Summary
Jann Horn discovered that the watch_queue event notification subsystem in
the Linux kernel contained an out-of-bounds write vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
escalate their privileges. (CVE-2022-0995)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- SuperH RISC architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- Drivers core;
- RAM backed block device driver;
- Virtio block driver;
- Data acquisition framework and drivers;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EDAC drivers;
- ARM SCPI message protocol;
- iSCSI Boot Firmware Table Attributes driver;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Microsoft Hyper-V drivers;
- I3C subsystem;
- IIO ADC drivers;
- IIO subsystem;
- InfiniBand drivers;
- IOMMU subsystem;
- LED subsystem;
- Multiple devices driver;
- Media drivers;
- Multifunction device drivers;
- MMC subsystem;
- MTD block device drivers;
- Network drivers;
- Mellanox network drivers;
- Microsoft Azure Network Adapter (MANA) driver;
- NVME drivers;
- PCI subsystem;
- Pin controllers subsystem;
- x86 platform drivers;
- Power supply drivers;
- Real Time Clock drivers;
- SCSI subsystem;
- SuperH / SH-Mobile drivers;
- i.MX SoC drivers;
- QCOM SoC drivers;
- SPI subsystem;
- Media staging drivers;
- UFS subsystem;
- DesignWare USB3 driver;
- USB Gadget drivers;
- USB Serial drivers;
- USB Type-C Port Controller Manager driver;
- VFIO drivers;
- Framebuffer layer;
- Xen hypervisor drivers;
- AFS file system;
- File systems infrastructure;
- BTRFS file system;
- Ceph distributed file system;
- F2FS file system;
- GFS2 file system;
- JFFS2 file system;
- JFS file system;
- Network file system (NFS) client;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- NTFS3 file system;
- Overlay file system;
- Proc file system;
- Diskquota system;
- SMB network file system;
- UBI file system;
- Timer subsystem;
- VLANs driver;
- LAPB network protocol;
- Network namespace;
- Kernel init infrastructure;
- BPF subsystem;
- Kernel CPU control infrastructure;
- DMA mapping infrastructure;
- KCSAN framework;
- Tracing infrastructure;
- Memory management;
- 9P file system network protocol;
- Bluetooth subsystem;
- Ethernet bridge;
- CAN network layer;
- Networking core;
- DCCP (Datagram Congestion Control Protocol);
- Distributed Switch Architecture;
- Ethtool driver;
- HSR network protocol;
- IEEE802154.4 network protocol;
- IPv4 networking;
- IPv6 networking;
- IEEE 802.15.4 subsystem;
- Multipath TCP;
- Netfilter;
- Netlink;
- NET/ROM layer;
- Packet sockets;
- Network traffic control;
- SCTP protocol;
- SMC sockets;
- Sun RPC protocol;
- TIPC protocol;
- VMware vSockets driver;
- eXpress Data Path;
- SELinux security module;
- ALSA framework;
- USB sound devices;
(CVE-2024-53690, CVE-2024-56642, CVE-2024-56777, CVE-2024-49998,
CVE-2024-53181, CVE-2024-53184, CVE-2024-53180, CVE-2024-56615,
CVE-2024-56679, CVE-2024-53099, CVE-2025-21993, CVE-2024-53112,
CVE-2024-56594, CVE-2024-56606, CVE-2024-56533, CVE-2024-56616,
CVE-2024-56631, CVE-2024-46784, CVE-2024-53124, CVE-2024-56623,
CVE-2024-57939, CVE-2025-21694, CVE-2025-21653, CVE-2024-56548,
CVE-2024-56600, CVE-2024-56578, CVE-2024-53198, CVE-2024-56619,
CVE-2024-44938, CVE-2024-56688, CVE-2024-56651, CVE-2024-53215,
CVE-2024-53150, CVE-2025-21687, CVE-2025-21646, CVE-2024-49571,
CVE-2024-57884, CVE-2025-21700, CVE-2024-57907, CVE-2024-56569,
CVE-2024-56747, CVE-2024-56575, CVE-2024-56700, CVE-2025-21640,
CVE-2024-52332, CVE-2024-56648, CVE-2025-21637, CVE-2024-53120,
CVE-2024-53685, CVE-2024-57798, CVE-2024-56597, CVE-2024-53142,
CVE-2024-46809, CVE-2024-56574, CVE-2024-56595, CVE-2025-21703,
CVE-2024-26837, CVE-2024-57850, CVE-2024-56759, CVE-2024-49950,
CVE-2025-21636, CVE-2024-57925, CVE-2024-57931, CVE-2024-35864,
CVE-2025-21683, CVE-2024-56587, CVE-2024-50248, CVE-2024-57948,
CVE-2024-56670, CVE-2024-56558, CVE-2024-57908, CVE-2024-56769,
CVE-2024-56681, CVE-2024-56602, CVE-2024-55916, CVE-2024-57841,
CVE-2024-36476, CVE-2024-56691, CVE-2024-57951, CVE-2024-53127,
CVE-2024-56779, CVE-2024-56704, CVE-2024-56568, CVE-2024-56754,
CVE-2024-53239, CVE-2024-56659, CVE-2024-47143, CVE-2024-58087,
CVE-2024-56693, CVE-2024-56567, CVE-2024-53138, CVE-2024-47408,
CVE-2024-53161, CVE-2025-21664, CVE-2025-21701, CVE-2024-56593,
CVE-2024-53158, CVE-2024-50256, CVE-2024-57900, CVE-2024-57901,
CVE-2024-57791, CVE-2024-48881, CVE-2024-57792, CVE-2024-50304,
CVE-2024-53172, CVE-2024-57903, CVE-2024-50283, CVE-2024-56636,
CVE-2024-53096, CVE-2024-53129, CVE-2024-53206, CVE-2025-21690,
CVE-2025-21631, CVE-2024-57807, CVE-2024-50242, CVE-2024-56572,
CVE-2024-57929, CVE-2024-56645, CVE-2024-56785, CVE-2025-21702,
CVE-2024-53237, CVE-2024-53146, CVE-2024-56627, CVE-2024-53680,
CVE-2024-56739, CVE-2024-56720, CVE-2024-56780, CVE-2025-21692,
CVE-2024-57940, CVE-2024-56776, CVE-2025-21680, CVE-2024-56701,
CVE-2024-53197, CVE-2024-53113, CVE-2024-46871, CVE-2024-46841,
CVE-2024-56763, CVE-2024-56658, CVE-2024-56723, CVE-2024-49996,
CVE-2024-53151, CVE-2024-56634, CVE-2024-43098, CVE-2024-56637,
CVE-2024-43900, CVE-2024-53174, CVE-2024-53145, CVE-2024-56614,
CVE-2024-56610, CVE-2024-56643, CVE-2024-56726, CVE-2024-56694,
CVE-2024-56562, CVE-2024-56770, CVE-2024-56745, CVE-2024-56767,
CVE-2024-56724, CVE-2024-57917, CVE-2024-56626, CVE-2024-57874,
CVE-2024-57913, CVE-2024-53121, CVE-2024-57889, CVE-2024-50051,
CVE-2024-56596, CVE-2024-5
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-gcp-5.15 | 5.15.0-1081.90~20.04.1 |
Vulnerabilities 267
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
High 7.8CVE-2024-53197 Exploited
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configura…
KEV Apr 9, 2025 -
High 7.1CVE-2024-53150 Exploited
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, wh…
KEV Apr 9, 2025 -
Critical 9.8
smb: client: fix potential UAF in smb2_is_valid_lease_break()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
Critical 9.8
RDMA/rtrs: Ensure 'ib_sge list' is accessible
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the f…
-
Critical 9.8
net/smc: check smcd_v2_ext_offset when receiving proposal msg
In the Linux kernel, the following vulnerability has been resolved: net/smc: check smcd_v2_ext_offset when receiving proposal msg When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be full…
-
Critical 9.8
ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-use-after-free in smb3_preauth_hash_rsp ksmbd_user_session_put should be called under smb3_preauth_hash_rsp(). It will avoid freeing session before calling smb3_preauth_hash_r…
-
Critical 9.8
net/mlx5e: kTLS, Fix incorrect page refcounting
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: kTLS, Fix incorrect page refcounting The kTLS tx handling code is using a mix of get_page() and page_ref_inc() APIs to increment the page reference. But on the release path (mlx5e_…
-
Critical 9.8
tcp: Fix use-after-free of nreq in reqsk_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix use-after-free of nreq in reqsk_timer_handler(). The cited commit replaced inet_csk_reqsk_queue_drop_and_put() with __inet_csk_reqsk_queue_drop() and reqsk_put() in reqsk_timer_handl…
-
Critical 9.8
net/smc: fix LGR and link use-after-free issue
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix LGR and link use-after-free issue We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making …
-
Critical 9.8
can: j1939: j1939_session_new(): fix skb reference counting
In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_session_new(): fix skb reference counting Since j1939_session_skb_queue() does an extra skb_get() for each new skb, do the same for the initial one in j1939_session_new() to…
-
Critical 9.8
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files rem…
-
Critical 9.8
mptcp: fix TCP options overflow.
