Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Fixed packages 142

Vulnerabilities 341

• High 7.8
  CVE-2024-1086 Exploited · Ransomware Public exploit EPSS 28%

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slo…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 31, 2024

  KEV May 30, 2024
• Critical 9.8
  CVE-2023-52881

  tcp: do not accept ACK of bytes we never sent

  In the Linux kernel, the following vulnerability has been resolved: tcp: do not accept ACK of bytes we never sent This patch is based on a detailed report and ideas from Yepeng Pan and Christian Rossow. ACK seq validation is currently following RFC 5961 5.2 g…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 29, 2024
• Critical 9.8
  CVE-2023-53192

  vxlan: Fix nexthop hash size

  In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_has…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Critical 9.8
  CVE-2023-53338

  lwt: Fix return values of BPF xmit ops

  In the Linux kernel, the following vulnerability has been resolved: lwt: Fix return values of BPF xmit ops BPF encap ops can return different types of positive values, such like NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function skb_do_redirec…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Critical 9.8
  CVE-2023-53751

  cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname

  In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Critical 9.8
  CVE-2023-54076

  smb: client: fix missed ses refcounting

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Critical 9.8
  CVE-2023-54090

  ixgbe: Fix panic during XDP_TX with > 64 CPUs

  In the Linux kernel, the following vulnerability has been resolved: ixgbe: Fix panic during XDP_TX with > 64 CPUs Commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus") adds support to allow XDP programs to run on systems with more than 64 …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Critical 9.8
  CVE-2023-54184

  scsi: target: iscsit: Free cmds before session free

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsit: Free cmds before session free Commands from recovery entries are freed after session has been closed. That leads to use-after-free at command free or NPE with such call …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Critical 9.8
  CVE-2023-54292

  RDMA/irdma: Fix data race on CQP request done

  In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_op while being updated in…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Critical 9.8
  CVE-2024-26582

  net: tls: fix use-after-free with partial reads and async decrypt

  In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 21, 2024
• Critical 9.8
  CVE-2024-26583

  tls: fix race between async notify and socket close

  In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past tha…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 21, 2024
• Critical 9.8
  CVE-2024-26584

  net: tls: handle backlogging of crypto requests

  In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY inst…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 21, 2024
• Critical 9.8
  CVE-2024-26585

  tls: fix race between tx work scheduling and socket close

  In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 21, 2024
• Critical 9.1
  CVE-2023-52832

  wifi: mac80211: don't return unset power in ieee80211_get_tx_power()

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't return unset power in ieee80211_get_tx_power() We can get a UBSAN warning if ieee80211_get_tx_power() returns the INT_MIN value mac80211 internally uses for "unset power…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• High 8.8
  CVE-2023-52478

  HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect

  In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU) races when it races with itself. hidpp_connect_event() …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 29, 2024
• High 8.8
  CVE-2023-52522

  net: fix possible store tearing in neigh_periodic_work()

  In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• High 8.8
  CVE-2023-53297

  Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balan…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 8.8
  CVE-2023-53322

  scsi: qla2xxx: Wait for io return on terminate rport

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Wait for io return on terminate rport System crash due to use after free. Current code allows terminate_rport_io to exit before making sure all IOs has returned. For FCP-2 devi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 8.8
  CVE-2023-53586

  scsi: target: Fix multiple LUN_RESET handling

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix multiple LUN_RESET handling This fixes a bug where an initiator thinks a LUN_RESET has cleaned up running commands when it hasn't. The bug was added in commit 51ec502a3266 (…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 8.8
  CVE-2023-53615

  scsi: qla2xxx: Fix deletion race condition

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix deletion race condition System crash when using debug kernel due to link list corruption. The cause of the link list corruption is due to session deletion was allowed to qu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 8.8
  CVE-2023-53673

  Bluetooth: hci_event: call disconnect callback before deleting conn

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: call disconnect callback before deleting conn In hci_cs_disconnect, we do hci_conn_del even if disconnection failed. ISO, L2CAP and SCO connections refer to the hci_conn…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 7, 2025
• High 8.8
  CVE-2023-53762

  Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync Use-after-free can occur in hci_disconnect_all_sync if a connection is deleted by concurrent processing of a controller event. To preve…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• High 8.8
  CVE-2023-54060

  iommufd: Set end correctly when doing batch carry

  In the Linux kernel, the following vulnerability has been resolved: iommufd: Set end correctly when doing batch carry Even though the test suite covers this it somehow became obscured that this wasn't working. The test iommufd_ioas.mock_domain.access_domain_d…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 8.8
  CVE-2023-54120

  Bluetooth: Fix race condition in hidp_session_thread

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidp_session_thread There is a potential race condition in hidp_session_thread that may lead to use-after-free. For instance, the timer is active while hidp_d…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 8.8
  CVE-2023-54214

  Bluetooth: L2CAP: Fix potential user-after-free

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix potential user-after-free This fixes all instances of which requires to allocate a buffer calling alloc_skb which may release the chan lock and reacquire later which mak…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 8.8
  CVE-2024-25744

  In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is relat…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Feb 12, 2024
• High 8.4
  CVE-2024-26830

  i40e: Do not allow untrusted VF to remove administratively set MAC

  In the Linux kernel, the following vulnerability has been resolved: i40e: Do not allow untrusted VF to remove administratively set MAC Currently when PF administratively sets VF's MAC address and the VF is put down (VF tries to delete all MACs) then the MAC i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 17, 2024
• High 8.2
  CVE-2023-53711

  NFS: Fix a potential data corruption

  In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 22, 2025
• High 8.1
  CVE-2023-52434

  smb: client: fix potential OOBs in smb2_parse_contexts()

  In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 20, 2024
• High 7.8
  CVE-2022-45934 Public exploit

  An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integ…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Nov 27, 2022
• High 7.8
  CVE-2022-48632

  i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()

  In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() memcpy() is called in a loop while 'operation->length' upper bound is not checked and 'data_idx' also increments.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Apr 28, 2024
• High 7.8
  CVE-2022-49754

  Bluetooth: Fix a buffer overflow in mgmt_mesh_add()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix a buffer overflow in mgmt_mesh_add() Smatch Warning: net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy() 'mesh_tx->param' too small (48 vs 50) Analysis: 'mesh_tx->p…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2022-49977

  ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead

  In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead ftrace_startup does not remove ops from ftrace_ops_list when ftrace_startup_enable fails: register_ftrace_func…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• High 7.8
  CVE-2022-50286

  ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline When converting files with inline data to extents, delayed allocations made on a file system created with both the bi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• High 7.8
  CVE-2022-50673

  ext4: fix use-after-free in ext4_orphan_cleanup

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2022-50780

  net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed

  In the Linux kernel, the following vulnerability has been resolved: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed When the ops_init() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr poi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-52469

  drivers/amd/pm: fix a use-after-free in kv_parse_power_table

  In the Linux kernel, the following vulnerability has been resolved: drivers/amd/pm: fix a use-after-free in kv_parse_power_table When ps allocated by kzalloc equals to NULL, kv_parse_power_table frees adev->pm.dpm.ps that allocated before. However, after the …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 25, 2024
• High 7.8
  CVE-2023-52486

  drm: Don't unref the same fb many times by mistake due to deadlock handling

  In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 29, 2024
• High 7.8
  CVE-2023-52574

  team: fix null-ptr-deref when team device type is changed

  In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 001…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• High 7.8
  CVE-2023-52620

  netfilter: nf_tables: disallow timeout for anonymous sets

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 21, 2024
• High 7.8
  CVE-2023-52628

  netfilter: nftables: exthdr: fix 4-byte stack OOB write

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv->len is a multiple of 4, then dst[len / 4] can write past the destination array which leads to stack corruption. This construct…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 28, 2024
• High 7.8
  CVE-2023-52934

  mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups

  In the Linux kernel, the following vulnerability has been resolved: mm/MADV_COLLAPSE: catch !none !huge !bad pmd lookups In commit 34488399fa08 ("mm/madvise: add file and shmem support to MADV_COLLAPSE") we make the following change to find_pmd_or_thp_or_none…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2023-52973

  vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF

  In the Linux kernel, the following vulnerability has been resolved: vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF After a call to console_unlock() in vcs_read() the vc_data struct can be freed by vc_deallocate(). Because of that, t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2023-52999

  net: fix UaF in netns ops registration error path

  In the Linux kernel, the following vulnerability has been resolved: net: fix UaF in netns ops registration error path If net_assign_generic() fails, the current error path in ops_init() tries to clear the gen pointer slot. Anyway, in such error path, the gen …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• High 7.8
  CVE-2023-53046

  Bluetooth: Fix race condition in hci_cmd_sync_clear

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hci_cmd_sync_clear There is a potential race condition in hci_cmd_sync_work and hci_cmd_sync_clear, and could lead to use-after-free. For instance, hci_cmd_sy…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• High 7.8
  CVE-2023-53047

  tee: amdtee: fix race condition in amdtee_open_session

  In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix race condition in amdtee_open_session There is a potential race condition in amdtee_open_session that may lead to use-after-free. For instance, in amdtee_open_session() after…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• High 7.8
  CVE-2023-53052

  cifs: fix use-after-free bug in refresh_cache_worker()

