Fixed packages 90
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debug | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debug-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debug-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debug-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debug-devel-matched | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debug-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debug-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debug-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-devel-matched | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-64k-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-abi-stablelists | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug-devel-matched | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debug-uki-virt | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debuginfo-common-aarch64 | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debuginfo-common-ppc64le | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debuginfo-common-s390x | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-debuginfo-common-x86_64 | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-devel-matched | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-doc | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-modules-extra-matched | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-debug | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-debug-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-debug-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-debug-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-debug-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-debug-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-debug-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-64k-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-debug | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-debug-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-debug-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-debug-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-debug-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-debug-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-debug-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-rt-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-tools | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-tools-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-tools-libs | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-tools-libs-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-uki-virt | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-uki-virt-addons | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-zfcpdump | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-zfcpdump-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-zfcpdump-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-zfcpdump-devel | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-zfcpdump-devel-matched | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-zfcpdump-modules | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-zfcpdump-modules-core | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | kernel-zfcpdump-modules-extra | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | libperf | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | libperf-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | perf | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | perf-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | python3-perf | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | python3-perf-debuginfo | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | rtla | 0:6.12.0-124.8.1.el10_1 |
| Red Hat · RHEL 10 enterprise_linux:10.1 | rv | 0:6.12.0-124.8.1.el10_1 |
Vulnerabilities 123
-
Critical 9.8
nfsd: clear acl_access/acl_default after releasing them
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a point…
-
Critical 9.8
netmem: prevent TX of unreadable skbs
In the Linux kernel, the following vulnerability has been resolved: netmem: prevent TX of unreadable skbs Currently on stable trees we have support for netmem/devmem RX but not TX. It is not safe to forward/redirect an RX unreadable netmem packet into the dev…
-
Critical 9.6
PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar()
In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Prevent changing BAR size/flags in pci_epc_set_bar() In commit 4284c88fff0e ("PCI: designware-ep: Allow pci_epc_set_bar() update inbound map address") set_bar() was modified to …
-
High 8.8
wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix read pointer after free in ath12k_mac_assign_vif_to_vdev() In ath12k_mac_assign_vif_to_vdev(), if arvif is created on a different radio, it gets deleted from that radio thro…
-
High 8.8
wifi: mac80211: don't flush non-uploaded STAs
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED (such as in IBSS scenarios) and insertion fails, the station is freed. In this case, the driver never kne…
-
High 8.8
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we al…
-
High 8.8
KVM: arm64: Tear down vGIC on failed vCPU creation
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Tear down vGIC on failed vCPU creation If kvm_arch_vcpu_create() fails to share the vCPU page with the hypervisor, we propagate the error back to the ioctl but leave the vGIC vCPU…
-
High 8.6
ibmvnic: Don't reference skb after sending to VIOS
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushing the xmit buffer to VIOS, the tx_bytes stat was incremented by the length of the skb. It is invalid t…
-
High 8.2
net: ppp: Add bound checking for skb data on ppp_sync_txmung
In the Linux kernel, the following vulnerability has been resolved: net: ppp: Add bound checking for skb data on ppp_sync_txmung Ensure we have enough data in linear buffer from skb before accessing initial bytes. This prevents potential out-of-bounds accesse…
-
High 8.1
ipv6: use RCU protection in ip6_default_advmss()
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss() needs rcu protection to make sure the net structure it reads does not disappear.
