Summary
Michael Randrianantenaina discovered that the Bluetooth driver in the Linux
Kernel contained an improper access control vulnerability. A nearby
attacker could use this to connect a rougue device and possibly execute
arbitrary code. (CVE-2024-8805)
It was discovered that the CIFS network file system implementation in the
Linux kernel did not properly verify the target namespace when handling
upcalls. An attacker could use this to expose sensitive information.
(CVE-2025-2312)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- ACPI drivers;
- Network block device driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- I2C subsystem;
- InfiniBand drivers;
- Media drivers;
- NVIDIA Tegra memory controller driver;
- MemoryStick subsystem;
- Network drivers;
- Mellanox network drivers;
- NTB driver;
- PCI subsystem;
- PPS (Pulse Per Second) driver;
- PTP clock framework;
- RapidIO drivers;
- Voltage and Current Regulator drivers;
- Remote Processor subsystem;
- Real Time Clock drivers;
- SCSI subsystem;
- SLIMbus drivers;
- QCOM SoC drivers;
- Trusted Execution Environment drivers;
- Thermal drivers;
- TTY drivers;
- USB DSL drivers;
- USB Device Class drivers;
- USB core drivers;
- USB Gadget drivers;
- USB Host Controller drivers;
- Renesas USBHS Controller drivers;
- ACRN Hypervisor Service Module driver;
- File systems infrastructure;
- BTRFS file system;
- Ext4 file system;
- F2FS file system;
- JFS file system;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- NTFS3 file system;
- Overlay file system;
- Proc file system;
- SMB network file system;
- UBI file system;
- KVM subsystem;
- IPv6 networking;
- L3 Master device support module;
- Netfilter;
- RDMA verbs API;
- SoC audio core drivers;
- Process Accounting mechanism;
- Padata parallel execution mechanism;
- printk logging mechanism;
- Scheduler infrastructure;
- Timer subsystem;
- Tracing infrastructure;
- Watch queue notification mechanism;
- Memory management;
- 802.1Q VLAN protocol;
- Asynchronous Transfer Mode (ATM) subsystem;
- B.A.T.M.A.N. meshing protocol;
- Bluetooth subsystem;
- Networking core;
- IPv4 networking;
- Logical Link layer;
- Multipath TCP;
- NFC subsystem;
- Open vSwitch;
- Rose network layer;
- Network traffic control;
- SMC sockets;
- Sun RPC protocol;
- Wireless networking;
- Landlock security;
- Linux Security Modules (LSM) Framework;
- Tomoyo security module;
- SoC Audio for Freescale CPUs drivers;
(CVE-2025-21647, CVE-2025-21925, CVE-2024-58034, CVE-2024-46812,
CVE-2024-56721, CVE-2025-21811, CVE-2025-21719, CVE-2025-21859,
CVE-2025-21745, CVE-2023-53034, CVE-2025-21924, CVE-2024-58052,
CVE-2024-58090, CVE-2025-21950, CVE-2025-21753, CVE-2024-57977,
CVE-2025-21910, CVE-2025-21806, CVE-2024-58063, CVE-2025-21835,
CVE-2024-58001, CVE-2025-21804, CVE-2025-21887, CVE-2024-53144,
CVE-2025-38152, CVE-2024-56599, CVE-2025-22035, CVE-2025-22045,
CVE-2025-21926, CVE-2024-58069, CVE-2025-21749, CVE-2023-52664,
CVE-2025-21779, CVE-2025-21957, CVE-2025-21877, CVE-2025-22008,
CVE-2025-21760, CVE-2025-22071, CVE-2025-22079, CVE-2024-56664,
CVE-2024-42230, CVE-2025-21748, CVE-2025-21744, CVE-2025-21758,
CVE-2025-21767, CVE-2025-21999, CVE-2025-21970, CVE-2025-21826,
CVE-2025-38637, CVE-2025-21846, CVE-2025-22073, CVE-2025-23138,
CVE-2025-22097, CVE-2025-22056, CVE-2024-58093, CVE-2025-21935,
CVE-2025-21785, CVE-2025-22010, CVE-2025-22075, CVE-2025-21948,
CVE-2025-21862, CVE-2025-38575, CVE-2025-22004, CVE-2025-22063,
CVE-2025-21905, CVE-2025-21962, CVE-2025-21912, CVE-2025-21814,
CVE-2024-58085, CVE-2025-22060, CVE-2025-21795, CVE-2024-46821,
CVE-2025-21916, CVE-2024-46753, CVE-2022-49636, CVE-2025-22055,
CVE-2025-21898, CVE-2025-21715, CVE-2024-58017, CVE-2025-21772,
CVE-2025-21718, CVE-2024-36945, CVE-2025-21762, CVE-2025-22005,
CVE-2025-21991, CVE-2024-58051, CVE-2025-21951, CVE-2025-21726,
CVE-2024-58083, CVE-2025-21909, CVE-2025-21928, CVE-2025-21992,
CVE-2024-58010, CVE-2025-39735, CVE-2025-21711, CVE-2025-21761,
CVE-2025-21844, CVE-2024-58076, CVE-2024-58079, CVE-2025-21956,
CVE-2025-21684, CVE-2025-21920, CVE-2025-21823, CVE-2025-21781,
CVE-2025-21943, CVE-2025-37937, CVE-2025-21820, CVE-2023-52927,
CVE-2024-57978, CVE-2025-21787, CVE-2025-21776, CVE-2025-21722,
CVE-2025-21866, CVE-2025-22021, CVE-2025-21782, CVE-2025-22054,
CVE-2024-58055, CVE-2025-21964, CVE-2025-21941, CVE-2024-57973,
CVE-2025-22066, CVE-2025-21708, CVE-2025-21878, CVE-2025-21799,
CVE-2025-22086, CVE-2025-21766, CVE-2025-37889, CVE-2024-58002,
CVE-2025-21791, CVE-2025-21830, CVE-2025-21858, CVE-2025-22081,
CVE-2024-57834, CVE-2024-58072, CVE-2024-57981, CVE-2025-21848,
CVE-2025-21727, CVE-2025-21765, CVE-2024-58007, CVE-2025-21963,
CVE-2024-56551, CVE-2022-49728, CVE-2025-21728, CVE-2024-58014,
CVE-2025-21994, CVE-2025-21707, CVE-2025-21735, CVE-2025-23136,
CVE-2025-21731, CVE-2024-58020, CVE-2025-21704, CVE-2024-57979,
CVE-2025-21796, CVE-2025-21975, CVE-2025-22025, CVE-2024-56608,
CVE-2025-21971, CVE-2025-21919, CVE-2025-22018, CVE-2024-26982,
CVE-2024-47726, CVE-2025-21721, CVE-2025-22044, CVE-2025-21968,
CVE-2025-21865, CVE-2025-21917, CVE-2025-21764, CVE-2024-58016,
CVE-2025-21736, CVE-2024-57986, CVE-2025-21763, CVE-2024-58005,
CVE-2025-21802, CVE-2025-21871, CVE-2025-37785, CVE-2025-21922,
CVE-2025-21959, CVE-2025-22020, CVE-2024-58086, CVE-2025-22089,
CVE-2025-22007, CVE-2025-39728, CVE-2025-22050, CVE-2025-21934,
CVE-2025-21875, CVE-2025-21996, CVE-2025-21914, CVE-2024-58071,
CVE-2024-58058, CVE-2024-57980, CVE-2025-21904, CVE-2025-
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | linux-xilinx-zynqmp | 5.15.0-1050.54 |
Vulnerabilities 196
-
Critical 10.0
netfilter: socket: Lookup orig tuple for IPv6 SNAT
In the Linux kernel, the following vulnerability has been resolved: netfilter: socket: Lookup orig tuple for IPv6 SNAT nf_sk_lookup_slow_v4 does the conntrack lookup for IPv4 packets to restore the original 5-tuple in case of SNAT, to be able to find the righ…
-
Critical 9.8
mptcp: consolidate suboption status
In the Linux kernel, the following vulnerability has been resolved: mptcp: consolidate suboption status MPTCP maintains the received sub-options status is the bitmask carrying the received suboptions and in several bitfields carrying per suboption additional …
-
Critical 9.8
ksmbd: fix integer overflows on 32 bit systems
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix integer overflows on 32 bit systems On 32bit systems the addition operations in ipc_msg_alloc() can potentially overflow leading to memory corruption. Add bounds checking using KSM…
-
Critical 9.8
nfsd: clear acl_access/acl_default after releasing them
In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl_access and acl_default will be released simultaneously. However, acl_access will still retain a point…
-
High 8.8
Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE This aligned BR/EDR JUST_WORKS method with LE which since 92516cd97fd4 ("Bluetooth: Always request for user confirmation for Just …
-
High 8.8
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability
BlueZ HID over GATT Profile Improper Access Control Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of BlueZ. Authentication is not required to exploit this vulnerab…
-
High 8.8
NFC: nci: Add bounds checking in nci_hci_create_pipe()
In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking in nci_hci_create_pipe() The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci…
-
High 8.8
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow When cur_qp isn't NULL, in order to avoid fetching the QP from the radix tree again we check if the next cqe QP is identical to the one we al…
-
High 8.6
net: atm: fix use after free in lec_send()
