20,182 results · Feed
-
Unscored —
f2fs: embed f2fs_gc_kthread in f2fs_sb_info
In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fs_gc_kthread in f2fs_sb_info Instead of allocating f2fs_gc_kthread dynamically, embed it in f2fs_sb_info. This simplifies lifetime management and prepares for fixing race condi…
-
High 8.8
drm/pagemap: dma-unmap pages before handling migration errors
In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: dma-unmap pages before handling migration errors drm_pagemap_migrate_unmap_pages() relies on the pages array to determine which pages require DMA unmapping. However, drm_pagemap_…
-
Unscored —
i3c: master: Fix device_register() error path
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix device_register() error path When device_register() fails in i3c_master_register_new_i3c_devs(), put_device() is called to drop the reference taken by device_register(). That…
-
High 8.1
ksmbd: fix maximum allowed access checks
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users A…
-
Unscored —
wifi: rtw89: fix HE extended capability length check
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix HE extended capability length check rtw89_mac_check_he_obss_narrow_bw_ru_iter() reads extended capability byte 10, but rejects only datalen values below 10. Byte 10 requires …
-
High 8.8
greybus: audio: bound the topology section sizes against the fetched size
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walk…
-
Unscored —
staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown
In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing tasklet_kill in cvm_oct_tx_shutdown The TX cleanup tasklet can be scheduled by the watchdog IRQ handler to execute cvm_oct_tx_do_cleanup. There can be a pending t…
-
Unscored —
staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown
In the Linux kernel, the following vulnerability has been resolved: staging: octeon: add missing napi_disable in cvm_oct_rx_shutdown cvm_oct_rx_shutdown calls free_irq and netif_napi_del without disabling the napi instance first. As the free_irq only waits fo…
-
High 7.8
RDMA/bnxt_re: Validate udata before executing commands
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Validate udata before executing commands The destroy callbacks currently zero the udata output after tearing down driver resources. If the userspace access fails, uverbs preserv…
-
Unscored —
phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator
In the Linux kernel, the following vulnerability has been resolved: phy: renesas: phy-rcar-gen3-usb2: Fix devm action registration for disabled VBUS regulator devm_regulator_get_exclusive() initialises the regulator with enable_count = 1, requiring the consum…
-
Unscored —
perf/x86/intel/pt: Fix stop/start with no update
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix stop/start with no update If pt_event_stop() is called without PERF_EF_UPDATE flag, then perf_aux_output_end() is not called. A subsequent call to pt_event_start() will…
-
Unscored —
pinctrl: bcm2835: Don't remove an unregistered GPIO chip
In the Linux kernel, the following vulnerability has been resolved: pinctrl: bcm2835: Don't remove an unregistered GPIO chip If the devm_pinctrl_register() function fails, bcm2835_pinctrl_probe() calls gpiochip_remove() before gpiochip_add_data() has register…
-
Unscored —
regulator: tps6594: Fix device node reference leaks in multiphase loop
In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594: Fix device node reference leaks in multiphase loop In tps6594_regulator_probe(), the multi-phase configuration loop calls of_find_node_by_name() to find buck nodes by name…
-
Unscored —
remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 The changes introduced to handle single power domain platforms have swapped the info pointer increment from num_pd_vregs t…
-
Unscored —
wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cap out-of-range rx MCS instead of leaving bogus rate ath11k can receive HT/VHT/HE frames whose reported MCS is above the maximum that can be expressed in the corresponding mac8…
-
Unscored —
ext4: fix circular lock dependency in ext4_ext_migrate
In the Linux kernel, the following vulnerability has been resolved: ext4: fix circular lock dependency in ext4_ext_migrate Move iput(tmp_inode) after ext4_writepages_up_write() to avoid a circular lock dependency between s_writepages_rwsem and sb_internal (fr…
-
Unscored —
bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn
In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + <percpu_base_off>'. However, the interpr…
-
Unscored —
ext4: skip extra isize expansion during mount to prevent deadlock
In the Linux kernel, the following vulnerability has been resolved: ext4: skip extra isize expansion during mount to prevent deadlock ext4_try_to_expand_extra_isize() is called from __ext4_mark_inode_dirty() while holding an active jbd2 handle. During mount (…
-
Unscored —
RDMA/core: Fix potential use after free in uverbs_free_dmah()
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in uverbs_free_dmah() When accessing a dmah via the netlink path the only synchronization mechanism for the said dmah is rdma_restrack_get(). Currently…
-
Unscored —
arm64: RSI: fix field-spanning write warning in attestation token init
In the Linux kernel, the following vulnerability has been resolved: arm64: RSI: fix field-spanning write warning in attestation token init The challenge is passed in registers a1 through a8. However, copying to ®s.a1 makes FORTIFY treat the destination as …
-
High 7.7
PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node
In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: tc9563: Fix parsing the integrated Ethernet MAC Endpoint node DSP3 has an integrated Ethernet MAC Endpoint which has its own set of config registers for configuring settings such…
