Action not permitted
Modal body text goes here.
Modal Title
Modal Body
WID-SEC-W-2025-2194
Vulnerability from csaf_certbund - Published: 2025-10-05 22:00 - Updated: 2026-04-09 22:00Summary
Linux Kernel: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Der Kernel stellt den Kern des Linux Betriebssystems dar.
Angriff: Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um nicht näher spezifizierte Angriffe durchzuführen.
Betroffene Betriebssysteme: - Linux
References
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Der Kernel stellt den Kern des Linux Betriebssystems dar.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein lokaler Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um nicht n\u00e4her spezifizierte Angriffe durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-2194 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2194.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-2194 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2194"
},
{
"category": "external",
"summary": "Kernel CVE Announce Mailingliste",
"url": "https://lore.kernel.org/linux-cve-announce/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50470",
"url": "https://lore.kernel.org/linux-cve-announce/2025100434-CVE-2022-50470-e56f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50471",
"url": "https://lore.kernel.org/linux-cve-announce/2025100436-CVE-2022-50471-a799@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50472",
"url": "https://lore.kernel.org/linux-cve-announce/2025100437-CVE-2022-50472-5d91@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50473",
"url": "https://lore.kernel.org/linux-cve-announce/2025100437-CVE-2022-50473-a1fc@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50474",
"url": "https://lore.kernel.org/linux-cve-announce/2025100437-CVE-2022-50474-7639@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50475",
"url": "https://lore.kernel.org/linux-cve-announce/2025100438-CVE-2022-50475-b3ed@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50476",
"url": "https://lore.kernel.org/linux-cve-announce/2025100438-CVE-2022-50476-f1b3@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50477",
"url": "https://lore.kernel.org/linux-cve-announce/2025100438-CVE-2022-50477-1815@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50478",
"url": "https://lore.kernel.org/linux-cve-announce/2025100438-CVE-2022-50478-81f8@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50479",
"url": "https://lore.kernel.org/linux-cve-announce/2025100439-CVE-2022-50479-de1c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50480",
"url": "https://lore.kernel.org/linux-cve-announce/2025100439-CVE-2022-50480-f296@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50481",
"url": "https://lore.kernel.org/linux-cve-announce/2025100439-CVE-2022-50481-3d22@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50482",
"url": "https://lore.kernel.org/linux-cve-announce/2025100440-CVE-2022-50482-0291@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50483",
"url": "https://lore.kernel.org/linux-cve-announce/2025100440-CVE-2022-50483-b6b2@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50484",
"url": "https://lore.kernel.org/linux-cve-announce/2025100440-CVE-2022-50484-1a6a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50485",
"url": "https://lore.kernel.org/linux-cve-announce/2025100441-CVE-2022-50485-9d4c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50486",
"url": "https://lore.kernel.org/linux-cve-announce/2025100441-CVE-2022-50486-da3d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50487",
"url": "https://lore.kernel.org/linux-cve-announce/2025100441-CVE-2022-50487-f5ea@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50488",
"url": "https://lore.kernel.org/linux-cve-announce/2025100413-CVE-2022-50488-32e8@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50489",
"url": "https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2022-50489-9d88@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50490",
"url": "https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2022-50490-dcd3@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50491",
"url": "https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2022-50491-7a8b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50492",
"url": "https://lore.kernel.org/linux-cve-announce/2025100418-CVE-2022-50492-19b5@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50493",
"url": "https://lore.kernel.org/linux-cve-announce/2025100418-CVE-2022-50493-2b70@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50494",
"url": "https://lore.kernel.org/linux-cve-announce/2025100418-CVE-2022-50494-00a0@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50495",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2022-50495-fdee@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50496",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2022-50496-6e44@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50497",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2022-50497-0aee@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50498",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2022-50498-c9ab@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50499",
