Summary
Ein Angreifer kann mehrere Schwachstellen im Linux-Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen, die möglicherweise zu einer Denial-of-Service- Bedingung führen oder eine Speicherbeschädigung verursachen können.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 207
-
Critical 9.8
nvmet-tcp: add bounds check on Transfer Tag
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: add bounds check on Transfer Tag ttag is used as an index to get cmd in nvmet_tcp_handle_h2c_data_pdu(), add a bounds check to avoid out-of-bounds access.
-
Critical 9.8
smb: client: fix missed ses refcounting
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missed ses refcounting Use new cifs_smb_ses_inc_refcount() helper to get an active reference of @ses and @ses->dfs_root_ses (if set). This will prevent @ses->dfs_root_ses of …
-
Critical 9.8
ixgbe: Fix panic during XDP_TX with > 64 CPUs
In the Linux kernel, the following vulnerability has been resolved: ixgbe: Fix panic during XDP_TX with > 64 CPUs Commit 4fe815850bdc ("ixgbe: let the xdpdrv work with more than 64 cpus") adds support to allow XDP programs to run on systems with more than 64 …
-
Critical 9.8
net: prevent skb corruption on frag list segmentation
In the Linux kernel, the following vulnerability has been resolved: net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: [ 62.624003] BUG: kernel NULL pointer der…
-
Critical 9.8
scsi: qla2xxx: Fix improper freeing of purex item
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxx_process_purls_iocb(), an item is allocated via qla27xx_copy_multiple_pkt(), which internally calls qla24xx_alloc_purex_item(). The…
-
Critical 9.8
scsi: qla2xxx: Clear cmds after chip reset
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Clear cmds after chip reset Commit aefed3e5548f ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after …
-
High 8.8
staging: rtl8192u: Fix use after free in ieee80211_rx()
In the Linux kernel, the following vulnerability has been resolved: staging: rtl8192u: Fix use after free in ieee80211_rx() We cannot dereference the "skb" pointer after calling ieee80211_monitor_rx(), because it is a use after free.
-
High 8.8
iommufd: Do not add the same hwpt to the ioas->hwpt_list twice
In the Linux kernel, the following vulnerability has been resolved: iommufd: Do not add the same hwpt to the ioas->hwpt_list twice The hwpt is added to the hwpt_list only during its creation, it is never added again. This hunk is some missed leftover from rew…
-
High 8.8
iommufd: Set end correctly when doing batch carry
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set end correctly when doing batch carry Even though the test suite covers this it somehow became obscured that this wasn't working. The test iommufd_ioas.mock_domain.access_domain_d…
-
High 8.8
wifi: rtw88: use work to update rate to avoid RCU warning
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: use work to update rate to avoid RCU warning The ieee80211_ops::sta_rc_update must be atomic, because ieee80211_chan_bw_change() holds rcu_read lock while calling drv_sta_rc_upda…
-
High 8.8
KVM: s390: pv: fix index value of replaced ASCE
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pv: fix index value of replaced ASCE The index field of the struct page corresponding to a guest ASCE should be 0. When replacing the ASCE in s390_replace_asce(), the index of the …
-
High 8.8
Bluetooth: Fix race condition in hidp_session_thread
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidp_session_thread There is a potential race condition in hidp_session_thread that may lead to use-after-free. For instance, the timer is active while hidp_d…
-
High 8.8
landlock: Fix handling of disconnected directories
In the Linux kernel, the following vulnerability has been resolved: landlock: Fix handling of disconnected directories Disconnected files or directories can appear when they are visible and opened from a bind mount, but have been renamed or moved from the sou…
-
High 8.4
erofs: validate the extent length for uncompressed pclusters
In the Linux kernel, the following vulnerability has been resolved: erofs: validate the extent length for uncompressed pclusters syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed imag…
-
High 7.8
ALSA: line6: fix stack overflow in line6_midi_transmit
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: fix stack overflow in line6_midi_transmit Correctly calculate available space including the size of the chunk buffer. This fixes a buffer overflow when multiple MIDI sysex messag…
-
High 7.8
net/mlx5: Fix possible use-after-free in async command interface
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix possible use-after-free in async command interface mlx5_cmd_cleanup_async_ctx should return only after all its callback handlers were completed. Before this patch, the below rac…
-
High 7.8
fs/ntfs3: Validate index root when initialize NTFS security
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate index root when initialize NTFS security This enhances the sanity check for $SDH and $SII while initializing NTFS security, guarantees these index root are legit. [ 162.459…
-
High 7.8
staging: media: tegra-video: fix device_node use after free
In the Linux kernel, the following vulnerability has been resolved: staging: media: tegra-video: fix device_node use after free At probe time this code path is followed: * tegra_csi_init * tegra_csi_channels_alloc * for_each_child_of_node(node, channel) -- it…
-
High 7.8
hfs: Fix OOB Write in hfs_asc2mac
In the Linux kernel, the following vulnerability has been resolved: hfs: Fix OOB Write in hfs_asc2mac Syzbot reported a OOB Write bug: loop0: detected capacity change from 0 to 64 ================================================================== BUG: KASAN: …
-
High 7.8
drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure
In the Linux kernel, the following vulnerability has been resolved: drm/panel/panel-sitronix-st7701: Remove panel on DSI attach failure In case mipi_dsi_attach() fails, call drm_panel_remove() to avoid memory leak.
-
High 7.8
md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk()
In the Linux kernel, the following vulnerability has been resolved: md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() When running chunk-sized reads on disks with badblocks duplicate bio free/puts are observed: =================================…
-
High 7.8
f2fs: fix to do sanity check on summary info
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on summary info As Wenqing Liu reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=216456 BUG: KASAN: use-after-free in recover_data+0x63ae/0x6ae0 […
-
High 7.8
udf: Avoid double brelse() in udf_rename()
In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double brelse() in udf_rename() syzbot reported a warning like below [1]: VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 __brelse+0x67/0xa0 .…
-
High 7.8
nvme-pci: fix mempool alloc size
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix mempool alloc size Convert the max size to bytes to match the units of the divisor that calculates the worst-case number of PRP entries. The result is used to determine how many…
-
High 7.8
media: camss: Clean up received buffers on failed start of streaming
In the Linux kernel, the following vulnerability has been resolved: media: camss: Clean up received buffers on failed start of streaming It is required to return the received buffers, if streaming can not be started. For instance media_pipeline_start() may fa…
-
High 7.8
staging: vt6655: fix potential memory leak
In the Linux kernel, the following vulnerability has been resolved: staging: vt6655: fix potential memory leak In function device_init_td0_ring, memory is allocated for member td_info of priv->apTD0Rings[i], with i increasing from 0. In case of allocation fai…
-
High 7.8
net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed
In the Linux kernel, the following vulnerability has been resolved: net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed When the ops_init() interface is invoked to initialize the net, but ops->init() fails, data is released. However, the ptr poi…