-
Unscored —
RDMA/efa: Fix PBL chunk length computation
In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix PBL chunk length computation On register MR, when creating the PBL, if it's an indirect PBL we create a chunk list to hold the PBL pages pointers. Each chunk is 4KB in size and …
-
Unscored —
clk: eswin: Zero-initialize stack-allocated clk_init_data
In the Linux kernel, the following vulnerability has been resolved: clk: eswin: Zero-initialize stack-allocated clk_init_data eswin_clk_register_pll() and eswin_register_clkdiv() declare a struct clk_init_data on the stack and only initialize some of its fiel…
-
High 7.8
md/raid5-ppl: fix use-after-free in ppl_do_flush()
In the Linux kernel, the following vulnerability has been resolved: md/raid5-ppl: fix use-after-free in ppl_do_flush() The loop in ppl_do_flush() continues iterating after calling ppl_io_unit_finished(), touching io->pending_flushes and leading to a use-after…
-
Unscored —
locking/lockdep: Fix NULL pointer dereference in __lock_set_class()
In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Fix NULL pointer dereference in __lock_set_class() register_lock_class() can return NULL when the lock class pool is exhausted, graph_lock() fails, or key validation fails. H…
-
High 7.4
powerpc/xive: propagate IPI init errors to prevent use-after-free
In the Linux kernel, the following vulnerability has been resolved: powerpc/xive: propagate IPI init errors to prevent use-after-free When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, x…
-
Unscored —
powerpc/irq: Fix missing r2 clobber in PCREL inline assembly
In the Linux kernel, the following vulnerability has been resolved: powerpc/irq: Fix missing r2 clobber in PCREL inline assembly In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC pointer and is available as a caller-saved register [0]. Bot…
-
Unscored —
ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full() This reverts commit 58b6fcd2ab34 ("ocfs2: mark inode bad upon validation failure during read"). Since 'make_bad_inode()' re…
-
Unscored —
arm64: hibernate: mask DAIF before restoring hibernated kernel
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: mask DAIF before restoring hibernated kernel The arm64 hibernate code manages the exception masking in an unsound way, leading to potential crashes and/or warnings during re…
-
Unscored —
block: handle nogenerate/noverify properly in fs-integrity
In the Linux kernel, the following vulnerability has been resolved: block: handle nogenerate/noverify properly in fs-integrity Check the BIP_CHECK flags before generating or verifying PI information, otherwise this can be incorrectly called for non-PI metadat…
-
Unscored —
btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock
In the Linux kernel, the following vulnerability has been resolved: btrfs: make sure EXTENT_BUFFER_READING is cleared under refs_lock [FALSE ALERTS] There is a bug report that the warning inside invalidate_and_check_btree_folios() got triggered during btrfs/2…
-
Unscored —
arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit
In the Linux kernel, the following vulnerability has been resolved: arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit Currently, when exiting to kernel mode, we attempt involuntary preemption. The preemption logic expects IRQs to be disabled,…
-
Unscored —
sched/isolation: Defer freeing of cpumask memblock memory to initcall
In the Linux kernel, the following vulnerability has been resolved: sched/isolation: Defer freeing of cpumask memblock memory to initcall When testing a linux-next kernel with commit 59bd1d914bb5 ("memblock: warn when freeing reserved memory before memory map…
-
Unscored —
ocfs2: fix circular locking dependency in ocfs2_init_acl()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix circular locking dependency in ocfs2_init_acl() A lockdep warning indicates a circular locking dependency between `&oi->ip_xattr_sem` and `&journal->j_trans_barrier`: WARNING: poss…
-
Unscored —
ACPI: bus: Introduce acpi_bus_get_primary_device()
In the Linux kernel, the following vulnerability has been resolved: ACPI: bus: Introduce acpi_bus_get_primary_device() The function used for obtaining the first "physical" device for which the given ACPI one is the ACPI companion, acpi_get_first_physical_node…
-
High 7.8
vxlan: mdb: Fix use-after-free in vxlan_mdb_flush()
In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlan_mdb_flush() vxlan_mdb_flush() iterates over the MDB entries using hlist_for_each_entry_safe(), which only tolerates the removal of the current entry. C…
-
Unscored —
spi: amlogic-spisg: Make sure clk_init_data is fully initialized
In the Linux kernel, the following vulnerability has been resolved: spi: amlogic-spisg: Make sure clk_init_data is fully initialized The clk_init_data structure contains several mutually-exclusive members for different methods to specify the possible parents …
-
Unscored —
drm/xe: don't WARN on kernel job timeout when device already wedged
In the Linux kernel, the following vulnerability has been resolved: drm/xe: don't WARN on kernel job timeout when device already wedged igt@xe_wedged@wedged-at-any-timeout wedges the device in mode 2 (UPON_ANY_HANG_NO_RESET) and then rebinds the driver. Durin…
-
Unscored —
Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix 'hdev->discovery.uuids' NULL dereference 'uuid_count' member of struct 'discovery_state' is assigned and read without any locks, so there is a chance of situation when uu…
-
Unscored —
octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity rvu_register_interrupts() walks every MSI-X vector and uses strstr() to match "Mbox" or "FLR" in irq_name before pinning those …