Unscored —
dax: make sure inodes are flushed before destroy cache
In the Linux kernel, the following vulnerability has been resolved: dax: make sure inodes are flushed before destroy cache A bug can be triggered by following command $ modprobe nd_pmem && modprobe -r nd_pmem [ 10.060014] BUG dax_cache (Not tainted): Objects …
-
Unscored —
watch_queue: Actually free the watch
In the Linux kernel, the following vulnerability has been resolved: watch_queue: Actually free the watch free_watch() does everything barring actually freeing the watch object. Fix this by adding the missing kfree. kmemleak produces a report something like th…
-
Unscored —
watch_queue: Fix NULL dereference in error cleanup
In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix NULL dereference in error cleanup In watch_queue_set_size(), the error cleanup code doesn't take account of the fact that __free_page() can't handle a NULL pointer when tryin…
-
Unscored —
net: ipv6: unexport __init-annotated seg6_hmac_init()
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: unexport __init-annotated seg6_hmac_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot …
-
Unscored —
virtio_net: fix xdp_rxq_info bug after suspend/resume
In the Linux kernel, the following vulnerability has been resolved: virtio_net: fix xdp_rxq_info bug after suspend/resume The following sequence currently causes a driver bug warning when using virtio_net: # ip link set eth0 up # echo mem > /sys/power/state (…
-
Unscored —
filemap: Handle sibling entries in filemap_get_read_batch()
In the Linux kernel, the following vulnerability has been resolved: filemap: Handle sibling entries in filemap_get_read_batch() If a read races with an invalidation followed by another read, it is possible for a folio to be replaced with a higher-order folio.…
-
Unscored —
drm/amd/display: Fix optc2_configure warning on dcn314
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix optc2_configure warning on dcn314 [Why] dcn314 uses optc2_configure_crc() that wraps optc1_configure_crc() + set additional registers not applicable to dcn314. It's not c…
-
Unscored —
KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign()
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix eventfd error handling in kvm_xen_eventfd_assign() Should not call eventfd_ctx_put() in case of error. [Introduce new goto target instead. - Paolo]
-
Unscored —
rethook: fix a potential memleak in rethook_alloc()
In the Linux kernel, the following vulnerability has been resolved: rethook: fix a potential memleak in rethook_alloc() In rethook_alloc(), the variable rh is not freed or passed out if handler is NULL, which could lead to a memleak, fix it. [Masami: Add "ret…
-
Unscored —
drbd: use after free in drbd_create_device()
In the Linux kernel, the following vulnerability has been resolved: drbd: use after free in drbd_create_device() The drbd_destroy_connection() frees the "connection" so use the _safe() iterator to prevent a use after free.
-
Unscored —
drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker()
In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref in drm_vblank_destroy_worker() drm_vblank_init() call drmm_add_action_or_reset() with drm_vblank_init_release() as action. If __drmm_add_action() failed, wil…
-
Unscored —
cifs: fix small mempool leak in SMB2_negotiate()
In the Linux kernel, the following vulnerability has been resolved: cifs: fix small mempool leak in SMB2_negotiate() In some cases of failure (dialect mismatches) in SMB2_negotiate(), after the request is sent, the checks would return -EIO when they should be…
-
Unscored —
xfrm: policy: fix metadata dst->dev xmit null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: fix metadata dst->dev xmit null pointer dereference When we try to transmit an skb with metadata_dst attached (i.e. dst->dev == NULL) through xfrm interface we can hit a null po…
-
Unscored —
nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Fix use-after-free bugs caused by pn532_cmd_timeout When the pn532 uart device is detaching, the pn532_uart_remove() is called. But there are no functions in pn532_uart_remove() t…
-
Unscored —
net: genl: fix error path memory leak in policy dumping
In the Linux kernel, the following vulnerability has been resolved: net: genl: fix error path memory leak in policy dumping If construction of the array of policies fails when recording non-first policy we need to unwind. netlink_policy_dump_add_policy() itse…
-
Unscored —
net: atlantic: fix aq_vec index out of range error
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: fix aq_vec index out of range error The final update statement of the for loop exceeds the array range, the dereference of self->aq_vec[i] is not checked and then leads to the …
-
Unscored —
cifs: Fix memory leak on the deferred close
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory leak on the deferred close xfstests on smb21 report kmemleak as below: unreferenced object 0xffff8881767d6200 (size 64): comm "xfs_io", pid 1284, jiffies 4294777434 (age 20.7…
-
Unscored —
locking/csd_lock: Change csdlock_debug from early_param to __setup
In the Linux kernel, the following vulnerability has been resolved: locking/csd_lock: Change csdlock_debug from early_param to __setup The csdlock_debug kernel-boot parameter is parsed by the early_param() function csdlock_debug(). If set, csdlock_debug() inv…
-
Unscored —
cifs: Fix memory leak when using fscache
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory leak when using fscache If we hit the 'index == next_cached' case, we leak a refcount on the struct page. Fix this by using readahead_folio() which takes care of the refcount…
-
Unscored —
watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource
In the Linux kernel, the following vulnerability has been resolved: watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource Unlike release_mem_region(), a call to release_resource() does not free the resource, so it has to be freed explicitly to avoid a…
-
Unscored —
vfio: Split migration ops from main device ops
In the Linux kernel, the following vulnerability has been resolved: vfio: Split migration ops from main device ops vfio core checks whether the driver sets some migration op (e.g. set_state/get_state) and accordingly calls its op. However, currently mlx5 driv…
-
Unscored —
RDMA/rxe: Fix error unwind in rxe_create_qp()
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix error unwind in rxe_create_qp() In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like the spin locks are not setup until rxe_qp_…
-
Unscored —
RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix BUG: KASAN: null-ptr-deref in rxe_qp_do_cleanup The function rxe_create_qp calls rxe_qp_from_init. If some error occurs, the error handler of function rxe_qp_from_init will set …
-
Unscored —
regulator: of: Fix refcount leak bug in of_get_regulation_constraints()
In the Linux kernel, the following vulnerability has been resolved: regulator: of: Fix refcount leak bug in of_get_regulation_constraints() We should call the of_node_put() for the reference returned by of_get_child_by_name() which has increased the refcount.