-
High 7.8
crypto: essiv - Handle EBUSY correctly
In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. Howev…
-
High 7.8
RDMA/bnxt_re: Prevent handling any completions after qp destroy
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Prevent handling any completions after qp destroy HW may generate completions that indicates QP is destroyed. Driver should not be scheduling any more completion handlers for th…
-
High 7.8
ubifs: Fix memleak when insert_old_idx() failed
In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memleak when insert_old_idx() failed Following process will cause a memleak for copied up znode: dirty_cow_znode zn = copy_znode(c, znode); err = insert_old_idx(c, zbr->lnum, zbr->…
-
High 7.8
ext4: fix invalid free tracking in ext4_xattr_move_to_block()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix invalid free tracking in ext4_xattr_move_to_block() In ext4_xattr_move_to_block(), the value of the extended attribute which we need to move to an external block may be allocated by…
-
High 7.8
fs/ntfs3: Fix OOB read in indx_insert_into_buffer
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix OOB read in indx_insert_into_buffer Syzbot reported a OOB read bug: BUG: KASAN: slab-out-of-bounds in indx_insert_into_buffer+0xaa3/0x13b0 fs/ntfs3/index.c:1755 Read of size 171…
-
High 7.8
net: dsa: realtek: fix out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: fix out-of-bounds access The probe function sets priv->chip_data to (void *)priv + sizeof(*priv) with the expectation that priv has enough trailing space. However, only rea…
-
High 7.8
btrfs: fix race when deleting free space root from the dirty cow roots list
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when deleting free space root from the dirty cow roots list When deleting the free space tree we are deleting the free space root from the list fs_info->dirty_cowonly_roots wi…
-
High 7.8
f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages()
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to call f2fs_wait_on_page_writeback() in f2fs_write_raw_pages() BUG_ON() will be triggered when writing files concurrently, because the same page is writtenback multiple t…
-
High 7.8
net/mlx5e: Use correct encap attribute during invalidation
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Use correct encap attribute during invalidation With introduction of post action infrastructure most of the users of encap attribute had been modified in order to obtain the correc…
-
High 7.8
fs/ntfs3: Fix memory leak if ntfs_read_mft failed
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix memory leak if ntfs_read_mft failed Label ATTR_ROOT in ntfs_read_mft() sets is_root = true and ni->ni_flags |= NI_FLAG_DIR, then next attr will goto label ATTR_ALLOC and alloc n…
-
High 7.8
power: supply: bq27xxx: Fix poll_interval handling and races on remove
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx: Fix poll_interval handling and races on remove Before this patch bq27xxx_battery_teardown() was setting poll_interval = 0 to avoid bq27xxx_battery_update() requeuing t…
-
High 7.8
phy: tegra: xusb: Clear the driver reference in usb-phy dev
In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Clear the driver reference in usb-phy dev For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy. When we…
-
High 7.8
blk-cgroup: hold queue_lock when removing blkg->q_node
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: hold queue_lock when removing blkg->q_node When blkg is removed from q->blkg_list from blkg_free_workfn(), queue_lock has to be held, otherwise, all kinds of bugs(list corruption,…
-
High 7.8
soundwire: fix enumeration completion
In the Linux kernel, the following vulnerability has been resolved: soundwire: fix enumeration completion The soundwire subsystem uses two completion structures that allow drivers to wait for soundwire device to become enumerated on the bus and initialised by…
-
High 7.8
scsi: qedi: Fix use after free bug in qedi_remove()
In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix use after free bug in qedi_remove() In qedi_probe() we call __qedi_probe() which initializes &qedi->recovery_work with qedi_recovery_handler() and &qedi->board_disable_work wi…
-
High 7.8
mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op()
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() 'op-cs' is copied in 'fun->mchip_number' which is used to access the 'mchip_offsets' and the 'rnb_gpio' arrays. These arrays hav…
-
High 7.8
blk-cgroup: dropping parent refcount after pd_free_fn() is done
In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: dropping parent refcount after pd_free_fn() is done Some cgroup policies will access parent pd through child pd even after pd_offline_fn() is done. If pd_free_fn() for parent is c…
-
High 7.8
drm/fbdev-generic: prohibit potential out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-generic: prohibit potential out-of-bounds access The fbdev test of IGT may write after EOF, which lead to out-of-bound access for drm drivers with fbdev-generic. For example, run fb…
-
High 7.8
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix incorrect splitting in btrfs_drop_extent_map_range In production we were seeing a variety of WARN_ON()'s in the extent_map code, specifically in btrfs_drop_extent_map_range() when …
-
High 7.8
f2fs: fix to drop all dirty pages during umount() if cp_error is set
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to drop all dirty pages during umount() if cp_error is set xfstest generic/361 reports a bug as below: f2fs_bug_on(sbi, sbi->fsync_node_num); kernel BUG at fs/f2fs/super.c:1627! RIP…
-
High 7.8
fs/ntfs3: Return error for inconsistent extended attributes
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Return error for inconsistent extended attributes ntfs_read_ea is called when we want to read extended attributes. There are some sanity checks for the validity of the EAs. However,…
-
High 7.8
fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()
In the Linux kernel, the following vulnerability has been resolved: fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount() Syzkaller reported the following issue: ================================================================== BUG: KASAN: do…
-
High 7.8
fs: drop peer group ids under namespace lock
In the Linux kernel, the following vulnerability has been resolved: fs: drop peer group ids under namespace lock When cleaning up peer group ids in the failure path we need to make sure to hold on to the namespace lock. Otherwise another thread might just tur…
-
High 7.8
hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling
In the Linux kernel, the following vulnerability has been resolved: hfs/hfsplus: avoid WARN_ON() for sanity check, use proper error handling Commit 55d1cbbbb29e ("hfs/hfsplus: use WARN_ON for sanity check") fixed a build warning by turning a comment into a WA…
-
High 7.8
erofs: stop parsing non-compact HEAD index if clusterofs is invalid
In the Linux kernel, the following vulnerability has been resolved: erofs: stop parsing non-compact HEAD index if clusterofs is invalid Syzbot generated a crafted image [1] with a non-compact HEAD index of clusterofs 33024 while valid numbers should be 0 ~ lc…
-
High 7.8
maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()
In the Linux kernel, the following vulnerability has been resolved: maple_tree: fix potential out-of-bounds access in mas_wr_end_piv() Check the write offset end bounds before using it as the offset into the pivot array. This avoids a possible out-of-bounds a…
-
High 7.8
tracing/user_events: Ensure write index cannot be negative
In the Linux kernel, the following vulnerability has been resolved: tracing/user_events: Ensure write index cannot be negative The write index indicates which event the data is for and accesses a per-file array. The index is passed by user processes during wr…
-
High 7.8
nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse A syzbot stress test using a corrupted disk image reported that mark_buffer_dirty() called from __nilfs_mark_inode_dirty…
-
High 7.8
gtp: Fix use-after-free in __gtp_encap_destroy().
