7,124 results · Feed
-
Unscored —
ipvs: filter some flags received in the backup server
In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This comm…
-
Unscored —
drm/amdgpu/gfx6: fix firmware leak on teardown
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfx_v6_0_init_microcode() is not released when the GFX block is torn down, leaking the firmware resources. Add gfx_v6_…
-
Unscored —
drm/amdgpu: fix ACP MFD device leak on init failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acp_hw_init() registers ACP child devices with mfd_add_devices() before attaching them to the ACP power domain and initializing the hardwar…
-
Unscored —
USB: serial: fix port tear down use-after-free
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach() or first open() and sto…
-
Unscored —
usb: storage: sierra_ms: reject short SWoC info transfers
In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierra_ms: reject short SWoC info transfers sierra_get_swoc_info() requests sizeof(struct swoc_info) (60) bytes from the device via usb_control_msg(), but its callers only treat…
-
Unscored —
usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd generic_set_cmd() and generic_get_cmd() use the low nibble of ctrl->bRequest as an index into con->data[]: u8 cmd …
-
Unscored —
USB: gadget: dummy-hcd: Fix wait for outstanding request completions
In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronize_irq() by waiting until its private callback_usage counter drops to 0 (with the p…
-
Unscored —
usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC When user space sets up FunctionFS with only full-speed descriptors (e.g., flags = FUNCTIONFS_HAS_FS_DESC) and the …
-
Unscored —
usb: core: clear both ep_in and ep_out for non-ep0 control endpoints
In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both ep_in and ep_out for non-ep0 control endpoints In usb_enable_endpoint(), non-zero control endpoints (where usb_endpoint_xfer_control(&ep->desc) is true) populate both de…
-
Unscored —
USB: dwc2: shut down wakeup timer before freeing HCD state
In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2_wakeup_detected() accesses the DWC2 host state and can rearm the wakeup timer. dwc2_hcd_free() currently deletes the timer only…
-
Unscored —
usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typec_partner_desc in tps6598x_connect() tps6598x_connect() passes a stack-allocated typec_partner_desc to typec_register_partner() after initializing only…
-
Unscored —
tty: vcc: zero-initialize control packet in vcc_send_ctl()
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vcc_send_ctl() The stack-allocated struct vio_vcc pkt was partially initialized, leaving the tag.stype_env field uninitialized before being sent vi…
-
Unscored —
tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup
In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup vcc_cleanup() sets port->tty to NULL without holding port->lock, racing with vcc_event() LDC callbacks that read port->tty un…
-
Unscored —
tty: tty_port: restore TTY_IO_ERROR on activation failure
In the Linux kernel, the following vulnerability has been resolved: tty: tty_port: restore TTY_IO_ERROR on activation failure Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This s…
-
Unscored —
tty: port: fix tty_port_tty_vhangup() race
In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty_port_tty_vhangup() race Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physica…
-
Unscored —
tty: abort break signalling on hangup
In the Linux kernel, the following vulnerability has been resolved: tty: abort break signalling on hangup The break ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Drivers must handle this ra…
-
Unscored —
tty: fix saved termios reset race
In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings…
-
Unscored —
tty: serial: max3100: shut down timer before freeing port
In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100_shutdown() stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the s…
-
Unscored —
ALSA: seq: Serialize compat port-info ioctls
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client->ioctl_mutex, but the translated port-info compat path invokes the same handl…
-
Unscored —
ALSA: ua101: reject mismatched capture/playback packet sizes
In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detect_usb_format() cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never…
-
Unscored —
Bluetooth: RFCOMM: Fix initial port reference race
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMM_RELEASE_ONHUP devices, rfcomm_tty_install() and __rfcomm_release_dev() both use RFCOMM_TTY_OWNED to decide who drops the initial …
-
Unscored —
Bluetooth: Serialize SMP remote OOB data access
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access build_pairing_cmd() looks up remote OOB data and copies its contents without holding hdev->lock, which serializes the list's writers. After SMP…
-
Unscored —
Bluetooth: hci_core: Serialize ACL scheduling with channel deletion
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize ACL scheduling with channel deletion hci_chan_sent() selects a channel under RCU but drops the read lock before accessing chan->conn and returning the channel. …
-
Unscored —
Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Serialize SCO and ISO scheduling with teardown hci_low_sent() selects a connection under RCU but drops the read lock before calculating its quota and returning it to the …
-
Unscored —
Bluetooth: btintel: fix buffer over-read in btintel_hw_error()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintel_hw_error() The "Exception info %s" print uses skb->data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read…
-
Unscored —
mtd: block2mtd: Fix divide error when erase_size is zero
In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erase_size is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. add_device() then evaluates if (size % erase_si…
-
Unscored —
KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU perf…
-
Unscored —
KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded
In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded Leave control.erap_ctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit ar…
-
Unscored —
wifi: cw1200: fix TX padding OOB read leaking heap data to device
In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment (align_size(), up to 511 bytes for SDIO, 1 byte for SPI) but sen…
-
Unscored —
wifi: iwlegacy: 3945: free EEPROM data on remove
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945_pci_probe() calls il_eeprom_init(), which allocates memory for the EEPROM data. The probe failure paths release this allocation with il…
-
Unscored —
wifi: mac80211: count only matching reservations in reserved switch
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211_vif_use_reserved_switch() validates a replacement by counting assigned links on ctx->replace_ctx and treating res…
-
Unscored —
wifi: mac80211: keep paired old chanctx alive
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replace_ctx pointers between the old WILL_BE_REPLACED chanctx and the new REPLACES_OTHER chanctx. Howeve…
-
Unscored —
wifi: mac80211: shut down RX BA session timer on teardown
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tid_rx. Later timer-wheel processing and the timer callba…
-
Unscored —
wifi: mac80211: drain PS delivery work during station teardown
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, a…
-
Unscored —
wifi: mac80211: account proxy paths against the mesh path limit
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: account proxy paths against the mesh path limit Proxy-path churn can drive the interface path counter negative and let later mesh path additions exceed MESH_MAX_MPATHS. mesh_p…
-
Unscored —
wifi: mac80211: minstrel_ht: validate fixed rate index
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrel_ht: validate fixed rate index The fixed_rate_idx debugfs file is a plain u32 attribute, so any value can be written to it. minstrel_ht_update_stats() then copies the …
-
Unscored —
wifi: mac80211: release mesh path quota on failed additions
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: release mesh path quota on failed additions Repeated failed or duplicate mesh path additions can exhaust MESH_MAX_MPATHS while the path table holds fewer paths, which stops ne…
-
Unscored —
wifi: mac80211: handle empty FILS association request payload
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element. crypt_len is the…
-
Unscored —
USB: serial: fix dynamic id driver deregistration race
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "new_id" attribute to avoid leaking any id added by a rac…
-
Unscored —
USB: serial: fix driver deregistration order
In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver…