Summary
Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 157
-
Critical 9.8
RDMA/siw: Fix QP destroy to wait for all references dropped.
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after success…
-
Critical 9.8
cifs: fix session state check in reconnect to avoid use-after-free issue
In the Linux kernel, the following vulnerability has been resolved: cifs: fix session state check in reconnect to avoid use-after-free issue Don't collect exiting session in smb2_reconnect_server(), because it will be released soon. Note that the exiting sess…
-
Critical 9.8
nvmet-fc: avoid scheduling association deletion twice
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid scheduling association deletion twice When forcefully shutting down a port via the configfs interface, nvmet_port_subsys_drop_link() first calls nvmet_port_del_ctrls() and the…
-
High 8.8
mt76: mt7921: don't assume adequate headroom for SDIO headers
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: don't assume adequate headroom for SDIO headers mt7921_usb_sdio_tx_prepare_skb() calls mt7921_usb_sdio_write_txwi() and mt7921_skb_add_usb_sdio_hdr(), both of which blindly assu…
-
High 8.8
wifi: ath11k: Ignore frags from uninitialized peer in dp.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Ignore frags from uninitialized peer in dp. When max virtual ap interfaces are configured in all the bands with ACS and hostapd restart is done every 60s, a crash is observed at…
-
High 8.8
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp}
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} Similar to commit d0be8347c623 ("Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put"), just use l2cap_chan_hold_u…
-
High 8.8
smb: client: fix potential UAF in smb2_close_cached_fid()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_close_cached_fid() find_or_create_cached_dir() could grab a new reference after kref_put() had seen the refcount drop to zero but before cfid_list_lock …
-
High 8.8
drm/gpusvm: fix hmm_pfn_to_map_order() usage
In the Linux kernel, the following vulnerability has been resolved: drm/gpusvm: fix hmm_pfn_to_map_order() usage Handle the case where the hmm range partially covers a huge page (like 2M), otherwise we can potentially end up doing something nasty like mapping…
-
High 8.8
nvme-fc: use lock accessing port_state and rport state
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: use lock accessing port_state and rport state nvme_fc_unregister_remote removes the remote port on a lport object at any point in time when there is no active association. This races…
-
High 8.4
drm/msm/dp: Drop aux devices together with DP controller
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: Drop aux devices together with DP controller Using devres to depopulate the aux bus made sure that upon a probe deferral the EDP panel device would be destroyed and recreated upon…
-
High 8.2
net: stmmac: Correctly handle Rx checksum offload errors
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Correctly handle Rx checksum offload errors The stmmac_rx function would previously set skb->ip_summed to CHECKSUM_UNNECESSARY if hardware checksum offload (CoE) was enabled and …
-
High 8.1
nfc: pn533: Clear nfc_target before being used
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Clear nfc_target before being used Fix a slab-out-of-bounds read that occurs in nla_put() called from nfc_genl_send_target() when target->sensb_res_len, which is duplicated from a…
-
High 8.1
scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process()
In the Linux kernel, the following vulnerability has been resolved: scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() A fix for: BUG: KASAN: slab-out-of-bounds in ses_enclosure_data_process+0x949/0xe30 [ses] Read of size 1 at addr ffff88a1b043…
-
High 7.8
bpf: Fix reference state management for synchronous callbacks
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix reference state management for synchronous callbacks Currently, verifier verifies callback functions (sync and async) as if they will be executed once, (i.e. it explores execution st…
-
High 7.8
ext4: fix use-after-free in ext4_orphan_cleanup
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_orphan_cleanup I caught a issue as follows: ================================================================== BUG: KASAN: use-after-free in __list_add_valid+…
-
High 7.8
accel/qaic: Clean up integer overflow checking in map_user_pages()
In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Clean up integer overflow checking in map_user_pages() The encode_dma() function has some validation on in_trans->size but it would be more clear to move those checks to find_and_…
-
High 7.8
smc: Fix use-after-free in tcp_write_timer_handler().
In the Linux kernel, the following vulnerability has been resolved: smc: Fix use-after-free in tcp_write_timer_handler(). With Eric's ref tracker, syzbot finally found a repro for use-after-free in tcp_write_timer_handler() by kernel TCP sockets. [0] If SMC c…
-
High 7.8
bpf: Zeroing allocated object from slab in bpf memory allocator
In the Linux kernel, the following vulnerability has been resolved: bpf: Zeroing allocated object from slab in bpf memory allocator Currently the freed element in bpf memory allocator may be immediately reused, for htab map the reuse will reinitialize special…
-
High 7.8
iommufd: IOMMUFD_DESTROY should not increase the refcount
In the Linux kernel, the following vulnerability has been resolved: iommufd: IOMMUFD_DESTROY should not increase the refcount syzkaller found a race where IOMMUFD_DESTROY increments the refcount: obj = iommufd_get_object(ucmd->ictx, cmd->id, IOMMUFD_OBJ_ANY);…
-
High 7.8
ubi: Fix use-after-free when volume resizing failed
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix use-after-free when volume resizing failed There is an use-after-free problem reported by KASAN: ================================================================== BUG: KASAN: use-af…
-
High 7.8
nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode() During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_w…
-
High 7.8
drm/amd/display: populate subvp cmd info only for the top pipe
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: populate subvp cmd info only for the top pipe [Why] System restart observed while changing the display resolution to 8k with extended mode. Sytem restart was caused by a page…
-
High 7.8
blk-mq: release crypto keyslot before reporting I/O complete
In the Linux kernel, the following vulnerability has been resolved: blk-mq: release crypto keyslot before reporting I/O complete Once all I/O using a blk_crypto_key has completed, filesystems can call blk_crypto_evict_key(). However, the block layer currently…
-
High 7.8
drm/amdkfd: fix potential kgd_mem UAFs
