Skip to content
OpenAdvisories

Summary

Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen und um nicht nähere beschriebene Effekte zu verursachen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 124

  • Critical 9.8

    nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure

    In the Linux kernel, the following vulnerability has been resolved: nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure On error situation `clp->cl_cb_conn.cb_xprt` should not be given a reference to the xprt otherwise both client cleanup and t…

  • Critical 9.8

    NFSD: Protect against send buffer overflow in NFSv2 READ

    In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READ Since before the git era, NFSD has conserved the number of pages held by each nfsd thread by combining the RPC receive and send buffer…

  • Critical 9.8

    net/smc: Reset connection when trying to use SMCRv2 fails.

    In the Linux kernel, the following vulnerability has been resolved: net/smc: Reset connection when trying to use SMCRv2 fails. We found a crash when using SMCRv2 with 2 Mellanox ConnectX-4. It can be reproduced by: - smc_run nginx - smc_run wrk -t 32 -c 500 -…

  • High 8.8

    Bluetooth: L2CAP: Fix user-after-free

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix user-after-free This uses l2cap_chan_hold_unless_zero() after calling __l2cap_get_chan_blah() to prevent the following trace: Bluetooth: l2cap_core.c:static void l2cap_c…

  • High 8.8

    wifi: mac80211: fix use-after-free

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix use-after-free We've already freed the assoc_data at this point, so need to use another copy of the AP (MLD) address instead.

  • High 8.8

    Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times device_add shall not be called multiple times as stated in its documentation: 'Do not call this routine or device_regist…

  • High 8.8

    Bluetooth: hci_conn: fail SCO/ISO via hci_conn_failed if ACL gone early

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: fail SCO/ISO via hci_conn_failed if ACL gone early Not calling hci_(dis)connect_cfm before deleting conn referred to by a socket generally results to use-after-free. When…

  • High 8.8

    scsi: ses: Handle enclosure with just a primary component gracefully

    In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Handle enclosure with just a primary component gracefully This reverts commit 3fe97ff3d949 ("scsi: ses: Don't attach if enclosure has no components") and introduces proper handling…

  • High 8.8

    firewire: net: fix use after free in fwnet_finish_incoming_packet()

    In the Linux kernel, the following vulnerability has been resolved: firewire: net: fix use after free in fwnet_finish_incoming_packet() The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

  • High 8.2

    sctp: fix a potential overflow in sctp_ifwdtsn_skip

    In the Linux kernel, the following vulnerability has been resolved: sctp: fix a potential overflow in sctp_ifwdtsn_skip Currently, when traversing ifwdtsn skips with _sctp_walk_ifwdtsn, it only checks the pos against the end of the chunk. However, the data le…

  • High 7.8

    drm/meson: reorder driver deinit sequence to fix use-after-free bug

    In the Linux kernel, the following vulnerability has been resolved: drm/meson: reorder driver deinit sequence to fix use-after-free bug Unloading the driver triggers the following KASAN warning: [ +0.006275] ===================================================…

  • High 7.8

    staging: vme_user: Fix possible UAF in tsi148_dma_list_add

    In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: Fix possible UAF in tsi148_dma_list_add Smatch report warning as follows: drivers/staging/vme_user/vme_tsi148.c:1757 tsi148_dma_list_add() warn: '&entry->list' not removed …

  • High 7.8

    drm/amdgpu: SDMA update use unlocked iterator

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: SDMA update use unlocked iterator SDMA update page table may be called from unlocked context, this generate below warning. Use unlocked iterator to handle this case. WARNING: CPU:…

  • High 7.8

    i2c: ismt: Fix an out-of-bounds bug in ismt_access()

    In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The …

  • High 7.8

    media: atomisp: prevent integer overflow in sh_css_set_black_frame()

    In the Linux kernel, the following vulnerability has been resolved: media: atomisp: prevent integer overflow in sh_css_set_black_frame() The "height" and "width" values come from the user so the "height * width" multiplication can overflow.

