20,182 results · Feed
-
High 7.8
tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()
In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy() TIPC UDP media bearer teardown calls dst_cache_destroy() on its replicast caches before calling synchronize_net() to wai…
-
Unscored —
ALSA: FCP: Fix NULL pointer dereference in interface lookup
In the Linux kernel, the following vulnerability has been resolved: ALSA: FCP: Fix NULL pointer dereference in interface lookup A malformed USB device can provide a vendor-specific interface without any endpoint descriptors. fcp_find_fc_interface() currently …
-
Unscored —
bpf: Fix insn_aux_data leak on verifier err_free_env path
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix insn_aux_data leak on verifier err_free_env path When bpf_check() allocates env->insn_aux_data successfully but later fails to allocate env->succ, it jumps directly to err_free_env. …
-
Unscored —
bpf: Mask pseudo pointer values in verifier logs
In the Linux kernel, the following vulnerability has been resolved: bpf: Mask pseudo pointer values in verifier logs print_bpf_insn() masks ldimm64 immediates for pointer-bearing pseudo sources when pointer leaks are not allowed, but the mask only covers BPF_…
-
High 7.8
seg6: validate SRH length before reading fixed fields
In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6_validate_srh() reads fixed SRH fields such as srh->type and srh->hdrlen before checking that the supplied length covers the fixed st…
-
Critical 9.8
net: enetc: check the number of BDs needed for xdp_frame
In the Linux kernel, the following vulnerability has been resolved: net: enetc: check the number of BDs needed for xdp_frame The size of xdp_redirect_arr array is ENETC_MAX_SKB_FRAGS. However, the number of fragments contained in xdp_frame may be greater than…
-
Critical 9.8
sctp: add INIT verification after cookie unpacking
In the Linux kernel, the following vulnerability has been resolved: sctp: add INIT verification after cookie unpacking In SCTP handshake, the INIT chunk is initially processed by the server and embedded into the cookie carried in INIT-ACK. The client then ret…
-
High 7.1
hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid() pmbus_data2reg_vid() hardcoded the VR11 encoding regardless of the vrm_version configured by the driver, while pmbus_reg2data_vid…
-
Unscored —
hwmon: adm1275: Prevent reading uninitialized stack
In the Linux kernel, the following vulnerability has been resolved: hwmon: adm1275: Prevent reading uninitialized stack While adding support for the ROHM BD127X0 hot-swap controllers, sashiko reported an error in device-name comparison, which can lead to read…
-
High 7.1
hwmon: (pmbus) Fix passing events to regulator core
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus) Fix passing events to regulator core Sashiko reports: Commit 754bd2b4a084 ("hwmon: (pmbus/core) Protect regulator operations with mutex") introduced a worker to batch regulator…
-
Critical 9.8
eth: fbnic: don't cache shinfo across skb realloc
In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic_tx_lso() calls skb_cow_head() which may reallocate the skb including the shared info. We can't use the pointer calculated before the ca…
-
Unscored —
hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero
In the Linux kernel, the following vulnerability has been resolved: hwmon: (aspeed-g6-pwm-tach) Guard fan RPM calculation against divide-by-zero Sashiko reports: In the aspeed-g6-pwm-tacho driver, the aspeed_tach_val_to_rpm() function calculates the fan RPM u…
-
Unscored —
ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump
In the Linux kernel, the following vulnerability has been resolved: ipv6: fib6: fix NULL deref in fib6_walk_continue() on multi-batch dump inet6_dump_fib() saves its progress in cb->args[1] as a positional index within the current hash chain. Between batches,…
-
High 7.8
net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF The teql master->slaves singly linked list is not protected against multiple writes. It can be mod'ed concurently fr…
-
Unscored —
net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy
In the Linux kernel, the following vulnerability has been resolved: net: phy: sfp: free mii_bus in sfp_i2c_mdiobus_destroy sfp_i2c_mdiobus_create() allocates the I2C MDIO bus with mdio_i2c_alloc(), a plain (non-devm) allocation, and registers it. sfp_i2c_mdio…
-
High 7.8
bridge: stp: Fix a potential use-after-free when deleting a bridge
In the Linux kernel, the following vulnerability has been resolved: bridge: stp: Fix a potential use-after-free when deleting a bridge The three STP timers are not supposed to be armed while the bridge is administratively down. They are synchronously deactiva…
-
Unscored —
drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom()
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix potential invalid pointer deref in group_process_tiler_oom() If heaps is an ERR_PTR(), panthor_heap_pool_put() will deref an invalid pointer. Make sure we set it to NULL in t…
-
Unscored —
drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock Since dma_fence objects can be shared with other subsystems, they may be accessed from hardirq context in those driv…
-
Unscored —
drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix a leak when a group is evicted before the tiler OOM is serviced A group ref is tied to the pending tiler_oom_work, so we need to release it if the cancel was effective.