-
High 7.8
drm/xe/tracing: Fix a potential TP_printk UAF
In the Linux kernel, the following vulnerability has been resolved: drm/xe/tracing: Fix a potential TP_printk UAF The commit afd2627f727b ("tracing: Check "%s" dereference via the field and not the TP_printk format") exposes potential UAFs in the xe_bo_move t…
-
High 7.8
exfat: fix out-of-bounds access of directory entries
In the Linux kernel, the following vulnerability has been resolved: exfat: fix out-of-bounds access of directory entries In the case of the directory size is greater than or equal to the cluster size, if start_clu becomes an EOF cluster(an invalid cluster) du…
-
High 7.8
nfsd: release svc_expkey/svc_export with rcu_work
In the Linux kernel, the following vulnerability has been resolved: nfsd: release svc_expkey/svc_export with rcu_work The last reference for `cache_head` can be reduced to zero in `c_show` and `e_show`(using `rcu_read_lock` and `rcu_read_unlock`). Consequentl…
-
High 7.8
NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() name is char[64] where the size of clnt->cl_program->name remains unknown. Invoking strcat() directly will also lead to potent…
-
High 7.8
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG…
-
High 7.8
bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF …
-
High 7.8
xfrm: state: fix out-of-bounds read during lookup
In the Linux kernel, the following vulnerability has been resolved: xfrm: state: fix out-of-bounds read during lookup lookup and resize can run in parallel. The xfrm_state_hash_generation seqlock ensures a retry, but the hash functions can observe a hmask val…
-
High 7.8
i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition
In the Linux kernel, the following vulnerability has been resolved: i3c: dw: Fix use-after-free in dw_i3c_master driver due to race condition In dw_i3c_common_probe, &master->hj_work is bound with dw_i3c_hj_work. And dw_i3c_master_irq_handler can call dw_i3c_…
-
High 7.8
media: intel/ipu6: remove cpu latency qos request on error
In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: remove cpu latency qos request on error Fix cpu latency qos list corruption like below. It happens when we do not remove cpu latency request on error path and free correspo…
-
High 7.8
Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync This fixes the following crash: ================================================================== BUG: KASAN: sl…
-
High 7.8
rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interface supports variable buffer sizes, while the regmap interface operates with fixed-size storage. If an nvmem clie…
-
High 7.8
crypto: tegra - do not transfer req when tegra init fails
In the Linux kernel, the following vulnerability has been resolved: crypto: tegra - do not transfer req when tegra init fails The tegra_cmac_init or tegra_sha_init function may return an error when memory is exhausted. It should not transfer the request when …
-
High 7.8
ipvlan: Fix use-after-free in ipvlan_get_iflink().
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix use-after-free in ipvlan_get_iflink(). syzbot presented an use-after-free report [0] regarding ipvlan and linkwatch. ipvlan does not hold a refcnt of the lower device unlike vlan …
-
High 7.8
io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eve…
-
High 7.8
zram: fix potential UAF of zram table
In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated zram->table without setting it NULL. Which will potentially cause zram_meta_free to access the table …
-
High 7.8
pktgen: Avoid out-of-bounds access in get_imix_entries
In the Linux kernel, the following vulnerability has been resolved: pktgen: Avoid out-of-bounds access in get_imix_entries Passing a sufficient amount of imix entries leads to invalid access to the pkt_dev->imix_entries array because of the incorrect boundary…
-
High 7.8
mm: zswap: properly synchronize freeing resources during CPU hotunplug
In the Linux kernel, the following vulnerability has been resolved: mm: zswap: properly synchronize freeing resources during CPU hotunplug In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the current CPU at the beginning of the operation i…
-
High 7.8
pfifo_tail_enqueue: Drop new packet when sch->limit == 0
In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease sche…
-
High 7.8
padata: avoid UAF for reorder_work
In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as bel…
-
High 7.8
padata: fix UAF in padata_reorder
In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u11…
-
High 7.8
ata: libata-sff: Ensure that we cannot write outside the allocated buffer
In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing reported that a SCSI_IOCTL_SEND_COMMAND ioctl with out_len set to 0xd42, SCSI command set to ATA_16 PA…
-
High 7.8
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF.
-
High 7.8
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache le…
-
High 7.8
workqueue: Put the pwq after detaching the rescuer from the pool
In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after detaching the rescuer from the pool The commit 68f83057b913("workqueue: Reap workers via kthread_stop() and remove detach_completion") adds code to reap the norma…
-
High 7.8
vrf: use RCU protection in l3mdev_l3_out()
In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip…
-
High 7.8
netfilter: nf_tables: reject mismatching sum of field_len with set key length
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field get…
-
High 7.8
bpf: Fix softlockup in arena_map_free on 64k page kernel
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG_PAGE_SIZE_64KB=y, arena_htab tests cause a segmentation fault and soft lockup. The same failure is no…
-
High 7.8
io_uring: prevent opcode speculation
In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent opcode speculation sqe->opcode is used for different tables, make sure we santitise it against speculations.