  • High 7.8

    net/tunnel: wait until all sk_user_data reader finish before releasing the sock

    In the Linux kernel, the following vulnerability has been resolved: net/tunnel: wait until all sk_user_data reader finish before releasing the sock There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possi…

  • High 7.8

    iomap: iomap: fix memory corruption when recording errors during writeback

    In the Linux kernel, the following vulnerability has been resolved: iomap: iomap: fix memory corruption when recording errors during writeback Every now and then I see this crash on arm64: Unable to handle kernel NULL pointer dereference at virtual address 00…

  • High 7.8

    wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit()

    In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() > ret = brcmf_proto_tx_queue_data(drvr, ifp->ifidx, skb); may be schedule, and then complete before the line > ndev->stats.…

  • High 7.8

    ACPICA: Fix error code path in acpi_ds_call_control_method()

    In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix error code path in acpi_ds_call_control_method() A use-after-free in acpi_ps_parse_aml() after a failing invocaion of acpi_ds_call_control_method() is reported by KASAN [1] and co…

  • High 7.8

    drm: bridge: adv7511: unregister cec i2c device after cec adapter

    In the Linux kernel, the following vulnerability has been resolved: drm: bridge: adv7511: unregister cec i2c device after cec adapter cec_unregister_adapter() assumes that the underlying adapter ops are callable. For example, if the CEC adapter currently has …

  • High 7.8

    drm/panfrost: Fix GEM handle creation ref-counting

    In the Linux kernel, the following vulnerability has been resolved: drm/panfrost: Fix GEM handle creation ref-counting panfrost_gem_create_with_handle() previously returned a BO but with the only reference being from the handle, which user space could in theo…

  • High 7.8

    crypto: seqiv - Handle EBUSY correctly

    In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Handle EBUSY correctly As it is seqiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…

  • High 7.8

    scsi: mpi3mr: Use number of bits to manage bitmap sizes

    In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Use number of bits to manage bitmap sizes To allocate bitmaps, the mpi3mr driver calculates sizes of bitmaps using byte as unit. However, bitmap helper functions assume that bit…

  • High 7.8

    cifs: prevent use-after-free by freeing the cfile later

    In the Linux kernel, the following vulnerability has been resolved: cifs: prevent use-after-free by freeing the cfile later In smb2_compound_op we have a possible use-after-free which can cause hard to debug problems later on. This was revealed during stress …

  • High 7.8

    drm/i915/dpt: Treat the DPT BO as a framebuffer

    In the Linux kernel, the following vulnerability has been resolved: drm/i915/dpt: Treat the DPT BO as a framebuffer Currently i915_gem_object_is_framebuffer() doesn't treat the BO containing the framebuffer's DPT as a framebuffer itself. This means eg. that t…

  • High 7.8

    Bluetooth: Fix potential use-after-free when clear keys

    In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix potential use-after-free when clear keys Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu(…

  • High 7.8

    scsi: ufs: core: Fix device management cmd timeout flow

    In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix device management cmd timeout flow In the UFS error handling flow, the host will send a device management cmd (NOP OUT) to the device for link recovery. If this cmd times…

  • High 7.8

    drm/mediatek: Clean dangling pointer on bind error path

    In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Clean dangling pointer on bind error path mtk_drm_bind() can fail, in which case drm_dev_put() is called, destroying the drm_device object. However a pointer to it was still bei…

  • High 7.8

    net/mlx5e: xsk: Fix crash on regular rq reactivation

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix crash on regular rq reactivation When the regular rq is reactivated after the XSK socket is closed it could be reading stale cqes which eventually corrupts the rq. This le…

  • High 7.8

    ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer

    In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5 According to the ACPI specification 19.6.134, no argument is required to be passed for …