-
Unscored —
selinux: fix memleak in security_read_state_kernel()
In the Linux kernel, the following vulnerability has been resolved: selinux: fix memleak in security_read_state_kernel() In this function, it directly returns the result of __security_read_policy without freeing the allocated memory in *data, cause memory lea…
-
Unscored —
cpufreq: qcom: fix writes in read-only memory region
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fix writes in read-only memory region This commit fixes a kernel oops because of a write in some read-only memory: [ 9.068287] Unable to handle kernel write to read-only memory…
-
Unscored —
usb: typec: tcpci: fix of node refcount leak in tcpci_register_port()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() I got the following report while doing device(mt6370-tcpc) load test with CONFIG_OF_UNITTEST and CONFIG_OF_DYNAMIC enable…
-
Unscored —
usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq
In the Linux kernel, the following vulnerability has been resolved: usb: xhci-mtk: fix leakage of shared hcd when fail to set wakeup irq Can not set the @shared_hcd to NULL before decrease the usage count by usb_put_hcd(), this will cause the shared hcd not r…
-
Unscored —
memory: of: Fix refcount leak bug in of_get_ddr_timings()
In the Linux kernel, the following vulnerability has been resolved: memory: of: Fix refcount leak bug in of_get_ddr_timings() We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refc…
-
Unscored —
regulator: core: fix use_count leakage when handling boot-on
In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix use_count leakage when handling boot-on I found a use_count leakage towards supply regulator of rdev with boot-on option. ┌───────────────────┐ ┌───────────────────┐ │ re…
-
Unscored —
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() This patch fixes a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is pass…
-
Unscored —
drm/vkms: Fix memory leak in vkms_init()
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix memory leak in vkms_init() A memory leak was reported after the vkms module install failed. unreferenced object 0xffff88810bc28520 (size 16): comm "modprobe", pid 9662, jiffies …
-
Unscored —
media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in ra…
-
Unscored —
drm/radeon: Add the missed acpi_put_table() to fix memory leak
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Add the missed acpi_put_table() to fix memory leak When the radeon driver reads the bios information from ACPI table in radeon_acpi_vfct_bios(), it misses to call acpi_put_table()…
-
Unscored —
power: supply: fix null pointer dereferencing in power_supply_get_battery_info
In the Linux kernel, the following vulnerability has been resolved: power: supply: fix null pointer dereferencing in power_supply_get_battery_info when kmalloc() fail to allocate memory in kasprintf(), propname will be NULL, strcmp() called by of_get_property…
-
Unscored —
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.p…
-
Unscored —
drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs
In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: fix a memory leak in generate_lfp_data_ptrs When (size != 0 || ptrs->lvds_ entries != 3), the program tries to free() the ptrs. However, the ptrs is not created by calling kzma…
-
Unscored —CVE-2022-50290 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
io_uring/msg_ring: Fix NULL pointer dereference in io_msg_send_fd()
In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: Fix NULL pointer dereference in io_msg_send_fd() Syzkaller produced the below call trace: BUG: KASAN: null-ptr-deref in io_msg_ring+0x3cb/0x9f0 Write of size 8 at addr 0000…
-
Unscored —
wifi: ath9k: verify the expected usb_endpoints are present
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: verify the expected usb_endpoints are present The bug arises when a USB device claims to be an ATH9K but doesn't have the expected endpoints. (In this case there was an interrupt…
-
Unscored —
drm/bridge: megachips: Fix a null pointer dereference bug
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: megachips: Fix a null pointer dereference bug When removing the module we will get the following warning: [ 31.911505] i2c-core: driver [stdp2690-ge-b850v3-fw] unregistered [ 31.9…
-
Unscored —
perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() pci_get_device() will increase the reference count for the returned 'dev'. We need to call pci_dev_put() to decrease …
-
Unscored —
rtc: msc313: Fix function prototype mismatch in msc313_rtc_probe()
In the Linux kernel, the following vulnerability has been resolved: rtc: msc313: Fix function prototype mismatch in msc313_rtc_probe() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expecte…
-
Unscored —
ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value The return value of acpi_fetch_acpi_dev() could be NULL, which would cause a NULL pointer dereference to occur in acpi_device_h…
-
Unscored —
remoteproc: imx_dsp_rproc: Add mutex protection for workqueue
In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_dsp_rproc: Add mutex protection for workqueue The workqueue may execute late even after remoteproc is stopped or stopping, some resources (rpmsg device and endpoint) have been…
-
Unscored —
memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings()
In the Linux kernel, the following vulnerability has been resolved: memory: of: Fix refcount leak bug in of_lpddr3_get_ddr_timings() We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease t…
-
Unscored —
clk: tegra20: Fix refcount leak in tegra20_clock_init
In the Linux kernel, the following vulnerability has been resolved: clk: tegra20: Fix refcount leak in tegra20_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add mi…
-
Unscored —
gpiolib: cdev: fix NULL-pointer dereferences
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix NULL-pointer dereferences There are several places where we can crash the kernel by requesting lines, unbinding the GPIO device, then calling any of the system calls releva…
-
Unscored —
clk: tegra: Fix refcount leak in tegra210_clock_init
In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra210_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add mis…
-
Unscored —
cifs: Fix xid leak in cifs_flock()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_flock() If not flock, before return -ENOLCK, should free the xid, otherwise, the xid will be leaked.
-
Unscored —
mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2()
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() As comment of pci_get_device() says, it returns a pci_device with its refcount increased. We need to call pci_dev_put() to…
-
Unscored —
xhci: Remove device endpoints from bandwidth list when freeing the device
In the Linux kernel, the following vulnerability has been resolved: xhci: Remove device endpoints from bandwidth list when freeing the device Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed. If xHC…
-
Unscored —
cpufreq: Init completion before kobject_init_and_add()
In the Linux kernel, the following vulnerability has been resolved: cpufreq: Init completion before kobject_init_and_add() In cpufreq_policy_alloc(), it will call uninitialed completion in cpufreq_sysfs_release() when kobject_init_and_add() fails. And that wi…
-
Unscored —
RDMA/core: Make sure "ib_port" is valid when access sysfs node
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Make sure "ib_port" is valid when access sysfs node The "ib_port" structure must be set before adding the sysfs kobject, and reset after removing it, otherwise it may crash when ac…
-
Unscored —
rtc: class: Fix potential memleak in devm_rtc_allocate_device()
In the Linux kernel, the following vulnerability has been resolved: rtc: class: Fix potential memleak in devm_rtc_allocate_device() devm_rtc_allocate_device() will alloc a rtc_device first, and then run dev_set_name(). If dev_set_name() failed, the rtc_device…
-
Unscored —
drm/amd: fix potential memory leak
In the Linux kernel, the following vulnerability has been resolved: drm/amd: fix potential memory leak This patch fix potential memory leak (clk_src) when function run into last return NULL. s/free/kfree/ - Alex
-
Unscored —
iommu/vt-d: Clean up si_domain in the init_dmars() error path
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Clean up si_domain in the init_dmars() error path A splat from kmem_cache_destroy() was seen with a kernel prior to commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mem…
-
Unscored —
drm/mipi-dsi: Detach devices when removing the host
In the Linux kernel, the following vulnerability has been resolved: drm/mipi-dsi: Detach devices when removing the host Whenever the MIPI-DSI host is unregistered, the code of mipi_dsi_host_unregister() loops over every device currently found on that bus and …
-
Unscored —
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
In the Linux kernel, the following vulnerability has been resolved: thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash When CPU 0 is offline and intel_powerclamp is used to inject idle, it generates kernel BUG: BUG: using sm…
-
Unscored —
iommu/amd: Fix pci device refcount leak in ppr_notifier()
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix pci device refcount leak in ppr_notifier() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller m…
-
Unscored —
perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init()
In the Linux kernel, the following vulnerability has been resolved: perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() arm_smmu_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove t…
-
Unscored —
drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix memory leak in hpd_rx_irq_create_workqueue() If construction of the array of work queues to handle hpd_rx_irq offload work fails, we need to unwind. Destroy all the created wo…
-
Unscored —
drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios()
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix PCI device refcount leak in radeon_atrm_get_bios() As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the i…
-
Unscored —
drm/amdgpu: Fix size validation for non-exclusive domains (v4)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix size validation for non-exclusive domains (v4) Fix amdgpu_bo_validate_size() to check whether the TTM domain manager for the requested memory exists, else we get a kernel oops…
-
Unscored —
scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() In mpt3sas_transport_port_add(), if sas_rphy_add() returns error, sas_rphy_free() needs be called to free the resour…
-
Unscored —
drm/amd/display: Fix potential null-deref in dm_resume
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential null-deref in dm_resume [Why] Fixing smatch error: dm_resume() error: we previously assumed 'aconnector->dc_link' could be null [How] Check if dc_link null at t…
-
Unscored —
dmaengine: qcom-adm: fix wrong sizeof config in slave_config