  In the Linux kernel, the following vulnerability has been resolved: cifs: fix use-after-free bug in refresh_cache_worker() The UAF bug occurred because we were putting DFS root sessions in cifs_umount() while DFS cache refresher was being executed. Make DFS r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• High 7.8
  CVE-2023-53057

  Bluetooth: HCI: Fix global-out-of-bounds

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HCI: Fix global-out-of-bounds To loop a variable-length array, hci_init_stage_sync(stage) considers that stage[i] is valid as long as stage[i-1].func is valid. Thus, the last eleme…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• High 7.8
  CVE-2023-53094

  tty: serial: fsl_lpuart: fix race on RX DMA shutdown

  In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsl_lpuart: fix race on RX DMA shutdown From time to time DMA completion can come in the middle of DMA shutdown: <process ctx>: <IRQ>: lpuart32_shutdown() lpuart_dma_shutdown() d…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• High 7.8
  CVE-2023-53184

  arm64/sme: Set new vector length before reallocating

  In the Linux kernel, the following vulnerability has been resolved: arm64/sme: Set new vector length before reallocating As part of fixing the allocation of the buffer for SVE state when changing SME vector length we introduced an immediate reallocation of th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• High 7.8
  CVE-2023-53235

  drm/tests: helpers: Avoid a driver uaf

  In the Linux kernel, the following vulnerability has been resolved: drm/tests: helpers: Avoid a driver uaf when using __drm_kunit_helper_alloc_drm_device() the driver may be dereferenced by device-managed resources up until the device is freed, which is typic…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• High 7.8
  CVE-2023-53252

  Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync hci_update_accept_list_sync iterates over hdev->pend_le_conns and hdev->pend_le_reports, and waits for controller events …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• High 7.8
  CVE-2023-53263

  drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

  In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create We can't simply free the connector after calling drm_connector_init on it. We need to clean up the drm side …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 7.8
  CVE-2023-53354

  skbuff: skb_segment, Call zero copy functions before using skbuff frags

  In the Linux kernel, the following vulnerability has been resolved: skbuff: skb_segment, Call zero copy functions before using skbuff frags Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb") added the call to zero copy funct…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• High 7.8
  CVE-2023-53394

  net/mlx5e: xsk: Fix crash on regular rq reactivation

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix crash on regular rq reactivation When the regular rq is reactivated after the XSK socket is closed it could be reading stale cqes which eventually corrupts the rq. This le…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• High 7.8
  CVE-2023-53465

  soundwire: qcom: fix storing port config out-of-bounds

  In the Linux kernel, the following vulnerability has been resolved: soundwire: qcom: fix storing port config out-of-bounds The 'qcom_swrm_ctrl->pconfig' has size of QCOM_SDW_MAX_PORTS (14), however we index it starting from 1, not 0, to match real port number…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• High 7.8
  CVE-2023-53473

  ext4: improve error handling from ext4_dirhash()

  In the Linux kernel, the following vulnerability has been resolved: ext4: improve error handling from ext4_dirhash() The ext4_dirhash() will *almost* never fail, especially when the hash tree feature was first introduced. However, with the addition of support…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• High 7.8
  CVE-2023-53490

  mptcp: fix disconnect vs accept race

  In the Linux kernel, the following vulnerability has been resolved: mptcp: fix disconnect vs accept race Despite commit 0ad529d9fd2b ("mptcp: fix possible divide by zero in recvmsg()"), the mptcp protocol is still prone to a race between disconnect() (or shut…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• High 7.8
  CVE-2023-53536

  blk-crypto: make blk_crypto_evict_key() more robust

  In the Linux kernel, the following vulnerability has been resolved: blk-crypto: make blk_crypto_evict_key() more robust If blk_crypto_evict_key() sees that the key is still in-use (due to a bug) or that ->keyslot_evict failed, it currently just returns while …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2023-53539

  RDMA/rxe: Fix incomplete state save in rxe_requester

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix incomplete state save in rxe_requester If a send packet is dropped by the IP layer in rxe_requester() the call to rxe_xmit_packet() can fail with err == -EAGAIN. To recover, the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 4, 2025
• High 7.8
  CVE-2023-53545

  drm/amdgpu: unmap and remove csa_va properly

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: unmap and remove csa_va properly Root PD BO should be reserved before unmap and remove a bo_va from VM otherwise lockdep will complain. v2: check fpriv->csa_va is not NULL instead…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 4, 2025
• High 7.8
  CVE-2023-53552

  drm/i915: mark requests for GuC virtual engines to avoid use-after-free

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: mark requests for GuC virtual engines to avoid use-after-free References to i915_requests may be trapped by userspace inside a sync_file or dmabuf (dma-resv) and held indefinitely a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2023-53559

  ip_vti: fix potential slab-use-after-free in decode_session6

  In the Linux kernel, the following vulnerability has been resolved: ip_vti: fix potential slab-use-after-free in decode_session6 When ip_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2023-53570

  wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()

  In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the number of MBSSID elements in the nested netlink attr…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2023-53577

  bpf, cpumap: Make sure kthread is running before map update returns

  In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Make sure kthread is running before map update returns The following warning was reported when running stress-mode enabled xdp_redirect_cpu with some RT threads: ------------[ cu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2023-53580

  USB: Gadget: core: Help prevent panic during UVC unconfigure

  In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: core: Help prevent panic during UVC unconfigure Avichal Rakesh reported a kernel panic that occurred when the UVC gadget driver was removed from a gadget's configuration. The pan…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• High 7.8
  CVE-2023-53645

  bpf: Make bpf_refcount_acquire fallible for non-owning refs

  In the Linux kernel, the following vulnerability has been resolved: bpf: Make bpf_refcount_acquire fallible for non-owning refs This patch fixes an incorrect assumption made in the original bpf_refcount series [0], specifically that the BPF program calling bp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• High 7.8
  CVE-2023-53646

  drm/i915/perf: add sentinel to xehp_oa_b_counters

  In the Linux kernel, the following vulnerability has been resolved: drm/i915/perf: add sentinel to xehp_oa_b_counters Arrays passed to reg_in_range_table should end with empty record. The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• High 7.8
  CVE-2023-53660

  bpf, cpumap: Handle skb as well when clean up ptr_ring

  In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Handle skb as well when clean up ptr_ring The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled: ------------[ cut here ]---…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• High 7.8
  CVE-2023-53713

  arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

  In the Linux kernel, the following vulnerability has been resolved: arm64: sme: Use STR P to clear FFR context field in streaming SVE mode The FFR is a predicate register which can vary between 16 and 256 bits in size depending upon the configured vector leng…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 22, 2025
• High 7.8
  CVE-2023-53795

  iommufd: IOMMUFD_DESTROY should not increase the refcount

  In the Linux kernel, the following vulnerability has been resolved: iommufd: IOMMUFD_DESTROY should not increase the refcount syzkaller found a race where IOMMUFD_DESTROY increments the refcount: obj = iommufd_get_object(ucmd->ictx, cmd->id, IOMMUFD_OBJ_ANY);…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2023-53806

  drm/amd/display: populate subvp cmd info only for the top pipe

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: populate subvp cmd info only for the top pipe [Why] System restart observed while changing the display resolution to 8k with extended mode. Sytem restart was caused by a page…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2023-53810

  blk-mq: release crypto keyslot before reporting I/O complete

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: release crypto keyslot before reporting I/O complete Once all I/O using a blk_crypto_key has completed, filesystems can call blk_crypto_evict_key(). However, the block layer currently…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2023-53819

  amdgpu: validate offset_in_bo of drm_amdgpu_gem_va

  In the Linux kernel, the following vulnerability has been resolved: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va This is motivated by OOB access in amdgpu_vm_update_range when offset_in_bo+map_size overflows. v2: keep the validations in amdgpu_vm_bo_map…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2023-53823

  block/rq_qos: protect rq_qos apis with a new lock

  In the Linux kernel, the following vulnerability has been resolved: block/rq_qos: protect rq_qos apis with a new lock commit 50e34d78815e ("block: disable the elevator int del_gendisk") move rq_qos_exit() from disk_release() to del_gendisk(), this will introd…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2023-53844

  drm/ttm: Don't leak a resource on swapout move error

  In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on swapout move error If moving the bo to system for swapout failed, we were leaking a resource. Fix.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2023-53860

  dm: don't attempt to queue IO under RCU protection

  In the Linux kernel, the following vulnerability has been resolved: dm: don't attempt to queue IO under RCU protection dm looks up the table for IO based on the request type, with an assumption that if the request is marked REQ_NOWAIT, it's fine to attempt to…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• High 7.8
  CVE-2023-53990

  SMB3: Add missing locks to protect deferred close file list

  In the Linux kernel, the following vulnerability has been resolved: SMB3: Add missing locks to protect deferred close file list cifs_del_deferred_close function has a critical section which modifies the deferred close file list. We must acquire deferred_lock …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54026

  opp: Fix use-after-free in lazy_opp_tables after probe deferral

  In the Linux kernel, the following vulnerability has been resolved: opp: Fix use-after-free in lazy_opp_tables after probe deferral When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns -EPROBE_DEFER, the opp_table is freed again, to wait until…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54035

  netfilter: nf_tables: fix underflow in chain reference counter

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix underflow in chain reference counter Set element addition error path decrements reference counter on chains twice: once on element release and again via nft_data_rel…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54048