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix TCP options overflow. Syzbot reported the following splat: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KA…
-
Critical 9.8
ksmbd: fix racy issue from session lookup and expire
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference count within the lock for lookup to avoid racy issue with session expire.
-
Critical 9.4
cifs: Fix buffer overflow when parsing NFS reparse points
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix buffer overflow when parsing NFS reparse points ReparseDataLength is sum of the InodeType size and DataBuffer size. So to get DataBuffer size it is needed to subtract InodeType's si…
-
Critical 9.4
netrom: check buffer length before accessing it
In the Linux kernel, the following vulnerability has been resolved: netrom: check buffer length before accessing it Syzkaller reports an uninit value read from ax25cmp when sending raw message through ieee802154 implementation. ===============================…
-
Critical 9.1
net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
In the Linux kernel, the following vulnerability has been resolved: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg a…
-
Critical 9.1
NFSD: Prevent a potential integer overflow
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent a potential integer overflow If the tag length is >= U32_MAX - 3 then the "length + 4" addition can result in an integer overflow. Address this by splitting the decoding into se…
-
High 8.8
Bluetooth: L2CAP: Fix uaf in l2cap_connect
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix uaf in l2cap_connect [Syzbot reported] BUG: KASAN: slab-use-after-free in l2cap_connect.constprop.0+0x10d8/0x1270 net/bluetooth/l2cap_core.c:3949 Read of size 8 at addr …
-
High 8.8
KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN
In the Linux kernel, the following vulnerability has been resolved: KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN Hide KVM's pt_mode module param behind CONFIG_BROKEN, i.e. disable support for virtualizing Intel PT via guest/ho…
-
High 8.8
Bluetooth: fix use-after-free in device_for_each_child()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix use-after-free in device_for_each_child() Syzbot has reported the following KASAN splat: BUG: KASAN: slab-use-after-free in device_for_each_child+0x18f/0x1a0 Read of size 8 at …
-
High 8.8
ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that t…
-
High 8.8
can: hi311x: hi3110_can_ist(): fix potential use-after-free
In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even…
-
High 8.4
9p/xen: fix release of IRQ
In the Linux kernel, the following vulnerability has been resolved: 9p/xen: fix release of IRQ Kernel logs indicate an IRQ was double-freed. Pass correct device ID during IRQ release. [Dominique: remove confusing variable reset to 0]
-
High 8.1
ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read An offset from client could be a negative value, It could lead to an out-of-bounds read from the stream_buf. Note that this issue is com…
-
High 7.8
spi: mpc52xx: Add cancel_work_sync before module remove
In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work…
-
High 7.8
driver core: bus: Fix double free in driver API bus_register()
In the Linux kernel, the following vulnerability has been resolved: driver core: bus: Fix double free in driver API bus_register() For bus_register(), any error which happens after kset_register() will cause that @priv are freed twice, fixed by setting @priv …
-
High 7.8
nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
In the Linux kernel, the following vulnerability has been resolved: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net In the normal case, when we excute `echo 0 > /proc/fs/nfsd/threads`, the function `nfs4_state_destroy_net` in `nfs4_…
-
High 7.8
mm: resolve faulty mmap_region() error path behaviour
In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behaviour The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and inco…
-
High 7.8
net/mlx5: fs, lock FTE when checking if active
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fs, lock FTE when checking if active The referenced commits introduced a two-step process for deleting FTEs: - Lock the FTE, delete it from hardware, set the hardware deletion funct…
-
High 7.8
bpf: sync_linked_regs() must preserve subreg_def
In the Linux kernel, the following vulnerability has been resolved: bpf: sync_linked_regs() must preserve subreg_def Range propagation must not affect subreg_def marks, otherwise the following example is rewritten by verifier incorrectly when BPF_F_TEST_RND_H…
-
High 7.8
Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K"
In the Linux kernel, the following vulnerability has been resolved: Revert "mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K" The commit 8396c793ffdf ("mmc: dw_mmc: Fix IDMAC operation with pages bigger than 4K") increased the max_req_size, even for…
-
High 7.8
netlink: terminate outstanding dump on socket close
In the Linux kernel, the following vulnerability has been resolved: netlink: terminate outstanding dump on socket close Netlink supports iterative dumping of data. It provides the families the following ops: - start - (optional) kicks off the dumping process …
-
High 7.8
comedi: Flush partial mappings in error case
In the Linux kernel, the following vulnerability has been resolved: comedi: Flush partial mappings in error case If some remap_pfn_range() calls succeeded before one failed, we still have buffer pages mapped into the userspace page tables when we drop the buf…
-
High 7.8
wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() I found the following bug in my fuzzer: UBSAN: array-index-out-of-bounds in drivers/net/wireless/ath/ath9k/htc_hst.c:26…
-
High 7.8
ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit
In the Linux kernel, the following vulnerability has been resolved: ubifs: authentication: Fix use-after-free in ubifs_tnc_end_commit After an insertion in TNC, the tree might split and cause a node to change its `znode->parent`. A further deletion of other n…
-
High 7.8
NFSv4.0: Fix a use-after-free problem in the asynchronous open()
In the Linux kernel, the following vulnerability has been resolved: NFSv4.0: Fix a use-after-free problem in the asynchronous open() Yang Erkun reports that when two threads are opening files at the same time, and are forced to abort before a reply is seen, t…
-
High 7.8
SUNRPC: make sure cache entry active before cache_show
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cache_show The function `c_show` was called with protection from RCU. This only ensures that `cp` will not be freed. Therefore, the reference count…
-
High 7.8
PCI: Fix use-after-free of slot->bus on hot remove
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") …
-
High 7.8
xen: Fix the issue of resource not being properly released in xenbus_dev_probe()
In the Linux kernel, the following vulnerability has been resolved: xen: Fix the issue of resource not being properly released in xenbus_dev_probe() This patch fixes an issue in the function xenbus_dev_probe(). In the xenbus_dev_probe() function, within the i…
-
High 7.8
vfio/pci: Properly hide first-in-list PCIe extended capability
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capab…
-
High 7.8
scsi: bfa: Fix use-after-free in bfad_im_module_exit()
In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Fix use-after-free in bfad_im_module_exit() BUG: KASAN: slab-use-after-free in __lock_acquire+0x2aca/0x3a20 Read of size 8 at addr ffff8881082d80c8 by task modprobe/25303 Call Trac…
-
High 7.8
ALSA: 6fire: Release resources at card release
In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: Release resources at card release The current 6fire code tries to release the resources right after the call of usb6fire_chip_abort(). But at this moment, the card object might b…
-
High 7.8
ALSA: caiaq: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disc…
-
High 7.8
hfsplus: don't query the device logical block size multiple times
In the Linux kernel, the following vulnerability has been resolved: hfsplus: don't query the device logical block size multiple times Devices block sizes may change. One of these cases is a loop device by using ioctl LOOP_SET_BLOCK_SIZE. While this may cause …
-
High 7.8
nfsd: make sure exp active before svc_export_show
In the Linux kernel, the following vulnerability has been resolved: nfsd: make sure exp active before svc_export_show The function `e_show` was called with protection from RCU. This only ensures that `exp` will not be freed. Therefore, the reference count for…
-
High 7.8
media: i2c: tc358743: Fix crash in the probe error path when using polling
In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix crash in the probe error path when using polling If an error occurs in the probe() function, we should remove the polling timer that was alarmed earlier, otherwise t…
-
High 7.8
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
In the Linux kernel, the following vulnerability has been resolved: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bai…
-
High 7.8
jfs: fix array-index-out-of-bounds in jfs_readdir
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in jfs_readdir The stbl might contain some invalid values. Added a check to return error code in that case.