  • High 7.8

    mlx5: fix possible ptp queue fifo use-after-free

    In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possib…

  • High 7.8

    xsk: Fix xsk_diag use-after-free error during socket cleanup

    In the Linux kernel, the following vulnerability has been resolved: xsk: Fix xsk_diag use-after-free error during socket cleanup Fix a use-after-free error that is possible if the xsk_diag interface is used after the socket has been unbound from the device. T…

  • High 7.8

    cifs: Fix warning and UAF when destroy the MR list

    In the Linux kernel, the following vulnerability has been resolved: cifs: Fix warning and UAF when destroy the MR list If the MR allocate failed, the MR recovery work not initialized and list not cleared. Then will be warning and UAF when release the MR: WARN…

  • High 7.8

    btrfs: don't check PageError in __extent_writepage

    In the Linux kernel, the following vulnerability has been resolved: btrfs: don't check PageError in __extent_writepage __extent_writepage currenly sets PageError whenever any error happens, and the also checks for PageError to decide if to call error handling…

  • High 7.8

    nilfs2: fix sysfs interface lifetime

    In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix sysfs interface lifetime The current nilfs2 sysfs support has issues with the timing of creation and deletion of sysfs entries, potentially leading to null pointer dereferences, u…

  • High 7.8

    net: qrtr: Fix a refcount bug in qrtr_recvmsg()

    In the Linux kernel, the following vulnerability has been resolved: net: qrtr: Fix a refcount bug in qrtr_recvmsg() Syzbot reported a bug as following: refcount_t: addition on 0; use-after-free. ... RIP: 0010:refcount_warn_saturate+0x17c/0x1f0 lib/refcount.c:…

  • High 7.8

    PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free

    In the Linux kernel, the following vulnerability has been resolved: PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free Struct pcie_link_state->downstream is a pointer to the pci_dev of function 0. Previously we retained that pointer when r…

  • High 7.5

    NFSD: fix leaked reference count of nfsd4_ssc_umount_item

    In the Linux kernel, the following vulnerability has been resolved: NFSD: fix leaked reference count of nfsd4_ssc_umount_item The reference count of nfsd4_ssc_umount_item is not decremented on error conditions. This prevents the laundromat from unmounting the…

  • High 7.5

    ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem()

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() If share is , share->path is NULL and it cause NULL pointer dereference issue.

  • High 7.1

    ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr()

    In the Linux kernel, the following vulnerability has been resolved: ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() Here is a BUG report from syzbot: BUG: KASAN: slab-out-of-bounds in ntfs_list_ea fs/ntfs3/xattr.c:191 [inline] BUG: KASAN: …

  • Medium 5.5

    tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown

    In the Linux kernel, the following vulnerability has been resolved: tty: serial: fsl_lpuart: disable dma rx/tx use flags in lpuart_dma_shutdown lpuart_dma_shutdown tears down lpuart dma, but lpuart_flush_buffer can still occur which in turn tries to access dm…

  • Medium 5.5

    orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()

    In the Linux kernel, the following vulnerability has been resolved: orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init() When insert and remove the orangefs module, there are memory leaked as below: unreferenced object 0xffff88816b0cc000 (size 2048…

  • Medium 5.5

    mm: /proc/pid/smaps_rollup: fix no vma's null-deref

    In the Linux kernel, the following vulnerability has been resolved: mm: /proc/pid/smaps_rollup: fix no vma's null-deref Commit 258f669e7e88 ("mm: /proc/pid/smaps_rollup: convert to single value seq_file") introduced a null-deref if there are no vma's in the t…

  • Medium 5.5

    md: fix a crash in mempool_free

    In the Linux kernel, the following vulnerability has been resolved: md: fix a crash in mempool_free There's a crash in mempool_free when running the lvm test shell/lvchange-rebuild-raid.sh. The reason for the crash is this: * super_written calls atomic_dec_an…

  • Medium 5.5

    padata: Always leave BHs disabled when running ->parallel()