-
High 7.8
tcp: drop secpath at the same time as we currently drop dst
In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the WARN in xfrm6_tunnel_net_exit while running tests that boil down to: - create a pair of netns - run a b…
-
High 7.8
fbdev: hyperv_fb: Allow graceful removal of framebuffer
In the Linux kernel, the following vulnerability has been resolved: fbdev: hyperv_fb: Allow graceful removal of framebuffer When a Hyper-V framebuffer device is unbind, hyperv_fb driver tries to release the framebuffer forcefully. If this framebuffer is in us…
-
High 7.8
netfilter: nft_tunnel: fix geneve_opt type confusion addition
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by o…
-
High 7.8
RDMA/core: Don't expose hw_counters outside of init net namespace
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to …
-
High 7.8
sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
In the Linux kernel, the following vulnerability has been resolved: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator BPF programs may call next() and destroy() on BPF iterators even after new() returns an error value (e.g. bpf_for_each() ma…
-
High 7.8
wifi: ath12k: fix uaf in ath12k_core_init()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix uaf in ath12k_core_init() When the execution of ath12k_core_hw_group_assign() or ath12k_core_hw_group_create() fails, the registered notifier chain is not unregistered prope…
-
High 7.8
sched/rt: Fix race in push_rt_task
In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fix race in push_rt_task Overview ======== When a CPU chooses to call push_rt_task and picks a task to push to another CPU's runqueue then it will call find_lock_lowest_rq method wh…
-
High 7.8
platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks
In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks After retrieving WMI data blocks in sysfs callbacks, check for the validity of them before dereferencing their c…
-
High 7.5
NFSD: fix hang in nfsd4_shutdown_callback
In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is …
-
High 7.5
smb: client: Add check for next_buffer in receive_encrypted_standard()
In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent nul…
-
High 7.5
nfsd: put dl_stid if fail to queue dl_recall
In the Linux kernel, the following vulnerability has been resolved: nfsd: put dl_stid if fail to queue dl_recall Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid. We expect that after the correspon…
-
High 7.3
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot. Rework vlan_get_protocol_dgram() to not touch skb at all, so …
-
High 7.3
af_packet: fix vlan_get_tci() vs MSG_PEEK
In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_tci() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot. Rework vlan_get_tci() to not touch skb at all, so that it can be used fr…
-
High 7.3
sched: sch_cake: add bounds checks to host bulk flow fairness counts
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host…
-
High 7.1
HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated w…
-
High 7.1
usbnet: ipheth: fix DPE OoB read
In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix DPE OoB read Fix an out-of-bounds DPE read, limit the number of processed DPEs to the amount that fits into the fixed-size NDP16 header.
-
High 7.1
usbnet: ipheth: use static NDP16 location in URB
In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: use static NDP16 location in URB Original code allowed for the start of NDP16 to be anywhere within the URB based on the `wNdpIndex` value in NTH16. Only the start position of…
-
High 7.1
usbnet: ipheth: fix possible overflow in DPE length check
In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix possible overflow in DPE length check Originally, it was possible for the DPE length check to overflow if wDatagramIndex + wDatagramLength > U16_MAX. This could lead to an…
-
High 7.1
netfs: Fix early read unlock of page with EOF in middle
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix early read unlock of page with EOF in middle The read result collection for buffered reads seems to run ahead of the completion of subrequests under some circumstances, as can be s…
-
Medium 5.6
Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution for some Intel(R) …
-
Medium 5.6
A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, po…
-
Medium 5.6
A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potent…
-
Medium 5.5
Bluetooth: btrtl: check for NULL in btrtl_setup_realtek()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: check for NULL in btrtl_setup_realtek() If insert an USB dongle which chip is not maintained in ic_id_table, it will hit the NULL point accessed. Add a null point check to a…
-
Medium 5.5
Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btbcm: Fix NULL deref in btbcm_get_board_name() devm_kstrdup() can return a NULL pointer on failure,but this returned value in btbcm_get_board_name() is not checked. Add NULL check…
-
Medium 5.5
wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: fix NULL deref check in mt7925_change_vif_links In mt7925_change_vif_links() devm_kzalloc() may return NULL but this returned value is not checked.