-
High 7.8
jfs: fix shift-out-of-bounds in dbSplit
In the Linux kernel, the following vulnerability has been resolved: jfs: fix shift-out-of-bounds in dbSplit When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself.
-
High 7.8
net: inet6: do not leave a dangling sk pointer in inet6_create()
In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object i…
-
High 7.8
net: inet: do not leave a dangling sk pointer in inet_create()
In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is fr…
-
High 7.8
net: af_can: do not leave a dangling sk pointer in can_create()
In the Linux kernel, the following vulnerability has been resolved: net: af_can: do not leave a dangling sk pointer in can_create() On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. …
-
High 7.8
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_all…
-
High 7.8
af_packet: avoid erroring out after sock_init_data() in packet_create()
In the Linux kernel, the following vulnerability has been resolved: af_packet: avoid erroring out after sock_init_data() in packet_create() After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees…
-
High 7.8
xsk: fix OOB map writes when deleting elements
In the Linux kernel, the following vulnerability has been resolved: xsk: fix OOB map writes when deleting elements Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). …
-
High 7.8
bpf: fix OOB devmap writes when deleting elements
In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, cau…
-
High 7.8
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large va…
-
High 7.8
scsi: qla2xxx: Fix use after free on unload
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use after free on unload System crash is observed with stack trace warning of use after free. There are 2 signals to tell dpc_thread to terminate (UNLOADING flag and kthrea…
-
High 7.8
scsi: sg: Fix slab-use-after-free read in sg_release()
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sg_release() Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 ker…
-
High 7.8
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). syzkaller reported a use-after-free of UDP kernel socket in cleanup_bearer() without repro. [0][1] When bearer_disable() calls t…
-
High 7.8
net: defer final 'struct net' free in netns dismantle
In the Linux kernel, the following vulnerability has been resolved: net: defer final 'struct net' free in netns dismantle Ilya reported a slab-use-after-free in dst_destroy [1] Issue is in xfrm6_net_init() and xfrm4_net_init() : They copy xfrm[46]_dst_ops_tem…
-
High 7.8
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG…
-
High 7.8
powerpc/mm/fault: Fix kfence page fault reporting
In the Linux kernel, the following vulnerability has been resolved: powerpc/mm/fault: Fix kfence page fault reporting copy_from_kernel_nofault() can be called when doing read of /proc/kcore. /proc/kcore can have some unmapped kfence objects which when read vi…
-
High 7.8
crypto: bcm - add error check in the ahash_hmac_init function
In the Linux kernel, the following vulnerability has been resolved: crypto: bcm - add error check in the ahash_hmac_init function The ahash_init functions may return fails. The ahash_hmac_init should not return ok when ahash_init returns error. For an example…
-
High 7.8
brd: defer automatic disk creation until module initialization succeeds
In the Linux kernel, the following vulnerability has been resolved: brd: defer automatic disk creation until module initialization succeeds My colleague Wupeng found the following problems during fault injection: BUG: unable to handle page fault for address: …
-
High 7.8
EDAC/igen6: Avoid segmentation fault on module unload
In the Linux kernel, the following vulnerability has been resolved: EDAC/igen6: Avoid segmentation fault on module unload The segmentation fault happens because: During modprobe: 1. In igen6_probe(), igen6_pvt will be allocated with kzalloc() 2. In igen6_regi…
-
High 7.8
ionic: Fix netdev notifier unregister on failure
In the Linux kernel, the following vulnerability has been resolved: ionic: Fix netdev notifier unregister on failure If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure…
-
High 7.8
bpf, sockmap: Several fixes to bpf_msg_pop_data
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Several fixes to bpf_msg_pop_data Several fixes to bpf_msg_pop_data, 1. In sk_msg_shift_left, we should put_page 2. if (len == 0), return early is better 3. pop the entire sk_ms…
-
High 7.8
btrfs: fix use-after-free when COWing tree bock and tracing is enabled
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preempt…
-
High 7.8
drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() While receiving an MST up request message from one thread in drm_dp_mst_handle_up_req(), the MST topology could b…
-
High 7.8
s390/cpum_sf: Handle CPU hotplug remove during sampling
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_sf: Handle CPU hotplug remove during sampling CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() .…
-
High 7.8
jffs2: Prevent rtime decompress memory corruption
In the Linux kernel, the following vulnerability has been resolved: jffs2: Prevent rtime decompress memory corruption The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the …
-
High 7.8
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_ge…
-
High 7.8
btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
In the Linux kernel, the following vulnerability has been resolved: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which fre…
-
High 7.8
ila: serialize calls to nf_register_net_hooks()
In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nf_register_net_hooks() syzbot found a race in ila_add_mapping() [1] commit 031ae72825ce ("ila: call nf_unregister_net_hooks() sooner") attempted to fix a similar issu…
-
High 7.8
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving…
-
High 7.8
hrtimers: Handle CPU state correctly on hotplug
In the Linux kernel, the following vulnerability has been resolved: hrtimers: Handle CPU state correctly on hotplug Consider a scenario where a CPU transitions from CPUHP_ONLINE to halfway through a CPU hotunplug down to CPUHP_HRTIMERS_PREPARE, and then back …
-
High 7.8
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read…
-
High 7.8
dm thin: make get_first_thin use rcu-safe list first function
In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty(…
-
High 7.8
vsock/virtio: discard packets if the transport changes
In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket has been de-assigned or assigned to another transport, we must discard any packets received because they are not expected …
-
High 7.8
gtp: Destroy device along with udp socket's netns dismantle.