In the Linux kernel, the following vulnerability has been resolved: gtp: Fix use-after-free in __gtp_encap_destroy(). syzkaller reported use-after-free in __gtp_encap_destroy(). [0] It shows the same process freed sk and touched it illegally. Commit e198987e7…
-
High 7.8
f2fs: Fix system crash due to lack of free space in LFS
In the Linux kernel, the following vulnerability has been resolved: f2fs: Fix system crash due to lack of free space in LFS When f2fs tries to checkpoint during foreground gc in LFS mode, system crash occurs due to lack of free space if the amount of dirty no…
-
High 7.8
ext4: turn quotas off if mount failed after enabling quotas
In the Linux kernel, the following vulnerability has been resolved: ext4: turn quotas off if mount failed after enabling quotas Yi found during a review of the patch "ext4: don't BUG on inconsistent journal feature" that when ext4_mark_recovery_complete() ret…
-
High 7.8
sfc: fix crash when reading stats while NIC is resetting
In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_stats is NULL as the NIC h…
-
High 7.8
binder: fix UAF of alloc->vma in race with munmap()
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of alloc->vma in race with munmap() [ cmllamas: clean forward port from commit 015ac18be7de ("binder: fix UAF of alloc->vma in race with munmap()") in 5.10 stable. It is neede…
-
High 7.8
drm/panthor: Prevent potential UAF in group creation
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Prevent potential UAF in group creation This commit prevents the possibility of a use after free issue in the GROUP_CREATE ioctl function, which arose as pointer to the group is …
-
High 7.8
spi: tegra210-quad: Fix timeout handling
In the Linux kernel, the following vulnerability has been resolved: spi: tegra210-quad: Fix timeout handling When the CPU that the QSPI interrupt handler runs on (typically CPU 0) is excessively busy, it can lead to rare cases of the IRQ thread not running be…
-
High 7.8
drm/panthor: Fix UAF on kernel BO VA nodes
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthor_vm_unmap_range() might return an error. We expect the page table to be updated still, and if the MMU is blocked, the res…
-
High 7.8
drm/panthor: Fix UAF race between device unplug and FW event processing
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF race between device unplug and FW event processing The function panthor_fw_unplug() will free the FW memory sections. The problem is that there could still be pending FW …
-
High 7.8
accel/ivpu: Fix race condition when unbinding BOs
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix race condition when unbinding BOs Fix 'Memory manager not clean during takedown' warning that occurs when ivpu_gem_bo_free() removes the BO from the BOs list before it gets un…
-
High 7.5
mptcp: fix NULL pointer dereference on fastopen early fallback
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer dereference on fastopen early fallback In case of early fallback to TCP, subflow_syn_recv_sock() deletes the subflow context before returning the newly allocated sock …
-
High 7.5
net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses
In the Linux kernel, the following vulnerability has been resolved: net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses When using the felix driver (the only one which supports UC filtering and MC filtering) as a DSA master for a random o…
-
High 7.3
drm/i915/gvt: fix gvt debugfs destroy
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gvt: fix gvt debugfs destroy When gvt debug fs is destroyed, need to have a sane check if drm minor's debugfs root is still available or not, otherwise in case like device remove thr…
-
High 7.1
RDMA/siw: Fix immediate work request flush to completion queue
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix immediate work request flush to completion queue Correctly set send queue element opcode during immediate work request flushing in post sendqueue operation, if the QP is in ERRO…
-
High 7.1
octeontx2-af: Add validation for lmac type
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmac_type_id, etc. Kernel derives lmac…
-
High 7.0
powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix notifiers being shared by PCI and VIO buses fail_iommu_setup() registers the fail_iommu_bus_notifier struct to both PCI and VIO buses. struct notifier_block is a linked lis…
-
Unscored —
devlink: hold region lock when flushing snapshots
In the Linux kernel, the following vulnerability has been resolved: devlink: hold region lock when flushing snapshots Netdevsim triggers a splat on reload, when it destroys regions with snapshots pending: WARNING: CPU: 1 PID: 787 at net/core/devlink.c:6291 de…
-
Unscored —
clk: visconti: Fix memory leak in visconti_register_pll()
In the Linux kernel, the following vulnerability has been resolved: clk: visconti: Fix memory leak in visconti_register_pll() @pll->rate_table has allocated memory by kmemdup(), if clk_hw_register() fails, it should be freed, otherwise it will cause memory le…
-
Unscored —
wifi: mt76: mt7921e: fix rmmod crash in driver reload test
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921e: fix rmmod crash in driver reload test In insmod/rmmod stress test, the following crash dump shows up immediately. The problem is caused by missing mt76_dev in mt7921_pci_…
-
Unscored —
md/raid1: stop mdx_raid1 thread when raid1 array run failed
In the Linux kernel, the following vulnerability has been resolved: md/raid1: stop mdx_raid1 thread when raid1 array run failed fail run raid1 array when we assemble array with the inactive disk only, but the mdx_raid1 thread were not stop, Even if the associ…
-
Unscored —
wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out
In the Linux kernel, the following vulnerability has been resolved: wifi: ar5523: Fix use-after-free on ar5523_cmd() timed out syzkaller reported use-after-free with the stack trace like below [1]: [ 38.960489][ C3] ===========================================…
-
Unscored —
drm/amdgpu: fix pci device refcount leak
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix pci device refcount leak As comment of pci_get_domain_bus_and_slot() says, it returns a pci device with refcount increment, when finish using it, the caller must decrement the…
-
Unscored —
x86/apic: Don't disable x2APIC if locked
In the Linux kernel, the following vulnerability has been resolved: x86/apic: Don't disable x2APIC if locked The APIC supports two modes, legacy APIC (or xAPIC), and Extended APIC (or x2APIC). X2APIC mode is mostly compatible with legacy APIC, but it disables…
-
Unscored —
dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg
In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom-adm: fix wrong calling convention for prep_slave_sg The calling convention for pre_slave_sg is to return NULL on error and provide an error log to the system. Qcom-adm instead…
-
Unscored —
media: ipu3-imgu: Fix NULL pointer dereference in active selection access
In the Linux kernel, the following vulnerability has been resolved: media: ipu3-imgu: Fix NULL pointer dereference in active selection access What the IMGU driver did was that it first acquired the pointers to active and try V4L2 subdev state, and only then f…
-
Unscored —
bnxt_en: fix memory leak in bnxt_nvm_test()
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: fix memory leak in bnxt_nvm_test() Free the kzalloc'ed buffer before returning in the success path.
-
Unscored —
regulator: core: fix resource leak in regulator_register()
In the Linux kernel, the following vulnerability has been resolved: regulator: core: fix resource leak in regulator_register() I got some resource leak reports while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 100, of_no…
-
Unscored —
media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init()
In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Fix use-after-free in vidtv_bridge_dvb_init() KASAN reports a use-after-free: BUG: KASAN: use-after-free in dvb_dmxdev_release+0x4d5/0x5d0 [dvb_core] Call Trace: ... dvb_dmxdev_…
-
Unscored —
scsi: efct: Fix possible memleak in efct_device_init()
In the Linux kernel, the following vulnerability has been resolved: scsi: efct: Fix possible memleak in efct_device_init() In efct_device_init(), when efct_scsi_reg_fc_transport() fails, efct_scsi_tgt_driver_exit() is not called to release memory for efct_scs…
-
Unscored —
s390/lcs: Fix return type of lcs_start_xmit()
In the Linux kernel, the following vulnerability has been resolved: s390/lcs: Fix return type of lcs_start_xmit() With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer pr…
-
Unscored —
ksmbd: Fix resource leak in ksmbd_session_rpc_open()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix resource leak in ksmbd_session_rpc_open() When ksmbd_rpc_open() fails then it must call ksmbd_rpc_id_free() to undo the result of ksmbd_ipc_id_alloc().
-
Unscored —
ext4: silence the warning when evicting inode with dioread_nolock
In the Linux kernel, the following vulnerability has been resolved: ext4: silence the warning when evicting inode with dioread_nolock When evicting an inode with default dioread_nolock, it could be raced by the unwritten extents converting kworker after write…
-
Unscored —
crypto: akcipher - default implementation for setting a private key
In the Linux kernel, the following vulnerability has been resolved: crypto: akcipher - default implementation for setting a private key Changes from v1: * removed the default implementation from set_pub_key: it is assumed that an implementation must always ha…
-
Unscored —
usb: idmouse: fix an uninit-value in idmouse_open
In the Linux kernel, the following vulnerability has been resolved: usb: idmouse: fix an uninit-value in idmouse_open In idmouse_create_image, if any ftip_command fails, it will go to the reset label. However, this leads to the data in bulk_in_buffer[HEADER..…
-
Unscored —
nvmem: core: Fix memleak in nvmem_register()
In the Linux kernel, the following vulnerability has been resolved: nvmem: core: Fix memleak in nvmem_register() dev_set_name will alloc memory for nvmem->dev.kobj.name in nvmem_register, when nvmem_validate_keepouts failed, nvmem's memory will be freed and r…
-
Unscored —
wifi: mt76: do not run mt76u_status_worker if the device is not running
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: do not run mt76u_status_worker if the device is not running Fix the following NULL pointer dereference avoiding to run mt76u_status_worker thread if the device is not running yet.…
-
Unscored —
vhost-vdpa: fix an iotlb memory leak
In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: fix an iotlb memory leak Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB") we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during release to free al…
-
Unscored —
fs/ntfs3: Add null pointer check for inode operations
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add null pointer check for inode operations This adds a sanity check for the i_op pointer of the inode which is returned after reading Root directory MFT record. We should check the…
-
Unscored —
wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that …
-
Unscored —
media: imx-jpeg: Disable useless interrupt to avoid kernel panic
In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Disable useless interrupt to avoid kernel panic There is a hardware bug that the interrupt STMBUF_HALF may be triggered after or when disable interrupt. It may led to unexpec…
-
Unscored —
misc: ocxl: fix possible refcount leak in afu_ioctl()
In the Linux kernel, the following vulnerability has been resolved: misc: ocxl: fix possible refcount leak in afu_ioctl() eventfd_ctx_put need to be called to put the refcount that gotten by eventfd_ctx_fdget when ocxl_irq_set_handler fails.