    In the Linux kernel, the following vulnerability has been resolved: padata: Always leave BHs disabled when running ->parallel() A deadlock can happen when an overloaded system runs ->parallel() in the context of the current task: padata_do_parallel ->parallel…

  • Medium 5.5

    media: mediatek: vcodec: Can't set dst buffer to done when lat decode error

    In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Can't set dst buffer to done when lat decode error Core thread will call v4l2_m2m_buf_done to set dst buffer done for lat architecture. If lat call v4l2_m2m_buf_done_…

  • Medium 5.5

    NFS: Fix an Oops in nfs_d_automount()

    In the Linux kernel, the following vulnerability has been resolved: NFS: Fix an Oops in nfs_d_automount() When mounting from a NFSv4 referral, path->dentry can end up being a negative dentry, so derive the struct nfs_server from the dentry itself instead.

  • Medium 5.5

    net: hinic: fix the issue of CMDQ memory leaks

    In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix the issue of CMDQ memory leaks When hinic_set_cmdq_depth() fails in hinic_init_cmdqs(), the cmdq memory is not released correctly. Fix it.

  • Medium 5.5

    nvme: fix multipath crash caused by flush request when blktrace is enabled

    In the Linux kernel, the following vulnerability has been resolved: nvme: fix multipath crash caused by flush request when blktrace is enabled The flush request initialized by blk_kick_flush has NULL bio, and it may be dealt with nvme_end_req during io comple…

  • Medium 5.5

    tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak

    In the Linux kernel, the following vulnerability has been resolved: tpm: tpm_crb: Add the missed acpi_put_table() to fix memory leak In crb_acpi_add(), we get the TPM2 table to retrieve information like start method, and then assign them to the priv data, so …

  • Medium 5.5

    drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED

    In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix undefined behavior in bit shift for TTM_TT_FLAG_PRIV_POPULATED Shifting signed 32-bit value by 31 bits is undefined, so changing significant bit to unsigned. The UBSAN warning ca…

  • Medium 5.5

    mm/mempolicy: fix memory leak in set_mempolicy_home_node system call

    In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix memory leak in set_mempolicy_home_node system call When encountering any vma in the range with policy other than MPOL_BIND or MPOL_PREFERRED_MANY, an error is returned witho…

  • Medium 5.5

    ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe()

    In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8183: fix refcount leak in mt8183_mt6358_ts3a227_max98357_dev_probe() The node returned by of_parse_phandle() with refcount incremented, of_node_put() needs be called when f…

  • Medium 5.5

    integrity: Fix memory leakage in keyring allocation error path

    In the Linux kernel, the following vulnerability has been resolved: integrity: Fix memory leakage in keyring allocation error path Key restriction is allocated in integrity_init_keyring(). However, if keyring allocation failed, it is not freed, causing memory…

  • Medium 5.5

    net: sched: fix memory leak in tcindex_set_parms

    In the Linux kernel, the following vulnerability has been resolved: net: sched: fix memory leak in tcindex_set_parms Syzkaller reports a memory leak as follows: ==================================== BUG: memory leak unreferenced object 0xffff88810c287f00 (size…

  • Medium 5.5

    drm/msm/dp: add atomic_check to bridge ops

    In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: add atomic_check to bridge ops DRM commit_tails() will disable downstream crtc/encoder/bridge if both disable crtc is required and crtc->active is set before pushing a new frame d…

  • Medium 5.5

    staging: greybus: audio_helper: remove unused and wrong debugfs usage

    In the Linux kernel, the following vulnerability has been resolved: staging: greybus: audio_helper: remove unused and wrong debugfs usage In the greybus audio_helper code, the debugfs file for the dapm has the potential to be removed and memory will be leaked…

  • Medium 5.5

    drivers/md/md-bitmap: check the return value of md_bitmap_get_counter()

    In the Linux kernel, the following vulnerability has been resolved: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() Check the return value of md_bitmap_get_counter() in case it returns NULL pointer, which will result in a null pointer …