In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom-adm: fix wrong sizeof config in slave_config Fix broken slave_config function that uncorrectly compare the peripheral_size with the size of the config pointer instead of the s…
-
Unscored —
usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info()
In the Linux kernel, the following vulnerability has been resolved: usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() xhci_alloc_stream_info() allocates stream context array for stream_info ->stream_ctx_array with xhci_alloc_stream_ctx().…
-
Unscored —
blk-iolatency: Fix memory leak on add_disk() failures
In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix memory leak on add_disk() failures When a gendisk is successfully initialized but add_disk() fails such as when a loop device has invalid number of minor device numbers spe…
-
Unscored —
drm: Fix potential null-ptr-deref due to drmm_mode_config_init()
In the Linux kernel, the following vulnerability has been resolved: drm: Fix potential null-ptr-deref due to drmm_mode_config_init() drmm_mode_config_init() will call drm_mode_create_standard_properties() and won't check the ret value. When drm_mode_create_st…
-
Unscored —
regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode
In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode Commit faa87ce9196d ("regmap-irq: Introduce config registers for irq types") added the num_config_regs, then com…
-
Unscored —
tpm: acpi: Call acpi_put_table() to fix memory leak
In the Linux kernel, the following vulnerability has been resolved: tpm: acpi: Call acpi_put_table() to fix memory leak The start and length of the event log area are obtained from TPM2 or TCPA table, so we call acpi_get_table() to get the ACPI information, b…
-
Unscored —
class: fix possible memory leak in __class_register()
In the Linux kernel, the following vulnerability has been resolved: class: fix possible memory leak in __class_register() If class_add_groups() returns error, the 'cp->subsys' need be unregister, and the 'cp' need be freed. We can not call kset_unregister() h…
-
Unscored —
regulator: core: Prevent integer underflow
In the Linux kernel, the following vulnerability has been resolved: regulator: core: Prevent integer underflow By using a ratio of delay to poll_enabled_time that is not integer time_remaining underflows and does not exit the loop as expected. As delay could …
-
Unscored —
regulator: core: Use different devices for resource allocation and DT lookup
In the Linux kernel, the following vulnerability has been resolved: regulator: core: Use different devices for resource allocation and DT lookup Following by the below discussion, there's the potential UAF issue between regulator and mfd. https://lore.kernel.…
-
Unscored —
drm/amdgpu/powerplay/psm: Fix memory leak in power state init
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/powerplay/psm: Fix memory leak in power state init Commit 902bc65de0b3 ("drm/amdgpu/powerplay/psm: return an error in power state init") made the power state init function return e…
-
Unscored —
drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr()
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leak in kfd_mem_dmamap_userptr() If the number of pages from the userptr BO differs from the SG BO then the allocated memory for the SG table doesn't get freed before r…
-
Unscored —
media: dvb-usb: fix memory leak in dvb_usb_adapter_init()
In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: fix memory leak in dvb_usb_adapter_init() Syzbot reports a memory leak in "dvb_usb_adapter_init()". The leak is due to not accounting for and freeing current iteration's adapt…
-
Unscored —
wifi: ath11k: fix monitor mode bringup crash
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix monitor mode bringup crash When the interface is brought up in monitor mode, it leads to NULL pointer dereference crash. This crash happens when the packet type is extracted…
-
Unscored —
drm/gud: Fix UBSAN warning
In the Linux kernel, the following vulnerability has been resolved: drm/gud: Fix UBSAN warning UBSAN complains about invalid value for bool: [ 101.165172] [drm] Initialized gud 1.0.0 20200422 for 2-3.2:1.0 on minor 1 [ 101.213360] gud 2-3.2:1.0: [drm] fb1: gu…
-
Unscored —
drivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init()
In the Linux kernel, the following vulnerability has been resolved: drivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init() tad_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. R…
-
Unscored —
usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init of_icc_get() alloc resources for path handle, we should release it when not need anymore. Like the release in dwc3_qcom_interco…
-
Unscored —
PCI: Fix pci_device_is_present() for VFs by checking PF
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_device_is_present() for VFs by checking PF pci_device_is_present() previously didn't work for VFs because it reads the Vendor and Device ID, which are 0xffff for VFs, which looks…
-
Unscored —
io-wq: Fix memory leak in worker creation
In the Linux kernel, the following vulnerability has been resolved: io-wq: Fix memory leak in worker creation If the CPU mask allocation for a node fails, then the memory allocated for the 'io_wqe' struct of the current node doesn't get freed on the error han…
-
Unscored —
cifs: Fix xid leak in cifs_copy_file_range()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_copy_file_range() If the file is used by swap, before return -EOPNOTSUPP, should free the xid, otherwise, the xid will be leaked.
-
Unscored —
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() As the comment of pci_get_domain_bus_and_slot() says, it returns a PCI device with refcount incremented, so it doesn't need to call an e…
-
Unscored —
cpufreq: qcom: fix memory leak in error path
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fix memory leak in error path If for some reason the speedbin length is incorrect, then there is a memory leak in the error path because we never free the speedbin buffer. This…
-
Unscored —
drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl() If the copy of the description string from userspace fails, then the page for the instance descriptor doesn't get freed before returning…
-
Unscored —
arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored
In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored Prior to commit 69e3b846d8a7 ("arm64: mte: Sync tags for pages where PTE is untagged"), mte_sync_tags() was only called …
-
Unscored —
selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()
In the Linux kernel, the following vulnerability has been resolved: selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() The following warning was triggered on a hardware environment: SELinux: Converting 162 SID table entries... BUG: sle…
-
Unscored —
USB: gadget: Fix use-after-free during usb config switch
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: Fix use-after-free during usb config switch In the process of switching USB config from rndis to other config, if the hardware does not support the ->pullup callback, or the hard…
-
Unscored —
io_uring/rw: defer fsnotify calls to task context
In the Linux kernel, the following vulnerability has been resolved: io_uring/rw: defer fsnotify calls to task context We can't call these off the kiocb completion as that might be off soft/hard irq context. Defer the calls to when we process the task_work for…
-
Unscored —
ice: set tx_tstamps when creating new Tx rings via ethtool
In the Linux kernel, the following vulnerability has been resolved: ice: set tx_tstamps when creating new Tx rings via ethtool When the user changes the number of queues via ethtool, the driver allocates new rings. This allocation did not initialize tx_tstamp…
-
Unscored —
devlink: hold region lock when flushing snapshots
In the Linux kernel, the following vulnerability has been resolved: devlink: hold region lock when flushing snapshots Netdevsim triggers a splat on reload, when it destroys regions with snapshots pending: WARNING: CPU: 1 PID: 787 at net/core/devlink.c:6291 de…
-
Unscored —
drm/amdgpu: fix pci device refcount leak
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix pci device refcount leak As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the…
-
Unscored —
dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg
In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg The calling convention for pre_slave_sg is to return NULL on error and provide an error log to the system. Qcom-adm instead…
-
Unscored —
regulator: core: fix resource leak in regulator_register()
In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix resource leak in regulator_register() I got some resource leak reports while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 100, of_no…
-
Unscored —
s390/lcs: Fix return type of lcs_start_xmit()
In the Linux kernel, the following vulnerability has been resolved: s390/lcs: Fix return type of lcs_start_xmit() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer pr…
-
Unscored —
usb: idmouse: fix an uninit-value in idmouse_open
In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..…
-
Unscored —
wifi: mt76: do not run mt76u_status_worker if the device is not running
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: do not run mt76u_status_worker if the device is not running Fix the following NULL pointer dereference avoiding to run mt76u_status_worker thread if the device is not running yet.…
-
Unscored —
wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that …
-
Unscored —
drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the i…
-
Unscored —
rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
In the Linux kernel, the following vulnerability has been resolved: rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() Running rcutorture with non-zero fqs_duration module parameter in a kernel built with CONFIG_PREEMPTION=y results in …
-
Unscored —
netdevsim: fix memory leak in nsim_bus_dev_new()
In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in nsim_bus_dev_new() If device_register() failed in nsim_bus_dev_new(), the value of reference in nsim_bus_dev->dev is 1. obj->name in nsim_bus_dev->dev will not b…
-
Unscored —
amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
In the Linux kernel, the following vulnerability has been resolved: amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() In the PP_OD_EDIT_VDDC_CURVE case the "input_index" variable is capped at 2 but not checked for negative values so it results…
-
Unscored —
wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: fix potential NULL-ptr deref after clone If cloning the SKB fails, don't try to use it, but rather return as if we should pass it. Coverity CID: 1503456
-
Unscored —
xhci: dbc: Fix memory leak in xhci_alloc_dbc()
In the Linux kernel, the following vulnerability has been resolved: xhci: dbc: Fix memory leak in xhci_alloc_dbc() If DbC is already in use, then the allocated memory for the xhci_dbc struct doesn't get freed before returning NULL, which leads to a memleak.
-
Unscored —
net: hsr: avoid possible NULL deref in skb_clone()
In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid possible NULL deref in skb_clone() syzbot got a crash [1] in skb_clone(), caused by a bug in hsr_get_untagged_frame(). When/if create_stripped_skb_hsr() returns NULL, we must …
-
Unscored —
udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
In the Linux kernel, the following vulnerability has been resolved: udmabuf: Set ubuf->sg = NULL if the creation of sg table fails When userspace tries to map the dmabuf and if for some reason (e.g. OOM) the creation of the sg table fails, ubuf->sg needs to b…
-
Unscored —
perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init()
In the Linux kernel, the following vulnerability has been resolved: perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() dmc620_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. Remove t…
-
Unscored —
clk: tegra: Fix refcount leak in tegra114_clock_init
In the Linux kernel, the following vulnerability has been resolved: clk: tegra: Fix refcount leak in tegra114_clock_init of_find_matching_node() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add mis…
-
Unscored —
tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak
In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak In check_acpi_tpm2(), we get the TPM2 table just to make sure the table is there, not used after the init, so the acpi_put_tab…
-
Unscored —
usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() I got the following report while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 4, of_no…
-
Unscored —
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() It is possible that skb is freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and we try to free skb again. It caus…
-
Unscored —
wifi: wilc1000: fix potential memory leak in wilc_mac_xmit()
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix potential memory leak in wilc_mac_xmit() The wilc_mac_xmit() returns NETDEV_TX_OK without freeing skb, add dev_kfree_skb() to fix it. Compile tested only.
-
Unscored —
drm/virtio: Check whether transferred 2D BO is shmem
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Check whether transferred 2D BO is shmem Transferred 2D BO always must be a shmem BO. Add check for that to prevent NULL dereference if userspace passes a VRAM BO.
-
Unscored —
drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the …
-
Unscored —
drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe During device boot, the HPD interrupt could be triggered before the DRM subsystem registers it6505 as a DRM bridge. In such case…
-
Unscored —
cifs: Fix xid leak in cifs_ses_add_channel()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_ses_add_channel() Before return, should free the xid, otherwise, the xid will be leaked.
-
Unscored —
bpf: prevent decl_tag from being referenced in func_proto
In the Linux kernel, the following vulnerability has been resolved: bpf: prevent decl_tag from being referenced in func_proto Syzkaller was able to hit the following issue: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3609 at kernel/bpf/btf.c:194…
-
Unscored —
gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init()
In the Linux kernel, the following vulnerability has been resolved: gpu: lontium-lt9611: Fix NULL pointer dereference in lt9611_connector_init() A NULL check for bridge->encoder shows that it may be NULL, but it already been dereferenced on all paths leading …
-
Unscored —
wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() This patch fixes a use-after-free in ath9k that occurs in ath9k_hif_usb_disconnect() when ath9k_destroy_wmi() is trying to access…
-
Unscored —
media: uvcvideo: Fix memory leak in uvc_gpio_parse
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix memory leak in uvc_gpio_parse Previously the unit buffer was allocated before checking the IRQ for privacy GPIO. In case of error, the unit buffer was leaked. Allocate th…
-
Unscored —
bpf: Prevent decl_tag from being referenced in func_proto arg
In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent decl_tag from being referenced in func_proto arg Syzkaller managed to hit another decl_tag issue: btf_func_proto_check kernel/bpf/btf.c:4506 [inline] btf_check_all_types kernel/b…
-
Unscored —
In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as t…
-
Unscored —CVE-2023-1206 Public exploit
A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a use…
-
Unscored —
A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network subcomponent in the L…
-
Unscored —
A flaw was found in the networking subsystem of the Linux kernel within the handling of the RPL protocol. This issue re…
-
Unscored —
A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_c…
-
Unscored —
A NULL pointer dereference issue was found in the gfs2 file system in the Linux kernel. It occurs on corrupt gfs2 file …
-
Unscored —CVE-2023-35825 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-3141. Reason: This candidate is a reservation duplicate of CVE-2…
-
Unscored —CVE-2023-52734 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
bpf: Skip invalid kfunc call in backtrack_insn
In the Linux kernel, the following vulnerability has been resolved: bpf: Skip invalid kfunc call in backtrack_insn The verifier skips invalid kfunc call in check_kfunc_call(), which would be captured in fixup_kfunc_call() if such insn is not eliminated by dea…
-
Unscored —
bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener A listening socket linked to a sockmap has its sk_prot overridden. It points to one of the struct proto variants in tcp_bp…
-
Unscored —
bpf: Skip task with pid=1 in send_signal_common()
In the Linux kernel, the following vulnerability has been resolved: bpf: Skip task with pid=1 in send_signal_common() The following kernel panic can be triggered when a task with pid=1 attaches a prog that attempts to send killing signal to itself, also see […
-
Unscored —
ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
In the Linux kernel, the following vulnerability has been resolved: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() if (!type) continue; if (type > RTAX_MAX) return -EINVAL; ... metrics[type - 1] = val; @type being used as an array index, we…
-
Unscored —
bnxt: Do not read past the end of test names
In the Linux kernel, the following vulnerability has been resolved: bnxt: Do not read past the end of test names Test names were being concatenated based on a offset beyond the end of the first name, which tripped the buffer overflow detection logic: detected…
-
Unscored —
thermal: core: call put_device() only after device_register() fails
In the Linux kernel, the following vulnerability has been resolved: thermal: core: call put_device() only after device_register() fails put_device() shouldn't be called before a prior call to device_register(). __thermal_cooling_device_register() doesn't foll…
-
Unscored —
bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation To mitigate Spectre v4, 2039f26f3aca ("bpf: Fix leakage due to insufficient speculative store bypass mitigation")…
-
Unscored —CVE-2023-53025 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
powerpc/imc-pmu: Fix use of mutex in IRQs disabled section
In the Linux kernel, the following vulnerability has been resolved: powerpc/imc-pmu: Fix use of mutex in IRQs disabled section Current imc-pmu code triggers a WARNING with CONFIG_DEBUG_ATOMIC_SLEEP and CONFIG_PROVE_LOCKING enabled, while running a thread_imc …
-
Unscored —
drm/amdgpu: Fix call trace warning and hang when removing amdgpu device
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix call trace warning and hang when removing amdgpu device On GPUs with RAS enabled, below call trace and hang are observed when shutting down device. v2: use DRM device unplugge…
-
Unscored —
scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read()
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() If kzalloc() fails in lpfc_sli4_cgn_params_read(), then we rely on lpfc_read_object()'s routine to NULL check pdata. Currently, an e…
-
Unscored —
drm/amd/display: Do not set DRR on pipe Commit
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not set DRR on pipe Commit [WHY] Writing to DRR registers such as OTG_V_TOTAL_MIN on the same frame as a pipe commit can cause underflow.