-
Medium 5.5
ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params Each cpu DAI should associate with a widget. However, the topology might not create the right number of DAI widgets for agg…
-
Medium 5.5
bpf: Fix deadlock when freeing cgroup storage
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix deadlock when freeing cgroup storage The following commit bc235cdb423a ("bpf: Prevent deadlock from recursive bpf_task_storage_[get|delete]") first introduced deadlock prevention for…
-
Medium 5.5
mm: clear uffd-wp PTE/PMD state on mremap()
In the Linux kernel, the following vulnerability has been resolved: mm: clear uffd-wp PTE/PMD state on mremap() When mremap()ing a memory region previously registered with userfaultfd as write-protected but without UFFD_FEATURE_EVENT_REMAP, an inconsistency i…
-
Medium 5.5
vxlan: check vxlan_vnigroup_init() return value
In the Linux kernel, the following vulnerability has been resolved: vxlan: check vxlan_vnigroup_init() return value vxlan_init() must check vxlan_vnigroup_init() success otherwise a crash happens later, spotted by syzbot. Oops: general protection fault, proba…
-
Medium 5.5
acct: perform last write from workqueue
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an inte…
-
Medium 5.5
ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps->cstream should be checked similarly as it is done in sof_set_stream_data_offset() function. Assuming…
-
Medium 5.5
net/sched: cls_api: fix error handling causing NULL dereference
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix error handling causing NULL dereference tcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can return 1 if the allocation succeeded after wrapping. This w…
-
Medium 5.5
mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()
In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If migration succeeded, we called folio_migrate_flags()->mem_cgroup_migrate() to migrate the memcg from the …
-
Unscored —
igb: Fix potential invalid memory access in igb_init_module()
In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier …
-
Unscored —
zram: fix NULL pointer in comp_algorithm_show()
In the Linux kernel, the following vulnerability has been resolved: zram: fix NULL pointer in comp_algorithm_show() LTP reported a NULL pointer dereference as followed: CPU: 7 UID: 0 PID: 5995 Comm: cat Kdump: loaded Not tainted 6.12.0-rc6+ #3 Hardware name: …
-
Unscored —
x86/xen: don't do PV iret hypercall through hypercall page
In the Linux kernel, the following vulnerability has been resolved: x86/xen: don't do PV iret hypercall through hypercall page Instead of jumping to the Xen hypercall page for doing the iret hypercall, directly code the required sequence in xen-asm.S. This is…
-
Unscored —
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET"), the pcrypt encryption and dec…
-
Unscored —
netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix the (non-)cancellation of copy when cache is temporarily disabled When the caching for a cookie is temporarily disabled (e.g. due to a DIO write on that file), future copying to th…
-
Unscored —
netfs: Fix ceph copy to cache on write-begin
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix ceph copy to cache on write-begin At the end of netfs_unlock_read_folio() in which folios are marked appropriately for copying to the cache (either with by being marked dirty and h…
-
Unscored —
memcg: fix soft lockup in the OOM process
In the Linux kernel, the following vulnerability has been resolved: memcg: fix soft lockup in the OOM process A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggere…
-
Unscored —
usb: xhci: Fix NULL pointer dereference on certain command aborts
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB …
-
Unscored —
tpm: Change to kvalloc() in eventlog/acpi.c
In the Linux kernel, the following vulnerability has been resolved: tpm: Change to kvalloc() in eventlog/acpi.c The following failure was reported on HPE ProLiant D320: [ 10.693310][ T1] tpm_tis STM0925:00: 2.0 TPM (device-id 0x3, rev-id 0) [ 10.848132][ T1] …
-
Unscored —
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN() instead of possible out-of-bounds 'tbl_iqcal_gainp…
-
Unscored —
wifi: ath12k: Fix for out-of bound access error
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix for out-of bound access error Selfgen stats are placed in a buffer using print_array_to_buf_index() function. Array length parameter passed to the function is too big, resul…
-
Unscored —
HID: multitouch: Add NULL check in mt_input_configured
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mt_input_configured devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt_input_configured() is not checked. Add NULL check in…
-
Unscored —
idpf: convert workqueues to unbound
In the Linux kernel, the following vulnerability has been resolved: idpf: convert workqueues to unbound When a workqueue is created with `WQ_UNBOUND`, its work items are served by special worker-pools, whose host workers are not bound to any specific CPU. In …
-
Unscored —
wifi: mac80211: prohibit deactivating all links
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prohibit deactivating all links In the internal API this calls this is a WARN_ON, but that should remain since internally we want to know about bugs that may cause this. Preve…
-
Unscored —
wifi: rtlwifi: remove unused check_buddy_priv
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused check_buddy_priv Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global list of private data structures. Later on, commit 26634c4b1868 ("rtlwifi …
-
Unscored —
ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback
In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callback commit 1f5664351410 ("ASoC: lower "no backend DAIs enabled for ... Port" log severity") ignores -EINVAL error message on common soc…