In the Linux kernel, the following vulnerability has been resolved: net: atm: fix use after free in lec_send() The ->send() operation frees skb so save the length before calling ->send() to avoid a use after free.
-
High 8.1
rdma/cxgb4: Prevent potential integer overflow on 32bit
In the Linux kernel, the following vulnerability has been resolved: rdma/cxgb4: Prevent potential integer overflow on 32bit The "gl->tot_len" variable is controlled by the user. It comes from process_responses(). On 32bit systems, the "gl->tot_len + sizeof(st…
-
High 8.1CVE-2025-21760 EPSS 38%
ndisc: extend RCU protection in ndisc_send_skb()
In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held. Acquire rcu_read_lock() earlier, so that we can use dev_net_rcu() and avoid a potenti…
-
High 8.1
arp: use RCU protection in arp_xmit()
In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
-
High 8.1
ipv6: use RCU protection in ip6_default_advmss()
In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss() needs rcu protection to make sure the net structure it reads does not disappear.
-
High 8.1
ipv4: use RCU protection in __ip_rt_update_pmtu()
In the Linux kernel, the following vulnerability has been resolved: ipv4: use RCU protection in __ip_rt_update_pmtu() __ip_rt_update_pmtu() must use RCU protection to make sure the net structure it reads does not disappear.
-
High 7.8
net: atlantic: eliminate double free in error handling logic
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is…
-
High 7.8CVE-2023-52927 Public exploit
netfilter: allow exp not to be removed in nf_ct_find_expectation
In the Linux kernel, the following vulnerability has been resolved: netfilter: allow exp not to be removed in nf_ct_find_expectation Currently nf_conntrack_in() calling nf_ct_find_expectation() will remove the exp from the hash table. However, in some scenari…
-
High 7.8
drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration [Why] Coverity reports Memory - illegal accesses. [How] Skip inactive planes.
-
High 7.8
f2fs: fix to wait dio completion
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to wait dio completion It should wait all existing dio write IOs before block removal, otherwise, previous direct write IO may overwrite data in the block which may be reused by oth…
-
High 7.8
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0…
-
High 7.8
drm/amdgpu: fix usage slab after free
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free [ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000027] Read of size 8 at addr ffff8881b8605f88 by ta…
-
High 7.8
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the h…
-
High 7.8
bpf, sockmap: Fix race between element replace and close()
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close() Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_de…
-
High 7.8
pps: Fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting: pps pps1: removed ------------[ cut here ]----------…
-
High 7.8
media: uvcvideo: Remove dangling pointers
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Remove dangling pointers When an async control is written, we copy a pointer to the file handle that started the operation. That pointer will be used when the device is done.…
-
High 7.8
binfmt_flat: Fix integer overflow bug on 32 bit systems
In the Linux kernel, the following vulnerability has been resolved: binfmt_flat: Fix integer overflow bug on 32 bit systems Most of these sizes and counts are capped at 256MB so the math doesn't result in an integer overflow. The "relocs" count needs to be ch…
-
High 7.8
memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code()
In the Linux kernel, the following vulnerability has been resolved: memory: tegra20-emc: fix an OF node reference bug in tegra_emc_find_node_by_ram_code() As of_find_node_by_name() release the reference of the argument device node, tegra_emc_find_node_by_ram_…
-
High 7.8
usb: gadget: f_tcm: Don't free command immediately
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_tcm: Don't free command immediately Don't prematurely free the command. Wait for the status completion of the sense status. It can be freed then. Otherwise we will double-free …
-
High 7.8
rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read
In the Linux kernel, the following vulnerability has been resolved: rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read The nvmem interface supports variable buffer sizes, while the regmap interface operates with fixed-size storage. If an nvmem clie…
-
High 7.8
media: uvcvideo: Fix crash during unbind if gpio unit is in use
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix crash during unbind if gpio unit is in use We used the wrong device for the device managed functions. We used the usb device, when we should be using the interface device…
-
High 7.8
KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()
In the Linux kernel, the following vulnerability has been resolved: KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() Explicitly verify the target vCPU is fully online _prior_ to clamping the index in kvm_get_vcpu(). If the index is "bad", the no…
-
High 7.8
drm/v3d: Stop active perfmon if it is being destroyed
In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Stop active perfmon if it is being destroyed If the active performance monitor (`v3d->active_perfmon`) is being destroyed, stop it first. Currently, the active perfmon is not stopped…
-
High 7.8
net: davicom: fix UAF in dm9000_drv_remove
In the Linux kernel, the following vulnerability has been resolved: net: davicom: fix UAF in dm9000_drv_remove dm is netdev private data and it cannot be used after free_netdev() call. Using dm after free_netdev() can cause UAF bug. Fix it by moving free_netd…
-
High 7.8
net: rose: fix timer races against user threads
In the Linux kernel, the following vulnerability has been resolved: net: rose: fix timer races against user threads Rose timers only acquire the socket spinlock, without checking if the socket is owned by one user thread. Add a check and rearm the timers if n…
-
High 7.8
nilfs2: do not force clear folio if buffer is referenced
In the Linux kernel, the following vulnerability has been resolved: nilfs2: do not force clear folio if buffer is referenced Patch series "nilfs2: protect busy buffer heads from being force-cleared". This series fixes the buffer head state inconsistency issue…
-
High 7.8
padata: avoid UAF for reorder_work
In the Linux kernel, the following vulnerability has been resolved: padata: avoid UAF for reorder_work Although the previous patch can avoid ps and ps UAF for _do_serial, it can not avoid potential UAF issue for reorder_work. This issue can happen just as bel…
-
High 7.8
padata: fix UAF in padata_reorder
In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u11…
-
High 7.8
nbd: don't allow reconnect after disconnect
In the Linux kernel, the following vulnerability has been resolved: nbd: don't allow reconnect after disconnect Following process can cause nbd_config UAF: 1) grab nbd_config temporarily; 2) nbd_genl_disconnect() flush all recv_work() and release the initial …
-
High 7.8
btrfs: fix use-after-free when attempting to join an aborted transaction
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs…
-
High 7.8CVE-2025-21758 EPSS 17%
ipv6: mcast: add RCU protection to mld_newpack()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL or RCU being held. Note that we no longer can use sock_alloc_send_skb() because ipv6.igmp_sk uses GFP…
-
High 7.8
openvswitch: use RCU protection in ovs_vport_cmd_fill_info()
In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() can be called without RTNL or RCU. Use RCU protection and dev_net_rcu() to avoid potential UAF.