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix potential kgd_mem UAFs kgd_mem pointers returned by kfd_process_device_translate_handle are only guaranteed to be valid while p->mutex is held. As soon as the mutex is unlocke…
-
High 7.8
amdgpu: validate offset_in_bo of drm_amdgpu_gem_va
In the Linux kernel, the following vulnerability has been resolved: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va This is motivated by OOB access in amdgpu_vm_update_range when offset_in_bo+map_size overflows. v2: keep the validations in amdgpu_vm_bo_map…
-
High 7.8
block/rq_qos: protect rq_qos apis with a new lock
In the Linux kernel, the following vulnerability has been resolved: block/rq_qos: protect rq_qos apis with a new lock commit 50e34d78815e ("block: disable the elevator int del_gendisk") move rq_qos_exit() from disk_release() to del_gendisk(), this will introd…
-
High 7.8
netlink: annotate lockless accesses to nlk->max_recvmsg_len
In the Linux kernel, the following vulnerability has been resolved: netlink: annotate lockless accesses to nlk->max_recvmsg_len syzbot reported a data-race in data-race in netlink_recvmsg() [1] Indeed, netlink_recvmsg() can be run concurrently, and netlink_du…
-
High 7.8
Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_add_adv_monitor() KSAN reports use-after-free in hci_add_adv_monitor(). While adding an adv monitor, hci_add_adv_monitor() calls -> ms…
-
High 7.8
f2fs: flush inode if atomic file is aborted
In the Linux kernel, the following vulnerability has been resolved: f2fs: flush inode if atomic file is aborted Let's flush the inode being aborted atomic operation to avoid stale dirty inode during eviction in this call stack: f2fs_mark_inode_dirty_sync+0x22…
-
High 7.8
bpf, sockmap: Fix skb refcnt race after locking changes
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix skb refcnt race after locking changes There is a race where skb's from the sk_psock_backlog can be referenced after userspace side has already skb_consumed() the sk_buff and…
-
High 7.8
f2fs: synchronize atomic write aborts
In the Linux kernel, the following vulnerability has been resolved: f2fs: synchronize atomic write aborts To fix a race condition between atomic write aborts, I use the inode lock and make COW inode to be re-usable thoroughout the whole atomic file inode life…
-
High 7.8
drm/ttm: Don't leak a resource on swapout move error
In the Linux kernel, the following vulnerability has been resolved: drm/ttm: Don't leak a resource on swapout move error If moving the bo to system for swapout failed, we were leaking a resource. Fix.
-
High 7.8
f2fs: fix to do sanity check on direct node in truncate_dnode()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on direct node in truncate_dnode() syzbot reports below bug: BUG: KASAN: slab-use-after-free in f2fs_truncate_data_blocks_range+0x122a/0x14c0 fs/f2fs/file.c:574 R…
-
High 7.8
dm: don't attempt to queue IO under RCU protection
In the Linux kernel, the following vulnerability has been resolved: dm: don't attempt to queue IO under RCU protection dm looks up the table for IO based on the request type, with an assumption that if the request is marked REQ_NOWAIT, it's fine to attempt to…
-
High 7.8
hfs: fix missing hfs_bnode_get() in __hfs_bnode_create
In the Linux kernel, the following vulnerability has been resolved: hfs: fix missing hfs_bnode_get() in __hfs_bnode_create Syzbot found a kernel BUG in hfs_bnode_put(): kernel BUG at fs/hfs/bnode.c:466! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: …
-
High 7.8
ASoC: soc-compress: Reposition and add pcm_mutex
In the Linux kernel, the following vulnerability has been resolved: ASoC: soc-compress: Reposition and add pcm_mutex If panic_on_warn is set and compress stream(DPCM) is started, then kernel panic occurred because card->pcm_mutex isn't held appropriately. In …
-
High 7.8
sctp: Prevent TOCTOU out-of-bounds write
In the Linux kernel, the following vulnerability has been resolved: sctp: Prevent TOCTOU out-of-bounds write For the following path not holding the sock lock, sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump() make sure not to exceed bounds in cas…
-
High 7.8
ASoC: Intel: avs: Disable periods-elapsed work when closing PCM
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Disable periods-elapsed work when closing PCM avs_dai_fe_shutdown() handles the shutdown procedure for HOST HDAudio stream while period-elapsed work services its IRQs. As th…
-
High 7.5
ext4: fix deadlock due to mbcache entry corruption
In the Linux kernel, the following vulnerability has been resolved: ext4: fix deadlock due to mbcache entry corruption When manipulating xattr blocks, we can deadlock infinitely looping inside ext4_xattr_block_set() where we constantly keep finding xattr bloc…
-
High 7.5
RDMA/rxe: Fix "kernel NULL pointer dereference" error
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix "kernel NULL pointer dereference" error When rxe_queue_init in the function rxe_qp_init_req fails, both qp->req.task.func and qp->req.task.arg are not initialized. Because of cr…
-
High 7.5
net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks()
In the Linux kernel, the following vulnerability has been resolved: net: rds: don't hold sock lock when cancelling work from rds_tcp_reset_callbacks() syzbot is reporting lockdep warning at rds_tcp_reset_callbacks() [1], for commit ac3615e7f3cffe2a ("RDS: TCP…
-
High 7.5
crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui()
In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - avoid null pointer deref in mpi_cmp_ui() During NVMeTCP Authentication a controller can trigger a kernel oops by specifying the 8192 bit Diffie Hellman group and passing a c…
-
High 7.3
drm/amdgpu: validate userq buffer virtual address and size
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate userq buffer virtual address and size It needs to validate the userq object virtual address to determine whether it is residented in a valid vm mapping.
-
High 7.1
wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix failed to find the peer with peer_id 0 when disconnected It has a fail log which is ath11k_dbg in ath11k_dp_rx_process_mon_status(), as below, it will not print when debug_m…
-
High 7.1
HID: wacom: Use ktime_t rather than int when dealing with timestamps
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Use ktime_t rather than int when dealing with timestamps Code which interacts with timestamps needs to use the ktime_t type returned by functions like ktime_get. The int type does…
-
High 7.0
ipmi: fix use after free in _ipmi_destroy_user()
In the Linux kernel, the following vulnerability has been resolved: ipmi: fix use after free in _ipmi_destroy_user() The intf_free() function frees the "intf" pointer so we cannot dereference it again on the next line.
-
Unscored —
RISC-V: kexec: Fix memory leak of fdt buffer
In the Linux kernel, the following vulnerability has been resolved: RISC-V: kexec: Fix memory leak of fdt buffer This is reported by kmemleak detector: unreferenced object 0xff60000082864000 (size 9588): comm "kexec", pid 146, jiffies 4294900634 (age 64.788s)…
-
Unscored —
drivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init()
In the Linux kernel, the following vulnerability has been resolved: drivers: perf: marvell_cn10k: Fix hotplug callback leak in tad_pmu_init() tad_pmu_init() won't remove the callback added by cpuhp_setup_state_multi() when platform_driver_register() failed. R…
-
Unscored —
usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: qcom: Fix memory leak in dwc3_qcom_interconnect_init of_icc_get() alloc resources for path handle, we should release it when not need anymore. Like the release in dwc3_qcom_interco…
-
Unscored —
power: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe()
In the Linux kernel, the following vulnerability has been resolved: power: supply: cw2015: Fix potential null-ptr-deref in cw_bat_probe() cw_bat_probe() calls create_singlethread_workqueue() and not checked the ret value, which may return NULL. And a null-ptr…
-
Unscored —
powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe()
In the Linux kernel, the following vulnerability has been resolved: powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() I found a null pointer reference in arch_prepare_kprobe(): # echo 'p cmdline_proc_show' > kprobe_events # echo 'p cmdline_…
-
Unscored —
PCI: Fix pci_device_is_present() for VFs by checking PF
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_device_is_present() for VFs by checking PF pci_device_is_present() previously didn't work for VFs because it reads the Vendor and Device ID, which are 0xffff for VFs, which looks…
-
Unscored —
cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut()
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-hw: Fix memory leak in qcom_cpufreq_hw_read_lut() If "cpu_dev" fails to get opp table in qcom_cpufreq_hw_read_lut(), the program will return, resulting in "table" resource is no…
-
Unscored —
ext4: fix bug_on in __es_tree_search caused by bad boot loader inode
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search caused by bad boot loader inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents…
-
Unscored —
io-wq: Fix memory leak in worker creation
In the Linux kernel, the following vulnerability has been resolved: io-wq: Fix memory leak in worker creation If the CPU mask allocation for a node fails, then the memory allocated for the 'io_wqe' struct of the current node doesn't get freed on the error han…
-
Unscored —
mmc: core: Fix kernel panic when remove non-standard SDIO card
In the Linux kernel, the following vulnerability has been resolved: mmc: core: Fix kernel panic when remove non-standard SDIO card SDIO tuple is only allocated for standard SDIO card, especially it causes memory corruption issues when the non-standard SDIO ca…
-
Unscored —
HSI: omap_ssi: Fix refcount leak in ssi_probe
In the Linux kernel, the following vulnerability has been resolved: HSI: omap_ssi: Fix refcount leak in ssi_probe When returning or breaking early from a for_each_available_child_of_node() loop, we need to explicitly call of_node_put() on the child node to po…
-
Unscored —
platform/chrome: cros_ec_typec: zero out stale pointers
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: cros_ec_typec: zero out stale pointers `cros_typec_get_switch_handles` allocates four pointers when obtaining type-c switch handles. These pointers are all freed if failing t…
-
Unscored —
cifs: Fix xid leak in cifs_copy_file_range()
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix xid leak in cifs_copy_file_range() If the file is used by swap, before return -EOPNOTSUPP, should free the xid, otherwise, the xid will be leaked.
-
Unscored —
clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe
In the Linux kernel, the following vulnerability has been resolved: clk: ti: dra7-atl: Fix reference leak in of_dra7_atl_clk_probe pm_runtime_get_sync() will increment pm usage counter. Forgetting to putting operation will result in reference leak. Add missin…
-
Unscored —
EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper()
In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() As the comment of pci_get_domain_bus_and_slot() says, it returns a PCI device with refcount incremented, so it doesn't need to call an e…
-
Unscored —
scsi: hpsa: Fix possible memory leak in hpsa_init_one()
In the Linux kernel, the following vulnerability has been resolved: scsi: hpsa: Fix possible memory leak in hpsa_init_one() The hpda_alloc_ctlr_info() allocates h and its field reply_map. However, in hpsa_init_one(), if alloc_percpu() failed, the hpsa_init_on…
-
Unscored —
RISC-V: Make port I/O string accessors actually work
In the Linux kernel, the following vulnerability has been resolved: RISC-V: Make port I/O string accessors actually work Fix port I/O string accessors such as `insb', `outsb', etc. which use the physical PCI port I/O address rather than the corresponding memo…
-
Unscored —
ftrace: Fix recursive locking direct_mutex in ftrace_modify_direct_caller
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix recursive locking direct_mutex in ftrace_modify_direct_caller Naveen reported recursive locking of direct_mutex with sample ftrace-direct-modify.ko: [ 74.762406] WARNING: possible…
-
Unscored —
power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()
In the Linux kernel, the following vulnerability has been resolved: power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type() ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length of 8, but adp5061_chg_type array size is 4, …
-
Unscored —
ethtool: eeprom: fix null-deref on genl_info in dump
In the Linux kernel, the following vulnerability has been resolved: ethtool: eeprom: fix null-deref on genl_info in dump The similar fix as commit 46cdedf2a0fa ("ethtool: pse-pd: fix null-deref on genl_info in dump") is also needed for ethtool eeprom.
-
Unscored —
uio: uio_dmem_genirq: Fix missing unlock in irq configuration
In the Linux kernel, the following vulnerability has been resolved: uio: uio_dmem_genirq: Fix missing unlock in irq configuration Commit b74351287d4b ("uio: fix a sleep-in-atomic-context bug in uio_dmem_genirq_irqcontrol()") started calling disable_irq() with…
-
Unscored —
mmc: atmel-mci: fix return value check of mmc_add_host()
In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_hos…
-
Unscored —
bpf: Fix panic due to wrong pageattr of im->image
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix panic due to wrong pageattr of im->image In the scenario where livepatch and kretfunc coexist, the pageattr of im->image is rox after arch_prepare_bpf_trampoline in bpf_trampoline_up…
-
Unscored —
ppp: associate skb with a device at tx
In the Linux kernel, the following vulnerability has been resolved: ppp: associate skb with a device at tx Syzkaller triggered flow dissector warning with the following: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0xc0802, 0x0) ioctl$PPPIOCNEWUNIT(…
-
Unscored —
riscv: mm: add missing memcpy in kasan_init
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: add missing memcpy in kasan_init Hi Atish, It seems that the panic is due to the missing memcpy during kasan_init. Could you please check whether this patch is helpful? When doing …
-
Unscored —
cpufreq: qcom: fix memory leak in error path
In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fix memory leak in error path If for some reason the speedbin length is incorrect, then there is a memory leak in the error path because we never free the speedbin buffer. This…
-
Unscored —
hwrng: geode - Fix PCI device refcount leak
In the Linux kernel, the following vulnerability has been resolved: hwrng: geode - Fix PCI device refcount leak for_each_pci_dev() is implemented by pci_get_device(). The comment of pci_get_device() says that it will increase the reference count for the retur…
-
Unscored —
wifi: ipw2200: fix memory leak in ipw_wdev_init()
In the Linux kernel, the following vulnerability has been resolved: wifi: ipw2200: fix memory leak in ipw_wdev_init() In the error path of ipw_wdev_init(), exception value is returned, and the memory applied for in the function is not released. Also the memor…
-
Unscored —
seccomp: Move copy_seccomp() to no failure path.