  RDMA/bnxt_re: Prevent handling any completions after qp destroy

  In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Prevent handling any completions after qp destroy HW may generate completions that indicates QP is destroyed. Driver should not be scheduling any more completion handlers for th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54062

  ext4: fix invalid free tracking in ext4_xattr_move_to_block()

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix invalid free tracking in ext4_xattr_move_to_block() In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54096

  soundwire: fix enumeration completion

  In the Linux kernel, the following vulnerability has been resolved: soundwire: fix enumeration completion The soundwire subsystem uses two completion structures that allow drivers to wait for soundwire device to become enumerated on the bus and initialised by…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54100

  scsi: qedi: Fix use after free bug in qedi_remove()

  In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix use after free bug in qedi_remove() In qedi_probe() we call __qedi_probe() which initializes &qedi->recovery_work with qedi_recovery_handler() and &qedi->board_disable_work wi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54135

  maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()

  In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix potential out-of-bounds access in mas_wr_end_piv() Check the write offset end bounds before using it as the offset into the pivot array. This avoids a possible out-of-bounds a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54156

  sfc: fix crash when reading stats while NIC is resetting

  In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_stats is NULL as the NIC h…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.8
  CVE-2023-54166

  igc: Fix Kernel Panic during ndo_tx_timeout callback

  In the Linux kernel, the following vulnerability has been resolved: igc: Fix Kernel Panic during ndo_tx_timeout callback The Xeon validation group has been carrying out some loaded tests with various HW configurations, and they have seen some transmit queue t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.8
  CVE-2023-54173

  bpf: Disable preemption in bpf_event_output

  In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_event_output We received report [1] of kernel crash, which is caused by using nesting protection without disabled preemption. The bpf_event_output can be called…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.8
  CVE-2023-54186

  usb: typec: altmodes/displayport: fix pin_assignment_show

  In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pin_assignment_show This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.8
  CVE-2023-54201

  RDMA/efa: Fix wrong resources deallocation order

  In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.8
  CVE-2023-54254

  drm/ttm: Don't leak a resource on eviction error

  In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on eviction error On eviction errors other than -EMULTIHOP we were leaking a resource. Fix. v2: - Avoid yet another goto (Andi Shyti)

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.8
  CVE-2023-54303

  bpf: Disable preemption in bpf_perf_event_output

  In the Linux kernel, the following vulnerability has been resolved: bpf: Disable preemption in bpf_perf_event_output The nesting protection in bpf_perf_event_output relies on disabled preemption, which is guaranteed for kprobes and tracepoints. However bpf_pe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.8
  CVE-2023-54326

  misc: pci_endpoint_test: Free IRQs before removing the device

  In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Free IRQs before removing the device In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received wit…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• High 7.8
  CVE-2023-6040

  An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family)

  An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) valu…

  The Linux Kernel Organization linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 12, 2024
• High 7.8
  CVE-2023-6931 Public exploit

  Out-of-bounds write in Linux kernel's Performance Events system component

  A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_…

  Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 19, 2023
• High 7.8
  CVE-2023-6932

  Use-after-free in Linux kernel's ipv4: igmp component

  A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Dec 19, 2023
• High 7.8
  CVE-2024-1085

  Use-after-free in Linux kernel's netfilter: nf_tables component

  A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current genera…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jan 31, 2024
• High 7.8
  CVE-2024-26586

  mlxsw: spectrum_acl_tcam: Fix stack corruption

  In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a lis…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 22, 2024
• High 7.5
  CVE-2023-39198

  Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()

  A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an atta…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Nov 9, 2023
• High 7.5
  CVE-2023-52610

  net/sched: act_ct: fix skb leak and crash on ooo frags

  In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2024
• High 7.5
  CVE-2023-53335

  RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish()

  In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() If get_ep_from_tid() fails to lookup non-NULL value for ep, ep is dereferenced later regardless of whether it is empty. This patch…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• High 7.1
  CVE-2022-50736

  RDMA/siw: Fix immediate work request flush to completion queue

  In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix immediate work request flush to completion queue Correctly set send queue element opcode during immediate work request flushing in post sendqueue operation, if the QP is in ERRO…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• High 7.1
  CVE-2023-3567

  Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

  A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jul 24, 2023
• High 7.1
  CVE-2023-53285

  ext4: add bounds checking in get_max_inline_xattr_value_size()

  In the Linux kernel, the following vulnerability has been resolved: ext4: add bounds checking in get_max_inline_xattr_value_size() Normally the extended attributes in the inode body would have been checked when the inode is first opened, but if someone is wri…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 7.1
  CVE-2023-53321

  wifi: mac80211_hwsim: drop short frames

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: drop short frames While technically some control frames like ACK are shorter and end after Address 1, such frames shouldn't be forwarded through wmediumd or similar user…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• High 7.1
  CVE-2023-53462

  hsr: Fix uninit-value access in fill_frame_info()

  In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in fill_frame_info() Syzbot reports the following uninit-value access problem. ===================================================== BUG: KMSAN: uninit-value in f…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• High 7.1
  CVE-2023-53726

  arm64: csum: Fix OoB access in IP checksum code for negative lengths

  In the Linux kernel, the following vulnerability has been resolved: arm64: csum: Fix OoB access in IP checksum code for negative lengths Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length calls") added an early return for zero-length inp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 22, 2025
• High 7.0
  CVE-2023-51043

  In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a n…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jan 23, 2024
• High 7.0
  CVE-2023-51779

  bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Dec 25, 2023
• High 7.0
  CVE-2023-6531

  Kernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uaf

  A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 21, 2024
• High 7.0
  CVE-2023-6546 Public exploit

  Kernel: gsm multiplexing race condition leads to privilege escalation

  A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem …

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Dec 21, 2023
• Medium 6.8
  CVE-2024-0565

  Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client

  An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.

  Linux Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Jan 15, 2024
• Medium 6.6
  CVE-2024-0841

  Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function

  A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Jan 28, 2024
• Medium 6.4
  CVE-2023-24023

  Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Nov 28, 2023
• Medium 6.3
  CVE-2022-38096

  There is a NULL pointer vulnerability in vmwgfx driver

  A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…

  Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 9, 2022
• Medium 6.3
  CVE-2023-52581

  netfilter: nf_tables: fix memleak when more than 255 elements expired

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Medium 6.2
  CVE-2023-6915

  Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c

  A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Jan 15, 2024
• Medium 6.1
  CVE-2023-39193

  Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()

  A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosu…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 9, 2023
• Medium 6.0
  CVE-2023-52529

  HID: sony: Fix a potential memory leak in sony_probe()

  In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occurs after a successful usb_alloc_urb() call, usb_free_urb() should be called.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Medium 5.6
  CVE-2023-25775

  Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an un…

  linux-raspi2 linux-hwe linux-azure linux-riscv Linux Debian Ubuntu
  Aug 11, 2023
• Medium 5.5
  CVE-2022-49322

  tracing: Fix sleeping function called from invalid context on RT kernel

  In the Linux kernel, the following vulnerability has been resolved: tracing: Fix sleeping function called from invalid context on RT kernel When setting bootparams="trace_event=initcall:initcall_start tp_printk=1" in the cmdline, the output_printk() was calle…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Medium 5.5
  CVE-2022-50346

  ext4: init quota for 'old.inode' in 'ext4_rename'

  In the Linux kernel, the following vulnerability has been resolved: ext4: init quota for 'old.inode' in 'ext4_rename' Syzbot found the following issue: ext4_parse_param: s_want_extra_isize=128 ext4_inode_info_init: s_want_extra_isize=32 ext4_rename: old.inode…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2022-50374

  Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure syzbot is reporting NULL pointer dereference at hci_uart_tty_close() [1], for rcu_sync_enter() is called without rcu_sync_init…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Medium 5.5
  CVE-2023-4133

  Kernel: cxgb4: use-after-free in ch_flower_stats_cb()

  A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, ca…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Aug 3, 2023
• Medium 5.5
  CVE-2023-42754

  Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()

  A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allo…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 5, 2023
• Medium 5.5
  CVE-2023-52817

  drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL In certain types of chips, such as VEGA20, reading the amdgpu_regs_smc file could result in an abnormal null pointer ac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 21, 2024
• Medium 5.5
  CVE-2023-52939

  mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()

  In the Linux kernel, the following vulnerability has been resolved: mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() As commit 18365225f044 ("hwpoison, memcg: forcibly uncharge LRU pages"), hwpoison will forcibly uncharg a LRU hwpoison…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Mar 27, 2025
• Medium 5.5
  CVE-2023-52976

  efi: fix potential NULL deref in efi_mem_reserve_persistent

  In the Linux kernel, the following vulnerability has been resolved: efi: fix potential NULL deref in efi_mem_reserve_persistent When iterating on a linked list, a result of memremap is dereferenced without checking it for NULL. This patch adds a check that fa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Medium 5.5
  CVE-2023-52984

  net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices

  In the Linux kernel, the following vulnerability has been resolved: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices The probe() function is only used for the DP83822 PHY, leaving the private data pointer uninitialized for the smaller DP8…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Medium 5.5
  CVE-2023-53016

  Bluetooth: Fix possible deadlock in rfcomm_sk_state_change

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix possible deadlock in rfcomm_sk_state_change syzbot reports a possible deadlock in rfcomm_sk_state_change [1]. While rfcomm_sock_connect acquires the sk lock and waits for the r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Medium 5.5
  CVE-2023-53017