-
High 7.8
neighbour: use RCU protection in __neigh_notify()
In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without RTNL or RCU protection. Use RCU protection to avoid potential UAF.
-
High 7.8
ndisc: use RCU protection in ndisc_alloc_skb()
In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RTNL or RCU being held. Add RCU protection to avoid possible UAF.
-
High 7.8
partitions: mac: fix handling of bogus partition table
In the Linux kernel, the following vulnerability has been resolved: partitions: mac: fix handling of bogus partition table Fix several issues in partition probing: - The bailout for a bad partoffset must use put_dev_sector(), since the preceding read_part_sec…
-
High 7.8
arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/populates cache information already has a bounds check on the array size but does not account for cache le…
-
High 7.8
vrf: use RCU protection in l3mdev_l3_out()
In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU being held: raw_sendmsg() ip_push_pending_frames() ip_send_skb() ip_local_out() __ip_local_out() l3mdev_ip…
-
High 7.8
nilfs2: protect access to buffers with no active references
In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect access to buffers with no active references nilfs_lookup_dirty_data_buffers(), which iterates through the buffers attached to dirty data folios/pages, accesses the attached bu…
-
High 7.8
batman-adv: Drop unmanaged ELP metric worker
In the Linux kernel, the following vulnerability has been resolved: batman-adv: Drop unmanaged ELP metric worker The ELP worker needs to calculate new metric values for all neighbors "reachable" over an interface. Some of the used metric sources require locks…
-
High 7.8
netfilter: nf_tables: reject mismatching sum of field_len with set key length
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field length description provides the length of each separated key field in the concatenation, each field get…
-
High 7.8
geneve: Fix use-after-free in geneve_find_dev().
In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net…
-
High 7.8
mptcp: always handle address removal under msk socket lock
In the Linux kernel, the following vulnerability has been resolved: mptcp: always handle address removal under msk socket lock Syzkaller reported a lockdep splat in the PM control path: WARNING: CPU: 0 PID: 6693 at ./include/net/sock.h:1711 sock_owned_by_me i…
-
High 7.8
ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up The issue was caused by dput(upper) being called before ovl_dentry_update_reval(), while upper->d_flags was still acces…
-
High 7.8
slimbus: messaging: Free transaction ID in delayed interrupt scenario
In the Linux kernel, the following vulnerability has been resolved: slimbus: messaging: Free transaction ID in delayed interrupt scenario In case of interrupt delay for any reason, slim_do_transfer() returns timeout error but the transaction ID (TID) is not f…
-
High 7.8
sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq. This 'prev' pointer can originate from struct rq's l…
-
High 7.8
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error
In the Linux kernel, the following vulnerability has been resolved: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error During the initialization of ptp, hclge_ptp_get_cycle might return an error and returned directl…
-
High 7.8
net: gso: fix ownership in __udp_gso_segment
In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is removed before segmenting the skb but the socket reference is kept as-is. This is an issue if the origi…
-
High 7.8
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handli…
-
High 7.8
rapidio: fix an API misues when rio_add_net() fails
In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rio_add_net() fails rio_add_net() calls device_register() and fails when device_register() fails. Thus, put_device() should be used rather than kfree(). Add "m…
-
High 7.8
drm/amd/display: Fix slab-use-after-free on hdcp_work
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix slab-use-after-free on hdcp_work [Why] A slab-use-after-free is reported when HDCP is destroyed but the property_validate_dwork queue is still running. [How] Cancel the d…
-
High 7.8
net/mlx5: Bridge, fix the crash caused by LAG state check
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Bridge, fix the crash caused by LAG state check When removing LAG device from bridge, NETDEV_CHANGEUPPER event is triggered. Driver finds the lower devices (PFs) to flush all the of…
-
High 7.8
net_sched: Prevent creation of classes with TC_H_ROOT
In the Linux kernel, the following vulnerability has been resolved: net_sched: Prevent creation of classes with TC_H_ROOT The function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination condition when traversing up the qdisc tree to update parent bac…
-
High 7.8
x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes
In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_microcode_amd() iterates over all NUMA nodes, retrieves their CPU masks and unconditionally accesses p…
-
High 7.8
proc: fix UAF in proc_get_inode()
In the Linux kernel, the following vulnerability has been resolved: proc: fix UAF in proc_get_inode() Fix race between rmmod and /proc/XXX's inode instantiation. The bug is that pde->proc_ops don't belong to /proc, it belongs to a module, therefore dereferenc…
-
High 7.8
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
In the Linux kernel, the following vulnerability has been resolved: memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove This fixes the following crash: ================================================================== BUG: KASAN: slab-us…
-
High 7.8
tracing: Fix use-after-free in print_graph_function_flags during tracer switching
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix use-after-free in print_graph_function_flags during tracer switching Kairui reported a UAF issue in print_graph_function_flags() during ftrace stress testing [1]. This issue can …
-
High 7.8
x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs On the following path, flush_tlb_range() can be used for zapping normal PMD entries (PMD entries that point to page tables) tog…
-
High 7.8
netfilter: nft_tunnel: fix geneve_opt type confusion addition
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by o…
-
High 7.8
ocfs2: validate l_tree_depth to avoid out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate l_tree_depth to avoid out-of-bounds access The l_tree_depth field is 16-bit (__le16), but the actual maximum depth is limited to OCFS2_MAX_PATH_DEPTH. Add a check to prevent o…
-
High 7.8
fs/ntfs3: Fix a couple integer overflows on 32bit systems
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix a couple integer overflows on 32bit systems On 32bit systems the "off + sizeof(struct NTFS_DE)" addition can have an integer wrapping issue. Fix it by using size_add().