-
Unscored —
dm stats: check for and propagate alloc_percpu failure
In the Linux kernel, the following vulnerability has been resolved: dm stats: check for and propagate alloc_percpu failure Check alloc_precpu()'s return value and return an error from dm_stats_init() if it fails. Update alloc_dev() to fail if dm_stats_init() …
-
Unscored —
thunderbolt: Fix memory leak in margining
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix memory leak in margining Memory for the usb4->margining needs to be relased for the upstream port of the router as well, even though the debugfs directory gets released with …
-
Unscored —
dm crypt: add cond_resched() to dmcrypt_write()
In the Linux kernel, the following vulnerability has been resolved: dm crypt: add cond_resched() to dmcrypt_write() The loop in dmcrypt_write may be running for unbounded amount of time, thus we need cond_resched() in it. This commit fixes the following warni…
-
Unscored —
erspan: do not use skb_mac_header() in ndo_start_xmit()
In the Linux kernel, the following vulnerability has been resolved: erspan: do not use skb_mac_header() in ndo_start_xmit() Drivers should not assume skb_mac_header(skb) == skb->data in their ndo_start_xmit(). Use skb_network_offset() and skb_transport_offset…
-
Unscored —
scsi: qla2xxx: Synchronize the IOCB count to be in order
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Synchronize the IOCB count to be in order A system hang was observed with the following call trace: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 …
-
Unscored —
net/mlx5: E-Switch, Fix an Oops in error handling code
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, Fix an Oops in error handling code The error handling dereferences "vport". There is nothing we can do if it is an error pointer except returning the error code.
-
Unscored —
igb: revert rtnl_lock() that causes deadlock
In the Linux kernel, the following vulnerability has been resolved: igb: revert rtnl_lock() that causes deadlock The commit 6faee3d4ee8b ("igb: Add lock to avoid data race") adds rtnl_lock to eliminate a false data race shown below (FREE from device detaching…
-
Unscored —
ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent
In the Linux kernel, the following vulnerability has been resolved: ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime usage") enabled to map PPTT once on the first…
-
Unscored —
wifi: mt76: do not run mt76_unregister_device() on unregistered hw
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: do not run mt76_unregister_device() on unregistered hw Trying to probe a mt7921e pci card without firmware results in a successful probe where ieee80211_register_hw hasn't been ca…
-
Unscored —
perf/x86/amd/core: Always clear status for idx
In the Linux kernel, the following vulnerability has been resolved: perf/x86/amd/core: Always clear status for idx The variable 'status' (which contains the unhandled overflow bits) is not being properly masked in some cases, displaying the following warning:…
-
Unscored —
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes [WHY] When PTEBufferSizeInRequests is zero, UBSAN reports the following warning because dml_log2 returns an unexpected negat…
-
Unscored —
scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() If alua_rtpg_queue() failed from alua_activate(), then 'qdata' is not freed, which will cause following memleak: unreferenced ob…
-
Unscored —
net/mlx5: Fix steering rules cleanup
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix steering rules cleanup vport's mc, uc and multicast rules are not deleted in teardown path when EEH happens. Since the vport's promisc settings(uc, mc and all) in firmware are r…
-
Unscored —
drm/edid: fix info leak when failing to get panel id
In the Linux kernel, the following vulnerability has been resolved: drm/edid: fix info leak when failing to get panel id Make sure to clear the transfer buffer before fetching the EDID to avoid leaking slab data to the logs on errors that leave the buffer unc…
-
Unscored —
ext4: fix task hung in ext4_xattr_delete_inode
In the Linux kernel, the following vulnerability has been resolved: ext4: fix task hung in ext4_xattr_delete_inode Syzbot reported a hung task problem: ================================================================== INFO: task syz-executor232:5073 blocked …
-
Unscored —
drm/ttm: Fix a NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Fix a NULL pointer dereference The LRU mechanism may look up a resource in the process of being removed from an object. The locking rules here are a bit unclear but it looks currentl…
-
Unscored —
interconnect: fix mem leak when freeing nodes
In the Linux kernel, the following vulnerability has been resolved: interconnect: fix mem leak when freeing nodes The node link array is allocated when adding links to a node but is not deallocated when nodes are destroyed.
-
Unscored —
bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
In the Linux kernel, the following vulnerability has been resolved: bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails syzbot reported a warning[1] where the bond device itself is a slave and we try to enslave a non-ethernet device as the f…
-
Unscored —
net/mlx5e: Fix cleanup null-ptr deref on encap lock
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix cleanup null-ptr deref on encap lock During module is unloaded while a peer tc flow is still offloaded, first the peer uplink rep profile is changed to a nic profile, and so ne…
-
Unscored —
net/iucv: Fix size of interrupt data
In the Linux kernel, the following vulnerability has been resolved: net/iucv: Fix size of interrupt data iucv_irq_data needs to be 4 bytes larger. These bytes are not used by the iucv module, but written by the z/VM hypervisor in case a CPU is deconfigured. R…
-
Unscored —
drm/i915/sseu: fix max_subslices array-index-out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: drm/i915/sseu: fix max_subslices array-index-out-of-bounds access It seems that commit bc3c5e0809ae ("drm/i915/sseu: Don't try to store EU mask internally in UAPI format") exposed a potential…
-
Unscored —
wifi: nl80211: fix NULL-ptr deref in offchan check
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix NULL-ptr deref in offchan check If, e.g. in AP mode, the link was already created by userspace but not activated yet, it has a chandef but the chandef isn't valid and has n…
-
Unscored —
i40e: Fix kernel crash during reboot when adapter is in recovery mode
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix kernel crash during reboot when adapter is in recovery mode If the driver detects during probe that firmware is in recovery mode then i40e_init_recovery_mode() is called and the res…
-
Unscored —
scsi: mpi3mr: Fix config page DMA memory leak
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix config page DMA memory leak A fix for: DMA-API: pci 0000:83:00.0: device driver has pending DMA allocations while released from device [count=1]
-
Unscored —
tcp: tcp_make_synack() can be called from process context
In the Linux kernel, the following vulnerability has been resolved: tcp: tcp_make_synack() can be called from process context tcp_rtx_synack() now could be called in process context as explained in 0a375c822497 ("tcp: tcp_rtx_synack() can be called from proce…
-
Unscored —
scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Port is allocated by sas_port_alloc_num() and rphy is allocated by either sas_end_device_alloc() or sas_expander_alloc()…
-
Unscored —
scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() Free mrioc->sas_hba.phy at .remove.