-
Unscored —
erofs: Fix pcluster memleak when its block address is zero
In the Linux kernel, the following vulnerability has been resolved: erofs: Fix pcluster memleak when its block address is zero syzkaller reported a memleak: https://syzkaller.appspot.com/bug?id=62f37ff612f0021641eda5b17f056f1668aa9aed unreferenced object 0xff…
-
Unscored —
scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix hard lockup when reading the rx_monitor from debugfs During I/O and simultaneous cat of /sys/kernel/debug/lpfc/fnX/rx_monitor, a hard lockup similar to the call trace below ma…
-
Unscored —
ipc: mqueue: fix possible memory leak in init_mqueue_fs()
In the Linux kernel, the following vulnerability has been resolved: ipc: mqueue: fix possible memory leak in init_mqueue_fs() commit db7cfc380900 ("ipc: Free mq_sysctls if ipc namespace creation failed") Here's a similar memory leak to the one fixed by the pa…
-
Unscored —
acct: fix potential integer overflow in encode_comp_t()
In the Linux kernel, the following vulnerability has been resolved: acct: fix potential integer overflow in encode_comp_t() The integer overflow is descripted with following codes: > 317 static comp_t encode_comp_t(u64 value) > 318 { > 319 int exp, rnd; .....…
-
Unscored —
configfs: fix possible memory leak in configfs_create_dir()
In the Linux kernel, the following vulnerability has been resolved: configfs: fix possible memory leak in configfs_create_dir() kmemleak reported memory leaks in configfs_create_dir(): unreferenced object 0xffff888009f6af00 (size 192): comm "modprobe", pid 37…
-
Unscored —
apparmor: fix a memleak in multi_transaction_new()
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix a memleak in multi_transaction_new() In multi_transaction_new(), the variable t is not freed or passed out on the failure of copy_from_user(t->data, buf, size), which could lead…
-
Unscored —
media: i2c: ov5648: Free V4L2 fwnode data on unbind
In the Linux kernel, the following vulnerability has been resolved: media: i2c: ov5648: Free V4L2 fwnode data on unbind The V4L2 fwnode data structure doesn't get freed on unbind, which leads to a memleak.
-
Unscored —
drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix PCI device refcount leak in amdgpu_atrm_get_bios() As comment of pci_get_class() says, it returns a pci_device with its refcount increased and decreased the refcount for the i…
-
Unscored —
x86/xen: Fix memory leak in xen_init_lock_cpu()
In the Linux kernel, the following vulnerability has been resolved: x86/xen: Fix memory leak in xen_init_lock_cpu() In xen_init_lock_cpu(), the @name has allocated new string by kasprintf(), if bind_ipi_to_irqhandler() fails, it should be freed, otherwise may…
-
Unscored —
fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Avoid UBSAN error on true_sectors_per_clst() syzbot reported UBSAN error as below: [ 76.901829][ T6677] =============================================================================…
-
Unscored —
crypto: marvell/octeontx - prevent integer overflows
In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - prevent integer overflows The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do…
-
Unscored —
ipv6/sit: use DEV_STATS_INC() to avoid data-races
In the Linux kernel, the following vulnerability has been resolved: ipv6/sit: use DEV_STATS_INC() to avoid data-races syzbot/KCSAN reported that multiple cpus are updating dev->stats.tx_error concurrently. This is because sit tunnels are NETIF_F_LLTX, meaning…
-
Unscored —
RISC-V: kexec: Fix memory leak of elf header buffer
In the Linux kernel, the following vulnerability has been resolved: RISC-V: kexec: Fix memory leak of elf header buffer This is reported by kmemleak detector: unreferenced object 0xff2000000403d000 (size 4096): comm "kexec", pid 146, jiffies 4294900633 (age 6…
-
Unscored —
btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer
In the Linux kernel, the following vulnerability has been resolved: btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer syzbot is reporting uninit-value in btrfs_clean_tree_block() [1], for commit bc877d285ca3dba2 ("btrfs: Ded…
-
Unscored —
fbdev: smscufx: Fix several use-after-free bugs
In the Linux kernel, the following vulnerability has been resolved: fbdev: smscufx: Fix several use-after-free bugs Several types of UAFs can occur when physically removing a USB device. Adds ufx_ops_destroy() function to .fb_destroy of fb_ops, and in this fu…
-
Unscored —
scsi: smartpqi: Correct device removal for multi-actuator devices
In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Correct device removal for multi-actuator devices Correct device count for multi-actuator drives which can cause kernel panics.
-
Unscored —
mmc: mxcmmc: fix return value check of mmc_add_host()
In the Linux kernel, the following vulnerability has been resolved: mmc: mxcmmc: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, the memory that allocated in mmc_alloc_host() will be leaked and it will …
-
Unscored —
ocfs2: fix memory leak in ocfs2_mount_volume()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2_mount_volume() There is a memory leak reported by kmemleak: unreferenced object 0xffff88810cc65e60 (size 32): comm "mount.ocfs2", pid 23753, jiffies 4302528942…
-
Unscored —
rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state()
In the Linux kernel, the following vulnerability has been resolved: rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() Running rcutorture with non-zero fqs_duration module parameter in a kernel built with CONFIG_PREEMPTION=y results in …
-
Unscored —
netdevsim: fix memory leak in nsim_bus_dev_new()
In the Linux kernel, the following vulnerability has been resolved: netdevsim: fix memory leak in nsim_bus_dev_new() If device_register() failed in nsim_bus_dev_new(), the value of reference in nsim_bus_dev->dev is 1. obj->name in nsim_bus_dev->dev will not b…
-
Unscored —
ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt
In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt I got a null-ptr-defer error report when I do the following tests on the qemu platform: make defconfig and CONFIG_PARPORT=m, CO…
-
Unscored —
crypto: qat - fix DMA transfer direction
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix DMA transfer direction When CONFIG_DMA_API_DEBUG is selected, while running the crypto self test on the QAT crypto algorithms, the function add_dma_entry() reports a warning…
-
Unscored —
RDMA/hns: Fix refcount leak in hns_roce_mmap
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix refcount leak in hns_roce_mmap rdma_user_mmap_entry_get_pgoff() takes the reference. Add missing rdma_user_mmap_entry_put() to release the reference. Acked-by Haoyue Xu <xuhaoyu…
-
Unscored —
clk: st: Fix memory leak in st_of_quadfs_setup()
In the Linux kernel, the following vulnerability has been resolved: clk: st: Fix memory leak in st_of_quadfs_setup() If st_clk_register_quadfs_pll() fails, @lock should be freed before goto @err_exit, otherwise will cause meory leak issue, fix it.
-
Unscored —
net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe
In the Linux kernel, the following vulnerability has been resolved: net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe of_phy_find_device() return device node with refcount incremented. Call put_device() to relese it when not needed anymore.