-
High 7.8
RDMA/core: Don't expose hw_counters outside of init net namespace
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Don't expose hw_counters outside of init net namespace Commit 467f432a521a ("RDMA/core: Split port and device counter sysfs attributes") accidentally almost exposed hw counters to …
-
High 7.8
drm/vkms: Fix use after free and double free on init error
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Fix use after free and double free on init error If the driver initialization fails, the vkms_exit() function might access an uninitialized or freed default_config pointer and it mi…
-
High 7.8
ext4: fix OOB read when checking dotdot dir
In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with directory which contains '.' dir entry with rec_len == block size results in out-of-bounds read (later on, whe…
-
High 7.6
ksmbd: fix incorrect validation for num_aces field of smb_acl
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_aces to allocate posix_ace_state_array. if (num_aces > ULONG_MAX / sizeof(struct smb_ace *)) It is an i…
-
High 7.5
net/smc: fix neighbour and rtable leak in smc_ib_find_route()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix neighbour and rtable leak in smc_ib_find_route() In smc_ib_find_route(), the neighbour found by neigh_lookup() and rtable resolved by ip_route_output_flow() are not released or p…
-
High 7.5
NFSD: fix hang in nfsd4_shutdown_callback
In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback If nfs4_client is in courtesy state then there is no point to send the callback. This causes nfsd4_shutdown_callback to hang since cl_cb_inflight is …
-
High 7.5
smb: client: Add check for next_buffer in receive_encrypted_standard()
In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the return value of cifs_buf_get() and cifs_small_buf_get() in receive_encrypted_standard() to prevent nul…
-
High 7.5
nfsd: put dl_stid if fail to queue dl_recall
In the Linux kernel, the following vulnerability has been resolved: nfsd: put dl_stid if fail to queue dl_recall Before calling nfsd4_run_cb to queue dl_recall to the callback_wq, we increment the reference count of dl_stid. We expect that after the correspon…
-
High 7.3
sched: sch_cake: add bounds checks to host bulk flow fairness counts
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host…
-
High 7.3
landlock: Handle weird files
In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem (e.g. bcachefs) might return weird files. Instead of throwing a warning and allowing access to such file, treat them as regular files.
-
High 7.3
netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() Since commit b36e4523d4d5 ("netfilter: nf_conncount: fix garbage collection confirm race"), `cpu` and `jif…
-
High 7.1
ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans
In the Linux kernel, the following vulnerability has been resolved: ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans There is a kernel API ntb_mw_clear_trans() would pass 0 to both addr and size. This would make xlate_pos negative. [ 23…
-
High 7.1
x86/CPU/AMD: Terminate the erratum_1386_microcode array
In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Terminate the erratum_1386_microcode array The erratum_1386_microcode array requires an empty entry at the end. Otherwise x86_match_cpu_with_stepping() will continue iterate the …
-
High 7.1
HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections
In the Linux kernel, the following vulnerability has been resolved: HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections A report in 2019 by the syzbot fuzzer was found to be connected to two errors in the HID core associated w…
-
High 7.1
ipmr: do not call mr_mfc_uses_dev() for unres entries
In the Linux kernel, the following vulnerability has been resolved: ipmr: do not call mr_mfc_uses_dev() for unres entries syzbot found that calling mr_mfc_uses_dev() for unres entries would crash [1], because c->mfc_un.res.minvif / c->mfc_un.res.maxvif alias …
-
High 7.1
PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region()
In the Linux kernel, the following vulnerability has been resolved: PCI: rcar-ep: Fix incorrect variable used when calling devm_request_mem_region() The rcar_pcie_parse_outbound_ranges() uses the devm_request_mem_region() macro to request a needed resource. A…
-
High 7.1
wifi: iwlwifi: limit printed string from FW file
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file is always with a NUL-termination, so reading the string may read beyond the end of the TLV. If that's …
-
High 7.1
vlan: enforce underlying device type
In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non-ethernet devices. Besides the fact that it doesn't make much sense, this also causes a bug which leak…
-
High 7.1
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl
In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: fix narrowing conversion in acpi_nfit_ctl Syzkaller has reported a warning in to_nfit_bus_uuid(): "only secondary bus families can be translated". This warning is emited if the ar…
-
High 7.1
net: fix geneve_opt length integer overflow
In the Linux kernel, the following vulnerability has been resolved: net: fix geneve_opt length integer overflow struct geneve_opt uses 5 bit length for each single option, which means every vary size option should be smaller than 128 bytes. However, all curre…
-
High 7.1
jfs: fix slab-out-of-bounds read in ea_get()
In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the "size_check" label in ea_get(), the code checks if the extended attribute list (xattr) size matches ea_size. If not, it logs "ea_get: i…
-
Medium 5.9
cifs.upcall makes an upcall to the wrong namespace in containerized environments
A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the hos…
-
Medium 5.5
drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table The function atomctrl_get_smc_sclk_range_table() does not check the return value of smu_atom_get_data_t…
-
Medium 5.5
ubifs: skip dumping tnc tree when zroot is null
In the Linux kernel, the following vulnerability has been resolved: ubifs: skip dumping tnc tree when zroot is null Clearing slab cache will free all znode in memory and make c->zroot.znode = NULL, then dumping tnc tree will access c->zroot.znode which cause …
-
Medium 5.5
wifi: rtlwifi: fix memory leaks and invalid access at probe error path
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: fix memory leaks and invalid access at probe error path Deinitialize at reverse order when probe fails. When init_sw_vars fails, rtl_deinit_core should not be called, specially…
-
Medium 5.5
team: prevent adding a device which is already a team device lower
In the Linux kernel, the following vulnerability has been resolved: team: prevent adding a device which is already a team device lower Prevent adding a device which is already a team device lower, e.g. adding veth0 if vlan1 was already added and veth0 is a lo…
-
Medium 5.5
clk: qcom: gcc-sm6350: Add missing parent_map for two clocks
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-sm6350: Add missing parent_map for two clocks If a clk_rcg2 has a parent, it should also have parent_map defined, otherwise we'll get a NULL pointer dereference when calling cl…
-
Medium 5.5
acct: perform last write from workqueue
In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system call can be used to trigger NULL deref in cases where it is set to write to a file that triggers an inte…
-
Medium 5.5
nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()
In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() Add check for the return value of nfp_app_ctrl_msg_alloc() in nfp_bpf_cmsg_alloc() to prevent null pointer dereference.