In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtp_newlink() links the device to a list in dev_net(dev) instead of src_net, where a udp tunnel socket is created. Even when src_n…
-
High 7.8
pktgen: Avoid out-of-bounds access in get_imix_entries
In the Linux kernel, the following vulnerability has been resolved: pktgen: Avoid out-of-bounds access in get_imix_entries Passing a sufficient amount of imix entries leads to invalid access to the pkt_dev->imix_entries array because of the incorrect boundary…
-
High 7.8
vfio/platform: check the bounds of read/write syscalls
In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bo…
-
High 7.8CVE-2025-21692 Public exploit
net: sched: fix ets qdisc OOB Indexing
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix ets qdisc OOB Indexing Haowei Yan <g1042620637@gmail.com> found that ets_class_from_arg() can index an Out-Of-Bound class in ets_class_from_arg() when passed clid of 0. The ov…
-
High 7.8
drm/v3d: Ensure job pointer is set to NULL after job completion
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Ensure job pointer is set to NULL after job completion After a job completes, the corresponding pointer in the device must be set to NULL. Failing to do so triggers a warning when un…
-
High 7.8
gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag
In the Linux kernel, the following vulnerability has been resolved: gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag Truncate an inode's address space when flipping the GFS2_DIF_JDATA flag: depending on that flag, the pages in the address space …
-
High 7.8
net: sched: Disallow replacing of child qdisc from one parent to another
In the Linux kernel, the following vulnerability has been resolved: net: sched: Disallow replacing of child qdisc from one parent to another Lion Ackermann was able to create a UAF which can be abused for privilege escalation with the following script Step 1.…
-
High 7.8
net: avoid race between device unregistration and ethnl ops
In the Linux kernel, the following vulnerability has been resolved: net: avoid race between device unregistration and ethnl ops The following trace can be seen if a device is being unregistered while its number of channels are being modified. DEBUG_LOCKS_WARN…
-
High 7.8
pfifo_tail_enqueue: Drop new packet when sch->limit == 0
In the Linux kernel, the following vulnerability has been resolved: pfifo_tail_enqueue: Drop new packet when sch->limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifo_tail_enqueue() will drop a packet in scheduler's queue and decrease sche…
-
High 7.8
netem: Update sch->q.qlen before qdisc_tree_reduce_backlog()
In the Linux kernel, the following vulnerability has been resolved: netem: Update sch->q.qlen before qdisc_tree_reduce_backlog() qdisc_tree_reduce_backlog() notifies parent qdisc only if child qdisc becomes empty, therefore we need to reduce the backlog of th…
-
High 7.8CVE-2025-21756 Public exploit
vsock: Keep the binding until socket destruction
In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes both resulting from an explicit bind() and those implicitly bound through autobind during connect(). …
-
High 7.6
Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/…
-
High 7.5
netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() I got a syzbot report without a repro [1] crashing in nf_send_reset6() I think the issue is that dev->hard_header_len is zer…
-
High 7.5
net/mlx5e: CT: Fix null-ptr-deref in add rule err flow
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: CT: Fix null-ptr-deref in add rule err flow In error flow of mlx5_tc_ct_entry_add_rule(), in case ct_rule_add() callback returns error, zone_rule->attr is used uninitiated. Fix it …
-
High 7.5
mptcp: cope racing subflow creation in mptcp_rcv_space_adjust
In the Linux kernel, the following vulnerability has been resolved: mptcp: cope racing subflow creation in mptcp_rcv_space_adjust Additional active subflows - i.e. created by the in kernel path manager - are included into the subflow list before starting the …
-
High 7.5
net: fix data-races around sk->sk_forward_alloc
In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk->sk_forward_alloc Syzkaller reported this warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 16 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x1c…
-
High 7.5
mm: revert "mm: shmem: fix data-race in shmem_getattr()"
In the Linux kernel, the following vulnerability has been resolved: mm: revert "mm: shmem: fix data-race in shmem_getattr()" Revert d949d1d14fa2 ("mm: shmem: fix data-race in shmem_getattr()") as suggested by Chuck [1]. It is causing deadlocks when accessing …
-
High 7.5
svcrdma: Address an integer overflow
In the Linux kernel, the following vulnerability has been resolved: svcrdma: Address an integer overflow Dan Carpenter reports: > Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data > structure") from Jun 22, 2020 (linux-next), leads to the followin…
-
High 7.5
NFSD: Prevent NULL dereference in nfsd4_process_cb_update()
In the Linux kernel, the following vulnerability has been resolved: NFSD: Prevent NULL dereference in nfsd4_process_cb_update() @ses is initialized to NULL. If __nfsd4_find_backchannel() finds no available backchannel session, setup_callback_client() will try…
-
High 7.5
RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg()
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix NULL pointer derefernce in hns_roce_map_mr_sg() ib_map_mr_sg() allows ULPs to specify NULL as the sg_offset argument. The driver needs to check whether it is a NULL pointer befo…
-
High 7.5
net/ipv6: release expired exception dst cached in socket
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6_negative_advice() when this function is executed for an expired IPv6 route located in the exception tabl…
-
High 7.5
sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport
In the Linux kernel, the following vulnerability has been resolved: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport Since transport->sock has been set to NULL during reset transport, XPRT_SOCK_UPD_TIMEOUT also needs to be cleared. Otherwise, the xs_t…
-
High 7.5
bpf: fix recursive lock when verdict program return SK_PASS
In the Linux kernel, the following vulnerability has been resolved: bpf: fix recursive lock when verdict program return SK_PASS When the stream_verdict program returns SK_PASS, it places the received skb into its own receive queue, but a recursive lock eventu…
-
High 7.5
net/smc: check return value of sock_recvmsg when draining clc data
In the Linux kernel, the following vulnerability has been resolved: net/smc: check return value of sock_recvmsg when draining clc data When receiving clc msg, the field length in smc_clc_msg_hdr indicates the length of msg should be received from network and …
-
High 7.5
afs: Fix the maximum cell name length
In the Linux kernel, the following vulnerability has been resolved: afs: Fix the maximum cell name length The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a director…
-
High 7.4
sh: intc: Fix use-after-free bug in register_intc_controller()
In the Linux kernel, the following vulnerability has been resolved: sh: intc: Fix use-after-free bug in register_intc_controller() In the error handling for this function, d is freed without ever removing it from intc_list which would lead to a use after free…
-
High 7.3
arm64/sve: Discard stale CPU state when handling SVE traps
In the Linux kernel, the following vulnerability has been resolved: arm64/sve: Discard stale CPU state when handling SVE traps The logic for handling SVE traps manipulates saved FPSIMD/SVE state incorrectly, and a race with preemption can result in a task hav…
-
High 7.3
netfilter: ipset: Hold module reference while requesting a module
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Hold module reference while requesting a module User space may unload ip_set.ko while it is itself requesting a set type backend module, leading to a kernel crash. The race …
-
High 7.3
power: supply: gpio-charger: Fix set charge current limits
In the Linux kernel, the following vulnerability has been resolved: power: supply: gpio-charger: Fix set charge current limits Fix set charge current limits for devices which allow to set the lowest charge current limit to be greater zero. If requested charge…
-
High 7.3
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot. Rework vlan_get_protocol_dgram() to not touch skb at all, so …
-
High 7.3
af_packet: fix vlan_get_tci() vs MSG_PEEK
In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_tci() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot. Rework vlan_get_tci() to not touch skb at all, so that it can be used fr…
-
High 7.1
fbdev: efifb: Register sysfs groups through driver core
In the Linux kernel, the following vulnerability has been resolved: fbdev: efifb: Register sysfs groups through driver core The driver core can register and cleanup sysfs groups already. Make use of that functionality to simplify the error handling and cleanu…
-
High 7.1
ntfs3: Add bounds checking to mi_enum_attr()
In the Linux kernel, the following vulnerability has been resolved: ntfs3: Add bounds checking to mi_enum_attr() Added bounds checking to make sure that every attr don't stray beyond valid memory region.