-
Unscored —
fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL
In the Linux kernel, the following vulnerability has been resolved: fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL With CONFIG_FORTIFY=y and CONFIG_UBSAN_LOCAL_BOUNDS=y enabled, we observe a runtime panic while running Android's Compatibility Te…
-
Unscored —
orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
In the Linux kernel, the following vulnerability has been resolved: orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string() When insert and remove the orangefs module, then debug_help_string will be leaked: unreferenced object 0xffff8881652ba000 (siz…
-
Unscored —
amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table()
In the Linux kernel, the following vulnerability has been resolved: amdgpu/pm: prevent array underflow in vega20_odn_edit_dpm_table() In the PP_OD_EDIT_VDDC_CURVE case the "input_index" variable is capped at 2 but not checked for negative values so it results…
-
Unscored —
ext4: fix bug_on in __es_tree_search caused by bad quota inode
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search caused by bad quota inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extents_statu…
-
Unscored —
mptcp: use proper req destructor for IPv6
In the Linux kernel, the following vulnerability has been resolved: mptcp: use proper req destructor for IPv6 Before, only the destructor from TCP request sock in IPv4 was called even if the subflow was IPv6. It is important to use the right destructor to avo…
-
Unscored —
spmi: Add a check for remove callback when removing a SPMI driver
In the Linux kernel, the following vulnerability has been resolved: spmi: Add a check for remove callback when removing a SPMI driver When removing a SPMI driver, there can be a crash due to NULL pointer dereference if it does not have a remove callback defin…
-
Unscored —
audit: fix possible soft lockup in __audit_inode_child()
In the Linux kernel, the following vulnerability has been resolved: audit: fix possible soft lockup in __audit_inode_child() Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. C…
-
Unscored —
drm/rockchip: dw_hdmi: cleanup drm encoder during unbind
In the Linux kernel, the following vulnerability has been resolved: drm/rockchip: dw_hdmi: cleanup drm encoder during unbind This fixes a use-after-free crash during rmmod. The DRM encoder is embedded inside the larger rockchip_hdmi, which is allocated with t…
-
Unscored —
rpmsg: glink: Add check for kstrdup
In the Linux kernel, the following vulnerability has been resolved: rpmsg: glink: Add check for kstrdup Add check for the return value of kstrdup() and return the error if it fails in order to avoid NULL pointer dereference.
-
Unscored —
net: do not allow gso_size to be set to GSO_BY_FRAGS
In the Linux kernel, the following vulnerability has been resolved: net: do not allow gso_size to be set to GSO_BY_FRAGS One missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again [1] Do not allow gso_size to be set to GSO_BY_FRAGS (0x…
-
Unscored —
wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU txs may be dropped if the frame is aggregated in AMSDU. When the problem shows up, some SKBs would be hold in driver to cause network …
-
Unscored —
wifi: iwlwifi: pcie: fix possible NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: fix possible NULL pointer dereference It is possible that iwl_pci_probe() will fail and free the trans, then afterwards iwl_pci_remove() will be called and crash by tryin…
-
Unscored —CVE-2023-54054 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
RDMA/irdma: Fix memory leak of PBLE objects
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix memory leak of PBLE objects On rmmod of irdma, the PBLE object memory is not being freed. PBLE object memory are not statically pre-allocated at function initialization time u…
-
Unscored —
kheaders: Use array declaration instead of char
In the Linux kernel, the following vulnerability has been resolved: kheaders: Use array declaration instead of char Under CONFIG_FORTIFY_SOURCE, memcpy() will check the size of destination and source buffers. Defining kernel_headers_data as "char" would trip …
-
Unscored —
iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter The 'acpiid' buffer in the parse_ivrs_acpihid function may overflow, because the string specifier in the format …
-
Unscored —
firmware: arm_ffa: Check if ffa_driver remove is present before executing
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Check if ffa_driver remove is present before executing Currently ffa_drv->remove() is called unconditionally from ffa_device_remove(). Since the driver registration doesn't…
-
Unscored —
soc: mediatek: mtk-svs: Enable the IRQ later
In the Linux kernel, the following vulnerability has been resolved: soc: mediatek: mtk-svs: Enable the IRQ later If the system does not come from reset (like when is booted via kexec()), the peripheral might triger an IRQ before the data structures are initia…
-
Unscored —CVE-2023-54061 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ipmi:ssif: Fix a memory leak when scanning for an adapter
In the Linux kernel, the following vulnerability has been resolved: ipmi:ssif: Fix a memory leak when scanning for an adapter The adapter scan ssif_info_find() sets info->adapter_name if the adapter info came from SMBIOS, as it's not set in that case. However…
-
Unscored —
media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer
In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb-v2: gl861: Fix null-ptr-deref in gl861_i2c_master_xfer In gl861_i2c_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg…
-
Unscored —
ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow
In the Linux kernel, the following vulnerability has been resolved: ext4: fix BUG in ext4_mb_new_inode_pa() due to overflow When we calculate the end position of ext4_free_extent, this position may be exactly where ext4_lblk_t (i.e. uint) overflows. For examp…
-
Unscored —
igb: clean up in all error paths when enabling SR-IOV
In the Linux kernel, the following vulnerability has been resolved: igb: clean up in all error paths when enabling SR-IOV After commit 50f303496d92 ("igb: Enable SR-IOV after reinit"), removing the igb module could hang or crash (depending on the machine) whe…
-
Unscored —
ALSA: pcm: Fix potential data race at PCM memory allocation helpers
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential data race at PCM memory allocation helpers The PCM memory allocation helpers have a sanity check against too many buffer allocations. However, the check is performed …
-
Unscored —
tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site
In the Linux kernel, the following vulnerability has been resolved: tpm: Add !tpm_amd_is_rng_defective() to the hwrng_unregister() call site The following crash was reported: [ 1950.279393] list_del corruption, ffff99560d485790->next is NULL [ 1950.279400] --…
-
Unscored —
ASoC: mediatek: common: Fix refcount leak in parse_dai_link_info
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: common: Fix refcount leak in parse_dai_link_info Add missing of_node_put()s before the returns to balance of_node_get()s and of_node_put()s, which may get unbalanced in case t…
-
Unscored —
media: max9286: Free control handler
In the Linux kernel, the following vulnerability has been resolved: media: max9286: Free control handler The control handler is leaked in some probe-time error paths, as well as in the remove path. Fix it.