  Bluetooth: hci_sync: fix memory leak in hci_update_adv_data()

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is not freed, which will cause memory leak, convert to use ER…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Medium 5.5
  CVE-2023-53018

  Bluetooth: hci_conn: Fix memory leaks

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leaks When hci_cmd_sync_queue() failed in hci_le_terminate_big() or hci_le_big_terminate(), the memory pointed by variable d is not freed, which will cause mem…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Medium 5.5
  CVE-2023-53208

  KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state

  In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state When emulating nested VM-Exit, load L1's TSC multiplier if L1's desired ratio doesn't match the current ratio, not if the r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53209

  wifi: mac80211_hwsim: Fix possible NULL dereference

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: Fix possible NULL dereference In a call to mac80211_hwsim_select_tx_link() the sta pointer might be NULL, thus need to check that it is not NULL before accessing it.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53210

  md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()

  In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() r5l_flush_stripe_to_raid() will check if the list 'flushing_ios' is empty, and then submit 'flush_bio', however, r5l_log_flus…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53221

  bpf: Fix memleak due to fentry attach failure

  In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms. Thi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53228

  drm/amdgpu: drop redundant sched job cleanup when cs is aborted

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: drop redundant sched job cleanup when cs is aborted Once command submission failed due to userptr invalidation in amdgpu_cs_submit, legacy code will perform cleanup of scheduler j…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53237

  drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini The gmc.ecc_irq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53248

  drm/amdgpu: install stub fence into potential unused fence pointers

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: install stub fence into potential unused fence pointers When using cpu to update page tables, vm update fences are unused. Install stub fence into these fence pointers instead of …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53256

  firmware: arm_ffa: Fix FFA device names for logical partitions

  In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix FFA device names for logical partitions Each physical partition can provide multiple services each with UUID. Each such service can be presented as logical partition wi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53258

  drm/amd/display: Fix possible underflow for displays with large vblank

  In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix possible underflow for displays with large vblank [Why] Underflow observed when using a display with a large vblank region and low refresh rate [How] Simplify calculation…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Medium 5.5
  CVE-2023-53270

  ext4: fix i_disksize exceeding i_size problem in paritally written case

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix i_disksize exceeding i_size problem in paritally written case It is possible for i_disksize can exceed i_size, triggering a warning. generic_perform_write copied = iov_iter_copy_fro…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2023-53275

  ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync()

  In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() The variable codec->regmap is often protected by the lock codec->regmap_lock when is accessed. Ho…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2023-53280

  scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue System crash when qla2x00_start_sp(sp) returns error code EGAIN and wake_up gets called for uninitialized wait queue sp->nvme_ls_waitq. q…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2023-53288

  drm/client: Fix memory leak in drm_client_modeset_probe

  In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_modeset_probe When a new mode is set to modeset->mode, the previous mode should be freed. This fixes the following kmemleak report: drm_mode_duplicat…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2023-53290

  samples/bpf: Fix fout leak in hbm's run_bpf_prog

  In the Linux kernel, the following vulnerability has been resolved: samples/bpf: Fix fout leak in hbm's run_bpf_prog Fix fout being fopen'ed but then not subsequently fclose'd. In the affected branch, fout is otherwise going out of scope.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2023-53304

  netfilter: nft_set_rbtree: fix overlap expiration walk

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix overlap expiration walk The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any. Can be reproduced wi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2023-53309

  drm/radeon: Fix integer overflow in radeon_cs_parser_init

  In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix integer overflow in radeon_cs_parser_init The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2023-53317

  ext4: fix WARNING in mb_find_extent

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in mb_find_extent Syzbot found the following issue: EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit suppor…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 16, 2025
• Medium 5.5
  CVE-2023-53343

  icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

  In the Linux kernel, the following vulnerability has been resolved: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and wil…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Medium 5.5
  CVE-2023-53351

  drm/sched: Check scheduler work queue before calling timeout handling

  In the Linux kernel, the following vulnerability has been resolved: drm/sched: Check scheduler work queue before calling timeout handling During an IGT GPU reset test we see again oops despite of commit 0c8c901aaaebc9 (drm/sched: Check scheduler ready before …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Medium 5.5
  CVE-2023-53352

  drm/ttm: check null pointer before accessing when swapping

  In the Linux kernel, the following vulnerability has been resolved: drm/ttm: check null pointer before accessing when swapping Add a check to avoid null pointer dereference as below: [ 90.002283] general protection fault, probably for non-canonical address 0x…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Medium 5.5
  CVE-2023-53365

  ip6mr: Fix skb_under_panic in ip6mr_cache_report()

  In the Linux kernel, the following vulnerability has been resolved: ip6mr: Fix skb_under_panic in ip6mr_cache_report() skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ---…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 17, 2025
• Medium 5.5
  CVE-2023-53370

  drm/amdgpu: fix memory leak in mes self test

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix memory leak in mes self test The fences associated with mes queue have to be freed up during amdgpu_ring_fini.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 18, 2025
• Medium 5.5
  CVE-2023-53371

  net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create The memory pointed to by the fs->any pointer is not freed in the error path of mlx5e_fs_tt_redirect_any_create, which can lead to…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• Medium 5.5
  CVE-2023-53380

  md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request

  In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request There are two check of 'mreplace' in raid10_sync_request(). In the first check, 'need_replace' will be set and 'mreplace' will…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• Medium 5.5
  CVE-2023-53384

  wifi: mwifiex: avoid possible NULL skb pointer dereference

  In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: avoid possible NULL skb pointer dereference In 'mwifiex_handle_uap_rx_forward()', always check the value returned by 'skb_copy()' to avoid potential NULL pointer dereference in…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• Medium 5.5
  CVE-2023-53415

  USB: dwc3: fix memory leak with using debugfs_lookup()

  In the Linux kernel, the following vulnerability has been resolved: USB: dwc3: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• Medium 5.5
  CVE-2023-53421

  blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()

  In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() When blkg_alloc() is called to allocate a blkcg_gq structure with the associated blkg_iostat_set's, there are 2 fields…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 18, 2025
• Medium 5.5
  CVE-2023-53441

  bpf: cpumap: Fix memory leak in cpu_map_update_elem

  In the Linux kernel, the following vulnerability has been resolved: bpf: cpumap: Fix memory leak in cpu_map_update_elem Syzkaller reported a memory leak as follows: BUG: memory leak unreferenced object 0xff110001198ef748 (size 192): comm "syz-executor.3", pid…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• Medium 5.5
  CVE-2023-53442

  ice: Block switchdev mode when ADQ is active and vice versa

  In the Linux kernel, the following vulnerability has been resolved: ice: Block switchdev mode when ADQ is active and vice versa ADQ and switchdev are not supported simultaneously. Enabling both at the same time can result in nullptr dereference. To prevent th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• Medium 5.5
  CVE-2023-53444

  drm/ttm: fix bulk_move corruption when adding a entry

  In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulk_move corruption when adding a entry When the resource is the first in the bulk_move range, adding it again (thus moving it to the tail) will corrupt the list since the first…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 18, 2025
• Medium 5.5
  CVE-2023-6622

  Kernel: null pointer dereference vulnerability in nft_dynset_init()

  A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Dec 8, 2023
• Medium 5.5
  CVE-2024-26633

  ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()

  In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 18, 2024
• Medium 5.3
  CVE-2023-28866

  In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_ini…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 27, 2023
• Medium 5.1
  CVE-2023-39189

  Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()

  A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 9, 2023
• Medium 4.7
  CVE-2023-6176

  Kernel: local dos vulnerability in scatterwalk_copychunks

  A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to cras…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Nov 16, 2023
• Medium 4.6
  CVE-2023-37453

  An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Jul 6, 2023
• Medium 4.4
  CVE-2023-42756

  Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap

  A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the syst…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Sep 28, 2023
• Medium 4.3
  CVE-2023-6121

  Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get

  An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potenti…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu
  Nov 16, 2023
• Medium 4.0
  CVE-2023-52597

  KVM: s390: fix setting of fpc register

  In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control (fpc) register of a guest cpu. The new value is tested for validity by temporaril…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 6, 2024
• Low 3.2
  CVE-2023-39194

  Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()

  A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigge…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  Oct 9, 2023
• Unscored —
  CVE-2020-26555

  Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated…

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  May 24, 2021
• Unscored —
  CVE-2021-47579

  ovl: fix warning in ovl_create_real()

  In the Linux kernel, the following vulnerability has been resolved: ovl: fix warning in ovl_create_real() Syzbot triggered the following warning in ovl_workdir_create() -> ovl_create_real(): if (!err && WARN_ON(!newdentry->d_inode)) { The reason is that the c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 19, 2024
• Unscored —
  CVE-2022-0480

  A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory ex…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Aug 29, 2022
• Unscored —
  CVE-2022-48947

  Bluetooth: L2CAP: Fix u8 overflow

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix u8 overflow By keep sending L2CAP_CONF_REQ packets, chan->num_conf_rsp increases multiple times and eventually it will wrap around the maximum number (i.e., 255). This p…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 21, 2024
• Unscored —
  CVE-2022-49011

  hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new()

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 21, 2024
• Unscored —
  CVE-2022-49350

  net: mdio: unexport __init-annotated mdio_bus_init()

  In the Linux kernel, the following vulnerability has been resolved: net: mdio: unexport __init-annotated mdio_bus_init() EXPORT_SYMBOL and __init is a bad combination because the .init.text section is freed up after the initialization. Hence, modules cannot u…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Unscored —
  CVE-2022-49721

  arm64: ftrace: consistently handle PLTs.

