20,182 results · Feed
-
High 7.8
ixgbe: do not configure xps for XDP queues
In the Linux kernel, the following vulnerability has been resolved: ixgbe: do not configure xps for XDP queues netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E6…
-
High 7.5
NFSD: Handle layout stid in nfsd4_drop_revoked_stid()
In the Linux kernel, the following vulnerability has been resolved: NFSD: Handle layout stid in nfsd4_drop_revoked_stid() nfsd4_drop_revoked_stid() has no SC_TYPE_LAYOUT case, so when a client sends FREE_STATEID for an admin-revoked layout stid, the default b…
-
Critical 9.8
lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file()
In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svc_lookup_file() file_hash() digests the first LOCKD_FH_HASH_SIZE bytes of nfs_fh.data when bucketing nlm_files[], independent of fh.size. Com…
-
High 7.8
bpf: Cancel special fields on map value recycle
In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields on map value recycle Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depen…
-
High 8.8
vduse: hold vduse_lock across IDR lookup in open path
In the Linux kernel, the following vulnerability has been resolved: vduse: hold vduse_lock across IDR lookup in open path vduse_dev_open() looks up struct vduse_dev through the IDR and then acquires dev->lock only after vduse_lock has been dropped. This leave…
-
High 7.8
vhost/vdpa: validate virtqueue index in mmap and fault paths
In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: validate virtqueue index in mmap and fault paths vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a virtqueue index for get_vq_notification(), but they do not validat…
-
Critical 9.3
vhost/net: complete zerocopy ubufs only once
In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubuf_info per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone…
-
High 7.8
virtio: rtc: tear down old virtqueues before restore
In the Linux kernel, the following vulnerability has been resolved: virtio: rtc: tear down old virtqueues before restore virtio_device_restore() resets the device and restores the negotiated features before calling ->restore(). viortc_freeze() intentionally l…
-
Critical 10.0
vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
In the Linux kernel, the following vulnerability has been resolved: vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler Look up the IRQ index in oct_hw->irqs instead of assuming irq - irqs[0]. This supports non-contiguous IRQ numbers and avoids incor…
-
Unscored —
ext4: fix kernel BUG in ext4_write_inline_data_end
In the Linux kernel, the following vulnerability has been resolved: ext4: fix kernel BUG in ext4_write_inline_data_end When the data=journal mount option is used, the ext4_journalled_write_end() function incorrectly calls ext4_write_inline_data_end() without …
-
High 7.8
vfio/qat: fix f_pos race in qat_vf_resume_write()
In the Linux kernel, the following vulnerability has been resolved: vfio/qat: fix f_pos race in qat_vf_resume_write() qat_vf_resume_write() checks filp->f_pos before taking migf->lock, but copies into the migration-state buffer after taking the lock and re-re…
-
Unscored —
ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT
In the Linux kernel, the following vulnerability has been resolved: ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT Reject the EXT4_IOC_MOVE_EXT ioctl early if the donor file does not belong to the same superblock as the original file. Current…
-
High 7.8
bpf: Tighten cgroup storage cookie checks for prog arrays
In the Linux kernel, the following vulnerability has been resolved: bpf: Tighten cgroup storage cookie checks for prog arrays The fix in commit abad3d0bad72 ("bpf: Fix oob access in cgroup local storage") is still incomplete. The prog-array compatibility chec…
-
Unscored —
Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: fix NULL pointer dereference in qca_setup() for non-serdev device hu->serdev is NULL for hci_uart attached via non-serdev paths, but qca_setup() unconditionally calls serd…
-
Unscored —
Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_qca: fix NULL pointer dereference in qca_dmp_hdr() for non-serdev device hu->serdev is NULL for hci_uart attached via non-serdev paths, but qca_dmp_hdr() unconditionally derefe…
-
High 7.8
Bluetooth: hci_core: Fix UAF in hci_unregister_dev()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix UAF in hci_unregister_dev() hci_unregister_dev() does not disable cmd_timer and ncmd_timer before the hci_dev structure is freed. If a timeout fires during device tea…
-
Unscored —
Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: fix URB leak in alloc_mtk_intr_urb error path When btmtk_isopkt_pad() fails, the previously allocated URB is not freed, leaking the urb structure. Add usb_free_urb() before …
-
High 8.8
Bluetooth: hci: validate codec capability element length
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci: validate codec capability element length Read Local Codec Capabilities returns a sequence of capability elements. Each element starts with a one-byte length followed by that m…
-
Unscored —
RDMA/core: Fix FRMR set pinned push error path
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMR handles in case the push to the pool fails. This prevents resources leak in case pool page allocation fails.