-
Unscored —CVE-2023-53129 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() Free mpi3mr_hba_port at .remove.
-
Unscored —
usb: ucsi_acpi: Increase the command completion timeout
In the Linux kernel, the following vulnerability has been resolved: usb: ucsi_acpi: Increase the command completion timeout Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command completion timeout value") increased the timeout from 5 seconds to 60 se…
-
Unscored —
vfio/type1: prevent underflow of locked_vm via exec()
In the Linux kernel, the following vulnerability has been resolved: vfio/type1: prevent underflow of locked_vm via exec() When a vfio container is preserved across exec, the task does not change, but it gets a new mm with locked_vm=0, and loses the count from…
-
Unscored —
wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved f…
-
Unscored —
net: openvswitch: fix race on port output
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix race on port output assume the following setup on a single machine: 1. An openvswitch instance with one bridge and default flows 2. two network namespaces "server" and "…
-
Unscored —
USB: uhci: fix memory leak with using debugfs_lookup()
In the Linux kernel, the following vulnerability has been resolved: USB: uhci: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler…
-
Unscored —
raw: Fix NULL deref in raw_get_next().
In the Linux kernel, the following vulnerability has been resolved: raw: Fix NULL deref in raw_get_next(). Dae R. Jeong reported a NULL deref in raw_get_next() [0]. It seems that the repro was running these sequences in parallel so that one thread was iterati…
-
Unscored —
mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data The MT7921 driver no longer uses eeprom.data, but the relevant code has not been removed completely since commit 16d98b5483…
-
Unscored —
HID: intel-ish-hid: Fix kernel panic during warm reset
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix kernel panic during warm reset During warm reset device->fw_client is set to NULL. If a bus driver is registered after this NULL setting and before new firmware client…
-
Unscored —
drm/radeon: free iio for atombios when driver shutdown
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: free iio for atombios when driver shutdown Fix below kmemleak when unload radeon driver: unreferenced object 0xffff9f8608ede200 (size 512): comm "systemd-udevd", pid 326, jiffies …
-
Unscored —
io_uring: wait interruptibly for request completions on exit
In the Linux kernel, the following vulnerability has been resolved: io_uring: wait interruptibly for request completions on exit WHen the ring exits, cleanup is done and the final cancelation and waiting on completions is done by io_ring_exit_work. That funct…
-
Unscored —
scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param()
In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() The validity of sock should be checked before assignment to avoid incorrect values. Commit 57569c37f0ad ("scsi: iscsi: iscsi…
-
Unscored —
wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit Always purge mcu skb queues in mt7915_mcu_exit routine even if mt7915_firmware_state fails.
-
Unscored —
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
In the Linux kernel, the following vulnerability has been resolved: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation In function rt6_nlmsg_size(), the length of nexthop is calculated by multipling the nexthop length of fib6_info and the nu…
-
Unscored —
cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()
In the Linux kernel, the following vulnerability has been resolved: cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() KASAN and KFENCE detected an user-after-free in the CXL driver. This happens in the cxl_decoder_add() fail path. KASAN prints the following…
-
Unscored —
tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.
In the Linux kernel, the following vulnerability has been resolved: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. syzkaller reported [0] memory leaks of an UDP socket and ZEROCOPY skbs. We can reproduce the problem with these sequences: sk …
-
Unscored —
io_uring: fix fget leak when fs don't support nowait buffered read
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix fget leak when fs don't support nowait buffered read Heming reported a BUG when using io_uring doing link-cp on ocfs2. [1] Do the following steps can reproduce this BUG: mount -…
-
Unscored —
scsi: mpt3sas: Fix a memory leak
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix a memory leak Add a forgotten kfree().
-
Unscored —
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() A fix for: BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses] Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/120…
-
Unscored —
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf An integer overflow occurs in the iwl_write_to_user_buf() function, which is called by the iwl_dbgfs_monitor_data_read() fun…
-
Unscored —
wifi: ath11k: fix deinitialization of firmware resources
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix deinitialization of firmware resources Currently, in ath11k_ahb_fw_resources_init(), iommu domain mapping is done only for the chipsets having fixed firmware memory. Also, f…
-
Unscored —
netfilter: ipset: Rework long task execution when adding/deleting entries
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Rework long task execution when adding/deleting entries When adding/deleting large number of elements in one step in ipset, it can take a reasonable amount of time and can r…
-
Unscored —
HID: hyperv: avoid struct memcpy overrun warning
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: avoid struct memcpy overrun warning A previous patch addressed the fortified memcpy warning for most builds, but I still see this one with gcc-9: In file included from include/li…
-
Unscored —
net: wwan: iosm: fix NULL pointer dereference when removing device
In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix NULL pointer dereference when removing device In suspend and resume cycle, the removal and rescan of device ends up in NULL pointer dereference. During driver initializat…
-
Unscored —
cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver
In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver After loading the amd-pstate-ut driver, amd_pstate_ut_check_perf() and amd_pstate_ut_check_freq() use cpufreq_cpu_get() to get…
-
Unscored —
wifi: iwlwifi: mvm: fix potential array out of bounds access
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix potential array out of bounds access Account for IWL_SEC_WEP_KEY_OFFSET when needed while verifying key_len size in iwl_mvm_sec_key_add().
-
Unscored —
null_blk: Always check queue mode setting from configfs
In the Linux kernel, the following vulnerability has been resolved: null_blk: Always check queue mode setting from configfs Make sure to check device queue mode in the null_validate_conf() and return error for NULL_Q_RQ as we don't allow legacy I/O path, with…
-
Unscored —
net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in qrtr_tx_…
-
Unscored —
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds Fix a stack-out-of-bounds read in brcmfmac that occurs when 'buf' that is not null-terminated is passed as…
-
Unscored —
net/mlx5e: Fix deadlock in tc route query code
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix deadlock in tc route query code Cited commit causes ABBA deadlock[0] when peer flows are created while holding the devcom rw semaphore. Due to peer flows offload implementation…
-
Unscored —
driver core: fix resource leak in device_add()
In the Linux kernel, the following vulnerability has been resolved: driver core: fix resource leak in device_add() When calling kobject_add() failed in device_add(), it will call cleanup_glue_dir() to free resource. But in kobject_add(), dev->kobj.parent has …
-
Unscored —
wifi: ath11k: fix memory leak in WMI firmware stats
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix memory leak in WMI firmware stats Memory allocated for firmware pdev, vdev and beacon statistics are not released during rmmod. Fix it by calling ath11k_fw_stats_free() func…
-
Unscored —
drm: amd: display: Fix memory leakage
In the Linux kernel, the following vulnerability has been resolved: drm: amd: display: Fix memory leakage This commit fixes memory leakage in dc_construct_ctx() function.