-
Unscored —
btrfs: zoned: skip splitting and logical rewriting on pre-alloc write
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: skip splitting and logical rewriting on pre-alloc write When doing a relocation, there is a chance that at the time of btrfs_reloc_clone_csums(), there is no checksum for the co…
-
Unscored —
xen: speed up grant-table reclaim
In the Linux kernel, the following vulnerability has been resolved: xen: speed up grant-table reclaim When a grant entry is still in use by the remote domain, Linux must put it on a deferred list. Normally, this list is very short, because the PV network and …
-
Unscored —CVE-2023-54082 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ALSA: firewire-digi00x: prevent potential use after free
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-digi00x: prevent potential use after free This code was supposed to return an error code if init_stream() failed, but it instead freed dg00x->rx_stream and returned success. Th…
-
Unscored —
bpf: Add preempt_count_{sub,add} into btf id deny list
In the Linux kernel, the following vulnerability has been resolved: bpf: Add preempt_count_{sub,add} into btf id deny list The recursion check in __bpf_prog_enter* and __bpf_prog_exit* leave preempt_count_{sub,add} unprotected. When attaching trampoline to th…
-
Unscored —
ubi: Fix possible null-ptr-deref in ubi_free_volume()
In the Linux kernel, the following vulnerability has been resolved: ubi: Fix possible null-ptr-deref in ubi_free_volume() It willl cause null-ptr-deref in the following case: uif_init() ubi_add_volume() cdev_add() -> if it fails, call kill_volumes() device_re…
-
Unscored —
virtio_pmem: add the missing REQ_OP_WRITE for flush bio
In the Linux kernel, the following vulnerability has been resolved: virtio_pmem: add the missing REQ_OP_WRITE for flush bio When doing mkfs.xfs on a pmem device, the following warning was ------------[ cut here ]------------ WARNING: CPU: 2 PID: 384 at block/…
-
Unscored —
drm/client: Fix memory leak in drm_client_target_cloned
In the Linux kernel, the following vulnerability has been resolved: drm/client: Fix memory leak in drm_client_target_cloned dmt_mode is allocated and never freed in this function. It was found with the ast driver, but most drivers using generic fbdev setup ar…
-
Unscored —
media: anysee: fix null-ptr-deref in anysee_master_xfer
In the Linux kernel, the following vulnerability has been resolved: media: anysee: fix null-ptr-deref in anysee_master_xfer In anysee_master_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be …
-
Unscored —
regulator: stm32-pwr: fix of_iomap leak
In the Linux kernel, the following vulnerability has been resolved: regulator: stm32-pwr: fix of_iomap leak Smatch reports: drivers/regulator/stm32-pwr.c:166 stm32_pwr_regulator_probe() warn: 'base' from of_iomap() not released on lines: 151,166. In stm32_pwr…
-
Unscored —
fs: Protect reconfiguration of sb read-write from racing writes
In the Linux kernel, the following vulnerability has been resolved: fs: Protect reconfiguration of sb read-write from racing writes The reconfigure / remount code takes a lot of effort to protect filesystem's reconfiguration code from racing writes on remount…
-
Unscored —
driver: soc: xilinx: use _safe loop iterator to avoid a use after free
In the Linux kernel, the following vulnerability has been resolved: driver: soc: xilinx: use _safe loop iterator to avoid a use after free The hash_for_each_possible() loop dereferences "eve_data" to get the next item on the list. However the loop frees eve_d…
-
Unscored —
scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow A static code analysis tool flagged the possibility of buffer overflow when using copy_from_user() for a debugfs entry. Curre…
-
Unscored —CVE-2023-54103 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
can: isotp: check CAN address family in isotp_bind()
In the Linux kernel, the following vulnerability has been resolved: can: isotp: check CAN address family in isotp_bind() Add missing check to block non-AF_CAN binds. Syzbot created some code which matched the right sockaddr struct size but used AF_XDP (0x2C) …
-
Unscored —
net/mlx5: fix potential memory leak in mlx5e_init_rep_rx
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: fix potential memory leak in mlx5e_init_rep_rx The memory pointed to by the priv->rx_res pointer is not freed in the error path of mlx5e_init_rep_rx, which can lead to a memory leak…
-
Unscored —
scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests The following message and call trace was seen with debug kernels: DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map er…
-
Unscored —
media: rcar_fdp1: Fix refcount leak in probe and remove function
In the Linux kernel, the following vulnerability has been resolved: media: rcar_fdp1: Fix refcount leak in probe and remove function rcar_fcp_get() take reference, which should be balanced with rcar_fcp_put(). Add missing rcar_fcp_put() in fdp1_remove and the…
-
Unscored —
usb: rndis_host: Secure rndis_query check against int overflow
In the Linux kernel, the following vulnerability has been resolved: usb: rndis_host: Secure rndis_query check against int overflow Variables off and len typed as uint32 in rndis_query function are controlled by incoming RNDIS response message thus their value…
-
Unscored —
pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups
In the Linux kernel, the following vulnerability has been resolved: pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups of_find_node_by_phandle() returns a node pointer with refcount incremented, We should use of_node_put() on it when not ne…
-
Unscored —
kcm: Fix memory leak in error path of kcm_sendmsg()
In the Linux kernel, the following vulnerability has been resolved: kcm: Fix memory leak in error path of kcm_sendmsg() syzbot reported a memory leak like below: BUG: memory leak unreferenced object 0xffff88810b088c00 (size 240): comm "syz-executor186", pid 5…
-
Unscored —
rcu: dump vmalloc memory info safely
In the Linux kernel, the following vulnerability has been resolved: rcu: dump vmalloc memory info safely Currently, for double invoke call_rcu(), will dump rcu_head objects memory info, if the objects is not allocated from the slab allocator, the vmalloc_dump…
-
Unscored —
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()
In the Linux kernel, the following vulnerability has been resolved: net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() As the call trace shows, skb_panic was caused by wrong skb->mac_header in nsh_gso_segment(): invalid opcode: 0000 [#1] …
-
Unscored —
pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db()
In the Linux kernel, the following vulnerability has been resolved: pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() When nonstatic_release_resource_db() frees all resources associated with an PCMCIA socket, it forgets to free socket…
-
Unscored —
s390/dcssblk: fix kernel crash with list_add corruption
In the Linux kernel, the following vulnerability has been resolved: s390/dcssblk: fix kernel crash with list_add corruption Commit fb08a1908cb1 ("dax: simplify the dax_device <-> gendisk association") introduced new logic for gendisk association, requiring dr…
-
Unscored —
serial: sc16is7xx: setup GPIO controller later in probe
In the Linux kernel, the following vulnerability has been resolved: serial: sc16is7xx: setup GPIO controller later in probe The GPIO controller component of the sc16is7xx driver is setup too early, which can result in a race condition where another device tri…
-
Unscored —
inotify: Avoid reporting event with invalid wd
In the Linux kernel, the following vulnerability has been resolved: inotify: Avoid reporting event with invalid wd When inotify_freeing_mark() races with inotify_handle_inode_event() it can happen that inotify_handle_inode_event() sees that i_mark->wd got alr…
-
Unscored —
drm/msm/dpu: Add check for cstate
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add check for cstate As kzalloc may fail and return NULL pointer, it should be better to check cstate in order to avoid the NULL pointer dereference in __drm_atomic_helper_crtc_r…
-
Unscored —
md/raid10: fix memleak for 'conf->bio_split'
In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix memleak for 'conf->bio_split' In the error path of raid10_run(), 'conf' need be freed, however, 'conf->bio_split' is missed and memory will be leaked. Since there are 3 places …
-
Unscored —
crypto: safexcel - Cleanup ring IRQ workqueues on load failure
In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel - Cleanup ring IRQ workqueues on load failure A failure loading the safexcel driver results in the following warning on boot, because the IRQ affinity has not been correctly …
-
Unscored —
wifi: rt2x00: Fix memory leak when handling surveys
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: Fix memory leak when handling surveys When removing a rt2x00 device, its associated channel surveys are not freed, causing a memory leak observable with kmemleak: unreferenced o…
-
Unscored —
nfp: clean mc addresses in application firmware when closing port
In the Linux kernel, the following vulnerability has been resolved: nfp: clean mc addresses in application firmware when closing port When moving devices from one namespace to another, mc addresses are cleaned in software while not removed from application fi…
-
Unscored —
autofs: fix memory leak of waitqueues in autofs_catatonic_mode
In the Linux kernel, the following vulnerability has been resolved: autofs: fix memory leak of waitqueues in autofs_catatonic_mode Syzkaller reports a memory leak: BUG: memory leak unreferenced object 0xffff88810b279e00 (size 96): comm "syz-executor399", pid …
-
Unscored —
serial: sprd: Fix DMA buffer leak issue
In the Linux kernel, the following vulnerability has been resolved: serial: sprd: Fix DMA buffer leak issue Release DMA buffer when _probe() returns failure to avoid memory leak.