-
Unscored —
RDMA/core: Fix FRMR aging push to queue error flow
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR aging push to queue error flow Aging pools with pinned handles requires moving handles from the active queue to a non-empty inactive queue that might fail on new page allo…
-
High 7.8
RDMA/mlx5: Fix undefined shift of user RQ WQE size
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size set_rq_size() computes the RQ WQE size as "1 << rq_wqe_shift" based on the user-provided rq_wqe_shift, which is only checked to be greater t…
-
High 7.1
ASoC: codecs: hdac_hdmi: Validate written enum value
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdac_hdmi: Validate written enum value hdac_hdmi_set_pin_port_mux() uses the written enum value to index the texts array before calling snd_soc_dapm_put_enum_double(), which val…
-
High 7.8
RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one Free the UAR index returned by the hardware.
-
High 7.3
ASoC: meson: aiu: Validate written enum values
In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with snd_soc_enum_item_to_val() before checking whether the value i…
-
High 7.8
ASoC: fsl: fsl_audmix: Validate written enum values
In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fsl_audmix: Validate written enum values fsl_audmix_put_mix_clk_src() and fsl_audmix_put_out_src() convert the user-provided enum item with snd_soc_enum_item_to_val() before checki…
-
High 7.1
ASoC: tegra: tegra210_ahub: Validate written enum value
In the Linux kernel, the following vulnerability has been resolved: ASoC: tegra: tegra210_ahub: Validate written enum value tegra_ahub_put_value_enum() reads e->values[item[0]] before checking whether item[0] is within the enum item range. The existing check …
-
Unscored —
net/sched: cls_flow: Dont expose folded kernel pointers
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: Dont expose folded kernel pointers The flow classifier falls back to addr_fold() for fields that are missing from packet headers. In map mode, userspace controls mask, xo…
-
Unscored —
ASoC: topology: Check PCM and DAI name strings before use
In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bo…
-
High 7.8
ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). syzbot reported use-after-free in nsim_fib4_prepare_event(). [0] The problem is that the following functions call fib_info_hold() / …
-
Critical 9.1
sctp: validate embedded address parameter length
In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctp_verify_asconf() and sctp_verify_param() only validate ADD_IP, DEL_IP, and SET_PRIMARY parameters against a fixed minimum size of sizeof(s…
-
High 7.8
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
In the Linux kernel, the following vulnerability has been resolved: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). rocker_router_fib_event() calls fib_rule_get() during RCU dump. If the fib_rule is dying, refcount_inc() will complain about it.…
-
Unscored —
net: pfcp: allocate per-cpu tstats for PFCP netdevs
In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses dev_get_tstats64() as its ndo_get_stats64 callback, but pfcp_link_setup() does not request NETDEV_PCPU_STAT_TSTATS. The net core …
-
High 8.8
net: Stop leased rxq before uninstalling its memory provider
In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netif_rxq_cleanup_unlease() tears down the memory provider that was installed on a physical RX queue through a netkit queue lease.…
-
Unscored —
net/sched: sch_hfsc: Don't make class passive twice
In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: Don't make class passive twice update_vf() is called from two places for the same class during a single dequeue when the class's child qdisc (e.g. codel/fq_codel) drops i…
-
High 7.5
tipc: prevent snt_unacked underflow on CONN_ACK
In the Linux kernel, the following vulnerability has been resolved: tipc: prevent snt_unacked underflow on CONN_ACK tipc_sk_conn_proto_rcv() subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter snt_unacked without checking th…
-
High 7.8
tipc: require net admin for TIPCv2 netlink mutators
In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAP_NET_ADMIN when an oper…
-
High 7.5
tipc: reject inverted service ranges from peer bindings
In the Linux kernel, the following vulnerability has been resolved: tipc: reject inverted service ranges from peer bindings tipc_update_nametbl() inserts a binding advertised by a peer node using the lower and upper service-range bounds taken directly from th…
-
Critical 10.0
crypto: cavium/cpt - fix DMA cleanup using wrong loop index
In the Linux kernel, the following vulnerability has been resolved: crypto: cavium/cpt - fix DMA cleanup using wrong loop index The sg_cleanup error path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repea…
-
Critical 10.0
crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/octeontx - fix DMA cleanup using wrong loop index The sg_cleanup path used list[i] instead of list[j] when unmapping DMA buffers, leaking successfully mapped entries and repea…
-
Unscored —
ALSA: seq: Fix kernel heap address leak in bounce_error_event()
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix kernel heap address leak in bounce_error_event() The comment above bounce_error_event() documents that user clients should receive SNDRV_SEQ_EVENT_BOUNCE with the original even…