Summary
Demi Marie Obenour and Simon Gaiser discovered that several Xen para-
virtualization device frontends did not properly restrict the access rights
of device backends. An attacker could possibly use a malicious Xen backend
to gain access to memory pages of a guest VM or cause a denial of service
in the guest. (CVE-2022-23037)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- GPU drivers;
- IIO ADC drivers;
- Multiple devices driver;
- Ethernet bonding driver;
- Network drivers;
- PCI subsystem;
- VFIO drivers;
- File systems infrastructure;
- F2FS file system;
- JFS file system;
- Network file system (NFS) server daemon;
- OCFS2 file system;
- Overlay file system;
- Tracing infrastructure;
- IUCV driver;
(CVE-2021-47633, CVE-2022-49058, CVE-2022-49170, CVE-2023-52784,
CVE-2024-53194, CVE-2024-53210, CVE-2024-53214, CVE-2024-56570,
CVE-2024-56616, CVE-2024-56763, CVE-2024-56779, CVE-2024-57904,
CVE-2025-21664, CVE-2025-38604, CVE-2025-39743, CVE-2026-43456,
CVE-2026-74350)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | linux-aws | 4.4.0-1162.168 |
Vulnerabilities 18
-
Critical 9.8
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files rem…
-
Critical 9.8
ocfs2: validate fast symlink target during inode read
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the files…
-
Critical 9.1
cifs: potential buffer overflow in handling symlinks
In the Linux kernel, the following vulnerability has been resolved: cifs: potential buffer overflow in handling symlinks Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max…
-
High 7.8
f2fs: fix to do sanity check on curseg->alloc_type
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on curseg->alloc_type As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215657 - Overview UBSAN: array-index-out-of-bounds in fs/f2…
-
High 7.8
PCI: Fix use-after-free of slot->bus on hot remove
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free of slot->bus on hot remove Dennis reports a boot crash on recent Lenovo laptops with a USB4 dock. Since commit 0fc70886569c ("thunderbolt: Reset USB4 v2 host router") …
-
High 7.8
vfio/pci: Properly hide first-in-list PCIe extended capability
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Properly hide first-in-list PCIe extended capability There are cases where a PCIe extended capability should be hidden from the user. For example, an unknown capability (i.e., capab…
-
High 7.8
dm thin: make get_first_thin use rcu-safe list first function
In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty(…
-
High 7.8
wifi: rtl818x: Kill URBs before clearing tx status queue
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Kill URBs before clearing tx status queue In rtl8187_stop() move the call of usb_kill_anchored_urbs() before clearing b_tx_status.queue. This change prevents callbacks from usi…
-
High 7.8
bonding: fix type confusion in bond_setup_by_slave()
In the Linux kernel, the following vulnerability has been resolved: bonding: fix type confusion in bond_setup_by_slave() kernel BUG at net/core/skbuff.c:2306! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:pskb_expand_head+0xa08/0xfe0 net/core/skbu…
-
Medium 5.5
s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()
In the Linux kernel, the following vulnerability has been resolved: s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() Passing MSG_PEEK flag to skb_recv_datagram() increments skb refcount (skb->users) and iucv_sock_recvmsg() does not decrement skb…
-
Unscored —
ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
In the Linux kernel, the following vulnerability has been resolved: ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 The bug was found during fuzzing. Stacktrace locates it in ath5k_eeprom_convert_pcal_info_5111. When none of the curve is selected in the lo…
-
Unscored —
Linux PV device frontends vulnerable to attacks by backends T[his CNA information record relates to multiple CVEs; the …
-
Unscored —
bonding: stop the device in bond_setup_by_slave()
In the Linux kernel, the following vulnerability has been resolved: bonding: stop the device in bond_setup_by_slave() Commit 9eed321cde22 ("net: lapbether: only support ethernet devices") has been able to keep syzbot away from net/lapb, until today. In the fo…
-
Unscored —
ovl: Filter invalid inodes with missing lookup function
In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is imp…
-
Unscored —
drm/dp_mst: Fix MST sideband message body length check
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix MST sideband message body length check Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC (aka message data CRC)…
-
Unscored —
tracing: Prevent bad count for tracing_cpumask_write
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.
-
Unscored —
iio: adc: at91: call input_free_device() on allocated iio_dev
In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91: call input_free_device() on allocated iio_dev Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached bef…
-
Unscored —
jfs: truncate good inode pages when hard link is 0
In the Linux kernel, the following vulnerability has been resolved: jfs: truncate good inode pages when hard link is 0 The fileset value of the inode copy from the disk by the reproducer is AGGR_RESERVED_I. When executing evict, its hard link number is 0, so …
References
-
report
https://ubuntu.com/security/CVE-2021-47633
-
report
https://ubuntu.com/security/CVE-2022-23037
-
report
https://ubuntu.com/security/CVE-2022-49058
-
report
https://ubuntu.com/security/CVE-2022-49170
-
report
https://ubuntu.com/security/CVE-2023-52784
-
report
https://ubuntu.com/security/CVE-2024-53194
-
report
https://ubuntu.com/security/CVE-2024-53210
-
report
https://ubuntu.com/security/CVE-2024-53214
-
report
https://ubuntu.com/security/CVE-2024-56570
-
report
https://ubuntu.com/security/CVE-2024-56616
-
report
https://ubuntu.com/security/CVE-2024-56763
-
report
https://ubuntu.com/security/CVE-2024-56779
-
report
https://ubuntu.com/security/CVE-2024-57904
-
report
https://ubuntu.com/security/CVE-2025-21664
-
report
https://ubuntu.com/security/CVE-2025-38604
-
report
https://ubuntu.com/security/CVE-2025-39743
-
report
https://ubuntu.com/security/CVE-2026-43456
-
report
https://ubuntu.com/security/CVE-2026-74350