-
High 7.1
bpf: Check validity of link->type in bpf_link_show_fdinfo()
In the Linux kernel, the following vulnerability has been resolved: bpf: Check validity of link->type in bpf_link_show_fdinfo() If a newly-added link type doesn't invoke BPF_LINK_TYPE(), accessing bpf_link_type_strs[link->type] may result in an out-of-bounds …
-
High 7.1
ocfs2: fix uninitialized value in ocfs2_file_read_iter()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix uninitialized value in ocfs2_file_read_iter() Syzbot has reported the following KMSAN splat: BUG: KMSAN: uninit-value in ocfs2_file_read_iter+0x9a4/0xf80 ocfs2_file_read_iter+0x9a4…
-
High 7.1
jfs: array-index-out-of-bounds fix in dtReadFirst
In the Linux kernel, the following vulnerability has been resolved: jfs: array-index-out-of-bounds fix in dtReadFirst The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case.
-
High 7.1
netfilter: x_tables: fix LED ID check in led_tg_check()
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix LED ID check in led_tg_check() Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff…
-
High 7.1
iio: adc: ti-ads8688: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive cha…
-
High 7.1
iio: adc: rockchip_saradc: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: adc: rockchip_saradc: fix information leak in triggered buffer The 'data' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive…
-
High 7.1
iio: imu: kmx61: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: imu: kmx61: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels…
-
High 7.1
iio: light: vcnl4035: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the…
-
High 7.1
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, bu…
-
High 7.1
iio: pressure: zpa2326: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: zpa2326: fix information leak in triggered buffer The 'sample' local struct is used to push data to user space from a triggered buffer, but it has a hole between the temperatur…
-
High 7.1
ksmbd: fix a missing return value check bug
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix a missing return value check bug In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() fails to allocate a node, it returns a NULL pointer to the in_work pointer. This can …
-
High 7.1
sctp: sysctl: udp_port: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inco…
-
High 7.1
sctp: sysctl: auth_enable: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - I…
-
High 7.1
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:…
-
High 7.1
iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()
In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing an iSCSI boot using IPv6, iscsistart still reads the /sys/firmware/ibft/ethernetX/subnet-mask entry. …
-
High 7.0
crypto: hisilicon/qm - inject error before stopping queue
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - inject error before stopping queue The master ooo cannot be completely closed when the accelerator core reports memory error. Therefore, the driver needs to inject the …
-
High 7.0
btrfs: ref-verify: fix use-after-free after invalid ref action
In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry'…
-
High 7.0
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, t…
-
Medium 6.1
arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero …
-
Medium 5.5
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. U…
-
Medium 5.5
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when the ring is being stopped. Depending on timing between …
-
Medium 5.5
dma-debug: fix a possible deadlock on radix_lock
In the Linux kernel, the following vulnerability has been resolved: dma-debug: fix a possible deadlock on radix_lock radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock otherwise, there's a possible deadlock scenario when dma debug API is ca…
-
Medium 5.5
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
In the Linux kernel, the following vulnerability has been resolved: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") leads a NULL pointer deference in cache_set_f…
-
Medium 5.5
um: Fix potential integer overflow during physmem setup
In the Linux kernel, the following vulnerability has been resolved: um: Fix potential integer overflow during physmem setup This issue happens when the real map size is greater than LONG_MAX, which can be easily triggered on UML/i386.
-
Medium 5.5
firmware: arm_scpi: Check the DVFS OPP count returned by the firmware
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scpi: Check the DVFS OPP count returned by the firmware Fix a kernel crash with the below call trace when the SCPI firmware returns OPP count of zero. dvfs_info.opp_count may be…
-
Medium 5.5
soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get()
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: geni-se: fix array underflow in geni_se_clk_tbl_get() This loop is supposed to break if the frequency returned from clk_round_rate() is the same as on the previous iteration. Howev…
-
Medium 5.5
EDAC/bluefield: Fix potential integer overflow
In the Linux kernel, the following vulnerability has been resolved: EDAC/bluefield: Fix potential integer overflow The 64-bit argument for the "get DIMM info" SMC call consists of mem_ctrl_idx left-shifted 16 bits and OR-ed with DIMM index. With mem_ctrl_idx …
-
Medium 5.5
ALSA: pcm: Add sanity NULL check for the default mmap fault handler
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Add sanity NULL check for the default mmap fault handler A driver might allow the mmap access before initializing its runtime->dma_area properly. Add a proper NULL check before pas…
-
Medium 5.5
svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init()
In the Linux kernel, the following vulnerability has been resolved: svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() There's issue as follows: RPC: Registered rdma transport module. RPC: Registered rdma backchannel transport module. RPC: Unreg…
-
Medium 5.5
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is fully initialized, we can hit the panic below: h…
-
Medium 5.5
drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
In the Linux kernel, the following vulnerability has been resolved: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() drm_mode_vrefresh() is trying to avoid divide by zero by checking whether htotal or vtotal are zero. But we may still end up with…
-
Medium 5.5
ALSA: us122l: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at dis…
-
Medium 5.5
ALSA: usx2y: Use snd_card_free_when_closed() at disconnection
In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: Use snd_card_free_when_closed() at disconnection The USB disconnect callback is supposed to be short and not too-long waiting. OTOH, the current code uses snd_card_free() at disc…
-
Medium 5.5
ad7780: fix division by zero in ad7780_write_raw()
In the Linux kernel, the following vulnerability has been resolved: ad7780: fix division by zero in ad7780_write_raw() In the ad7780_write_raw() , val2 can be zero, which might lead to a division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw() is…
-
Medium 5.5
ftrace: Fix regression with module command in stack_trace_filter
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix regression with module command in stack_trace_filter When executing the following command: # echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter The current mod comman…
-
Medium 5.5
media: ts2020: fix null-ptr-deref in ts2020_probe()
In the Linux kernel, the following vulnerability has been resolved: media: ts2020: fix null-ptr-deref in ts2020_probe() KASAN reported a null-ptr-deref issue when executing the following command: # echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new_device KASA…
-
Medium 5.5
media: imx-jpeg: Ensure power suppliers be suspended before detach them
In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Ensure power suppliers be suspended before detach them The power suppliers are always requested to suspend asynchronously, dev_pm_domain_detach() requires the caller to ensur…
-
Medium 5.5
media: imx-jpeg: Set video drvdata before register video device
In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Set video drvdata before register video device The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() …
-
Medium 5.5
leds: class: Protect brightness_show() with led_cdev->led_access mutex
In the Linux kernel, the following vulnerability has been resolved: leds: class: Protect brightness_show() with led_cdev->led_access mutex There is NULL pointer issue observed if from Process A where hid device being added which results in adding a led_cdev a…
-
Medium 5.5
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' valu…
-
Medium 5.5
scsi: ufs: core: sysfs: Prevent div by zero
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: sysfs: Prevent div by zero Prevent a division by 0 when monitoring is not enabled.
-
Medium 5.5
HID: wacom: fix when get product name maybe null pointer
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix when get product name maybe null pointer Due to incorrect dev->product reporting by certain devices, null pointer dereferences occur when dev->product is empty, leading to pot…
-
Medium 5.5
gpio: grgpio: Add NULL check in grgpio_probe
In the Linux kernel, the following vulnerability has been resolved: gpio: grgpio: Add NULL check in grgpio_probe devm_kasprintf() can return a NULL pointer on failure,but this returned value in grgpio_probe is not checked. Add NULL check in grgpio_probe, to h…
-
Medium 5.5
net: hsr: avoid potential out-of-bound access in fill_frame_info()
In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid potential out-of-bound access in fill_frame_info() syzbot is able to feed a packet with 14 bytes, pretending it is a vlan one. Since fill_frame_info() is relying on skb->mac_l…
-
Medium 5.5
net: lapb: increase LAPB_HEADER_LEN
In the Linux kernel, the following vulnerability has been resolved: net: lapb: increase LAPB_HEADER_LEN It is unclear if net/lapb code is supposed to be ready for 8021q. We can at least avoid crashes like the following : skbuff: skb_under_panic: text:ffffffff…
-
Medium 5.5
usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Threa…
-
Medium 5.5
usb: dwc3: gadget: Fix looping of queued SG entries
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix looping of queued SG entries The dwc3_request->num_queued_sgs is decremented on completion. If a partially completed request is handled, then the dwc3_request->num_queu…
-
Medium 5.5
netdevsim: prevent bad user input in nsim_dev_health_break_write()
In the Linux kernel, the following vulnerability has been resolved: netdevsim: prevent bad user input in nsim_dev_health_break_write() If either a zero count or a large one is provided, kernel can crash.