-
Unscored —
vfio/type1: fix cap_migration information leak
In the Linux kernel, the following vulnerability has been resolved: vfio/type1: fix cap_migration information leak Fix an information leak where an uninitialized hole in struct vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace. The defi…
-
Unscored —
drm/msm: fix NULL-deref on irq uninstall
In the Linux kernel, the following vulnerability has been resolved: drm/msm: fix NULL-deref on irq uninstall In case of early initialisation errors and on platforms that do not use the DPU controller, the deinitilisation code can be called with the kms pointe…
-
Unscored —
wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018 During sending data after clients connected, hw_ops->get_ring_selector() will be called. But for IPQ5018, this member isn't s…
-
Unscored —
media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init()
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: fix resource leaks in vdec_msg_queue_init() If we encounter any error in the vdec_msg_queue_init() then we need to set "msg_queue->wdma_addr.size = 0;". Normally, thi…
-
Unscored —
drm/amdkfd: Fix kernel warning during topology setup
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix kernel warning during topology setup This patch fixes the following kernel warning seen during driver load by correctly initializing the p2plink attr before creating the sysfs…
-
Unscored —
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
In the Linux kernel, the following vulnerability has been resolved: bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log It's trivial for user to trigger "verifier log line truncated" warning, as verifier has a fixed-sized buffer of 1024 bytes (a…
-
Unscored —
x86/kexec: Fix double-free of elf header buffer
In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix double-free of elf header buffer After b3e34a47f989 ("x86/kexec: fix memory leak of elf header buffer"), freeing image->elf_headers in the error path of crash_load_segments() i…
-
Unscored —
media: platform: mtk-mdp3: Add missing check and free for ida_alloc
In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Add missing check and free for ida_alloc Add the check for the return value of the ida_alloc in order to avoid NULL pointer dereference. Moreover, free allocated "c…
-
Unscored —
net/mlx5e: Move representor neigh cleanup to profile cleanup_tx
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor neigh cleanup to profile cleanup_tx For IP tunnel encapsulation in ECMP (Equal-Cost Multipath) mode, as the flow is duplicated to the peer eswitch, the related nei…
-
Unscored —
drm/amd: Fix an out of bounds error in BIOS parser
In the Linux kernel, the following vulnerability has been resolved: drm/amd: Fix an out of bounds error in BIOS parser The array is hardcoded to 8 in atomfirmware.h, but firmware provides a bigger one sometimes. Deferencing the larger array causes an out of b…
-
Unscored —
can: j1939: prevent deadlock by moving j1939_sk_errqueue()
In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by moving j1939_sk_errqueue() This commit addresses a deadlock situation that can occur in certain scenarios, such as when running data TP/ETP transfer and subscr…
-
Unscored —
scsi: target: core: Fix target_cmd_counter leak
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Fix target_cmd_counter leak The target_cmd_counter struct allocated via target_alloc_cmd_counter() is never freed, resulting in leaks across various transport types, e.g.:…
-
Unscored —
net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail()
In the Linux kernel, the following vulnerability has been resolved: net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() Syzkaller reported the following issue: ======================================= Too BIG xdp->frame_sz = 131072 WARNING: C…
-
Unscored —
btrfs: don't free qgroup space unless specified
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't free qgroup space unless specified Boris noticed in his simple quotas testing that he was getting a leak with Sweet Tea's change to subvol create that stopped doing a transaction…
-
Unscored —
usb: mtu3: fix kernel panic at qmu transfer done irq handler
In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu->lock before give back request, if another thread handle disconnect event at the…
-
Unscored —
firmware: arm_sdei: Fix sleep from invalid context BUG
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_sdei: Fix sleep from invalid context BUG Running a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra triggers: BUG: sleeping function called from invalid context at kern…
-
Unscored —CVE-2023-54161 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
arm64/pageattr: Propagate return value from __change_memory_common
In the Linux kernel, the following vulnerability has been resolved: arm64/pageattr: Propagate return value from __change_memory_common The rodata=on security measure requires that any code path which does vmalloc -> set_memory_ro/set_memory_rox must protect t…
-
Unscored —
wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix null pointer deref in mt7996_conf_tx() If a link does not have an assigned channel yet, mt7996_vif_link returns NULL. We still need to store the updated queue settings…
-
Unscored —
PM / devfreq: hisi: Fix potential UAF in OPP handling
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: hisi: Fix potential UAF in OPP handling Ensure all required data is acquired before calling dev_pm_opp_put(opp) to maintain correct resource acquisition and release order.
-
Unscored —
ima: Handle error code returned by ima_filter_rule_match()
In the Linux kernel, the following vulnerability has been resolved: ima: Handle error code returned by ima_filter_rule_match() In ima_match_rules(), if ima_filter_rule_match() returns -ENOENT due to the rule being NULL, the function incorrectly skips the 'if …
-
Unscored —
bpf: Fix invalid prog->stats access when update_effective_progs fails
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix invalid prog->stats access when update_effective_progs fails Syzkaller triggers an invalid memory access issue following fault injection in update_effective_progs. The issue can be d…
-
Unscored —
mshv: Fix create memory region overlap check
In the Linux kernel, the following vulnerability has been resolved: mshv: Fix create memory region overlap check The current check is incorrect; it only checks if the beginning or end of a region is within an existing region. This doesn't account for userspac…
-
Unscored —
bpf: Free special fields when update [lru_,]percpu_hash maps
In the Linux kernel, the following vulnerability has been resolved: bpf: Free special fields when update [lru_,]percpu_hash maps As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' could ca…
-
Unscored —
usb: potential integer overflow in usbg_make_tpg()
In the Linux kernel, the following vulnerability has been resolved: usb: potential integer overflow in usbg_make_tpg() The variable tpgt in usbg_make_tpg() is defined as unsigned long and is assigned to tpgt->tport_tpgt, which is defined as u16. This may caus…
Revision history
-
#101
Neue Updates von Debian aufgenommen
-
#100
Neue Updates von Ubuntu aufgenommen
-
#99
Neue Updates von SUSE aufgenommen
-
#98
Neue Updates von IBM aufgenommen
-
#97
Neue Updates von Debian aufgenommen
-
#96
Neue Updates von Red Hat aufgenommen
-
#95
Neue Updates von Red Hat aufgenommen
-
#94
Neue Updates von Red Hat aufgenommen
-
#93
Neue Updates von Red Hat aufgenommen
-
#92
Neue Updates von Red Hat aufgenommen
-
#91
Neue Updates von Red Hat aufgenommen
-
#90
Neue Updates von Debian aufgenommen
-
#89
Neue Updates von IBM aufgenommen
-
#88
Neue Updates von Ubuntu aufgenommen
-
#87
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#86
Neue Updates von IBM aufgenommen
-
#85
Neue Updates von Oracle Linux aufgenommen
-
#84
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#83
Neue Updates von Red Hat aufgenommen
-
#82
Neue Updates von Ubuntu aufgenommen
-
#81
Neue Updates von Oracle Linux und Rocky Enterprise Software Foundation aufgenommen
-
#80
Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen
-
#79
Neue Updates von Red Hat aufgenommen
-
#78
Neue Updates von Oracle Linux aufgenommen
-
#77
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
References
-
Kernel CVE Announce Mailingliste
https://lore.kernel.org/linux-cve-announce/
-
Linux Kernel CVE Announcement CVE-2022-50712
https://lore.kernel.org/linux-cve-announce/2025122412-CVE-2022-50712-6c0d@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50713
https://lore.kernel.org/linux-cve-announce/2025122414-CVE-2022-50713-24cc@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50714
https://lore.kernel.org/linux-cve-announce/2025122415-CVE-2022-50714-32b3@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50715
https://lore.kernel.org/linux-cve-announce/2025122415-CVE-2022-50715-5640@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50716
https://lore.kernel.org/linux-cve-announce/2025122415-CVE-2022-50716-88e6@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50717
https://lore.kernel.org/linux-cve-announce/2025122416-CVE-2022-50717-dc68@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50718
https://lore.kernel.org/linux-cve-announce/2025122416-CVE-2022-50718-a890@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50719