  In the Linux kernel, the following vulnerability has been resolved: arm64: ftrace: consistently handle PLTs. Sometimes it is necessary to use a PLT entry to call an ftrace trampoline. This is handled by ftrace_make_call() and ftrace_make_nop(), with each havi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 26, 2025
• Unscored —
  CVE-2022-49744

  mm/uffd: fix pte marker when fork() without fork event

  In the Linux kernel, the following vulnerability has been resolved: mm/uffd: fix pte marker when fork() without fork event Patch series "mm: Fixes on pte markers". Patch 1 resolves the syzkiller report from Pengfei. Patch 2 further harden pte markers when use…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Unscored —
  CVE-2022-49940

  tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf()

  In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() A null pointer dereference can happen when attempting to access the "gsm->receive()" function in gsmld_receive_buf(). Curren…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• Unscored —
  CVE-2022-50080

  tee: add overflow check in register_shm_helper()

  In the Linux kernel, the following vulnerability has been resolved: tee: add overflow check in register_shm_helper() With special lengths supplied by user space, register_shm_helper() has an integer overflow when calculating the number of pages covered by a s…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• Unscored —
  CVE-2022-50116

  tty: n_gsm: fix deadlock and link starvation in outgoing data path

  In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: fix deadlock and link starvation in outgoing data path The current implementation queues up new control and user packets as needed and processes this queue down to the ldisc in th…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Jun 18, 2025
• Unscored —
  CVE-2022-50202

  PM: hibernate: defer device probing when resuming from hibernation

  In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: defer device probing when resuming from hibernation syzbot is reporting hung task at misc_open() [1], for there is a race window of AB-BA deadlock which involves probe_count va…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025
• Unscored —
  CVE-2022-50277

  ext4: don't allow journal inode to have encrypt flag

  In the Linux kernel, the following vulnerability has been resolved: ext4: don't allow journal inode to have encrypt flag Mounting a filesystem whose journal inode has the encrypt flag causes a NULL dereference in fscrypt_limit_io_blocks() when the 'inlinecryp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2022-50313

  erofs: fix order >= MAX_ORDER warning due to crafted negative i_size

  In the Linux kernel, the following vulnerability has been resolved: erofs: fix order >= MAX_ORDER warning due to crafted negative i_size As syzbot reported [1], the root cause is that i_size field is a signed type, and negative i_size is also less than EROFS_…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2022-50318

  perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox()

  In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() pci_get_device() will increase the reference count for the returned 'dev'. We need to call pci_dev_put() to decrease …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2022-50377 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Sep 18, 2025
• Unscored —
  CVE-2022-50447

  Bluetooth: hci_conn: Fix crash on hci_create_cis_sync

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix crash on hci_create_cis_sync When attempting to connect multiple ISO sockets without using DEFER_SETUP may result in the following crash: BUG: KASAN: null-ptr-deref i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2022-50453

  gpiolib: cdev: fix NULL-pointer dereferences

  In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: fix NULL-pointer dereferences There are several places where we can crash the kernel by requesting lines, unbinding the GPIO device, then calling any of the system calls releva…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2022-50485

  ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode

  In the Linux kernel, the following vulnerability has been resolved: ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode There are many places that will get unhappy (and crash) when ext4_iget() returns a bad inode. However, if iget the boot loader ino…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2022-50637

  cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()

  In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() If "cpu_dev" fails to get opp table in qcom_cpufreq_hw_read_lut(), the program will return, resulting in "table" resource is no…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2022-50638

  ext4: fix bug_on in __es_tree_search caused by bad boot loader inode

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search caused by bad boot loader inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2022-50642

  platform/chrome: cros_ec_typec: zero out stale pointers

  In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_typec: zero out stale pointers `cros_typec_get_switch_handles` allocates four pointers when obtaining type-c switch handles. These pointers are all freed if failing t…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2022-50777

  net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe

  In the Linux kernel, the following vulnerability has been resolved: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe of_phy_find_device() return device node with refcount incremented. Call put_device() to relese it when not needed anymore.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2022-50782

  ext4: fix bug_on in __es_tree_search caused by bad quota inode

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search caused by bad quota inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_statu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2022-50845

  ext4: fix inode leak in ext4_xattr_inode_create() on an error path

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix inode leak in ext4_xattr_inode_create() on an error path There is issue as follows when do setxattr with inject fault: [localhost]# fsck.ext4 -fn /dev/sda e2fsck 1.46.6-rc1 (12-Sep-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2022-50879

  objtool: Fix SEGFAULT

  In the Linux kernel, the following vulnerability has been resolved: objtool: Fix SEGFAULT find_insn() will return NULL in case of failure. Check insn in order to avoid a kernel Oops for NULL pointer dereference.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-28464

  hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_co…

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu Azure Linux
  Mar 31, 2023
• Unscored —
  CVE-2023-31083

  An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a rac…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Apr 24, 2023
• Unscored —
  CVE-2023-45863

  An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 14, 2023
• Unscored —
  CVE-2023-46862

  An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_u…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Oct 29, 2023
• Unscored —
  CVE-2023-51780

  An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because …

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Dec 25, 2023
• Unscored —
  CVE-2023-52448

  gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump

  In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 22, 2024
• Unscored —
  CVE-2023-52450

  perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()

  In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() Get logical socket id instead of physical id in discover_upi_topology() to avoid out-of-bound access on 'upi =…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 22, 2024
• Unscored —
  CVE-2023-52470

  drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()

  In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 25, 2024
• Unscored —
  CVE-2023-52476

  perf/x86/lbr: Filter vsyscall addresses

  In the Linux kernel, the following vulnerability has been resolved: perf/x86/lbr: Filter vsyscall addresses We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 29, 2024
• Unscored —
  CVE-2023-52489

  mm/sparsemem: fix race in accessing memory_section->usage

  In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are su…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 29, 2024
• Unscored —
  CVE-2023-52519

  HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit

  In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit The EHL (Elkhart Lake) based platforms provide a OOB (Out of band) service, which allows to wakup device when the system is in S5 (S…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Unscored —
  CVE-2023-52578

  net: bridge: use DEV_STATS_INC()

  In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_I…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Unscored —
  CVE-2023-52580

  net/core: Fix ETH_P_1588 flow dissector

  In the Linux kernel, the following vulnerability has been resolved: net/core: Fix ETH_P_1588 flow dissector When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 2, 2024
• Unscored —
  CVE-2023-52924

  netfilter: nf_tables: don't skip expired elements during walk

  In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: don't skip expired elements during walk There is an asymmetry between commit/abort and preparation phase if the following conditions are met: 1. set is a verdict map ("1…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 5, 2025
• Unscored —
  CVE-2023-52940

  mm: multi-gen LRU: fix crash during cgroup migration

  In the Linux kernel, the following vulnerability has been resolved: mm: multi-gen LRU: fix crash during cgroup migration lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself. This isn't true for the following scenario: CPU 1 CPU 2 clone() cgroup…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Unscored —
  CVE-2023-52985

  arm64: dts: imx8mm-verdin: Do not power down eth-phy

  In the Linux kernel, the following vulnerability has been resolved: arm64: dts: imx8mm-verdin: Do not power down eth-phy Currently if suspending using either freeze or memory state, the fec driver tries to power down the phy which leads to crash of the kernel…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Unscored —
  CVE-2023-53004

  ovl: fix tmpfile leak

  In the Linux kernel, the following vulnerability has been resolved: ovl: fix tmpfile leak Missed an error cleanup.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Unscored —
  CVE-2023-53019

  net: mdio: validate parameter addr in mdiobus_get_phy()

  In the Linux kernel, the following vulnerability has been resolved: net: mdio: validate parameter addr in mdiobus_get_phy() The caller may pass any value as addr, what may result in an out-of-bounds access to array mdio_map. One existing case is stmmac_init_p…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 27, 2025
• Unscored —
  CVE-2023-53097

  powerpc/iommu: fix memory leak with using debugfs_lookup()