-
Medium 5.5
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices
In the Linux kernel, the following vulnerability has been resolved: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for PMIC devices While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inheri…
-
Medium 5.5
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device
In the Linux kernel, the following vulnerability has been resolved: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for TMU device While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (inherite…
-
Medium 5.5
octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c Add error pointer check after calling otx2_mbox_get_rsp().
-
Medium 5.5
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_ethtool.c Add error pointer check after calling otx2_mbox_get_rsp().
-
Medium 5.5
rtc: check if __rtc_read_time was successful in rtc_timer_do_work()
In the Linux kernel, the following vulnerability has been resolved: rtc: check if __rtc_read_time was successful in rtc_timer_do_work() If the __rtc_read_time call fails,, the struct rtc_time tm; may contain uninitialized data, or an illegal date/time read fr…
-
Medium 5.5
crypto: caam - Fix the pointer passed to caam_qi_shutdown()
In the Linux kernel, the following vulnerability has been resolved: crypto: caam - Fix the pointer passed to caam_qi_shutdown() The type of the last parameter given to devm_add_action_or_reset() is "struct caam_drv_private *", but in caam_qi_shutdown(), it is…
-
Medium 5.5
nvme-pci: fix freeing of the HMB descriptor table
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix freeing of the HMB descriptor table The HMB descriptor table is sized to the maximum number of descriptors that could be used for a given device, but __nvme_alloc_host_mem could…
-
Medium 5.5
net/sched: netem: account for backlog updates from child qdisc
In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its childre…
-
Medium 5.5
btrfs: add a sanity check for btrfs root in btrfs_search_slot()
In the Linux kernel, the following vulnerability has been resolved: btrfs: add a sanity check for btrfs root in btrfs_search_slot() Syzbot reports a null-ptr-deref in btrfs_search_slot(). The reproducer is using rescue=ibadroots, and the extent tree root is c…
-
Medium 5.5
drm/sti: avoid potential dereference of error pointers
In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure.
-
Medium 5.5
drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' …
-
Medium 5.5
drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state…
-
Medium 5.5
quota: flush quota_release_work upon quota writeback
In the Linux kernel, the following vulnerability has been resolved: quota: flush quota_release_work upon quota writeback One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots() Since we curr…
-
Medium 5.5
MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
In the Linux kernel, the following vulnerability has been resolved: MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a Fix the dtc warnings: arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a00000…
-
Medium 5.5
soc: imx8m: Probe the SoC driver as platform driver
In the Linux kernel, the following vulnerability has been resolved: soc: imx8m: Probe the SoC driver as platform driver With driver_async_probe=* on kernel command line, the following trace is produced because on i.MX8M Plus hardware because the soc-imx8m.c d…
-
Medium 5.5
scsi: megaraid_sas: Fix for a potential deadlock
In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix for a potential deadlock This fixes a 'possible circular locking dependency detected' warning CPU0 CPU1 ---- ---- lock(&instance->reset_mutex); lock(&shost->scan_mutex…
-
Medium 5.5
net: fix memory leak in tcp_conn_request()
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in tcp_conn_request() If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will return without free the dst memory, which allocated in af_ops->route_req. H…
-
Medium 5.5
RDMA/uverbs: Prevent integer overflow issue
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wr…
-
Medium 5.5
drm/amd/display: Add check for granularity in dml ceil/floor helpers
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add check for granularity in dml ceil/floor helpers [Why] Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert an…
-
Medium 5.5
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in…
-
Medium 5.5
riscv: Fix sleeping in invalid context in die()
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix sleeping in invalid context in die() die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. …
-
Medium 5.5
virtio-blk: don't keep queue frozen during system suspend
In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before deleting vqs.") replaces queue quiesce with queue freeze in…
-
Medium 5.5
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different r…
-
Medium 5.5
sctp: sysctl: rto_min/max: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - I…
-
Medium 5.5
filemap: avoid truncating 64-bit offset to 32 bits
In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits On 32-bit kernels, folio_seek_hole_data() was inadvertently truncating a 64-bit value to 32 bits, leading to a possible infinite loop when w…
-
Medium 5.5
vsock: prevent null-ptr-deref in vsock_*[has_data|has_space]
In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reports have shown how we sometimes call vsock_*_has_data() when a vsock socket has been de-assigned from a transport (see …
-
Medium 5.5
bpf: Fix bpf_sk_select_reuseport() memory leak
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sk_select_reuseport() memory leak As pointed out in the original comment, lookup in sockmap can return a TCP ESTABLISHED socket. Such TCP socket may have had SO_ATTACH_REUSEPORT_…
-
Medium 5.5
USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb()
In the Linux kernel, the following vulnerability has been resolved: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() This patch addresses a null-ptr-deref in qt2_process_read_urb() due to an incorrect bounds check in the following: if (newp…
-
Medium 5.5
scsi: storvsc: Ratelimit warning logs to prevent VM denial of service
In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persistent error in the hypervisor, the SCSI warning for failed I/O can flood the kernel log and max out CPU…
-
Medium 5.5
fs/proc: fix softlockup in __read_vmcore (part 2)
In the Linux kernel, the following vulnerability has been resolved: fs/proc: fix softlockup in __read_vmcore (part 2) Since commit 5cbcb62dddf5 ("fs/proc: fix softlockup in __read_vmcore") the number of softlockups in __read_vmcore at kdump time have gone dow…
-
Medium 4.7
iommu/arm-smmu: Defer probe of clients after smmu device bound
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Defer probe of clients after smmu device bound Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for cli…
-
Medium 4.7
usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind This commit addresses an issue related to below kernel panic where panic_on_warn is enabled. It is caused by the unnecessary use of WARN_O…
-
Low 3.3
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
In the Linux kernel, the following vulnerability has been resolved: media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() The buffer in the loop should be released under the exception path, otherwise there may be a memory leak …
-
Low 3.3
dccp: Fix memory leak in dccp_feat_change_recv
In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccp_feat_change_recv If dccp_feat_push_confirm() fails after new value for SP feature was accepted without reconciliation ('entry == NULL' branch), memory allocated …
-
Low 3.3
PCI: Fix reset_method_store() memory leak
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix reset_method_store() memory leak In reset_method_store(), a string is allocated via kstrndup() and assigned to the local "options". options is then used in with strsep() to find spac…
-
Low 3.3
fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem()
In the Linux kernel, the following vulnerability has been resolved: fbdev: sh7760fb: Fix a possible memory leak in sh7760fb_alloc_mem() When information such as info->screen_base is not ready, calling sh7760fb_free_mem() does not release memory correctly. Cal…
-
Low 3.3
scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb()
In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() Hook "qedi_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent(…
-
Low 3.3
scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb()
In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() Hook "qed_ops->common->sb_init = qed_sb_init" does not release the DMA memory sb_virt when it fails. Add dma_free_coherent()…
-
Unscored —
sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK
In the Linux kernel, the following vulnerability has been resolved: sh: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK When CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are selected, cpu_max_bits_warn() generates a runtime warning similar as belo…
-
Unscored —
net: bridge: switchdev: Skip MDB replays of deferred events on offload
In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, generation of the list of MDB events to replay would race against the creation of new group membersh…
-
Unscored —
smb: client: fix potential UAF in cifs_debug_files_proc_show()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in cifs_debug_files_proc_show() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
Unscored —
gpiolib: cdev: Fix use after free in lineinfo_changed_notify
In the Linux kernel, the following vulnerability has been resolved: gpiolib: cdev: Fix use after free in lineinfo_changed_notify The use-after-free issue occurs as follows: when the GPIO chip device file is being closed by invoking gpio_chrdev_release(), watc…
-
Unscored —
exfat: fix potential deadlock on __exfat_get_dentry_set
In the Linux kernel, the following vulnerability has been resolved: exfat: fix potential deadlock on __exfat_get_dentry_set When accessing a file with more entries than ES_MAX_ENTRY_NUM, the bh-array is allocated in __exfat_get_entry_set. The problem is that …
-
Unscored —
media: xc2028: avoid use-after-free in load_firmware_cb()
In the Linux kernel, the following vulnerability has been resolved: media: xc2028: avoid use-after-free in load_firmware_cb() syzkaller reported use-after-free in load_firmware_cb() [1]. The reason is because the module allocated a struct tuner in tuner_probe…
-
Unscored —
jfs: Fix shift-out-of-bounds in dbDiscardAG
In the Linux kernel, the following vulnerability has been resolved: jfs: Fix shift-out-of-bounds in dbDiscardAG When searching for the next smaller log2 block, BLKSTOL2() returned 0, causing shift exponent -1 to be negative. This patch fixes the issue by exit…
-
Unscored —
net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup Currently napi_disable() gets called during rxq and txq cleanup, even before napi is enabled and hrtimer is initialized. It…
-
Unscored —
drm/amd/display: Check BIOS images before it is used
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check BIOS images before it is used BIOS images may fail to load and null checks are added before they are used. This fixes 6 NULL_RETURNS issues reported by Coverity.