  • Medium 5.5

    fbdev: fbcon: release buffer when fbcon_do_set_font() failed

    In the Linux kernel, the following vulnerability has been resolved: fbdev: fbcon: release buffer when fbcon_do_set_font() failed syzbot is reporting memory leak at fbcon_do_set_font() [1], for commit a5a923038d70 ("fbdev: fbcon: Properly revert changes when v…

  • Medium 5.5

    crypto: hisilicon/qm - increase the memory of local variables

    In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/qm - increase the memory of local variables Increase the buffer to prevent stack overflow by fuzz test. The maximum length of the qos configuration buffer is 256 bytes. Curr…

  • Medium 5.5

    scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails

    In the Linux kernel, the following vulnerability has been resolved: scsi: fcoe: Fix transport not deattached when fcoe_if_init() fails fcoe_init() calls fcoe_transport_attach(&fcoe_sw_transport), but when fcoe_if_init() fails, &fcoe_sw_transport is not detach…

  • Medium 5.5

    parisc: led: Fix potential null-ptr-deref in start_task()

    In the Linux kernel, the following vulnerability has been resolved: parisc: led: Fix potential null-ptr-deref in start_task() start_task() calls create_singlethread_workqueue() and not checked the ret value, which may return NULL. And a null-ptr-deref may hap…

  • Medium 5.5

    irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init()

    In the Linux kernel, the following vulnerability has been resolved: irqchip/wpcm450: Fix memory leak in wpcm450_aic_of_init() If of_iomap() failed, 'aic' should be freed before return. Otherwise there is a memory leak.

  • Medium 5.5

    wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register()

    In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() mhi_alloc_controller() allocates a memory space for mhi_ctrl. When gets some error, mhi_ctrl should be freed with mhi_fre…

  • Medium 5.5

    net: dcb: choose correct policy to parse DCB_ATTR_BCN

    In the Linux kernel, the following vulnerability has been resolved: net: dcb: choose correct policy to parse DCB_ATTR_BCN The dcbnl_bcn_setcfg uses erroneous policy to parse tb[DCB_ATTR_BCN], which is introduced in commit 859ee3c43812 ("DCB: Add support for D…

  • Medium 5.5

    drm/amdgpu: fix memory leak in mes self test

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix memory leak in mes self test The fences associated with mes queue have to be freed up during amdgpu_ring_fini.

  • Medium 5.5

    net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create

    In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix memory leak in mlx5e_fs_tt_redirect_any_create The memory pointed to by the fs->any pointer is not freed in the error path of mlx5e_fs_tt_redirect_any_create, which can lead to…

  • Medium 5.5

    tracing: Free error logs of tracing instances

    In the Linux kernel, the following vulnerability has been resolved: tracing: Free error logs of tracing instances When a tracing instance is removed, the error messages that hold errors that occurred in the instance needs to be freed. The following reports a …

  • Medium 5.5

    usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe()

    In the Linux kernel, the following vulnerability has been resolved: usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() Smatch reports: drivers/usb/phy/phy-tahvo.c: tahvo_usb_probe() warn: missing unwind goto? After geting irq, if ret < 0, it will retur…

  • Medium 5.5

    md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request

    In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request There are two check of 'mreplace' in raid10_sync_request(). In the first check, 'need_replace' will be set and 'mreplace' will…

  • Medium 5.5

    irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4

    In the Linux kernel, the following vulnerability has been resolved: irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 The T241 platform suffers from the T241-FABRIC-4 erratum which causes unexpected behavior in the GIC when multiple transactions are …

  • Medium 5.5

    wifi: mwifiex: avoid possible NULL skb pointer dereference

    In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: avoid possible NULL skb pointer dereference In 'mwifiex_handle_uap_rx_forward()', always check the value returned by 'skb_copy()' to avoid potential NULL pointer dereference in…

  • Medium 5.5

    media: mdp3: Fix resource leaks in of_find_device_by_node

    In the Linux kernel, the following vulnerability has been resolved: media: mdp3: Fix resource leaks in of_find_device_by_node Use put_device to release the object get through of_find_device_by_node, avoiding resource leaks.