-
Unscored —CVE-2025-21633 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
cachestat: fix page cache statistics permission checking
In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()' system call was added in commit cf264e1329fb ("cachestat: implement cachestat syscall"), it was meant to be a m…
-
Unscored —
RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error This patch addresses a race condition for an ODP MR that can result in a CQE with an error on the UMR QP. During the __mlx5_i…
-
Unscored —
wifi: brcmfmac: Check the return value of of_property_read_string_index()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the return value of of_property_read_string_index() Somewhen between 6.10 and 6.11 the driver started to crash on my MacBookPro14,3. The property doesn't exist and 'tmp'…
-
Unscored —
sched_ext: Fix incorrect autogroup migration detection
In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix incorrect autogroup migration detection scx_move_task() is called from sched_move_task() and tells the BPF scheduler that cgroup migration is being committed. sched_move_task()…
-
Unscored —
ring-buffer: Validate the persistent meta data subbuf array
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Validate the persistent meta data subbuf array The meta data for a mapped ring buffer contains an array of indexes of all the subbuffers. The first entry is the reader page, and …
-
Unscored —CVE-2025-21837 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
bpf: avoid holding freeze_mutex during mmap operation
In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent races between map_freeze() and memory mapping BPF map contents with writable permissions. The way we …
-
Unscored —
acpi: typec: ucsi: Introduce a ->poll_cci method
In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "registers" are just a memory copy of the register values in an opregion. The ACPI implementation in the…
-
Unscored —
hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio
In the Linux kernel, the following vulnerability has been resolved: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio Commit b15c87263a69 ("hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined) add page poison checks in do_migrate_…
-
Unscored —
PCI: Fix NULL dereference in SR-IOV VF creation error path
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix NULL dereference in SR-IOV VF creation error path Clean up when virtfn setup fails to prevent NULL pointer dereference during device removal. The kernel oops below occurred due to in…
-
Unscored —
bonding: check xdp prog when set bond mode
In the Linux kernel, the following vulnerability has been resolved: bonding: check xdp prog when set bond mode Following operations can trigger a warning[1]: ip netns add ns1 ip netns exec ns1 ip link add bond0 type bond mode balance-rr ip netns exec ns1 ip l…
-
Unscored —
net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF.
In the Linux kernel, the following vulnerability has been resolved: net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat be…
-
Unscored —
idpf: check error for register_netdev() on init
In the Linux kernel, the following vulnerability has been resolved: idpf: check error for register_netdev() on init Current init logic ignores the error code from register_netdev(), which will cause WARN_ON() on attempt to unregister it, if there was one, and…
-
Unscored —
wifi: cfg80211: init wiphy_work before allocating rfkill fails
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: init wiphy_work before allocating rfkill fails syzbort reported a uninitialize wiphy_work_lock in cfg80211_dev_free. [1] After rfkill allocation fails, the wiphy release proce…
-
Unscored —
block: fix adding folio to bio
In the Linux kernel, the following vulnerability has been resolved: block: fix adding folio to bio >4GB folio is possible on some ARCHs, such as aarch64, 16GB hugepage is supported, then 'offset' of folio can't be held in 'unsigned int', cause warning in bio_…
-
Unscored —
wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Clear affinity hint before calling ath11k_pcic_free_irq() in error path If a shared IRQ is used by the driver due to platform limitation, then the IRQ affinity hint is set right…
-
Unscored —
sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash
In the Linux kernel, the following vulnerability has been resolved: sched/eevdf: Fix se->slice being set to U64_MAX and resulting crash There is a code path in dequeue_entities() that can set the slice of a sched_entity to U64_MAX, which sometimes results in …
-
Unscored —
usb: typec: ucsi: displayport: Fix NULL pointer access
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix NULL pointer access This patch ensures that the UCSI driver waits for all pending tasks in the ucsi_displayport_work workqueue to finish executing before pr…
-
Unscored —
wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure that n_channels is set after allocating the struct cfg80211_registered_device::int_scan_req member. Seen…
-
Unscored —
rseq: Fix segfault on registration when rseq_cs is non-zero
In the Linux kernel, the following vulnerability has been resolved: rseq: Fix segfault on registration when rseq_cs is non-zero The rseq_cs field is documented as being set to 0 by user-space prior to registration, however this is not currently enforced by th…
-
Unscored —
net: phy: mscc: Fix memory leak when using one step timestamping
In the Linux kernel, the following vulnerability has been resolved: net: phy: mscc: Fix memory leak when using one step timestamping Fix memory leak when running one-step timestamping. When running one-step sync timestamping, the HW is configured to insert th…
-
Unscored —
i40e: fix MMIO write access to an invalid page in i40e_clear_hw