In the Linux kernel, the following vulnerability has been resolved: seccomp: Move copy_seccomp() to no failure path. Our syzbot instance reported memory leaks in do_seccomp() [0], similar to the report [1]. It shows that we miss freeing struct seccomp_filter …
-
Unscored —
RDMA/hns: fix memory leak in hns_roce_alloc_mr()
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: fix memory leak in hns_roce_alloc_mr() When hns_roce_mr_enable() failed in hns_roce_alloc_mr(), mr_key is not released. Compiled test only.
-
Unscored —
net: stmmac: fix possible memory leak in stmmac_dvr_probe()
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix possible memory leak in stmmac_dvr_probe() The bitmap_free() should be called to free priv->af_xdp_zc_qps when create_singlethread_workqueue() fails, otherwise there will be …
-
Unscored —
media: dvb-frontends: fix leak of memory fw
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: fix leak of memory fw
-
Unscored —
drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl()
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix memory leak in vmw_mksstat_add_ioctl() If the copy of the description string from userspace fails, then the page for the instance descriptor doesn't get freed before returning…
-
Unscored —
misc: ocxl: fix possible name leak in ocxl_file_register_afu()
In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible name leak in ocxl_file_register_afu() If device_register() returns error in ocxl_file_register_afu(), the name allocated by dev_set_name() need be freed. As comment o…
-
Unscored —
mmc: omap_hsmmc: fix return value check of mmc_add_host()
In the Linux kernel, the following vulnerability has been resolved: mmc: omap_hsmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, it will lead two issues: 1. The memory that allocated in mmc_alloc_ho…
-
Unscored —
mailbox: zynq-ipi: fix error handling while device_register() fails
In the Linux kernel, the following vulnerability has been resolved: mailbox: zynq-ipi: fix error handling while device_register() fails If device_register() fails, it has two issues: 1. The name allocated by dev_set_name() is leaked. 2. The parent of device i…
-
Unscored —
riscv: vdso: fix NULL deference in vdso_join_timens() when vfork
In the Linux kernel, the following vulnerability has been resolved: riscv: vdso: fix NULL deference in vdso_join_timens() when vfork Testing tools/testing/selftests/timens/vfork_exec.c got below kernel log: [ 6.838454] Unable to handle kernel access to user m…
-
Unscored —
arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored
In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored Prior to commit 69e3b846d8a7 ("arm64: mte: Sync tags for pages where PTE is untagged"), mte_sync_tags() was only called …
-
Unscored —
wifi: brcmfmac: fix invalid address access when enabling SCAN log level
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix invalid address access when enabling SCAN log level The variable i is changed when setting random MAC address and causes invalid address access when printing the value of …
-
Unscored —
i40e: Fix DMA mappings leak
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix DMA mappings leak During reallocation of RX buffers, new DMA mappings are created for those buffers. steps for reproduction: while : do for ((i=0; i<=8160; i=i+32)) do ethtool -G en…
-
Unscored —
erofs: kill hooked chains to avoid loops on deduplicated compressed images
In the Linux kernel, the following vulnerability has been resolved: erofs: kill hooked chains to avoid loops on deduplicated compressed images After heavily stressing EROFS with several images which include a hand-crafted image of repeated patterns for more t…
-
Unscored —CVE-2023-53779 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
drm/amd/display: fix FCLK pstate change underflow
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix FCLK pstate change underflow [Why] Currently we set FCLK p-state change watermark calculated based on dummy p-state latency when UCLK p-state is not supported [How] Calcu…
-
Unscored —
dccp: Fix out of bounds access in DCCP error handler
In the Linux kernel, the following vulnerability has been resolved: dccp: Fix out of bounds access in DCCP error handler There was a previous attempt to fix an out-of-bounds access in the DCCP error handlers, but that fix assumed that the error handlers only …
-
Unscored —
blk-iocost: fix divide by 0 error in calc_lcoefs()
In the Linux kernel, the following vulnerability has been resolved: blk-iocost: fix divide by 0 error in calc_lcoefs() echo max of u64 to cost.model can cause divide by 0 error. # echo 8:0 rbps=18446744073709551615 > /sys/fs/cgroup/io.cost.model divide error:…
-
Unscored —
drm: bridge: dw_hdmi: fix connector access for scdc
In the Linux kernel, the following vulnerability has been resolved: drm: bridge: dw_hdmi: fix connector access for scdc Commit 5d844091f237 ("drm/scdc-helper: Pimp SCDC debugs") changed the scdc interface to pick up an i2c adapter from a connector instead. Ho…
-
Unscored —
dm flakey: fix a crash with invalid table line
In the Linux kernel, the following vulnerability has been resolved: dm flakey: fix a crash with invalid table line This command will crash with NULL pointer dereference: dmsetup create flakey --table \ "0 `blockdev --getsize /dev/ram0` flakey /dev/ram0 0 0 1 …
-
Unscored —
regulator: da9063: fix null pointer deref with partial DT config
In the Linux kernel, the following vulnerability has been resolved: regulator: da9063: fix null pointer deref with partial DT config When some of the da9063 regulators do not have corresponding DT nodes a null pointer dereference occurs on boot because such r…
-
Unscored —
ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set() tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A). static int tuning_ctl_set(...) { for…
-
Unscored —
iommu/amd: Improve page fault error reporting
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Improve page fault error reporting If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always…
-
Unscored —
md: fix warning for holder mismatch from export_rdev()
In the Linux kernel, the following vulnerability has been resolved: md: fix warning for holder mismatch from export_rdev() Commit a1d767191096 ("md: use mddev->external to select holder in export_rdev()") fix the problem that 'claim_rdev' is used for blkdev_g…
-
Unscored —
nvme-core: fix memory leak in dhchap_ctrl_secret
In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix memory leak in dhchap_ctrl_secret Free dhchap_secret in nvme_ctrl_dhchap_ctrl_secret_store() before we return when nvme_auth_generate_key() returns error.