  • Medium 5.5

    drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached

    In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: Only trigger DRM HPD events if bridge is attached The MediaTek DisplayPort interface bridge driver starts its interrupts as soon as its probed. However when the interrupts t…

  • Medium 5.5

    drivers: base: dd: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: drivers: base: dd: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things…

  • Medium 5.5

    shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs

    In the Linux kernel, the following vulnerability has been resolved: shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs As the ramfs-based tmpfs uses ramfs_init_fs_context() for the init_fs_context method, which allocates fc->s_fs_info, use ram…

  • Medium 5.5

    RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device

    In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device Currently, when mlx5_ib_get_hw_stats() is used for device (port_num = 0), there is a special handling in order to use the correct coun…

  • Medium 5.5

    ubifs: Fix memory leak in do_rename

    In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memory leak in do_rename If renaming a file in an encrypted directory, function fscrypt_setup_filename allocates memory for a file name. This name is never used, and before returni…

  • Medium 5.5

    modpost: fix off by one in is_executable_section()

    In the Linux kernel, the following vulnerability has been resolved: modpost: fix off by one in is_executable_section() The > comparison should be >= to prevent an out of bounds array access.

  • Medium 5.5

    ALSA: hda: Fix Oops by 9.1 surround channel names

    In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix Oops by 9.1 surround channel names get_line_out_pfx() may trigger an Oops by overflowing the static array with more than 8 channels. This was reported for MacBookPro 12,1 with …

  • Medium 5.5

    kernel/printk/index.c: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: kernel/printk/index.c: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make th…

  • Medium 5.5

    time/debug: Fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: time/debug: Fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simple…

  • Medium 5.5

    USB: fotg210: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: fotg210: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simp…

  • Medium 5.5

    USB: gadget: gr_udc: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: gadget: gr_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make thin…

  • Medium 5.5

    USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: gadget: pxa25x_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make …

  • Medium 5.5

    USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: gadget: pxa27x_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make …

  • Medium 5.5

    trace/blktrace: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: trace/blktrace: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things si…

  • Medium 5.5

    drivers: base: component: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: drivers: base: component: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make…

  • Medium 5.5

    USB: ULPI: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: ULPI: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler…

  • Medium 5.5

    PM: EM: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: PM: EM: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, j…

  • Medium 5.5

    USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: gadget: bcm63xx_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make…

  • Medium 5.5

    USB: isp116x: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: isp116x: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simp…

  • Medium 5.5

    scsi: snic: Fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simple…

  • Medium 5.5

    USB: dwc3: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: dwc3: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler…

  • Medium 5.5

    USB: isp1362: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: isp1362: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simp…

  • Medium 5.5

    USB: sl811: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: sl811: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simple…

  • Medium 5.5

    USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup()

    In the Linux kernel, the following vulnerability has been resolved: USB: gadget: lpc32xx_udc: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make…

  • Medium 5.5

    rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access

    In the Linux kernel, the following vulnerability has been resolved: rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access For kernels built with CONFIG_PREEMPT_RCU=y, the following scenario can result in a NULL-pointer dereference: CPU1 CPU2 rcu_preempt_…

  • Medium 5.5

    blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()

    In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() When blkg_alloc() is called to allocate a blkcg_gq structure with the associated blkg_iostat_set's, there are 2 fields…

  • Medium 5.5

    wifi: iwlwifi: fw: fix memory leak in debugfs

    In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fw: fix memory leak in debugfs Fix a memory leak that occurs when reading the fw_info file all the way, since we return NULL indicating no more data, but don't free the status …

  • Medium 5.5

    objtool: Fix memory leak in create_static_call_sections()

    In the Linux kernel, the following vulnerability has been resolved: objtool: Fix memory leak in create_static_call_sections() strdup() allocates memory for key_name. We need to release the memory in the following error paths. Add free() to avoid memory leak.