https://lore.kernel.org/linux-cve-announce/2025122416-CVE-2022-50719-02d8@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50720
https://lore.kernel.org/linux-cve-announce/2025122417-CVE-2022-50720-0297@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50721
https://lore.kernel.org/linux-cve-announce/2025122417-CVE-2022-50721-9683@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50722
https://lore.kernel.org/linux-cve-announce/2025122417-CVE-2022-50722-06c7@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50723
https://lore.kernel.org/linux-cve-announce/2025122417-CVE-2022-50723-a62d@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50724
https://lore.kernel.org/linux-cve-announce/2025122418-CVE-2022-50724-f625@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50725
https://lore.kernel.org/linux-cve-announce/2025122418-CVE-2022-50725-967f@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50726
https://lore.kernel.org/linux-cve-announce/2025122418-CVE-2022-50726-2f42@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50727
https://lore.kernel.org/linux-cve-announce/2025122419-CVE-2022-50727-95aa@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50728
https://lore.kernel.org/linux-cve-announce/2025122419-CVE-2022-50728-afa8@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50729
https://lore.kernel.org/linux-cve-announce/2025122419-CVE-2022-50729-f996@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50730
https://lore.kernel.org/linux-cve-announce/2025122420-CVE-2022-50730-a4ca@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50731
https://lore.kernel.org/linux-cve-announce/2025122420-CVE-2022-50731-a78b@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50732
https://lore.kernel.org/linux-cve-announce/2025122420-CVE-2022-50732-042c@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50733
https://lore.kernel.org/linux-cve-announce/2025122421-CVE-2022-50733-a587@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50734
https://lore.kernel.org/linux-cve-announce/2025122421-CVE-2022-50734-96fa@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50735
https://lore.kernel.org/linux-cve-announce/2025122421-CVE-2022-50735-2929@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50736
https://lore.kernel.org/linux-cve-announce/2025122422-CVE-2022-50736-1cb3@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50737
https://lore.kernel.org/linux-cve-announce/2025122447-CVE-2022-50737-45ae@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50738
https://lore.kernel.org/linux-cve-announce/2025122447-CVE-2022-50738-d561@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50739
https://lore.kernel.org/linux-cve-announce/2025122448-CVE-2022-50739-f061@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50740
https://lore.kernel.org/linux-cve-announce/2025122448-CVE-2022-50740-a780@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50741
https://lore.kernel.org/linux-cve-announce/2025122448-CVE-2022-50741-1736@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50742
https://lore.kernel.org/linux-cve-announce/2025122449-CVE-2022-50742-e130@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50743
https://lore.kernel.org/linux-cve-announce/2025122449-CVE-2022-50743-8e63@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50744
https://lore.kernel.org/linux-cve-announce/2025122449-CVE-2022-50744-bc80@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50745
https://lore.kernel.org/linux-cve-announce/2025122450-CVE-2022-50745-af5c@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50746
https://lore.kernel.org/linux-cve-announce/2025122450-CVE-2022-50746-7cbf@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50747
https://lore.kernel.org/linux-cve-announce/2025122450-CVE-2022-50747-8937@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50748
https://lore.kernel.org/linux-cve-announce/2025122451-CVE-2022-50748-0136@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50749
https://lore.kernel.org/linux-cve-announce/2025122451-CVE-2022-50749-dae0@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50750
https://lore.kernel.org/linux-cve-announce/2025122451-CVE-2022-50750-5395@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50751
https://lore.kernel.org/linux-cve-announce/2025122452-CVE-2022-50751-b5ed@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50752
https://lore.kernel.org/linux-cve-announce/2025122452-CVE-2022-50752-fa82@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50753
https://lore.kernel.org/linux-cve-announce/2025122452-CVE-2022-50753-6266@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50754
https://lore.kernel.org/linux-cve-announce/2025122453-CVE-2022-50754-ec9a@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50755
https://lore.kernel.org/linux-cve-announce/2025122453-CVE-2022-50755-f5d8@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50756
https://lore.kernel.org/linux-cve-announce/2025122453-CVE-2022-50756-ce43@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50757
https://lore.kernel.org/linux-cve-announce/2025122454-CVE-2022-50757-15f0@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50758
https://lore.kernel.org/linux-cve-announce/2025122454-CVE-2022-50758-800b@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50759
https://lore.kernel.org/linux-cve-announce/2025122454-CVE-2022-50759-747e@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50760
https://lore.kernel.org/linux-cve-announce/2025122455-CVE-2022-50760-b793@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50761
https://lore.kernel.org/linux-cve-announce/2025122455-CVE-2022-50761-0e67@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50762
https://lore.kernel.org/linux-cve-announce/2025122455-CVE-2022-50762-282c@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50763
https://lore.kernel.org/linux-cve-announce/2025122456-CVE-2022-50763-923e@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50764
https://lore.kernel.org/linux-cve-announce/2025122456-CVE-2022-50764-45eb@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50765
https://lore.kernel.org/linux-cve-announce/2025122456-CVE-2022-50765-356e@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50766
https://lore.kernel.org/linux-cve-announce/2025122456-CVE-2022-50766-0964@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50767
https://lore.kernel.org/linux-cve-announce/2025122457-CVE-2022-50767-9a13@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50768
https://lore.kernel.org/linux-cve-announce/2025122457-CVE-2022-50768-2703@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50769
https://lore.kernel.org/linux-cve-announce/2025122457-CVE-2022-50769-f4db@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50770
https://lore.kernel.org/linux-cve-announce/2025122458-CVE-2022-50770-ba3b@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50771
https://lore.kernel.org/linux-cve-announce/2025122458-CVE-2022-50771-3440@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50772
https://lore.kernel.org/linux-cve-announce/2025122458-CVE-2022-50772-774d@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50773
https://lore.kernel.org/linux-cve-announce/2025122459-CVE-2022-50773-b946@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50774
https://lore.kernel.org/linux-cve-announce/2025122459-CVE-2022-50774-73eb@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50775
https://lore.kernel.org/linux-cve-announce/2025122459-CVE-2022-50775-6733@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50776
https://lore.kernel.org/linux-cve-announce/2025122400-CVE-2022-50776-f275@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50777
https://lore.kernel.org/linux-cve-announce/2025122400-CVE-2022-50777-d1e3@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50778
https://lore.kernel.org/linux-cve-announce/2025122400-CVE-2022-50778-0b9a@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50779
https://lore.kernel.org/linux-cve-announce/2025122401-CVE-2022-50779-fa1d@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50780
https://lore.kernel.org/linux-cve-announce/2025122401-CVE-2022-50780-bc90@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50781
https://lore.kernel.org/linux-cve-announce/2025122401-CVE-2022-50781-3d18@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50782
https://lore.kernel.org/linux-cve-announce/2025122402-CVE-2022-50782-d849@gregkh/
-
Linux Kernel CVE Announcement CVE-2022-50783
https://lore.kernel.org/linux-cve-announce/2025122402-CVE-2022-50783-3109@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-54043
https://lore.kernel.org/linux-cve-announce/2025122422-CVE-2023-54043-16c8@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-54044
https://lore.kernel.org/linux-cve-announce/2025122422-CVE-2023-54044-61d9@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-54045
https://lore.kernel.org/linux-cve-announce/2025122423-CVE-2023-54045-e0ff@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-54046
https://lore.kernel.org/linux-cve-announce/2025122423-CVE-2023-54046-aaf6@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-54047
https://lore.kernel.org/linux-cve-announce/2025122423-CVE-2023-54047-42ff@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-54048
https://lore.kernel.org/linux-cve-announce/2025122424-CVE-2023-54048-ea7d@gregkh/
-
Linux Kernel CVE Announcement CVE-2023-54049
https://lore.kernel.org/linux-cve-announce/2025122424-CVE-2023-54049-79f7@gregkh/