-
Unscored —
perf tool x86: Fix perf_env memory leak
In the Linux kernel, the following vulnerability has been resolved: perf tool x86: Fix perf_env memory leak Found by leak sanitizer: ``` ==1632594==ERROR: LeakSanitizer: detected memory leaks Direct leak of 21 byte(s) in 1 object(s) allocated from: #0 0x7f295…
-
Unscored —
f2fs: fix information leak in f2fs_move_inline_dirents()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix information leak in f2fs_move_inline_dirents() When converting an inline directory to a regular one, f2fs is leaking uninitialized memory to disk because it doesn't initialize the e…
-
Unscored —
ethtool: Fix uninitialized number of lanes
In the Linux kernel, the following vulnerability has been resolved: ethtool: Fix uninitialized number of lanes It is not possible to set the number of lanes when setting link modes using the legacy IOCTL ethtool interface. Since 'struct ethtool_link_ksettings…
-
Unscored —
crypto: api - Use work queue in crypto_destroy_instance
In the Linux kernel, the following vulnerability has been resolved: crypto: api - Use work queue in crypto_destroy_instance The function crypto_drop_spawn expects to be called in process context. However, when an instance is unregistered while it still has ac…
-
Unscored —
iommu/sprd: Release dma buffer to avoid memory leak
In the Linux kernel, the following vulnerability has been resolved: iommu/sprd: Release dma buffer to avoid memory leak When attaching to a domain, the driver would alloc a DMA buffer which is used to store address mapping table, and it need to be released wh…
-
Unscored —
wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: htc_hst: free skb in ath9k_htc_rx_msg() if there is no callback function It is stated that ath9k_htc_rx_msg() either frees the provided skb or passes its management to another ca…
-
Unscored —CVE-2023-53805 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider()
In the Linux kernel, the following vulnerability has been resolved: clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() Smatch detected this potential error pointer dereference clk_wzrd_register_divider(). If devm_clk_hw_register() fails then it set…
-
Unscored —
wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix memory leak in mwifiex_histogram_read() Always free the zeroed page on return from 'mwifiex_histogram_read()'.
-
Unscored —
l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register()
In the Linux kernel, the following vulnerability has been resolved: l2tp: Avoid possible recursive deadlock in l2tp_tunnel_register() When a file descriptor of pppol2tp socket is passed as file descriptor of UDP socket, a recursive deadlock occurs in l2tp_tun…
-
Unscored —
RDMA/irdma: Cap MSIX used to online CPUs + 1
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Cap MSIX used to online CPUs + 1 The irdma driver can use a maximum number of msix vectors equal to num_online_cpus() + 1 and the kernel warning stack below is shown if that numbe…
-
Unscored —
media: mediatek: vcodec: fix decoder disable pm crash
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix decoder disable pm crash Can't call pm_runtime_disable when the architecture support sub device for 'dev->pm.dev' is NUll, or will get below crash log. [ 10.77155…
-
Unscored —
ext4: fix rbtree traversal bug in ext4_mb_use_preallocated
In the Linux kernel, the following vulnerability has been resolved: ext4: fix rbtree traversal bug in ext4_mb_use_preallocated During allocations, while looking for preallocations(PA) in the per inode rbtree, we can't do a direct traversal of the tree because…
-
Unscored —
PCI: Fix dropping valid root bus resources with .end = zero
In the Linux kernel, the following vulnerability has been resolved: PCI: Fix dropping valid root bus resources with .end = zero On r8a7791/koelsch: kmemleak: 1 new suspected memory leaks (see /sys/kernel/debug/kmemleak) # cat /sys/kernel/debug/kmemleak unrefe…
-
Unscored —
posix-timers: Prevent RT livelock in itimer_delete()
In the Linux kernel, the following vulnerability has been resolved: posix-timers: Prevent RT livelock in itimer_delete() itimer_delete() has a retry loop when the timer is concurrently expired. On non-RT kernels this just spin-waits until the timer callback h…
-
Unscored —
ARM: zynq: Fix refcount leak in zynq_early_slcr_init
In the Linux kernel, the following vulnerability has been resolved: ARM: zynq: Fix refcount leak in zynq_early_slcr_init of_find_compatible_node() returns a node pointer with refcount incremented, we should use of_node_put() on error path. Add missing of_node…
-
Unscored —
loop: loop_set_status_from_info() check before assignment
In the Linux kernel, the following vulnerability has been resolved: loop: loop_set_status_from_info() check before assignment In loop_set_status_from_info(), lo->lo_offset and lo->lo_sizelimit should be checked before reassignment, because if an overflow erro…
-
Unscored —
ip6_vti: fix slab-use-after-free in decode_session6
In the Linux kernel, the following vulnerability has been resolved: ip6_vti: fix slab-use-after-free in decode_session6 When ipv6_vti device is set to the qdisc of the sfb type, the cb field of the sent skb may be modified during enqueuing. Then, slab-use-aft…
-
Unscored —
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
In the Linux kernel, the following vulnerability has been resolved: kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg(). syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720 ("kcm: Fix memory leak in error path of kcm_sendmsg()") suppre…
-
Unscored —
ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show()
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix UAF wear-leveling entry in eraseblk_count_seq_show() Wear-leveling entry could be freed in error path, which may be accessed again in eraseblk_count_seq_show(), for example: __erase_…
-
Unscored —
platform/x86: think-lmi: Fix memory leak when showing current settings
In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix memory leak when showing current settings When retriving a item string with tlmi_setting(), the result has to be freed using kfree(). In current_value_show() howe…
-
Unscored —
net: read sk->sk_family once in sk_mc_loop()
In the Linux kernel, the following vulnerability has been resolved: net: read sk->sk_family once in sk_mc_loop() syzbot is playing with IPV6_ADDRFORM quite a lot these days, and managed to hit the WARN_ON_ONCE(1) in sk_mc_loop() We have many more similar issu…
-
Unscored —
md/raid10: fix null-ptr-deref in raid10_sync_request
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix null-ptr-deref in raid10_sync_request init_resync() inits mempool and sets conf->have_replacemnt at the beginning of sync, close_sync() frees the mempool when sync is completed…
-
Unscored —