-
Unscored —
ALSA: ymfpci: Fix BUG_ON in probe function
In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Fix BUG_ON in probe function The snd_dma_buffer.bytes field now contains the aligned size, which this snd_BUG_ON() did not account for, resulting in the following: [ 9.625915] -…
-
Unscored —
md: fix soft lockup in status_resync
In the Linux kernel, the following vulnerability has been resolved: md: fix soft lockup in status_resync status_resync() will calculate 'curr_resync - recovery_active' to show user a progress bar like following: [============>........] resync = 61.4% 'curr_re…
-
Unscored —
mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
In the Linux kernel, the following vulnerability has been resolved: mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() The si->lock must be held when deleting the si from the available list. Otherwise, another thread can re-add the si to …
-
Unscored —
net/sched: sch_fq: fix integer overflow of "credit"
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_fq: fix integer overflow of "credit" if sch_fq is configured with "initial quantum" having values greater than INT_MAX, the first assignment of "credit" does signed integer ove…
-
Unscored —
drm/i915/gvt: fix vgpu debugfs clean in remove
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gvt: fix vgpu debugfs clean in remove Check carefully on root debugfs available when destroying vgpu, e.g in remove case drm minor's debugfs root might already be destroyed, which le…
-
Unscored —
bpf, arm64: Fixed a BTI error on returning to patched function
In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Fixed a BTI error on returning to patched function When BPF_TRAMP_F_CALL_ORIG is set, BPF trampoline uses BLR to jump back to the instruction next to call site to call the patched…
-
Unscored —
wifi: ath6kl: reduce WARN to dev_dbg() in callback
In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: reduce WARN to dev_dbg() in callback The warn is triggered on a known race condition, documented in the code above the test, that is correctly handled. Using WARN() hinders auto…
-
Unscored —
wifi: ath9k: hif_usb: fix memory leak of remain_skbs
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of remain_skbs hif_dev->remain_skb is allocated and used exclusively in ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is processe…
-
Unscored —
drivers/perf: hisi: Don't migrate perf to the CPU going to teardown
In the Linux kernel, the following vulnerability has been resolved: drivers/perf: hisi: Don't migrate perf to the CPU going to teardown The driver needs to migrate the perf context if the current using CPU going to teardown. By the time calling the cpuhp::tea…
-
Unscored —
nvme-core: fix dev_pm_qos memleak
In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix dev_pm_qos memleak Call dev_pm_qos_hide_latency_tolerance() in the error unwind patch to avoid following kmemleak:- blktests (master) # kmemleak-clear; ./check nvme/044; blktes…
-
Unscored —
srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL
In the Linux kernel, the following vulnerability has been resolved: srcu: Delegate work to the boot cpu if using SRCU_SIZE_SMALL Commit 994f706872e6 ("srcu: Make Tree SRCU able to operate without snp_node array") assumes that cpu 0 is always online. However, …
-
Unscored —
drm/i915: Fix memory leaks in i915 selftests
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leaks in i915 selftests This patch fixes memory leaks on error escapes in function fake_get_pages (cherry picked from commit 8bfbdadce85c4c51689da10f39c805a7106d4567)
-
Unscored —
drm/i915: Fix system suspend without fbdev being initialized
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix system suspend without fbdev being initialized If fbdev is not initialized for some reason - in practice on platforms without display - suspending fbdev should be skipped during…
-
Unscored —
mm/vmemmap/devdax: fix kernel crash when probing devdax devices
In the Linux kernel, the following vulnerability has been resolved: mm/vmemmap/devdax: fix kernel crash when probing devdax devices commit 4917f55b4ef9 ("mm/sparse-vmemmap: improve memory savings for compound devmaps") added support for using optimized vmmema…
-
Unscored —
wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read Kernel NULL pointer dereference when ACPI SAR table isn't implemented well. Fix the error code of return to mark the ACPI SAR …
-
Unscored —
net: fix skb leak in __skb_tstamp_tx()
In the Linux kernel, the following vulnerability has been resolved: net: fix skb leak in __skb_tstamp_tx() Commit 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with zerocop…
-
Unscored —
wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout…
-
Unscored —
s390/vfio-ap: fix memory leak in vfio_ap device driver
In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix memory leak in vfio_ap device driver The device release callback function invoked to release the matrix device uses the dev_get_drvdata(device *dev) function to retrieve the…
-
Unscored —
dmaengine: ptdma: check for null desc before calling pt_cmd_callback
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: check for null desc before calling pt_cmd_callback Resolves a panic that can occur on AMD systems, typically during host shutdown, after the PTDMA driver had been exercised.…
-
Unscored —
KVM: VMX: Fix crash due to uninitialized current_vmcs
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Fix crash due to uninitialized current_vmcs KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as a nested hypervisor on top of Hyper-V. When MSR bitmap is upd…
-
Unscored —
scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue When ufshcd_err_handler() is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcd_handle_mcq_cq_e…
-
Unscored —
wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work() Currently the buffer pointed by event is not freed in case ATH12K_FLAG_UNREGISTERING bit is set, this causes memory leak. Add a…
-
Unscored —
drm/amd/display: fix FCLK pstate change underflow
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix FCLK pstate change underflow [Why] Currently we set FCLK p-state change watermark calculated based on dummy p-state latency when UCLK p-state is not supported [How] Calcu…
-
Unscored —
dm flakey: fix a crash with invalid table line
In the Linux kernel, the following vulnerability has been resolved: dm flakey: fix a crash with invalid table line This command will crash with NULL pointer dereference: dmsetup create flakey --table \ "0 `blockdev --getsize /dev/ram0` flakey /dev/ram0 0 0 1 …
-
Unscored —
iommu/amd: Improve page fault error reporting
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Improve page fault error reporting If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always…
-
Unscored —
nvme-core: fix memory leak in dhchap_ctrl_secret
In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix memory leak in dhchap_ctrl_secret Free dhchap_secret in nvme_ctrl_dhchap_ctrl_secret_store() before we return when nvme_auth_generate_key() returns error.
-
Unscored —
PCI: Fix dropping valid root bus resources with .end = zero
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix dropping valid root bus resources with .end = zero On r8a7791/koelsch: kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unrefe…
-
Unscored —
md/raid10: fix null-ptr-deref in raid10_sync_request
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null-ptr-deref in raid10_sync_request init_resync() inits mempool and sets conf->have_replacemnt at the beginning of sync, close_sync() frees the mempool when sync is completed…
-
Unscored —
nvme-core: fix memory leak in dhchap_secret_store
In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix memory leak in dhchap_secret_store Free dhchap_secret in nvme_ctrl_dhchap_secret_store() before we return fix following kmemleack:- unreferenced object 0xffff8886376ea800 (size…
-
Unscored —
scsi: mpi3mr: Fix an issue found by KASAN
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix an issue found by KASAN Write only correct size (32 instead of 64 bytes).