-
Medium 5.5
USB: gadget: f_midi: f_midi_complete to call queue_work
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: f_midi: f_midi_complete to call queue_work When using USB MIDI, a lock is attempted to be acquired twice through a re-entrant call to f_midi_transmit, causing a deadlock. Fix it …
-
Medium 5.5
drop_monitor: fix incorrect initialization order
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix incorrect initialization order Syzkaller reports the following bug: BUG: spinlock bad magic on CPU#1, syz-executor.0/7995 lock: 0xffff88805303f3e0, .magic: 00000000, .owner:…
-
Medium 5.5
gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().
In the Linux kernel, the following vulnerability has been resolved: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). Brad Spengler reported the list_del() corruption splat in gtp_net_exit_batch_rtnl(). [0] Commit eb28fd76c0a0 ("gtp: Destroy d…
-
Medium 5.5
powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC
In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC Erhard reported the following KASAN hit while booting his PowerMac G4 with a KASAN-enabled kernel 6.13-rc6:…
-
Medium 5.5
ftrace: Avoid potential division by zero in function_stat_show()
In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_stat_show() Check whether denominator expression x * (x - 1) * 1000 mod {2^32, 2^64} produce zero and skip stddev computation in that case…
-
Medium 5.5
caif_virtio: fix wrong pointer check in cfv_probe()
In the Linux kernel, the following vulnerability has been resolved: caif_virtio: fix wrong pointer check in cfv_probe() del_vqs() frees virtqueues, therefore cfv->vq_tx pointer should be checked for NULL before calling it, not cfv->vdev. Also the current impl…
-
Medium 5.5
usb: renesas_usbhs: Flush the notify_hotplug_work
In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Flush the notify_hotplug_work When performing continuous unbind/bind operations on the USB drivers available on the Renesas RZ/G2L SoC, a kernel crash with the message "Un…
-
Medium 5.5
ppp: Fix KMSAN uninit-value warning with bpf
In the Linux kernel, the following vulnerability has been resolved: ppp: Fix KMSAN uninit-value warning with bpf Syzbot caught an "KMSAN: uninit-value" warning [1], which is caused by the ppp driver not initializing a 2-byte header when using socket filter. T…
-
Medium 5.5
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params Null pointer dereference issue could occur when pipe_ctx->plane_state is null. The fix adds a check …
-
Medium 5.5
HID: appleir: Fix potential NULL dereference at raw event handle
In the Linux kernel, the following vulnerability has been resolved: HID: appleir: Fix potential NULL dereference at raw event handle Syzkaller reports a NULL pointer dereference issue in input_event(). BUG: KASAN: null-ptr-deref in instrument_atomic_read incl…
-
Medium 5.5
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock There are multiple places from where the recovery work gets scheduled asynchronously. Also, there are multiple plac…
-
Medium 5.5
scsi: qla1280: Fix kernel oops when debug level > 2
In the Linux kernel, the following vulnerability has been resolved: scsi: qla1280: Fix kernel oops when debug level > 2 A null dereference or oops exception will eventually occur when qla1280.c driver is compiled with DEBUG_QLA1280 enabled and ql_debug_level …
-
Medium 5.5
cifs: Fix integer overflow while processing closetimeo mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing closetimeo mount option User-provided mount parameter closetimeo of type u32 is intended to have an upper limit, but before it is validated, the va…
-
Medium 5.5
cifs: Fix integer overflow while processing acdirmax mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acdirmax mount option User-provided mount parameter acdirmax of type u32 is intended to have an upper limit, but before it is validated, the value …
-
Medium 5.5
cifs: Fix integer overflow while processing acregmax mount option
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix integer overflow while processing acregmax mount option User-provided mount parameter acregmax of type u32 is intended to have an upper limit, but before it is validated, the value …
-
Medium 5.5
ice: fix memory leak in aRFS after reset
In the Linux kernel, the following vulnerability has been resolved: ice: fix memory leak in aRFS after reset Fix aRFS (accelerated Receive Flow Steering) structures memory leak by adding a checker to verify if aRFS memory is already allocated while configurin…
-
Medium 5.5
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse()
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() On the off chance that command stream passed from userspace via ioctl() call to radeon_vce_cs_parse() is weirdly crafted and …
-
Medium 5.5
ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw().
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything when it fails. Commit 7dd73168e273 ("ipv6: Always alloc…
-
Medium 5.5
Bluetooth: Fix error code in chan_alloc_skb_cb()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix error code in chan_alloc_skb_cb() The chan_alloc_skb_cb() function is supposed to return error pointers on error. Returning NULL will lead to a NULL dereference.
-
Medium 5.5
atm: Fix NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: atm: Fix NULL pointer dereference When MPOA_cache_impos_rcvd() receives the msg, it can trigger Null Pointer Dereference Vulnerability if both entry and holding_time are NULL. Because there i…
-
Medium 5.5
arcnet: Add NULL check in com20020pci_probe()
In the Linux kernel, the following vulnerability has been resolved: arcnet: Add NULL check in com20020pci_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, com20020pci_probe() does not check for this case, which results in a NULL …
-
Medium 5.5
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets
In the Linux kernel, the following vulnerability has been resolved: netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets When calling netlbl_conn_setattr(), addr->sa_family is used to determine the function behavior. If sk is an IPv4 socket,…
-
Medium 5.5
ASoC: imx-card: Add NULL check in imx_card_probe()
In the Linux kernel, the following vulnerability has been resolved: ASoC: imx-card: Add NULL check in imx_card_probe() devm_kasprintf() returns NULL when memory allocation fails. Currently, imx_card_probe() does not check for this case, which results in a NUL…
-
Medium 5.5
thermal: int340x: Add NULL check for adev
In the Linux kernel, the following vulnerability has been resolved: thermal: int340x: Add NULL check for adev Not all devices have an ACPI companion fwnode, so adev might be NULL. This is similar to the commit cd2fd6eab480 ("platform/x86: int3472: Check for a…
-
Medium 5.5
remoteproc: core: Clear table_sz when rproc_shutdown
In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear table_sz when rproc_shutdown There is case as below could trigger kernel dump: Use U-Boot to start remote processor(rproc) with resource table published to a fixed add…
-
Medium 5.5
clk: samsung: Fix UBSAN panic in samsung_clk_init()
In the Linux kernel, the following vulnerability has been resolved: clk: samsung: Fix UBSAN panic in samsung_clk_init() With UBSAN_ARRAY_BOUNDS=y, I'm hitting the below panic due to dereferencing `ctx->clk_data.hws` before setting `ctx->clk_data.num = nr_clks…
-
Medium 4.7
gpio: aggregator: protect driver attr handlers against module unload
In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: protect driver attr handlers against module unload Both new_device_store and delete_device_store touch module global resources (e.g. gpio_aggregator_lock). To prevent race c…
-
Unscored —
vlan: fix memory leak in vlan_newlink()
In the Linux kernel, the following vulnerability has been resolved: vlan: fix memory leak in vlan_newlink() Blamed commit added back a bug I fixed in commit 9bbd917e0bec ("vlan: fix memory leak in vlan_dev_set_egress_priority") If a memory allocation fails in…
-
Unscored —
ipv6: Fix signed integer overflow in __ip6_append_data
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix signed integer overflow in __ip6_append_data Resurrect ubsan overflow checks and ubsan report this warning, fix it by change the variable [length] type to size_t. UBSAN: signed-inte…
-
Unscored —
Squashfs: check the inode number is not the invalid value of zero
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because t…
-
Unscored —
powerpc/pseries: Fix scv instruction crash with kexec
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL (reloc_on_exc), required for scv instruction support, before other CPUs have been shut down. This means the…
-
Unscored —
btrfs: handle errors from btrfs_dec_ref() properly
In the Linux kernel, the following vulnerability has been resolved: btrfs: handle errors from btrfs_dec_ref() properly In walk_up_proc() we BUG_ON(ret) from btrfs_dec_ref(). This is incorrect, we have proper error handling here, return the error.