drm/i915: Fix NULL ptr deref by checking new_crtc_state
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL ptr deref by checking new_crtc_state intel_atomic_get_new_crtc_state can return NULL, unless crtc state wasn't obtained previously with intel_atomic_get_crtc_state, so we m…
-
Unscored —
iio: adc: ina2xx: avoid NULL pointer dereference on OF device match
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ina2xx: avoid NULL pointer dereference on OF device match The affected lines were resulting in a NULL pointer dereference on our platform because the device tree contained the follo…
-
Unscored —CVE-2023-53835 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
drm/msm: fix NULL-deref on snapshot tear down
In the Linux kernel, the following vulnerability has been resolved: drm/msm: fix NULL-deref on snapshot tear down In case of early initialisation errors and on platforms that do not use the DPU controller, the deinitilisation code can be called with the kms p…
-
Unscored —
dccp: fix data-race around dp->dccps_mss_cache
In the Linux kernel, the following vulnerability has been resolved: dccp: fix data-race around dp->dccps_mss_cache dccp_sendmsg() reads dp->dccps_mss_cache before locking the socket. Same thing in do_dccp_getsockopt(). Add READ_ONCE()/WRITE_ONCE() annotations…
-
Unscored —
usb: early: xhci-dbc: Fix a potential out-of-bound memory access
In the Linux kernel, the following vulnerability has been resolved: usb: early: xhci-dbc: Fix a potential out-of-bound memory access If xdbc_bulk_write() fails, the values in 'buf' can be anything. So the string is not guaranteed to be NULL terminated when xd…
-
Unscored —
devlink: report devlink_port_type_warn source device
In the Linux kernel, the following vulnerability has been resolved: devlink: report devlink_port_type_warn source device devlink_port_type_warn is scheduled for port devlink and warning when the port type is not set. But from this warning it is not easy found…
-
Unscored —
ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove The MBHC resources must be released on component probe failure and removal so can not be tied to the lifetime of the componen…
-
Unscored —
net: openvswitch: reject negative ifindex
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject negative ifindex Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs in an xarray")) refactored the handling of pre-assigned ifindexes and let syzbot…
-
Unscored —
nilfs2: fix infinite loop in nilfs_mdt_get_block()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfs_mdt_get_block() If the disk image that nilfs2 mounts is corrupted and a virtual block address obtained by block lookup for a metadata file is invalid, nilfs…
-
Unscored —
usb-storage: alauda: Fix uninit-value in alauda_check_media()
In the Linux kernel, the following vulnerability has been resolved: usb-storage: alauda: Fix uninit-value in alauda_check_media() Syzbot got KMSAN to complain about access to an uninitialized value in the alauda subdriver of usb-storage: BUG: KMSAN: uninit-va…
-
Unscored —
md/raid5-cache: fix a deadlock in r5l_exit_log()
In the Linux kernel, the following vulnerability has been resolved: md/raid5-cache: fix a deadlock in r5l_exit_log() Commit b13015af94cf ("md/raid5-cache: Clear conf->log after finishing work") introduce a new problem: // caller hold reconfig_mutex r5l_exit_l…
-
Unscored —
drm/msm: fix workqueue leak on bind errors
In the Linux kernel, the following vulnerability has been resolved: drm/msm: fix workqueue leak on bind errors Make sure to destroy the workqueue also in case of early errors during bind (e.g. a subcomponent failing to bind). Since commit c3b790ea07a1 ("drm: …
-
Unscored —
iavf: use internal state to free traffic IRQs
In the Linux kernel, the following vulnerability has been resolved: iavf: use internal state to free traffic IRQs If the system tries to close the netdev while iavf_reset_task() is running, __LINK_STATE_START will be cleared and netif_running() will return fa…
-
Unscored —
nvme-core: fix memory leak in dhchap_secret_store
In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix memory leak in dhchap_secret_store Free dhchap_secret in nvme_ctrl_dhchap_secret_store() before we return fix following kmemleack:- unreferenced object 0xffff8886376ea800 (size…
-
Unscored —
netlink: annotate accesses to nlk->cb_running
In the Linux kernel, the following vulnerability has been resolved: netlink: annotate accesses to nlk->cb_running Both netlink_recvmsg() and netlink_native_seq_show() read nlk->cb_running locklessly. Use READ_ONCE() there. Add corresponding WRITE_ONCE() to ne…
-
Unscored —
ASoC: mediatek: mt8186: Fix use-after-free in driver remove path
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8186: Fix use-after-free in driver remove path When devm runs function in the "remove" path for a device it runs them in the reverse order. That means that if you have parts…
-
Unscored —
net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove
In the Linux kernel, the following vulnerability has been resolved: net: dsa: ocelot: call dsa_tag_8021q_unregister() under rtnl_lock() on driver remove When the tagging protocol in current use is "ocelot-8021q" and we unbind the driver, we see this splat: $ …
-
Unscored —
of: overlay: Call of_changeset_init() early
In the Linux kernel, the following vulnerability has been resolved: of: overlay: Call of_changeset_init() early When of_overlay_fdt_apply() fails, the changeset may be partially applied, and the caller is still expected to call of_overlay_remove() to clean up…
-
Unscored —
bpf: bpf_sk_storage: Fix invalid wait context lockdep report
In the Linux kernel, the following vulnerability has been resolved: bpf: bpf_sk_storage: Fix invalid wait context lockdep report './test_progs -t test_local_storage' reported a splat: [ 27.137569] ============================= [ 27.138122] [ BUG: Invalid wait…
-
Unscored —
tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
In the Linux kernel, the following vulnerability has been resolved: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error If clk_get_rate() fails, the clk that has just been allocated needs to be freed.
-
Unscored —
s390/idle: mark arch_cpu_idle() noinstr
In the Linux kernel, the following vulnerability has been resolved: s390/idle: mark arch_cpu_idle() noinstr linux-next commit ("cpuidle: tracing: Warn about !rcu_is_watching()") adds a new warning which hits on s390's arch_cpu_idle() function: RCU not on for:…
-
Unscored —
ext4: correct grp validation in ext4_mb_good_group
In the Linux kernel, the following vulnerability has been resolved: ext4: correct grp validation in ext4_mb_good_group Group corruption check will access memory of grp and will trigger kernel crash if grp is NULL. So do NULL check before corruption check.