-
Unscored —
tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry()
In the Linux kernel, the following vulnerability has been resolved: tracing/fprobe: Fix NULL pointer dereference in fprobe_fgraph_entry() fprobe_fgraph_entry() sizes a shadow-stack reservation in one walk of the per-ip fprobe list and fills it in a second wal…
-
Unscored —
irqchip/ts4800: Fix missing chained handler cleanup on remove
In the Linux kernel, the following vulnerability has been resolved: irqchip/ts4800: Fix missing chained handler cleanup on remove The driver installs a chained handler for the parent interrupt during probe using irq_set_chained_handler_and_data(), but the rem…
-
High 8.8
ksmbd: reject undersized DACLs before parsing ACEs
In the Linux kernel, the following vulnerability has been resolved: ksmbd: reject undersized DACLs before parsing ACEs parse_dacl() limits the attacker-controlled ACE count by comparing it with the number of minimal ACEs that fit in the DACL size. The DACL si…
-
High 7.8
sctp: fix addr_wq_timer race in sctp_free_addr_wq()
In the Linux kernel, the following vulnerability has been resolved: sctp: fix addr_wq_timer race in sctp_free_addr_wq() sctp_free_addr_wq() previously removed addr_wq_timer using timer_delete() while holding addr_wq_lock. However, timer_delete() does not guar…
-
Critical 9.8
ksmbd: fix use-after-free of fp->owner.name in durable handle owner check
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free of fp->owner.name in durable handle owner check Two concurrent SMB2 durable reconnects (DH2C/DHnC) on the same persistent_id race the fp->owner.name compare-read in …
-
High 8.8
xen/pvcalls: bound backend response req_id before indexing rsp[]
In the Linux kernel, the following vulnerability has been resolved: xen/pvcalls: bound backend response req_id before indexing rsp[] pvcalls_front_event_handler() takes req_id directly from the backend-supplied ring response and uses it to index the fixed-siz…
-
Unscored —
fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid
In the Linux kernel, the following vulnerability has been resolved: fs: refuse O_TMPFILE creation with an unmapped fsuid or fsgid vfs_tmpfile() never checked that the caller's fsuid and fsgid map into the filesystem. On an idmapped mount whose idmapping does …
-
High 7.5
afs: Fix error code in afs_extract_vl_addrs()
In the Linux kernel, the following vulnerability has been resolved: afs: Fix error code in afs_extract_vl_addrs() The error codes on these paths are only set on the first iteration through the loop. Set the correct error code on every iteration.
-
Unscored —
afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints
In the Linux kernel, the following vulnerability has been resolved: afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints Regular AFS files correctly use afs_file_aops which have release_folio set as netfs_release_folio, so AS_RELEASE_ALWAYS i…
-
Unscored —
afs: Fix misplaced inc of net->cells_outstanding
In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net->cells_outstanding Fix net->cells_outstanding being incremented before the check for failure of idr_alloc_cyclic(), leaving the count incremented on error.
-
High 7.8
afs: Fix reinitialisation of the inode, in particular ->lock_work
In the Linux kernel, the following vulnerability has been resolved: afs: Fix reinitialisation of the inode, in particular ->lock_work It seems that initalising afs_vnode::lock_work a single time in the slab's init function isn't sufficient for work_structs. T…
-
High 7.5
afs: Fix callback service message parsers to pass through -EAGAIN
In the Linux kernel, the following vulnerability has been resolved: afs: Fix callback service message parsers to pass through -EAGAIN The AFS filesystem client uses an rxrpc server to listen for callback notifications. Each callback call type handler has a de…
-
High 7.5
afs: Fix missing NULL pointer check in afs_break_some_callbacks()
In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing NULL pointer check in afs_break_some_callbacks() Fix afs_break_some_callbacks() to check to see if afs_lookup_volume_rcu() returned NULL (e.g. the specified volume is unknown…
-
High 7.8
afs: Fix the volume AFS_VOLUME_RM_TREE is set on
In the Linux kernel, the following vulnerability has been resolved: afs: Fix the volume AFS_VOLUME_RM_TREE is set on Fix afs_insert_volume_into_cell() to set AFS_VOLUME_RM_TREE on the volume replaced, not the new volume, as it's now removed from the cell's vo…
-
High 7.8
afs: Fix lack of locking around modifications of net->cells_dyn_ino
In the Linux kernel, the following vulnerability has been resolved: afs: Fix lack of locking around modifications of net->cells_dyn_ino Fix the lack of locking around modifications of net->cells_dyn_ino by taking net->cells_lock exclusively. This also require…
-
Unscored —
iomap: release pages on atomic dio size mismatch
In the Linux kernel, the following vulnerability has been resolved: iomap: release pages on atomic dio size mismatch If bio_iov_iter_get_pages() or the bounce helper succeeds but builds a short bio, the REQ_ATOMIC size check rejects it before submission. The …
-
High 7.8
minix: avoid overflow in bitmap block count calculation
In the Linux kernel, the following vulnerability has been resolved: minix: avoid overflow in bitmap block count calculation minix_check_superblock() uses minix_blocks_needed() to verify that the on-disk imap and zmap block counts are large enough for the adve…
-
High 7.8
cachefiles: Fix double unlock in nomem_d_alloc error path
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double unlock in nomem_d_alloc error path When start_creating() fails and returns -ENOMEM, it has already released the parent directory lock in __start_dirop(): static struct …
-
Critical 9.8
netfs: Fix netfs_create_write_req() to handle async cache object creation
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_create_write_req() to handle async cache object creation netfs_create_write_req() will skip caching if the fscache cookie is disabled, but this is a problem because async cac…
-
High 8.8
iomap: guard io_size EOF trim against concurrent truncate underflow
In the Linux kernel, the following vulnerability has been resolved: iomap: guard io_size EOF trim against concurrent truncate underflow iomap: fix zero padding data issue in concurrent append writes changed ioend accounting so that io_size tracks only valid d…
-
Unscored —
netfs: Fix writethrough to use collection offload
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix writethrough to use collection offload Fix writethrough write to set NETFS_RREQ_OFFLOAD_COLLECTION on the request so that collection is processed asynchronously rather than only ri…