-
Unscored —
drm/amd/pm: Fix negative array index read
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix negative array index read Avoid using the negative values for clk_idex as an index into an array pptable->DpmDescriptor. V2: fix clk_index return check (Tim Huang)
-
Unscored —
wifi: ath10k: avoid NULL pointer error during sdio remove
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: avoid NULL pointer error during sdio remove When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT…
-
Unscored —
media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread
In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Fix a null-ptr-deref in vidtv_mux_stop_thread syzbot report a null-ptr-deref in vidtv_mux_stop_thread. [1] If dvb->mux is not initialized successfully by vidtv_mux_init() in the…
-
Unscored —
memcg: fix soft lockup in the OOM process
In the Linux kernel, the following vulnerability has been resolved: memcg: fix soft lockup in the OOM process A soft lockup issue was found in the product with about 56,000 tasks were in the OOM cgroup, it was traversing them when the soft lockup was triggere…
-
Unscored —
media: imx-jpeg: Fix potential error pointer dereference in detach_pm()
In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Fix potential error pointer dereference in detach_pm() The proble is on the first line: if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i])) If jpeg->pd_dev[i] is a…
-
Unscored —
media: uvcvideo: Fix double free in error path
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix double free in error path If the uvc_status_init() function fails to allocate the int_urb, it will free the dev->status pointer but doesn't reset the pointer to NULL. Thi…
-
Unscored —
usb: xhci: Fix NULL pointer dereference on certain command aborts
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Fix NULL pointer dereference on certain command aborts If a command is queued to the final usable TRB of a ring segment, the enqueue pointer is advanced to the subsequent link TRB …
-
Unscored —
ocfs2: handle a symlink read error correctly
In the Linux kernel, the following vulnerability has been resolved: ocfs2: handle a symlink read error correctly Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;-) So I've…
-
Unscored —
tpm: Change to kvalloc() in eventlog/acpi.c
In the Linux kernel, the following vulnerability has been resolved: tpm: Change to kvalloc() in eventlog/acpi.c The following failure was reported on HPE ProLiant D320: [ 10.693310][ T1] tpm_tis STM0925:00: 2.0 TPM (device-id 0x3, rev-id 0) [ 10.848132][ T1] …
-
Unscored —
soc: qcom: socinfo: Avoid out of bounds read of serial number
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: socinfo: Avoid out of bounds read of serial number On MSM8916 devices, the serial number exposed in sysfs is constant and does not change across individual devices. It's always: db…
-
Unscored —
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() In 'wlc_phy_iqcal_gainparams_nphy()', add gain range check to WARN() instead of possible out-of-bounds 'tbl_iqcal_gainp…
-
Unscored —
safesetid: check size of policy writes
In the Linux kernel, the following vulnerability has been resolved: safesetid: check size of policy writes syzbot attempts to write a buffer with a large size to a sysfs entry with writes handled by handle_policy_update(), triggering a warning in kmalloc. Che…
-
Unscored —
printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX
In the Linux kernel, the following vulnerability has been resolved: printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX Shifting 1 << 31 on a 32-bit int causes signed integer overflow, which leads to undefined behavior. To prevent this, cast 1 t…
-
Unscored —
HID: multitouch: Add NULL check in mt_input_configured
In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Add NULL check in mt_input_configured devm_kasprintf() can return a NULL pointer on failure,but this returned value in mt_input_configured() is not checked. Add NULL check in…
-
Unscored —
ipmi: ipmb: Add check devm_kasprintf() returned value
In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: Add check devm_kasprintf() returned value devm_kasprintf() can return a NULL pointer on failure but this returned value is not checked.
-
Unscored —
wifi: rtlwifi: remove unused check_buddy_priv
In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: remove unused check_buddy_priv Commit 2461c7d60f9f ("rtlwifi: Update header file") introduced a global list of private data structures. Later on, commit 26634c4b1868 ("rtlwifi …
-
Unscored —
tomoyo: don't emit warning in tomoyo_write_control()
In the Linux kernel, the following vulnerability has been resolved: tomoyo: don't emit warning in tomoyo_write_control() syzbot is reporting too large allocation warning at tomoyo_write_control(), for one can write a very very long line without new line chara…
-
Unscored —
sched/core: Prevent rescheduling when interrupts are disabled
In the Linux kernel, the following vulnerability has been resolved: sched/core: Prevent rescheduling when interrupts are disabled David reported a warning observed while loop testing kexec jump: Interrupts enabled after irqrouter_resume+0x0/0x50 WARNING: CPU:…
-
Unscored —
PCI/ASPM: Fix link state exit during switch upstream function removal
In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Fix link state exit during switch upstream function removal Before 456d8aa37d0f ("PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free"), we would free the ASPM li…
-
Unscored —
gpio: xilinx: Convert gpio_lock to raw spinlock
In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: Convert gpio_lock to raw spinlock irq_chip functions may be called in raw spinlock context. Therefore, we must also use a raw spinlock for our own internal locking. This fixes t…
-
Unscored —
usb: cdc-acm: Check control transfer buffer size before access
In the Linux kernel, the following vulnerability has been resolved: usb: cdc-acm: Check control transfer buffer size before access If the first fragment is shorter than struct usb_cdc_notification, we can't calculate an expected_size. Log an error and discard…
-
Unscored —
net: usb: rtl8150: enable basic endpoint checking
In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: enable basic endpoint checking Syzkaller reports [1] encountering a common issue of utilizing a wrong usb endpoint type during URB submitting stage. This, in turn, triggers…
-
Unscored —
net/rose: prevent integer overflows in rose_setsockopt()
In the Linux kernel, the following vulnerability has been resolved: net/rose: prevent integer overflows in rose_setsockopt() In case of possible unpredictably large arguments passed to rose_setsockopt() and multiplied by extra values on top of that, integer o…
-
Unscored —
nilfs2: handle errors that nilfs_prepare_chunk() may return
In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle errors that nilfs_prepare_chunk() may return Patch series "nilfs2: fix issues with rename operations". This series fixes BUG_ON check failures reported by syzbot around rename …
-
Unscored —
bpf: Send signals asynchronously if !preemptible