-
Unscored —
netlink: do not hard code device address lenth in fdb dumps
In the Linux kernel, the following vulnerability has been resolved: netlink: do not hard code device address lenth in fdb dumps syzbot reports that some netdev devices do not have a six bytes address [1] Replace ETH_ALEN by dev->addr_len. [1] (Case of a devic…
-
Unscored —
drm/mxsfb: Disable overlay plane in mxsfb_plane_overlay_atomic_disable()
In the Linux kernel, the following vulnerability has been resolved: drm/mxsfb: Disable overlay plane in mxsfb_plane_overlay_atomic_disable() When disabling overlay plane in mxsfb_plane_overlay_atomic_update(), overlay plane's framebuffer pointer is NULL. So, …
-
Unscored —
btrfs: fix warning when putting transaction with qgroups enabled after abort
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix warning when putting transaction with qgroups enabled after abort If we have a transaction abort with qgroups enabled we get a warning triggered when doing the final put on the tra…
-
Unscored —
perf/core: Fix system hang caused by cpu-clock usage
In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix system hang caused by cpu-clock usage cpu-clock usage by the async-profiler tool can trigger a system hang, which got bisected back to the following commit by Octavia Togami: 1…
-
Unscored —
drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb
In the Linux kernel, the following vulnerability has been resolved: drm/sched: Fix deadlock in drm_sched_entity_kill_jobs_cb The Mesa issue referenced below pointed out a possible deadlock: [ 1231.611031] Possible interrupt unsafe locking scenario: [ 1231.611…
-
Unscored —
bnxt_en: Shutdown FW DMA in bnxt_shutdown()
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Shutdown FW DMA in bnxt_shutdown() The netif_close() call in bnxt_shutdown() only stops packet DMA. There may be FW DMA for trace logging (recently added) that will continue. If we k…
-
Unscored —
drm/amdkfd: Fix mmap write lock not release
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mmap write lock not release If mmap write lock is taken while draining retry fault, mmap write lock is not released because svm_range_restore_pages calls mmap_read_unlock then…
-
Unscored —
f2fs: fix infinite loop in __insert_extent_tree()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix infinite loop in __insert_extent_tree() When we get wrong extent info data, and look up extent_node in rb tree, it will cause infinite loop (CONFIG_F2FS_CHECK_FS=n). Avoiding this b…
-
Unscored —
drm/amdgpu: validate userq input args
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate userq input args This will help on validating the userq input args, and rejecting for the invalid userq request at the IOCTLs first place.
-
Unscored —
ASoC: Intel: avs: Do not share the name pointer between components
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Do not share the name pointer between components By sharing 'name' directly, tearing down components may lead to use-after-free errors. Duplicate the name to avoid that. At …
-
Unscored —
drm/amdgpu: fix nullptr err of vm_handle_moved
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix nullptr err of vm_handle_moved If a amdgpu_bo_va is fpriv->prt_va, the bo of this one is always NULL. So, such kind of amdgpu_bo_va should be updated separately before amdgpu_…
-
Unscored —
drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test.
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix oops in xe_gem_fault when running core_hotunplug test. I saw an oops in xe_gem_fault when running the xe-fast-feedback testlist against the realtime kernel without debug options e…
-
Unscored —
futex: Don't leak robust_list pointer on exec race
In the Linux kernel, the following vulnerability has been resolved: futex: Don't leak robust_list pointer on exec race sys_get_robust_list() and compat_get_robust_list() use ptrace_may_access() to check if the calling task is allowed to access another task's …
Revision history
-
#64
Neue Updates von Debian aufgenommen
-
#63
Neue Updates von Debian aufgenommen
-
#62
Neue Updates von Debian aufgenommen
-
#61
Neue Updates von SUSE aufgenommen
-
#60
Neue Updates von SUSE aufgenommen
-
#59
Neue Updates von Red Hat aufgenommen
-
#58
Neue Updates von Ubuntu aufgenommen
-
#57
Neue Updates von Dell aufgenommen
-
#56
Neue Updates von IBM aufgenommen
-
#55
Neue Updates von SUSE aufgenommen
-
#54
Neue Updates von openSUSE aufgenommen
-
#53
Neue Updates von SUSE aufgenommen
-
#52
Neue Updates von SUSE aufgenommen
-
#51
Neue Updates von SUSE aufgenommen
-
#50
Neue Updates von Oracle Linux aufgenommen
-
#49
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#48
Neue Updates von Red Hat aufgenommen
-
#47
Neue Updates von Oracle Linux aufgenommen
-
#46
Neue Updates von Ubuntu aufgenommen
-
#45
Neue Updates von SUSE und Ubuntu aufgenommen
-
#44
Neue Updates von SUSE aufgenommen
-
#43
Neue Updates von Ubuntu aufgenommen
-
#42
Neue Updates von SUSE aufgenommen
-
#41
Neue Updates von Ubuntu aufgenommen
-
#40
Neue Updates von SUSE aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2022-50631
https://lore.kernel.org/linux-cve-announce/2025120931-CVE-2022-50631-ee18@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50632
https://lore.kernel.org/linux-cve-announce/2025120934-CVE-2022-50632-97fb@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50633
https://lore.kernel.org/linux-cve-announce/2025120934-CVE-2022-50633-8c49@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50634
https://lore.kernel.org/linux-cve-announce/2025120934-CVE-2022-50634-2887@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50635
https://lore.kernel.org/linux-cve-announce/2025120935-CVE-2022-50635-b2b8@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50636
https://lore.kernel.org/linux-cve-announce/2025120935-CVE-2022-50636-6d4d@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50637
https://lore.kernel.org/linux-cve-announce/2025120935-CVE-2022-50637-f1b4@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50638
https://lore.kernel.org/linux-cve-announce/2025120935-CVE-2022-50638-fb89@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50639
https://lore.kernel.org/linux-cve-announce/2025120935-CVE-2022-50639-789f@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50640
https://lore.kernel.org/linux-cve-announce/2025120935-CVE-2022-50640-324c@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50641
https://lore.kernel.org/linux-cve-announce/2025120936-CVE-2022-50641-edfb@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50642
https://lore.kernel.org/linux-cve-announce/2025120936-CVE-2022-50642-6975@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50643
https://lore.kernel.org/linux-cve-announce/2025120936-CVE-2022-50643-74ca@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50644
https://lore.kernel.org/linux-cve-announce/2025120936-CVE-2022-50644-5149@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50645
https://lore.kernel.org/linux-cve-announce/2025120936-CVE-2022-50645-2014@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50646
https://lore.kernel.org/linux-cve-announce/2025120936-CVE-2022-50646-37e0@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50647
https://lore.kernel.org/linux-cve-announce/2025120937-CVE-2022-50647-cb33@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50648
https://lore.kernel.org/linux-cve-announce/2025120937-CVE-2022-50648-ac1e@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50649
https://lore.kernel.org/linux-cve-announce/2025120937-CVE-2022-50649-6a84@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50650
https://lore.kernel.org/linux-cve-announce/2025120937-CVE-2022-50650-fbae@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50651