-
Unscored —
ELF: fix kernel.randomize_va_space double read
In the Linux kernel, the following vulnerability has been resolved: ELF: fix kernel.randomize_va_space double read ELF loader uses "randomize_va_space" twice. It is sysctl and can change at any moment, so 2 loads could see 2 different values in theory with un…
-
Unscored —
btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc()
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUG_ON on ENOMEM from btrfs_lookup_extent_info() in walk_down_proc() We handle errors here properly, ENOMEM isn't fatal, return the error.
-
Unscored —
drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX [Why & How] It actually exposes '6' types in enum dmub_notification_type. Not 5. Using smaller number to create arr…
-
Unscored —
ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev()
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid possible NULL deref in rt6_uncached_list_flush_dev() Blamed commit accidentally removed a check for rt->rt6i_idev being NULL, as spotted by syzbot: Oops: general protection fault,…
-
Unscored —
NFSD: Limit the number of concurrent async COPY operations
In the Linux kernel, the following vulnerability has been resolved: NFSD: Limit the number of concurrent async COPY operations Nothing appears to limit the number of concurrent async COPY operations that clients can start. In addition, AFAICT each async COPY …
-
Unscored —
net: dsa: improve shutdown sequence
In the Linux kernel, the following vulnerability has been resolved: net: dsa: improve shutdown sequence Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens to reproduce there. T…
-
Unscored —
fs/ntfs3: Additional check in ntfs_file_release
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Additional check in ntfs_file_release
-
Unscored —
ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()
In the Linux kernel, the following vulnerability has been resolved: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() The per-netns IP tunnel hash table is protected by the RTNL mutex and ip_tunnel_find() is only called from the control pa…
-
Unscored —
igb: Fix potential invalid memory access in igb_init_module()
In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier …
-
Unscored —
ocfs2: uncache inode which has failed entering the group
In the Linux kernel, the following vulnerability has been resolved: ocfs2: uncache inode which has failed entering the group Syzbot has reported the following BUG: kernel BUG at fs/ocfs2/uptodate.c:509! ... Call Trace: <TASK> ? __die_body+0x5f/0xb0 ? die+0x9e…
-
Unscored —
mm: fix NULL pointer dereference in alloc_pages_bulk_noprof
In the Linux kernel, the following vulnerability has been resolved: mm: fix NULL pointer dereference in alloc_pages_bulk_noprof We triggered a NULL pointer dereference for ac.preferred_zoneref->zone in alloc_pages_bulk_noprof() when the task is migrated betwe…
-
Unscored —
virtio/vsock: Fix accept_queue memory leak
In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fix accept_queue memory leak As the final stages of socket destruction may be delayed, it is possible that virtio_transport_recv_listen() will be called after the accept_queue h…
-
Unscored —
drm/rockchip: vop: Fix a dereferenced before check warning
In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: vop: Fix a dereferenced before check warning The 'state' can't be NULL, we should check crtc_state. Fix warning: drivers/gpu/drm/rockchip/rockchip_drm_vop.c:1096 vop_plane_atomi…
-
Unscored —
nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix null-ptr-deref in block_dirty_buffer tracepoint When using the "block:block_dirty_buffer" tracepoint, mark_buffer_dirty() may cause a NULL pointer dereference, or a general protec…
-
Unscored —
nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints". This series fixes null pointer dereference bugs that occur whe…
-
Unscored —
initramfs: avoid filename buffer overrun
In the Linux kernel, the following vulnerability has been resolved: initramfs: avoid filename buffer overrun The initramfs filename field is defined in Documentation/driver-api/early-userspace/buffer-format.rst as: 37 cpio_file := ALGN(4) + cpio_header + file…
-
Unscored —
ubi: fastmap: Fix duplicate slab cache names while attaching
In the Linux kernel, the following vulnerability has been resolved: ubi: fastmap: Fix duplicate slab cache names while attaching Since commit 4c39529663b9 ("slab: Warn on duplicate cache names when DEBUG_VM=y"), the duplicate slab cache names can be detected …
-
Unscored —
um: vector: Do not use drvdata in release
In the Linux kernel, the following vulnerability has been resolved: um: vector: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the vector_device instance. Otherwise, removing a vector device will re…
-
Unscored —
um: net: Do not use drvdata in release
In the Linux kernel, the following vulnerability has been resolved: um: net: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the uml_net instance. Otherwise, removing a network device will result in …
-
Unscored —
um: ubd: Do not use drvdata in release
In the Linux kernel, the following vulnerability has been resolved: um: ubd: Do not use drvdata in release The drvdata is not available in release. Let's just use container_of() to get the ubd instance. Otherwise, removing a ubd device will result in a crash:…
-
Unscored —
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() Under certain kernel configurations when building with Clang/LLVM, the compiler does not generate a return or jump as t…
-
Unscored —
ceph: give up on paths longer than PATH_MAX
In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, e…
-
Unscored —
nilfs2: prevent use of deleted inode
In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent use of deleted inode syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file wa…
-
Unscored —
KVM: x86: Play nice with protected guests in complete_hypercall_exit()
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Play nice with protected guests in complete_hypercall_exit() Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For g…
-
Unscored —
wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() Replace one-element array with a flexible-array member in `struct mwifiex_ie_types_wildcard_ssid_params` to f…
-
Unscored —
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() if (dev->boardinfo && dev->boardinfo->init_dyn_addr) ^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master…
-
Unscored —
ovl: Filter invalid inodes with missing lookup function
In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is imp…
-
Unscored —
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enabl…
-
Unscored —
scsi: hisi_sas: Add cond_resched() for no forced preemption model
In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add cond_resched() for no forced preemption model For no forced preemption model kernel, in the scenario where the expander is connected to 12 high performance SAS SSDs, the f…
-
Unscored —
drm/amdgpu: set the right AMDGPU sg segment limitation
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: set the right AMDGPU sg segment limitation The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg…
-
Unscored —
kcsan: Turn report_filterlist_lock into a raw_spinlock
In the Linux kernel, the following vulnerability has been resolved: kcsan: Turn report_filterlist_lock into a raw_spinlock Ran Xiaokai reports that with a KCSAN-enabled PREEMPT_RT kernel, we can see splats like: | BUG: sleeping function called from invalid co…
-
Unscored —
drm/dp_mst: Fix MST sideband message body length check
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix MST sideband message body length check Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC (aka message data CRC)…
-
Unscored —
can: dev: can_set_termination(): allow sleeping GPIOs
In the Linux kernel, the following vulnerability has been resolved: can: dev: can_set_termination(): allow sleeping GPIOs In commit 6e86a1543c37 ("can: dev: provide optional GPIO based termination support") GPIO based termination support was added. For no par…
-
Unscored —
ocfs2: free inode when ocfs2_get_init_inode() fails
In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2_get_init_inode() fails syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput(…
-
Unscored —
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging tosend bytes, which is either msg->sg.size or a smaller val…
-
Unscored —
geneve: do not assume mac header is set in geneve_xmit_skb()
In the Linux kernel, the following vulnerability has been resolved: geneve: do not assume mac header is set in geneve_xmit_skb() We should not assume mac header is set in output path. Use skb_eth_hdr() instead of eth_hdr() to fix the issue. sysbot reported th…
-
Unscored —
octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c
In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c Add error pointer check after calling otx2_mbox_get_rsp().