In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a specific input, an integer underflow can occur, leading to MMIO write access to an invalid page. Preven…
-
Unscored —
ext4: only dirty folios when data journaling regular files
In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files fstest generic/388 occasionally reproduces a crash that looks as follows: BUG: kernel NULL pointer dereference, address: 00000000000…
-
Unscored —
scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels Correct kernel call trace when calling smp_processor_id() when called in preemptible kernels by using raw_smp_process…
-
Unscored —
perf/x86/intel: Fix crash in icl_update_topdown_event()
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix crash in icl_update_topdown_event() The perf_fuzzer found a hard-lockup crash on a RaptorLake machine: Oops: general protection fault, maybe for address 0xffff89aeceab400:…
-
Unscored —
firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info)
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix OOB memory read access in KUnit test (wmfw info) KASAN reported out of bounds access - cs_dsp_mock_wmfw_add_info(), because the source string length was rounded up to th…
-
Unscored —
firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache)
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix OOB memory read access in KUnit test (ctl cache) KASAN reported out of bounds access - cs_dsp_ctl_cache_init_multiple_offsets(). The code uses mock_coeff_template.length…
-
Unscored —
scsi: lpfc: Use memcpy() for BIOS version
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Use memcpy() for BIOS version The strlcat() with FORTIFY support is triggering a panic because it thinks the target buffer will overflow although the correct target buffer size is…
-
Unscored —
dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Check availability of workqueue allocated by idxd wq driver before using Running IDXD workloads in a container with the /dev directory mounted can trigger a call trace or eve…
-
Unscored —
nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails.
In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails. syzbot reported a warning below [1] following a fault injection in nfs_fs_proc_net_init(). [0] When nfs_fs_proc_net_init() f…
-
Unscored —
ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak.
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can have address allocated by kstrdup() and can be overwritten. Memory leak was detected with kmemleak: un…
-
Unscored —
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree
In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf has a BUG_ON that can trigger with the following: tc qdisc del dev lo root tc qdisc add dev lo root hand…
-
Unscored —
hv_netvsc: Fix panic during namespace deletion with VF
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix panic during namespace deletion with VF The existing code move the VF NIC to new namespace when NETDEV_REGISTER is received on netvsc NIC. During deletion of the namespace, def…
-
Unscored —
Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu…
-
Unscored —
smb/client: fix memory leak in smb2_open_file()
In the Linux kernel, the following vulnerability has been resolved: smb/client: fix memory leak in smb2_open_file() Reproducer: 1. server: directories are exported read-only 2. client: mount -t cifs //${server_ip}/export /mnt 3. client: dd if=/dev/zero of=/mn…
References
-
article
https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/10.1_release_notes/index
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2331326
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2333985
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2334373
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2334415
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2334547
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2334548
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2334676
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2337121
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2338185
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2338211
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2338813
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2338821
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2338828
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2338998
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2339130
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2339141
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2343172
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2343186
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2344684
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2344687
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2345240
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2346272
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348522
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348523
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348541
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348543
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348547
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348550
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348556
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348561
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348567
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348572
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348574
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348577
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348581
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348584
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2348587