  In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things sim…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• Unscored —
  CVE-2023-53134

  bnxt_en: Avoid order-5 memory allocation for TPA data

  In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Avoid order-5 memory allocation for TPA data The driver needs to keep track of all the possible concurrent TPA (GRO/LRO) completions on the aggregation ring. On P5 chips, the maximum…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• Unscored —
  CVE-2023-53140

  scsi: core: Remove the /proc/scsi/${proc_name} directory earlier

  In the Linux kernel, the following vulnerability has been resolved: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. T…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  May 2, 2025
• Unscored —
  CVE-2023-53148

  igb: Fix igb_down hung on surprise removal

  In the Linux kernel, the following vulnerability has been resolved: igb: Fix igb_down hung on surprise removal In a setup where a Thunderbolt hub connects to Ethernet and a display through USB Type-C, users may experience a hung task timeout when they remove …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53149

  ext4: avoid deadlock in fs reclaim with page writeback

  In the Linux kernel, the following vulnerability has been resolved: ext4: avoid deadlock in fs reclaim with page writeback Ext4 has a filesystem wide lock protecting ext4_writepages() calls to avoid races with switching of journalled data flag or inode format…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 15, 2025
• Unscored —
  CVE-2023-53150

  scsi: qla2xxx: Pointer may be dereferenced

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Pointer may be dereferenced Klocwork tool reported pointer 'rport' returned from call to function fc_bsg_to_rport() may be NULL and will be dereferenced. Add a fix to validate …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53151

  md/raid10: prevent soft lockup while flush writes

  In the Linux kernel, the following vulnerability has been resolved: md/raid10: prevent soft lockup while flush writes Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't, and too many…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53152

  drm/amdgpu: fix calltrace warning in amddrm_buddy_fini

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix calltrace warning in amddrm_buddy_fini The following call trace is observed when removing the amdgpu driver, which is caused by that BOs allocated for psp are not freed until …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Sep 15, 2025
• Unscored —
  CVE-2023-53164

  irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe

  In the Linux kernel, the following vulnerability has been resolved: irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anym…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53180

  wifi: ath12k: Avoid NULL pointer access during management transmit cleanup

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid NULL pointer access during management transmit cleanup Currently 'ar' reference is not added in skb_cb. Though this is generally not used during transmit completion callba…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53181

  dma-buf/dma-resv: Stop leaking on krealloc() failure

  In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fai…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53193

  drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini The gmc.ecc_irq is enabled by firmware per IFWI setting, and the host driver is not privileged to enable/disable the interrupt. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53202

  PM: domains: fix memory leak with using debugfs_lookup()

  In the Linux kernel, the following vulnerability has been resolved: PM: domains: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpl…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53204

  af_unix: Fix data-races around user->unix_inflight.

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-races around user->unix_inflight. user->unix_inflight is changed under spin_lock(unix_gc_lock), but too_many_unix_fds() reads it locklessly. Let's annotate the write/read ac…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53246

  cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL

  In the Linux kernel, the following vulnerability has been resolved: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Sep 15, 2025
• Unscored —
  CVE-2023-53293 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  Sep 16, 2025
• Unscored —
  CVE-2023-53451

  scsi: qla2xxx: Fix potential NULL pointer dereference

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix potential NULL pointer dereference Klocwork tool reported 'cur_dsd' may be dereferenced. Add fix to validate pointer before dereferencing the pointer.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53471

  drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras gfx9 cp_ecc_error_irq is only enabled when legacy gfx ras is assert. So in gfx_v9_0_hw_fini, interrupt disablem…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53476

  iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry()

  In the Linux kernel, the following vulnerability has been resolved: iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() This condition needs to match the previous "if (epcp->state == LISTEN) {" exactly to avoid a NULL dereference of either…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53479

  cxl/acpi: Fix a use-after-free in cxl_parse_cfmws()

  In the Linux kernel, the following vulnerability has been resolved: cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() KASAN and KFENCE detected an user-after-free in the CXL driver. This happens in the cxl_decoder_add() fail path. KASAN prints the following…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53487

  powerpc/rtas_flash: allow user copy to flash block cache objects

  In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas_flash: allow user copy to flash block cache objects With hardened usercopy enabled (CONFIG_HARDENED_USERCOPY=y), using the /proc/powerpc/rtas/firmware_update interface to prepare…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53496

  x86/platform/uv: Use alternate source for socket to node data

  In the Linux kernel, the following vulnerability has been resolved: x86/platform/uv: Use alternate source for socket to node data The UV code attempts to build a set of tables to allow it to do bidirectional socket<=>node lookups. But when nr_cpus is set to a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53501

  iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind

  In the Linux kernel, the following vulnerability has been resolved: iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind When unbinding pasid - a race condition exists vs outstanding page faults. To prevent this, the pasid_state obje…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53513

  nbd: fix incomplete validation of ioctl arg

  In the Linux kernel, the following vulnerability has been resolved: nbd: fix incomplete validation of ioctl arg We tested and found an alarm caused by nbd_ioctl arg without verification. The UBSAN warning calltrace like below: UBSAN: Undefined behaviour in fs…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53525

  RDMA/cma: Allow UD qp_type to join multicast only

  In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Allow UD qp_type to join multicast only As for multicast: - The SIDR is the only mode that makes sense; - Besides PS_UDP, other port spaces like PS_IB is also allowed, as it is UD c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53527

  thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request()

  In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request() The memory allocated in tb_queue_dp_bandwidth_request() needs to be released once the request is handled to avoid leaking it.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53530

  scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id() The following call trace was observed: localhost kernel: nvme nvme0: NVME-FC{0}: controller connect complete localhost …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 1, 2025
• Unscored —
  CVE-2023-53544

  cpufreq: davinci: Fix clk use after free

  In the Linux kernel, the following vulnerability has been resolved: cpufreq: davinci: Fix clk use after free The remove function first frees the clks and only then calls cpufreq_unregister_driver(). If one of the cpufreq callbacks is called just before cpufre…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53546

  net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx when mlx5_cmd_exec failed in mlx5dr_cmd_create_reformat_ctx, the memory pointed by 'in' is not released, which will cause memor…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53547

  drm/amdgpu: Fix sdma v4 sw fini error

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix sdma v4 sw fini error Fix sdma v4 sw fini error for sdma 4.2.2 to solve the following general protection fault [ +0.108196] general protection fault, probably for non-canonica…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53550

  cpufreq: amd-pstate: fix global sysfs attribute type

  In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate: fix global sysfs attribute type In commit 3666062b87ec ("cpufreq: amd-pstate: move to use bus_get_dev_root()") the "amd_pstate" attributes where moved from a dedicated ko…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53553

  HID: hyperv: avoid struct memcpy overrun warning

  In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: avoid struct memcpy overrun warning A previous patch addressed the fortified memcpy warning for most builds, but I still see this one with gcc-9: In file included from include/li…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53563

  cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver

  In the Linux kernel, the following vulnerability has been resolved: cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver After loading the amd-pstate-ut driver, amd_pstate_ut_check_perf() and amd_pstate_ut_check_freq() use cpufreq_cpu_get() to get…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53581

  net/mlx5e: Check for NOT_READY flag state after locking

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Check for NOT_READY flag state after locking Currently the check for NOT_READY flag is performed before obtaining the necessary lock. This opens a possibility for race condition wh…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53585

  bpf: reject unhashed sockets in bpf_sk_assign

  In the Linux kernel, the following vulnerability has been resolved: bpf: reject unhashed sockets in bpf_sk_assign The semantics for bpf_sk_assign are as follows: sk = some_lookup_func() bpf_sk_assign(skb, sk) bpf_sk_release(sk) That is, the sk is not consumed…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53611

  ipmi_si: fix a memleak in try_smi_init()

  In the Linux kernel, the following vulnerability has been resolved: ipmi_si: fix a memleak in try_smi_init() Kmemleak reported the following leak info in try_smi_init(): unreferenced object 0xffff00018ecf9400 (size 1024): comm "modprobe", pid 2707763, jiffies…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53612

  hwmon: (coretemp) Simplify platform device handling

  In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Simplify platform device handling Coretemp's platform driver is unconventional. All the real work is done globally by the initcall and CPU hotplug notifiers, while the "driv…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 4, 2025
• Unscored —
  CVE-2023-53621

  memcontrol: ensure memcg acquired by id is properly set up

  In the Linux kernel, the following vulnerability has been resolved: memcontrol: ensure memcg acquired by id is properly set up In the eviction recency check, we attempt to retrieve the memcg to which the folio belonged when it was evicted, by the memcg id sto…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53628

  drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs The gfx.cp_ecc_error_irq is retired in gfx11. In gfx_v11_0_hw_fini still use amdgpu_irq_put to disable this interrupt, which caused the call …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53632

  net/mlx5e: Take RTNL lock when needed before calling xdp_set_features()

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Take RTNL lock when needed before calling xdp_set_features() Hold RTNL lock when calling xdp_set_features() with a registered netdev, as the call triggers the netdev notifiers. Thi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53647

  Drivers: hv: vmbus: Don't dereference ACPI root object handle

  In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't dereference ACPI root object handle Since the commit referenced in the Fixes: tag below the VMBus client driver is walking the ACPI namespace up from the VMBus ACPI …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Oct 7, 2025
• Unscored —
  CVE-2023-53649

  perf trace: Really free the evsel->priv area

  In the Linux kernel, the following vulnerability has been resolved: perf trace: Really free the evsel->priv area In 3cb4d5e00e037c70 ("perf trace: Free syscall tp fields in evsel->priv") it only was freeing if strcmp(evsel->tp_format->system, "syscalls") retu…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53652

  vdpa: Add features attr to vdpa_nl_policy for nlattr length check

  In the Linux kernel, the following vulnerability has been resolved: vdpa: Add features attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute bei…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53655

  rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed

  In the Linux kernel, the following vulnerability has been resolved: rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed Registering a kprobe on __rcu_irq_enter_check_tick() can cause kernel stack overflow as shown below. This issue c…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53657

  ice: Don't tx before switchdev is fully configured

  In the Linux kernel, the following vulnerability has been resolved: ice: Don't tx before switchdev is fully configured There is possibility that ice_eswitch_port_start_xmit might be called while some resources are still not allocated which might cause NULL po…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53661

  bnxt: avoid overflow in bnxt_get_nvram_directory()