-
Unscored —
crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY
In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - Call crypto layer directly when padata_do_parallel() return -EBUSY Since commit 8f4f68e788c3 ("crypto: pcrypt - Fix hungtask for PADATA_RESET"), the pcrypt encryption and dec…
-
Unscored —
mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device
In the Linux kernel, the following vulnerability has been resolved: mfd: intel_soc_pmic_bxtwc: Use IRQ domain for USB Type-C device While design wise the idea of converting the driver to use the hierarchy of the IRQ chips is correct, the implementation has (i…
-
Unscored —
media: wl128x: Fix atomicity violation in fmc_send_cmd()
In the Linux kernel, the following vulnerability has been resolved: media: wl128x: Fix atomicity violation in fmc_send_cmd() Atomicity violation occurs when the fmc_send_cmd() function is executed simultaneously with the modification of the fmdev->resp_skb va…
-
Unscored —
powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix dtl_access_lock to be a rw_semaphore The dtl_access_lock needs to be a rw_sempahore, a sleeping lock, because the code calls kmalloc() while holding it, which can sleep: …
-
Unscored —
media: atomisp: Add check for rgby_data memory allocation failure
In the Linux kernel, the following vulnerability has been resolved: media: atomisp: Add check for rgby_data memory allocation failure In ia_css_3a_statistics_allocate(), there is no check on the allocation result of the rgby_data memory. If rgby_data is not s…
-
Unscored —
tracing: Prevent bad count for tracing_cpumask_write
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.
-
Unscored —
dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will lead to a null pointer dereference. For example, the len inpu…
-
Unscored —
media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1] an uninitialized value issue found by KMSAN in dib3000_read_reg(). Local u8 rb[2] is used in i2c_tran…
-
Unscored —CVE-2024-56781 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
s390/entry: Mark IRQ entries to fix stack depot warnings
In the Linux kernel, the following vulnerability has been resolved: s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside of the top interrupt context as an uninteresting or irrelevant part of the stack traces…
-
Unscored —
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() The task sometimes continues looping in throttle_direct_reclaim() because allow_direct_reclaim(pgdat) …
-
Unscored —
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen: BUG: sleeping function called from…
-
Unscored —
drm/amdkfd: Correct the migration DMA map direction
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Correct the migration DMA map direction The SVM DMA device map direction should be set the same as the DMA unmap setting, otherwise the DMA core will report the following warning.…
-
Unscored —
net: restrict SO_REUSEPORT to inet sockets
In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_REUSEPORT to inet sockets After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot [1]. Trying to acquire a mutex in RCU c…
-
Unscored —
iio: adc: at91: call input_free_device() on allocated iio_dev
In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91: call input_free_device() on allocated iio_dev Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached bef…
-
Unscored —
topology: Keep the cpumask unchanged when printing cpumap
In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the following warning was discovered: different return values (15 and 11) from vsnprintf("%*pbl ", ...) test:key…
-
Unscored —
selinux: ignore unknown extended permissions
In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be adde…
-
Unscored —
exfat: fix the infinite loop in exfat_readdir()
In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the clust…
-
Unscored —
mac802154: check local interfaces before deleting sdata list
In the Linux kernel, the following vulnerability has been resolved: mac802154: check local interfaces before deleting sdata list syzkaller reported a corrupted list in ieee802154_if_remove. [1] Remove an IEEE 802.15.4 network interface after unregister an IEE…
-
Unscored —
netfilter: conntrack: clamp maximum hashtable size to INT_MAX
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof(…
-
Unscored —
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSA…
References
-
report
https://ubuntu.com/security/CVE-2022-0995
-
report
https://ubuntu.com/security/CVE-2022-49034
-
report
https://ubuntu.com/security/CVE-2024-26837
-
report
https://ubuntu.com/security/CVE-2024-26928
-
report
https://ubuntu.com/security/CVE-2024-35864
-
report
https://ubuntu.com/security/CVE-2024-36476
-
report
https://ubuntu.com/security/CVE-2024-36899
-
report
https://ubuntu.com/security/CVE-2024-42315
-
report
https://ubuntu.com/security/CVE-2024-43098
-
report
https://ubuntu.com/security/CVE-2024-43900
-
report
https://ubuntu.com/security/CVE-2024-44938
-
report
https://ubuntu.com/security/CVE-2024-45828
-
report
https://ubuntu.com/security/CVE-2024-46784
-
report
https://ubuntu.com/security/CVE-2024-46809
-
report
https://ubuntu.com/security/CVE-2024-46826
-
report
https://ubuntu.com/security/CVE-2024-46841
-
report
https://ubuntu.com/security/CVE-2024-46871
-
report
https://ubuntu.com/security/CVE-2024-47143
-
report
https://ubuntu.com/security/CVE-2024-47408
-
report
https://ubuntu.com/security/CVE-2024-47707
-
report
https://ubuntu.com/security/CVE-2024-47730
-
report
https://ubuntu.com/security/CVE-2024-48881
-
report
https://ubuntu.com/security/CVE-2024-49571
-
report
https://ubuntu.com/security/CVE-2024-49925
-
report
https://ubuntu.com/security/CVE-2024-49950
-
report
https://ubuntu.com/security/CVE-2024-49974
-
report
https://ubuntu.com/security/CVE-2024-49996
-
report
https://ubuntu.com/security/CVE-2024-49998
-
report
https://ubuntu.com/security/CVE-2024-50051
-
report
https://ubuntu.com/security/CVE-2024-50055
-
report
https://ubuntu.com/security/CVE-2024-50121
-
report
https://ubuntu.com/security/CVE-2024-50242
-
report
https://ubuntu.com/security/CVE-2024-50248
-
report
https://ubuntu.com/security/CVE-2024-50256
-
report
https://ubuntu.com/security/CVE-2024-50275
-
report
https://ubuntu.com/security/CVE-2024-50283
-
report
https://ubuntu.com/security/CVE-2024-50304
-
report
https://ubuntu.com/security/CVE-2024-52332
-
report
https://ubuntu.com/security/CVE-2024-53096