  • Medium 5.5

    clk: mediatek: fix of_iomap memory leak

    In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: fix of_iomap memory leak Smatch reports: drivers/clk/mediatek/clk-mtk.c:583 mtk_clk_simple_probe() warn: 'base' from of_iomap() not released on lines: 496. This problem was als…

  • Medium 5.5

    media: platform: mediatek: vpu: fix NULL ptr dereference

    In the Linux kernel, the following vulnerability has been resolved: media: platform: mediatek: vpu: fix NULL ptr dereference If pdev is NULL, then it is still dereferenced. This fixes this smatch warning: drivers/media/platform/mediatek/vpu/mtk_vpu.c:570 vpu_…

  • Medium 5.5

    powercap: arm_scmi: Remove recursion while parsing zones

    In the Linux kernel, the following vulnerability has been resolved: powercap: arm_scmi: Remove recursion while parsing zones Powercap zones can be defined as arranged in a hierarchy of trees and when registering a zone with powercap_register_zone(), the kerne…

  • Medium 5.5

    wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup

    In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup Fix device unregister memory leak and alway cleanup all configured rx queues in mt76_dma_tx_cleanup routine.

  • Medium 5.5

    net: add vlan_get_protocol_and_depth() helper

    In the Linux kernel, the following vulnerability has been resolved: net: add vlan_get_protocol_and_depth() helper Before blamed commit, pskb_may_pull() was used instead of skb_header_pointer() in __vlan_get_protocol() and friends. Few callers depended on skb-…

  • Medium 5.5

    remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores

    In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_dsp_rproc: Add custom memory copy implementation for i.MX DSP Cores The IRAM is part of the HiFi DSP. According to hardware specification only 32-bits write are allowed otherw…

  • Medium 5.5

    cassini: Fix a memory leak in the error handling path of cas_init_one()

    In the Linux kernel, the following vulnerability has been resolved: cassini: Fix a memory leak in the error handling path of cas_init_one() cas_saturn_firmware_init() allocates some memory using vmalloc(). This memory is freed in the .remove() function but no…

  • Medium 5.5

    scsi: snic: Fix possible memory leak if device_add() fails

    In the Linux kernel, the following vulnerability has been resolved: scsi: snic: Fix possible memory leak if device_add() fails If device_add() returns error, the name allocated by dev_set_name() needs be freed. As the comment of device_add() says, put_device(…

  • Medium 5.5

    media: uvcvideo: Handle cameras with invalid descriptors

    In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Handle cameras with invalid descriptors If the source entity does not contain any pads, do not create a link.

  • Medium 5.5

    x86/MCE: Always save CS register on AMD Zen IF Poison errors

    In the Linux kernel, the following vulnerability has been resolved: x86/MCE: Always save CS register on AMD Zen IF Poison errors The Instruction Fetch (IF) units on current AMD Zen-based systems do not guarantee a synchronous #MC is delivered for poison consu…

  • Medium 5.5

    net: skb_partial_csum_set() fix against transport header magic value

    In the Linux kernel, the following vulnerability has been resolved: net: skb_partial_csum_set() fix against transport header magic value skb->transport_header uses the special 0xFFFF value to mark if the transport header was set or not. We must prevent caller…

  • Medium 5.5

    bpf: cpumap: Fix memory leak in cpu_map_update_elem

    In the Linux kernel, the following vulnerability has been resolved: bpf: cpumap: Fix memory leak in cpu_map_update_elem Syzkaller reported a memory leak as follows: BUG: memory leak unreferenced object 0xff110001198ef748 (size 192): comm "syz-executor.3", pid…