  In the Linux kernel, the following vulnerability has been resolved: bnxt: avoid overflow in bnxt_get_nvram_directory() The value of an arithmetic expression is subject of possible overflow due to a failure to cast operands to a larger data type before perform…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53663

  KVM: nSVM: Check instead of asserting on nested TSC scaling support

  In the Linux kernel, the following vulnerability has been resolved: KVM: nSVM: Check instead of asserting on nested TSC scaling support Check for nested TSC scaling support on nested SVM VMRUN instead of asserting that TSC scaling is exposed to L1 if L1's MSR…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53664

  OPP: Fix potential null ptr dereference in dev_pm_opp_get_required_pstate()

  In the Linux kernel, the following vulnerability has been resolved: OPP: Fix potential null ptr dereference in dev_pm_opp_get_required_pstate() "opp" pointer is dereferenced before the IS_ERR_OR_NULL() check. Fix it by removing the dereference to cache opp_ta…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53665

  md: don't dereference mddev after export_rdev()

  In the Linux kernel, the following vulnerability has been resolved: md: don't dereference mddev after export_rdev() Except for initial reference, mddev->kobject is referenced by rdev->kobject, and if the last rdev is freed, there is no guarantee that mddev is…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53666

  ASoC: codecs: wcd938x: fix missing mbhc init error handling

  In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix missing mbhc init error handling MBHC initialisation can fail so add the missing error handling to avoid dereferencing an error pointer when later configuring the j…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53677

  drm/i915: Fix memory leaks in i915 selftests

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix memory leaks in i915 selftests This patch fixes memory leaks on error escapes in function fake_get_pages (cherry picked from commit 8bfbdadce85c4c51689da10f39c805a7106d4567)

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 7, 2025
• Unscored —
  CVE-2023-53696

  scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() There is a memory leak reported by kmemleak: unreferenced object 0xffffc900003f0000 (size 12288): comm "modprobe", pid 19117, jiffies 429…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 22, 2025
• Unscored —
  CVE-2023-53709

  ring-buffer: Handle race between rb_move_tail and rb_check_pages

  In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 22, 2025
• Unscored —
  CVE-2023-53722

  md: raid1: fix potential OOB in raid1_remove_disk()

  In the Linux kernel, the following vulnerability has been resolved: md: raid1: fix potential OOB in raid1_remove_disk() If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in raid1_remove_disk(). We have already found similar…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 22, 2025
• Unscored —
  CVE-2023-53730

  blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost

  In the Linux kernel, the following vulnerability has been resolved: blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost adjust_inuse_and_calc_cost() use spin_lock_irq() and IRQ will be enabled when unlock. DEADLOCK might happen if we have held oth…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Oct 22, 2025
• Unscored —
  CVE-2023-53743

  PCI: Free released resource after coalescing

  In the Linux kernel, the following vulnerability has been resolved: PCI: Free released resource after coalescing release_resource() doesn't actually free the resource or resource list entry so free the resource list entry to avoid a leak.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Unscored —
  CVE-2023-53761

  USB: usbtmc: Fix direction for 0-length ioctl control messages

  In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 8, 2025
• Unscored —
  CVE-2023-53784

  drm: bridge: dw_hdmi: fix connector access for scdc

  In the Linux kernel, the following vulnerability has been resolved: drm: bridge: dw_hdmi: fix connector access for scdc Commit 5d844091f237 ("drm/scdc-helper: Pimp SCDC debugs") changed the scdc interface to pick up an i2c adapter from a connector instead. Ho…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53791

  md: fix warning for holder mismatch from export_rdev()

  In the Linux kernel, the following vulnerability has been resolved: md: fix warning for holder mismatch from export_rdev() Commit a1d767191096 ("md: use mddev->external to select holder in export_rdev()") fix the problem that 'claim_rdev' is used for blkdev_g…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53813

  ext4: fix rbtree traversal bug in ext4_mb_use_preallocated

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix rbtree traversal bug in ext4_mb_use_preallocated During allocations, while looking for preallocations(PA) in the per inode rbtree, we can't do a direct traversal of the tree because…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53821

  ip6_vti: fix slab-use-after-free in decode_session6

  In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-aft…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53833

  drm/i915: Fix NULL ptr deref by checking new_crtc_state

  In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we m…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53842

  ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove

  In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove The MBHC resources must be released on component probe failure and removal so can not be tied to the lifetime of the componen…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53843

  net: openvswitch: reject negative ifindex

  In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject negative ifindex Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs in an xarray")) refactored the handling of pre-assigned ifindexes and let syzbot…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53847

  usb-storage: alauda: Fix uninit-value in alauda_check_media()

  In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alauda_check_media() Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage: BUG: KMSAN: uninit-va…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53848

  md/raid5-cache: fix a deadlock in r5l_exit_log()

  In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix a deadlock in r5l_exit_log() Commit b13015af94cf ("md/raid5-cache: Clear conf->log after finishing work") introduce a new problem: // caller hold reconfig_mutex r5l_exit_l…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53857

  bpf: bpf_sk_storage: Fix invalid wait context lockdep report

  In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_sk_storage: Fix invalid wait context lockdep report './test_progs -t test_local_storage' reported a splat: [ 27.137569] ============================= [ 27.138122] [ BUG: Invalid wait…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53863

  netlink: do not hard code device address lenth in fdb dumps

  In the Linux kernel, the following vulnerability has been resolved: netlink: do not hard code device address lenth in fdb dumps syzbot reports that some netdev devices do not have a six bytes address [1] Replace ETH_ALEN by dev->addr_len. [1] (Case of a devic…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 9, 2025
• Unscored —
  CVE-2023-53992

  wifi: cfg80211: ocb: don't leave if not joined

  In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: ocb: don't leave if not joined If there's no OCB state, don't ask the driver/mac80211 to leave, since that's just confusing. Since set/clear the chandef state, that's a simple…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-53993

  PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y

  In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fix memory leak with CONFIG_DEBUG_OBJECTS=y After a pci_doe_task completes, its work_struct needs to be destroyed to avoid a memory leak with CONFIG_DEBUG_OBJECTS=y.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-53995

  net: ipv4: fix one memleak in __inet_del_ifa()

  In the Linux kernel, the following vulnerability has been resolved: net: ipv4: fix one memleak in __inet_del_ifa() I got the below warning when do fuzzing test: unregister_netdevice: waiting for bond0 to become free. Usage count = 2 It can be repoduced via: i…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-53999

  net/mlx5e: TC, Fix internal port memory leak

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Fix internal port memory leak The flow rule can be splited, and the extra post_act rules are added to post_act table. It's possible to trigger memleak when the rule forwards pa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54003

  RDMA/core: Fix GID entry ref leak when create_ah fails

  In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix GID entry ref leak when create_ah fails If AH create request fails, release sgid_attr to avoid GID entry referrence leak reported while releasing GID table

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54006

  af_unix: Fix data-race around unix_tot_inflight.

  In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-race around unix_tot_inflight. unix_tot_inflight is changed under spin_lock(unix_gc_lock), but unix_release_sock() reads it locklessly. Let's use READ_ONCE() for unix_tot_in…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54008

  virtio_vdpa: build affinity masks conditionally

  In the Linux kernel, the following vulnerability has been resolved: virtio_vdpa: build affinity masks conditionally We try to build affinity mask via create_affinity_masks() unconditionally which may lead several issues: - the affinity mask is not used for pa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54014

  scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() Klocwork reported warning of rport maybe NULL and will be dereferenced. rport returned by call to fc_bsg_to_rport() could be NUL…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54016

  wifi: ath12k: Fix memory leak in rx_desc and tx_desc

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix memory leak in rx_desc and tx_desc Currently when ath12k_dp_cc_desc_init() is called we allocate memory to rx_descs and tx_descs. In ath12k_dp_cc_cleanup(), during descripto…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54021

  ext4: set goal start correctly in ext4_mb_normalize_request

  In the Linux kernel, the following vulnerability has been resolved: ext4: set goal start correctly in ext4_mb_normalize_request We need to set ac_g_ex to notify the goal start used in ext4_mb_find_by_goal. Set ac_g_ex instead of ac_f_ex in ext4_mb_normalize_r…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54022

  ALSA: usb-audio: Fix potential memory leaks at error path for UMP open

  In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential memory leaks at error path for UMP open The allocation and initialization errors at alloc_midi_urbs() that is called at MIDI 2.0 / UMP device are supposed to be…

  Linux Linux linux-raspi2 linux-hwe Linux Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54028

  RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task"

  In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task" In the function rxe_create_qp(), rxe_qp_from_init() is called to initialize qp, internally things like rxe_init…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54030

  io_uring/net: don't overflow multishot recv

  In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't overflow multishot recv Don't allow overflowing multishot recv CQEs, it might get out of hand, hurt performance, and in the worst case scenario OOM the task.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54031

  vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check

  In the Linux kernel, the following vulnerability has been resolved: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check The vdpa_nl_policy structure is used to validate the nlattr when parsing the incoming nlmsg. It will ensure the attribute …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54033

  bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps

  In the Linux kernel, the following vulnerability has been resolved: bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps The LRU and LRU_PERCPU maps allocate a new element on update before locking the target hash table bucket. Right after that the maps …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54038

  Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link hci_connect_sco currently returns NULL when there is no link (i.e. when hci_conn_link() returns NULL). sco_connect() …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54052

  wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU

  In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU txs may be dropped if the frame is aggregated in AMSDU. When the problem shows up, some SKBs would be hold in driver to cause network …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54064

  ipmi:ssif: Fix a memory leak when scanning for an adapter

  In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: Fix a memory leak when scanning for an adapter The adapter scan ssif_info_find() sets info->adapter_name if the adapter info came from SMBIOS, as it's not set in that case. However…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54069

  ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow

  In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow When we calculate the end position of ext4_free_extent, this position may be exactly where ext4_lblk_t (i.e. uint) overflows. For examp…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54070

  igb: clean up in all error paths when enabling SR-IOV

  In the Linux kernel, the following vulnerability has been resolved: igb: clean up in all error paths when enabling SR-IOV After commit 50f303496d92 ("igb: Enable SR-IOV after reinit"), removing the igb module could hang or crash (depending on the machine) whe…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54072

  ALSA: pcm: Fix potential data race at PCM memory allocation helpers

  In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential data race at PCM memory allocation helpers The PCM memory allocation helpers have a sanity check against too many buffer allocations. However, the check is performed …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54091

  drm/client: Fix memory leak in drm_client_target_cloned

  In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_target_cloned dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup ar…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54106

  net/mlx5: fix potential memory leak in mlx5e_init_rep_rx

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fix potential memory leak in mlx5e_init_rep_rx The memory pointed to by the priv->rx_res pointer is not freed in the error path of mlx5e_init_rep_rx, which can lead to a memory leak…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54137

  vfio/type1: fix cap_migration information leak

  In the Linux kernel, the following vulnerability has been resolved: vfio/type1: fix cap_migration information leak Fix an information leak where an uninitialized hole in struct vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace. The defi…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54141

  wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018 During sending data after clients connected, hw_ops->get_ring_selector() will be called. But for IPQ5018, this member isn't s…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54145

  bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log

  In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (a…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54148

  net/mlx5e: Move representor neigh cleanup to profile cleanup_tx

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor neigh cleanup to profile cleanup_tx For IP tunnel encapsulation in ECMP (Equal-Cost Multipath) mode, as the flow is duplicated to the peer eswitch, the related nei…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54154

  scsi: target: core: Fix target_cmd_counter leak

  In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix target_cmd_counter leak The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in leaks across various transport types, e.g.:…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54155

  net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()

  In the Linux kernel, the following vulnerability has been resolved: net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() Syzkaller reported the following issue: ======================================= Too BIG xdp->frame_sz = 131072 WARNING: C…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54160

  firmware: arm_sdei: Fix sleep from invalid context BUG

  In the Linux kernel, the following vulnerability has been resolved: firmware: arm_sdei: Fix sleep from invalid context BUG Running a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra triggers: BUG: sleeping function called from invalid context at kern…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 24, 2025
• Unscored —
  CVE-2023-54169

  net/mlx5e: fix memory leak in mlx5e_ptp_open

  In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix memory leak in mlx5e_ptp_open When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory pointed by "c" or "cparams" is not freed, which can lead to a memory leak. Fix…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54170

  keys: Fix linking a duplicate key to a keyring's assoc_array

  In the Linux kernel, the following vulnerability has been resolved: keys: Fix linking a duplicate key to a keyring's assoc_array When making a DNS query inside the kernel using dns_query(), the request code can in rare cases end up creating a duplicate index …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54179

  scsi: qla2xxx: Array index may go out of bound

  In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Array index may go out of bound Klocwork reports array 'vha->host_str' of size 16 may use index value(s) 16..19. Use snprintf() instead of sprintf().

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54197

  Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work"

  In the Linux kernel, the following vulnerability has been resolved: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. This patch introduces a possible null-…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54215

  virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()

  In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs() Free the cpumask allocated by create_affinity_masks() before returning from the function.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54221

  clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe

  In the Linux kernel, the following vulnerability has been resolved: clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe In function probe(), it returns directly without unregistered hws when error occurs. Fix this by adding 'goto unregis…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54229

  wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range

  In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range Because of what seems to be a typo, a 6Ghz-only phy for which the BDF does not allow the 7115Mhz channel will fa…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54235

  PCI/DOE: Fix destroy_work_on_stack() race

  In the Linux kernel, the following vulnerability has been resolved: PCI/DOE: Fix destroy_work_on_stack() race The following debug object splat was observed in testing: ODEBUG: free active (active state 0) object: 0000000097d23782 object type: work_struct hint…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54242

  block, bfq: Fix division by zero error on zero wsum

  In the Linux kernel, the following vulnerability has been resolved: block, bfq: Fix division by zero error on zero wsum When the weighted sum is zero the calculation of limit causes a division by zero error. Fix this by continuing to the next level. This was …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54251

  net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX.

  In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. syzkaller found zero division error [0] in div_s64_rem() called from get_cycle_time_elapsed(), where sched->cycle_time is…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54260

  cifs: Fix lost destroy smbd connection when MR allocate failed

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix lost destroy smbd connection when MR allocate failed If the MR allocate failed, the smb direct connection info is NULL, then smbd_destroy() will directly return, then the connection…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54261

  drm/amdkfd: Add missing gfx11 MQD manager callbacks

  In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add missing gfx11 MQD manager callbacks mqd_stride function was introduced in commit 2f77b9a242a2 ("drm/amdkfd: Update MQD management on multi XCC setup") but not assigned for gfx…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54263

  drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP

  In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP Fixes OOPS on boards with ANX9805 DP encoders.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54274

  RDMA/srpt: Add a check for valid 'mad_agent' pointer

  In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Add a check for valid 'mad_agent' pointer When unregistering MAD agent, srpt module has a non-null check for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). This che…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54283

  bpf: Address KCSAN report on bpf_lru_list

  In the Linux kernel, the following vulnerability has been resolved: bpf: Address KCSAN report on bpf_lru_list KCSAN reported a data-race when accessing node->ref. Although node->ref does not have to be accurate, take this chance to use a more common READ_ONCE…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54289

  scsi: qedf: Fix NULL dereference in error handling

  In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix NULL dereference in error handling Smatch reported: drivers/scsi/qedf/qedf_main.c:3056 qedf_alloc_global_queues() warn: missing unwind goto? At this point in the function, not…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54296

  KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration

  In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration Fix a goof where KVM tries to grab source vCPUs from the destination VM when doing intrahost migration. Grabbing the w…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54302

  RDMA/irdma: Fix data race on CQP completion stats

  In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP completion stats CQP completion statistics is read lockesly in irdma_wait_event and irdma_check_cqp_progress while it can be updated in the completion thread …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54312

  samples/bpf: Fix buffer overflow in tcp_basertt

  In the Linux kernel, the following vulnerability has been resolved: samples/bpf: Fix buffer overflow in tcp_basertt Using sizeof(nv) or strlen(nv)+1 is correct.

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54316

  refscale: Fix uninitalized use of wait_queue_head_t

  In the Linux kernel, the following vulnerability has been resolved: refscale: Fix uninitalized use of wait_queue_head_t Running the refscale test occasionally crashes the kernel with the following error: [ 8569.952896] BUG: unable to handle page fault for add…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2023-54324

  dm: fix a race condition in retrieve_deps

  In the Linux kernel, the following vulnerability has been resolved: dm: fix a race condition in retrieve_deps There's a race condition in the multipath target when retrieve_deps races with multipath_message calling dm_get_device and dm_put_device. retrieve_de…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Dec 30, 2025
• Unscored —
  CVE-2024-26593

  i2c: i801: Fix block process call transactions

  In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Feb 23, 2024
• Unscored —
  CVE-2024-26602

  sched/membarrier: reduce the ability to hammer on sys_membarrier

  In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Feb 24, 2024
• Unscored —
  CVE-2024-26609 Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Feb 29, 2024
• Unscored —
  CVE-2024-26649

  drm/amdgpu: Fix the null pointer when load rlc firmware

  In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer when load rlc firmware If the RLC firmware is invalid because of wrong header size, the pointer to the rlc firmware is released in function amdgpu_ucode_reque…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Mar 26, 2024
• Unscored —
  CVE-2024-26671

  blk-mq: fix IO hang from sbitmap wakeup race

  In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. …

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  Apr 2, 2024
• Unscored —
  CVE-2025-38053

  idpf: fix null-ptr-deref in idpf_features_check

  In the Linux kernel, the following vulnerability has been resolved: idpf: fix null-ptr-deref in idpf_features_check idpf_features_check is used to validate the TX packet. skb header length is compared with the hardware supported value received from the device…

  Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  Jun 18, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1918601
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2049700
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2133452
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2151959
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2177759
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2185519
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2188102
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2210024
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2213132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2218332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2219359
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2221039
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2221463
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2221702
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2226777
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2226787
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2226788
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2231410
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2239845
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2239848
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2244720
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2246980
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2250043
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2252731
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253034
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254961
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2254982
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255283
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2255498
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2256490
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2256822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2257682
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2258013
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2258518
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2260005
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262126