-
Unscored —
net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device In case devcom allocation is failed, mlx5 is always freeing the priv. However, this priv might have been allocated by a differe…
-
Unscored —
KVM: Destroy target device if coalesced MMIO unregistration fails
In the Linux kernel, the following vulnerability has been resolved: KVM: Destroy target device if coalesced MMIO unregistration fails Destroy and free the target coalesced MMIO device if unregistering said device fails. As clearly noted in the code, kvm_io_bu…
-
Unscored —CVE-2023-54029 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
iommufd: Make sure to zero vfio_iommu_type1_info before copying to user
In the Linux kernel, the following vulnerability has been resolved: iommufd: Make sure to zero vfio_iommu_type1_info before copying to user Missed a zero initialization here. Most of the struct is filled with a copy_from_user(), however minsz for that copy is…
-
Unscored —
wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?) when it's connected to a bluetooth audio device. The busy bl…
-
Unscored —
ice: prevent NULL pointer deref during reload
In the Linux kernel, the following vulnerability has been resolved: ice: prevent NULL pointer deref during reload Calling ethtool during reload can lead to call trace, because VSI isn't configured for some time, but netdev is alive. To fix it add rtnl lock fo…
-
Unscored —
io_uring: fix memory leak when removing provided buffers
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix memory leak when removing provided buffers When removing provided buffers, io_buffer structs are not being disposed of, leading to a memory leak. They can't be freed individuall…
-
Unscored —
wifi: iwlwifi: pcie: fix possible NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: fix possible NULL pointer dereference It is possible that iwl_pci_probe() will fail and free the trans, then afterwards iwl_pci_remove() will be called and crash by tryin…
-
Unscored —
RDMA/irdma: Fix memory leak of PBLE objects
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix memory leak of PBLE objects On rmmod of irdma, the PBLE object memory is not being freed. PBLE object memory are not statically pre-allocated at function initialization time u…
-
Unscored —
iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format …
-
Unscored —
tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site
In the Linux kernel, the following vulnerability has been resolved: tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site The following crash was reported: [ 1950.279393] list_del corruption, ffff99560d485790->next is NULL [ 1950.279400] --…
-
Unscored —
regulator: stm32-pwr: fix of_iomap leak
In the Linux kernel, the following vulnerability has been resolved: regulator: stm32-pwr: fix of_iomap leak Smatch reports: drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn: 'base' from of_iomap() not released on lines: 151,166. In stm32_pwr…
-
Unscored —
scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copy_from_user() for a debugfs entry. Curre…
-
Unscored —
scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map er…
-
Unscored —
md/raid10: fix memleak for 'conf->bio_split'
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak for 'conf->bio_split' In the error path of raid10_run(), 'conf' need be freed, however, 'conf->bio_split' is missed and memory will be leaked. Since there are 3 places …
-
Unscored —
wifi: rt2x00: Fix memory leak when handling surveys
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: Fix memory leak when handling surveys When removing a rt2x00 device, its associated channel surveys are not freed, causing a memory leak observable with kmemleak: unreferenced o…
-
Unscored —
drm/amdkfd: Fix kernel warning during topology setup
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kernel warning during topology setup This patch fixes the following kernel warning seen during driver load by correctly initializing the p2plink attr before creating the sysfs…
-
Unscored —
vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd
In the Linux kernel, the following vulnerability has been resolved: vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd group->iommufd is not initialized for the iommufd_ctx_put() [20018.331541] BUG: kernel NULL pointer dereference, addr…
-
Unscored —
mptcp: stricter state check in mptcp_worker
In the Linux kernel, the following vulnerability has been resolved: mptcp: stricter state check in mptcp_worker As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state: connect() // incoming reset…
-
Unscored —
wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit Always purge mcu skb queues in mt7996_mcu_exit routine even if mt7996_firmware_state fails.
-
Unscored —
rxrpc: Fix timeout of a call that hasn't yet been granted a channel
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix timeout of a call that hasn't yet been granted a channel afs_make_call() calls rxrpc_kernel_begin_call() to begin a call (which may get stalled in the background waiting for a conn…
-
Unscored —
ASoC: SOF: avoid a NULL dereference with unsupported widgets
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: avoid a NULL dereference with unsupported widgets If an IPC4 topology contains an unsupported widget, its .module_info field won't be set, then sof_ipc4_route_setup() will cause a …
-
Unscored —
iommufd: Check for uptr overflow
In the Linux kernel, the following vulnerability has been resolved: iommufd: Check for uptr overflow syzkaller found that setting up a map with a user VA that wraps past zero can trigger WARN_ONs, particularly from pin_user_pages weirdly returning 0 due to in…
-
Unscored —
ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds When we run syzkaller we get below Out of Bound. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace of the…
-
Unscored —
soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow
In the Linux kernel, the following vulnerability has been resolved: soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow This reverts commit 443a98e649b4 ("soundwire: bus: use pm_runtime_resume_and_get()") Change calls to pm_runtime_r…
-
Unscored —
ipv6: Fix an uninit variable access bug in __ip6_make_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix an uninit variable access bug in __ip6_make_skb() Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in arch_atomic64…
-
Unscored —
media: usb: siano: Fix use after free bugs caused by do_submit_urb
In the Linux kernel, the following vulnerability has been resolved: media: usb: siano: Fix use after free bugs caused by do_submit_urb There are UAF bugs caused by do_submit_urb(). One of the KASan reports is shown below: [ 36.403605] BUG: KASAN: use-after-fr…
-
Unscored —
xfrm: Fix leak of dev tracker
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix leak of dev tracker At the stage of direction checks, the netdev reference tracker is already initialized, but released with wrong *_put() call.
-
Unscored —
wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup crypto_alloc_shash() allocates resources, which should be released by crypto_free_shash(). When ath11k_peer_find() fails, there has …
-
Unscored —
nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net
In the Linux kernel, the following vulnerability has been resolved: nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net Commit f5f9d4a314da ("nfsd: move reply cache initialization into nfsd startup") moved the initialization of the repl…
-
Unscored —
md/raid10: fix memleak of md thread
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak of md thread In raid10_run(), if setup_conf() succeed and raid10_run() failed before setting 'mddev->thread', then in the error path 'conf->thread' is not freed. Fix th…
-
Unscored —
wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx For the reasons also described in commit b383e8abed41 ("wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()"), ath9k_…
-
Unscored —
tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation
In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation /dev/vtpmx is made visible before 'workqueue' is initialized, which can lead to a memory corruption in the worst case scenario…
-
Unscored —
platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2() Function amd_pmc_stb_debugfs_open_v2() may be called when the STB debug mechanism enabled. When amd_pmc_send_cmd() fail…
-
Unscored —
driver core: fix potential null-ptr-deref in device_add()
In the Linux kernel, the following vulnerability has been resolved: driver core: fix potential null-ptr-deref in device_add() I got the following null-ptr-deref report while doing fault injection test: BUG: kernel NULL pointer dereference, address: 0000000000…
References
-
article
https://access.redhat.com/security/updates/classification/#important
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.3_release_notes/index
-
article
https://access.redhat.com/solutions/7027704
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2008229
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2063818
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2090016
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2133453
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2133455
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2140017
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2143906
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2147356
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2149024
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2150953
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2165926
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2169343
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2169719
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2170423
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2172087
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173403
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173430
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173434
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173435
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173444
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2174224
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2175323
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2175903
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2176140
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2176554
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2178302
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2178741
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2179877
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2180124
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2181134
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2181272
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2181277
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2182031
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2182443
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2183556
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2184476