https://lore.kernel.org/linux-cve-announce/2025120937-CVE-2022-50651-d950@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50652
https://lore.kernel.org/linux-cve-announce/2025120937-CVE-2022-50652-b7be@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50653
https://lore.kernel.org/linux-cve-announce/2025120938-CVE-2022-50653-6da2@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50654
https://lore.kernel.org/linux-cve-announce/2025120938-CVE-2022-50654-a5d9@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50655
https://lore.kernel.org/linux-cve-announce/2025120938-CVE-2022-50655-746b@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50656
https://lore.kernel.org/linux-cve-announce/2025120938-CVE-2022-50656-4655@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50657
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2022-50657-6582@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50658
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2022-50658-77b4@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50659
https://lore.kernel.org/linux-cve-announce/2025120942-CVE-2022-50659-8205@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50660
https://lore.kernel.org/linux-cve-announce/2025120942-CVE-2022-50660-562d@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50661
https://lore.kernel.org/linux-cve-announce/2025120942-CVE-2022-50661-ff17@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50662
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2022-50662-6595@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50663
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2022-50663-5606@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50664
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2022-50664-043a@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50665
https://lore.kernel.org/linux-cve-announce/2025120944-CVE-2022-50665-2ac9@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50666
https://lore.kernel.org/linux-cve-announce/2025120944-CVE-2022-50666-0d75@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50667
https://lore.kernel.org/linux-cve-announce/2025120945-CVE-2022-50667-01f6@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50668
https://lore.kernel.org/linux-cve-announce/2025120945-CVE-2022-50668-153a@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50669
https://lore.kernel.org/linux-cve-announce/2025120945-CVE-2022-50669-f124@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50670
https://lore.kernel.org/linux-cve-announce/2025120946-CVE-2022-50670-feb4@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50671
https://lore.kernel.org/linux-cve-announce/2025120946-CVE-2022-50671-e025@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50672
https://lore.kernel.org/linux-cve-announce/2025120947-CVE-2022-50672-d9b1@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50673
https://lore.kernel.org/linux-cve-announce/2025120947-CVE-2022-50673-f920@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50674
https://lore.kernel.org/linux-cve-announce/2025120947-CVE-2022-50674-023e@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50675
https://lore.kernel.org/linux-cve-announce/2025120948-CVE-2022-50675-9032@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50676
https://lore.kernel.org/linux-cve-announce/2025120948-CVE-2022-50676-1387@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50677
https://lore.kernel.org/linux-cve-announce/2025120948-CVE-2022-50677-d2c8@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50678
https://lore.kernel.org/linux-cve-announce/2025120949-CVE-2022-50678-53a4@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50679
https://lore.kernel.org/linux-cve-announce/2025120949-CVE-2022-50679-b2b8@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53777
https://lore.kernel.org/linux-cve-announce/2025120938-CVE-2023-53777-f842@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53778
https://lore.kernel.org/linux-cve-announce/2025120938-CVE-2023-53778-ee4d@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53779
https://lore.kernel.org/linux-cve-announce/2025120939-CVE-2023-53779-dd3d@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53780
https://lore.kernel.org/linux-cve-announce/2025120939-CVE-2023-53780-914d@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53781
https://lore.kernel.org/linux-cve-announce/2025120939-CVE-2023-53781-cb1d@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53782
https://lore.kernel.org/linux-cve-announce/2025120939-CVE-2023-53782-6428@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53783
https://lore.kernel.org/linux-cve-announce/2025120939-CVE-2023-53783-4c33@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53784
https://lore.kernel.org/linux-cve-announce/2025120939-CVE-2023-53784-a381@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53785
https://lore.kernel.org/linux-cve-announce/2025120940-CVE-2023-53785-2a61@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53786
https://lore.kernel.org/linux-cve-announce/2025120940-CVE-2023-53786-3c1a@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53787
https://lore.kernel.org/linux-cve-announce/2025120940-CVE-2023-53787-2074@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53788
https://lore.kernel.org/linux-cve-announce/2025120940-CVE-2023-53788-e6a0@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53789
https://lore.kernel.org/linux-cve-announce/2025120940-CVE-2023-53789-c5cb@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53790
https://lore.kernel.org/linux-cve-announce/2025120940-CVE-2023-53790-6f22@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53791
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2023-53791-a2ea@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53792
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2023-53792-3de7@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53793
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2023-53793-0dc1@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53794
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2023-53794-8912@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53795
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2023-53795-f912@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53796
https://lore.kernel.org/linux-cve-announce/2025120941-CVE-2023-53796-4092@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53797
https://lore.kernel.org/linux-cve-announce/2025120942-CVE-2023-53797-4a88@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53798
https://lore.kernel.org/linux-cve-announce/2025120942-CVE-2023-53798-7845@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53799
https://lore.kernel.org/linux-cve-announce/2025120942-CVE-2023-53799-8397@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53800
https://lore.kernel.org/linux-cve-announce/2025120942-CVE-2023-53800-eb42@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53801
https://lore.kernel.org/linux-cve-announce/2025120942-CVE-2023-53801-6d74@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53802
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2023-53802-4ffb@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53803
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2023-53803-0ff9@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53804
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2023-53804-3c10@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53805
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2023-53805-f08b@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-53806
https://lore.kernel.org/linux-cve-announce/2025120943-CVE-2023-53806-03cb@gregkh/