In the Linux kernel, the following vulnerability has been resolved: bpf: Send signals asynchronously if !preemptible BPF programs can execute in all kinds of contexts and when a program running in a non-preemptible context uses the bpf_send_signal() kfunc, it…
-
Unscored —
nilfs2: fix possible int overflows in nilfs_fiemap()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix possible int overflows in nilfs_fiemap() Since nilfs_bmap_lookup_contig() in nilfs_fiemap() calculates its result by being prepared to go through potentially maxblocks == INT_MAX …
-
Unscored —
wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() On removal of the device or unloading of the kernel module a potential NULL pointer dereference occurs. The following sequen…
-
Unscored —
blk-cgroup: Fix class @block_class's subsystem refcount leakage
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blkcg_fill_root_iostats() iterates over @block_class's devices by class_dev_iter_(init|next)(), but does not end iterating with…
-
Unscored —
net: rose: lock the socket in rose_bind()
In the Linux kernel, the following vulnerability has been resolved: net: rose: lock the socket in rose_bind() syzbot reported a soft lockup in rose_loopback_timer(), with a repro calling bind() from multiple threads. rose_bind() must lock the socket to avoid …
-
Unscored —
clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context
In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context The following bug report happened with a PREEMPT_RT kernel: BUG: sleeping function called from invalid c…
-
Unscored —
USB: hub: Ignore non-compliant devices with too many configs or interfaces
In the Linux kernel, the following vulnerability has been resolved: USB: hub: Ignore non-compliant devices with too many configs or interfaces Robert Morris created a test program which can cause usb_hub_to_struct_hub() to dereference a NULL or inappropriate …
-
Unscored —
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel Advertise support for Hyper-V's SEND_IPI and SEND_IPI_EX hypercalls if and only if the local API is emulated/virtu…
-
Unscored —
batman-adv: fix panic during interface removal
In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix panic during interface removal Reference counting is used to ensure that batadv_hardif_neigh_node and batadv_hard_iface are not freed before/during batadv_v_elp_throughput_met…
-
Unscored —
orangefs: fix a oob in orangefs_debug_write
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix a oob in orangefs_debug_write I got a syzbot report: slab-out-of-bounds Read in orangefs_debug_write... several people suggested fixes, I tested Al Viro's suggestion and made th…
-
Unscored —
team: better TEAM_OPTION_TYPE_STRING validation
In the Linux kernel, the following vulnerability has been resolved: team: better TEAM_OPTION_TYPE_STRING validation syzbot reported following splat [1] Make sure user-provided data contains one nul byte. [1] BUG: KMSAN: uninit-value in string_nocheck lib/vspr…
-
Unscored —
net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns()
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65_cpsw_nuss_remove_tx_chns() When getting the IRQ we use k3_udma_glue_tx_get_irq() which returns negative error value on error. So not NULL…
-
Unscored —
net: hns3: fix oops when unload drivers paralleling
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix oops when unload drivers paralleling When unload hclge driver, it tries to disable sriov first for each ae_dev node from hnae3_ae_dev_list. If user unloads hns3 driver at the t…
-
Unscored —
net: let net.core.dev_weight always be non-zero
In the Linux kernel, the following vulnerability has been resolved: net: let net.core.dev_weight always be non-zero The following problem was encountered during stability test: (NULL net_device): NAPI poll function process_backlog+0x0/0x530 \ returned 1, exce…
-
Unscored —
ptp: Ensure info->enable callback is always set
In the Linux kernel, the following vulnerability has been resolved: ptp: Ensure info->enable callback is always set The ioctl and sysfs handlers unconditionally call the ->enable callback. Not all drivers implement that callback, leading to NULL dereferences.…
-
Unscored —
tty: xilinx_uartps: split sysrq handling
In the Linux kernel, the following vulnerability has been resolved: tty: xilinx_uartps: split sysrq handling lockdep detects the following circular locking dependency: CPU 0 CPU 1 ========================== ============================ cdns_uart_isr() printk(…
-
Unscored —
usb: gadget: f_midi: fix MIDI Streaming descriptor lengths
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_midi: fix MIDI Streaming descriptor lengths While the MIDI jacks are configured correctly, and the MIDIStreaming endpoint descriptors are filled with the correct information, b…
-
Unscored —
tee: optee: Fix supplicant wait loop
In the Linux kernel, the following vulnerability has been resolved: tee: optee: Fix supplicant wait loop OP-TEE supplicant is a user-space daemon and it's possible for it be hung or crashed or killed in the middle of processing an OP-TEE RPC call. It becomes …
-
Unscored —
usbnet: gl620a: fix endpoint checking in genelink_bind()
In the Linux kernel, the following vulnerability has been resolved: usbnet: gl620a: fix endpoint checking in genelink_bind() Syzbot reports [1] a warning in usb_submit_urb() triggered by inconsistencies between expected and actually present endpoints in gl620…
-
Unscored —
i2c: npcm: disable interrupt enable bit before devm_request_irq
In the Linux kernel, the following vulnerability has been resolved: i2c: npcm: disable interrupt enable bit before devm_request_irq The customer reports that there is a soft lockup issue related to the i2c driver. After checking, the i2c module was doing a tx…
-
Unscored —
wifi: nl80211: reject cooked mode if it is set along with other flags
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to set both MONITOR_FLAG_COOK_FRAMES and MONITOR_FLAG_ACTIVE flags simultaneously on the same monitor inte…
-
Unscored —
wifi: cfg80211: regulatory: improve invalid hints checking
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issue [1] that occurs when erroneous symbols sent from userspace get through into user_alpha2[] via regula…
-
Unscored —
gpio: rcar: Use raw_spinlock to protect register access
In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use raw_spinlock to protect register access Use raw_spinlock in order to fix spurious messages about invalid context when spinlock debugging is enabled. The lock is only used to s…
-
Unscored —
usb: atm: cxacru: fix a flaw in existing endpoint checks
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix a flaw in existing endpoint checks Syzbot once again identified a flaw in usb endpoint checking, see [1]. This time the issue stems from a commit authored by me (2eabb65…
-
Unscored —
llc: do not use skb_get() before dev_queue_xmit()
In the Linux kernel, the following vulnerability has been resolved: llc: do not use skb_get() before dev_queue_xmit() syzbot is able to crash hosts [1], using llc and devices not supporting IFF_TX_SKB_SHARING. In this case, e1000 driver calls eth_skb_pad(), w…
-
Unscored —
rapidio: add check for rio_add_net() in rio_scan_alloc_net()