  • Medium 5.5

    ice: Block switchdev mode when ADQ is active and vice versa

    In the Linux kernel, the following vulnerability has been resolved: ice: Block switchdev mode when ADQ is active and vice versa ADQ and switchdev are not supported simultaneously. Enabling both at the same time can result in nullptr dereference. To prevent th…

  • Medium 5.5

    mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak

    In the Linux kernel, the following vulnerability has been resolved: mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak In arizona_clk32k_enable(), we should use pm_runtime_resume_and_get() as pm_runtime_get_sync() will increase the refcnt ev…

  • Medium 5.5

    drm/ttm: fix bulk_move corruption when adding a entry

    In the Linux kernel, the following vulnerability has been resolved: drm/ttm: fix bulk_move corruption when adding a entry When the resource is the first in the bulk_move range, adding it again (thus moving it to the tail) will corrupt the list since the first…

  • Medium 4.7

    btrfs: fix race between quota enable and quota rescan ioctl

    In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race between quota enable and quota rescan ioctl When enabling quotas, at btrfs_quota_enable(), after committing the transaction, we change fs_info->quota_root to point to the quot…

  • Medium 4.7

    mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()

    In the Linux kernel, the following vulnerability has been resolved: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() KCSAN found an issue in obj_stock_flush_required(): stock->cached_objcg can be reset between the check and dereference: …

  • Medium 4.7

    f2fs: don't reset unchangable mount option in f2fs_remount()

    In the Linux kernel, the following vulnerability has been resolved: f2fs: don't reset unchangable mount option in f2fs_remount() syzbot reports a bug as below: general protection fault, probably for non-canonical address 0xdffffc0000000009: 0000 [#1] PREEMPT …

  • Unscored —
    CVE-2022-50377 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —
    CVE-2022-50397 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —
    CVE-2022-50403 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory

    In the Linux kernel, the following vulnerability has been resolved: net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory Fixes the below NULL pointer dereference: [...] [ 14.471200] Call Trace: [ 14.471562] <TASK> [ 14.471882] lock_acquire+…

  • Unscored —

    HID: intel-ish-hid: Fix kernel panic during warm reset

    In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix kernel panic during warm reset During warm reset device->fw_client is set to NULL. If a bus driver is registered after this NULL setting and before new firmware client…

Revision history

  1. #70

    Neue Updates von Ubuntu aufgenommen

  2. #69

    Neue Updates von Ubuntu aufgenommen

  3. #68

    Neue Updates von Debian aufgenommen

  4. #67

    Neue Updates von Ubuntu aufgenommen

  5. #66

    Neue Updates von Ubuntu aufgenommen

  6. #65

    Neue Updates von Debian aufgenommen

  7. #64

    Neue Updates von Red Hat aufgenommen

  8. #63

    Neue Updates von Red Hat aufgenommen

  9. #62

    Neue Updates von Ubuntu aufgenommen

  10. #61

    Neue Updates von Ubuntu und Dell aufgenommen

  11. #60

    Neue Updates von Ubuntu aufgenommen

  12. #59

    Neue Updates von Ubuntu aufgenommen

  13. #58

    Neue Updates von Ubuntu aufgenommen

  14. #57

    Neue Updates von Ubuntu aufgenommen

  15. #56

    Neue Updates von SUSE aufgenommen

  16. #55

    Neue Updates von Oracle Linux aufgenommen

  17. #54

    Neue Updates von Amazon aufgenommen

  18. #53

    Neue Updates von Debian aufgenommen

  19. #52

    Neue Updates von Debian aufgenommen

  20. #51

    Neue Updates von Oracle Linux aufgenommen

  21. #50

    Neue Updates von SUSE aufgenommen

  22. #49

    Neue Updates von Oracle Linux aufgenommen

  23. #48

    Neue Updates von SUSE aufgenommen

  24. #47

    Neue Updates von SUSE aufgenommen

  25. #46

    Neue Updates von Debian aufgenommen

References