In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rio_add_net() in rio_scan_alloc_net() The return value of rio_add_net() should be checked. If it fails, put_device() should be called to free the memory and give up the…
-
Unscored —
drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl
In the Linux kernel, the following vulnerability has been resolved: drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctl In the "pmcmd_ioctl" function, three memory objects allocated by kmalloc are initialized by "hcall_get_cpu_state", whic…
-
Unscored —
drm/amd/display: Assign normalized_pix_clk when color depth = 14
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign normalized_pix_clk when color depth = 14 [WHY & HOW] A warning message "WARNING: CPU: 4 PID: 459 at ... /dc_resource.c:3397 calculate_phy_pix_clks+0xef/0x100 [amdgpu]"…
-
Unscored —
net/mlx5: handle errors in mlx5_chains_create_table()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: handle errors in mlx5_chains_create_table() In mlx5_chains_create_table(), the return value of mlx5_get_fdb_sub_ns() and mlx5_get_flow_namespace() must be checked to prevent NULL po…
-
Unscored —
HID: ignore non-functional sensor in HP 5MP Camera
In the Linux kernel, the following vulnerability has been resolved: HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) reports a HID sensor interface that is not actually implemented. Attempting to access this non-function…
-
Unscored —
regulator: check that dummy regulator has been probed before using it
In the Linux kernel, the following vulnerability has been resolved: regulator: check that dummy regulator has been probed before using it Due to asynchronous driver probing there is a chance that the dummy regulator hasn't already been probed when first acces…
-
Unscored —
RDMA/hns: Fix soft lockup during bt pages loop
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix soft lockup during bt pages loop Driver runs a for-loop when allocating bt pages and mapping them with buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated,…
-
Unscored —
soc: qcom: pdr: Fix the potential deadlock
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: Fix the potential deadlock When some client process A call pdr_add_lookup() to add the look up for the service and does schedule locator work, later a process B got a new serv…
-
Unscored —
usbnet:fix NPE during rx_complete
In the Linux kernel, the following vulnerability has been resolved: usbnet:fix NPE during rx_complete Missing usbnet_going_away Check in Critical Path. The usb_submit_urb function lacks a usbnet_going_away validation, whereas __usbnet_queue_skb includes this …
-
Unscored —
net: mvpp2: Prevent parser TCAM memory corruption
In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: Prevent parser TCAM memory corruption Protect the parser TCAM/SRAM memory, and the cached (shadow) SRAM information, from concurrent modifications. Both the TCAM and SRAM tables a…
-
Unscored —
spufs: fix a leak in spufs_create_context()
In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak in spufs_create_context() Leak fixes back in 2008 missed one case - if we are trying to set affinity and spufs_mkdir() fails, we need to drop the reference to neighbor.
-
Unscored —
spufs: fix a leak on spufs_new_file() failure
In the Linux kernel, the following vulnerability has been resolved: spufs: fix a leak on spufs_new_file() failure It's called from spufs_fill_dir(), and caller of that will do spufs_rmdir() in case of failure. That does remove everything we'd managed to creat…
-
Unscored —
rtnetlink: Allocate vfinfo size for VF GUIDs when supported
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Allocate vfinfo size for VF GUIDs when supported Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs") added support for getting VF port and node GUIDs in netlink ifin…
-
Unscored —
watch_queue: fix pipe accounting mismatch
In the Linux kernel, the following vulnerability has been resolved: watch_queue: fix pipe accounting mismatch Currently, watch_queue_set_size() modifies the pipe buffers charged to user->pipe_bufs without updating the pipe->nr_accounted on the pipe itself, du…
-
Unscored —
ASoC: ops: Consistently treat platform_max as control value
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Consistently treat platform_max as control value This reverts commit 9bdd10d57a88 ("ASoC: ops: Shift tested values in snd_soc_put_volsw() by +min"), and makes some additional relat…
-
Unscored —
objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds()
In the Linux kernel, the following vulnerability has been resolved: objtool, media: dib8000: Prevent divide-by-zero in dib8000_set_dds() If dib8000_set_dds()'s call to dib8000_read32() returns zero, the result is a divide-by-zero. Prevent that from happening.…
-
Unscored —
ksmbd: use aead_request_free to match aead_request_alloc
In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto da…
-
Unscored —
net_sched: skbprio: Remove overly strict queue assertions
In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions In the current implementation, skbprio enqueue/dequeue contains an assertion that fails under certain conditions when SKBPRIO is used…
References
-
report
https://ubuntu.com/security/CVE-2022-49636
-
report
https://ubuntu.com/security/CVE-2022-49728
-
report
https://ubuntu.com/security/CVE-2023-52664
-
report
https://ubuntu.com/security/CVE-2023-52927
-
report
https://ubuntu.com/security/CVE-2023-53034
-
report
https://ubuntu.com/security/CVE-2024-8805
-
report
https://ubuntu.com/security/CVE-2024-26982
-
report
https://ubuntu.com/security/CVE-2024-36945
-
report
https://ubuntu.com/security/CVE-2024-42230
-
report
https://ubuntu.com/security/CVE-2024-46753
-
report
https://ubuntu.com/security/CVE-2024-46812
-
report
https://ubuntu.com/security/CVE-2024-46821
-
report
https://ubuntu.com/security/CVE-2024-47726
-
report
https://ubuntu.com/security/CVE-2024-53144
-
report
https://ubuntu.com/security/CVE-2024-53168
-
report
https://ubuntu.com/security/CVE-2024-56551
-
report
https://ubuntu.com/security/CVE-2024-56599
-
report
https://ubuntu.com/security/CVE-2024-56608
-
report
https://ubuntu.com/security/CVE-2024-56664
-
report
https://ubuntu.com/security/CVE-2024-56721
-
report
https://ubuntu.com/security/CVE-2024-57834
-
report
https://ubuntu.com/security/CVE-2024-57973
-
report
https://ubuntu.com/security/CVE-2024-57977
-
report
https://ubuntu.com/security/CVE-2024-57978
-
report
https://ubuntu.com/security/CVE-2024-57979
-
report
https://ubuntu.com/security/CVE-2024-57980
-
report
https://ubuntu.com/security/CVE-2024-57981
-
report
https://ubuntu.com/security/CVE-2024-57986
-
report
https://ubuntu.com/security/CVE-2024-58001
-
report
https://ubuntu.com/security/CVE-2024-58002
-
report
https://ubuntu.com/security/CVE-2024-58005
-
report
https://ubuntu.com/security/CVE-2024-58007
-
report
https://ubuntu.com/security/CVE-2024-58010
-
report
https://ubuntu.com/security/CVE-2024-58014
-
report
https://ubuntu.com/security/CVE-2024-58016
-
report
https://ubuntu.com/security/CVE-2024-58017
-
report
https://ubuntu.com/security/CVE-2024-58020
-
report
https://ubuntu.com/security/CVE-2024-58034
-
report
https://ubuntu.com/security/CVE-2024-58051