"url": "https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2022-50499-9f94@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50500",
"url": "https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2022-50500-787b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50501",
"url": "https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2022-50501-1b81@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50502",
"url": "https://lore.kernel.org/linux-cve-announce/2025100421-CVE-2022-50502-c819@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50503",
"url": "https://lore.kernel.org/linux-cve-announce/2025100421-CVE-2022-50503-6c75@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50504",
"url": "https://lore.kernel.org/linux-cve-announce/2025100422-CVE-2022-50504-d655@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50505",
"url": "https://lore.kernel.org/linux-cve-announce/2025100422-CVE-2022-50505-b427@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50506",
"url": "https://lore.kernel.org/linux-cve-announce/2025100422-CVE-2022-50506-1642@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50507",
"url": "https://lore.kernel.org/linux-cve-announce/2025100423-CVE-2022-50507-9739@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2022-50508",
"url": "https://lore.kernel.org/linux-cve-announce/2025100423-CVE-2022-50508-dd1b@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53533",
"url": "https://lore.kernel.org/linux-cve-announce/2025100441-CVE-2023-53533-7fbb@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53534",
"url": "https://lore.kernel.org/linux-cve-announce/2025100442-CVE-2023-53534-9260@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53535",
"url": "https://lore.kernel.org/linux-cve-announce/2025100442-CVE-2023-53535-c515@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53536",
"url": "https://lore.kernel.org/linux-cve-announce/2025100442-CVE-2023-53536-0e4f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53537",
"url": "https://lore.kernel.org/linux-cve-announce/2025100443-CVE-2023-53537-7d50@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53538",
"url": "https://lore.kernel.org/linux-cve-announce/2025100443-CVE-2023-53538-f39c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53539",
"url": "https://lore.kernel.org/linux-cve-announce/2025100443-CVE-2023-53539-4411@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53540",
"url": "https://lore.kernel.org/linux-cve-announce/2025100444-CVE-2023-53540-8805@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53541",
"url": "https://lore.kernel.org/linux-cve-announce/2025100444-CVE-2023-53541-d961@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53542",
"url": "https://lore.kernel.org/linux-cve-announce/2025100444-CVE-2023-53542-fc74@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53543",
"url": "https://lore.kernel.org/linux-cve-announce/2025100445-CVE-2023-53543-227c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53544",
"url": "https://lore.kernel.org/linux-cve-announce/2025100445-CVE-2023-53544-f48f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53545",
"url": "https://lore.kernel.org/linux-cve-announce/2025100445-CVE-2023-53545-8d50@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53546",
"url": "https://lore.kernel.org/linux-cve-announce/2025100445-CVE-2023-53546-a432@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53547",
"url": "https://lore.kernel.org/linux-cve-announce/2025100446-CVE-2023-53547-38ce@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53548",
"url": "https://lore.kernel.org/linux-cve-announce/2025100446-CVE-2023-53548-8719@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53549",
"url": "https://lore.kernel.org/linux-cve-announce/2025100446-CVE-2023-53549-9c74@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53550",
"url": "https://lore.kernel.org/linux-cve-announce/2025100447-CVE-2023-53550-bbac@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53551",
"url": "https://lore.kernel.org/linux-cve-announce/2025100447-CVE-2023-53551-4afc@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53552",
"url": "https://lore.kernel.org/linux-cve-announce/2025100447-CVE-2023-53552-5ba9@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53553",
"url": "https://lore.kernel.org/linux-cve-announce/2025100448-CVE-2023-53553-f661@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53554",
"url": "https://lore.kernel.org/linux-cve-announce/2025100448-CVE-2023-53554-3351@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53555",
"url": "https://lore.kernel.org/linux-cve-announce/2025100448-CVE-2023-53555-b949@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53556",
"url": "https://lore.kernel.org/linux-cve-announce/2025100448-CVE-2023-53556-db4c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53557",
"url": "https://lore.kernel.org/linux-cve-announce/2025100449-CVE-2023-53557-e7ba@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53558",
"url": "https://lore.kernel.org/linux-cve-announce/2025100449-CVE-2023-53558-e6f7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53559",
"url": "https://lore.kernel.org/linux-cve-announce/2025100449-CVE-2023-53559-c2f0@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53560",
"url": "https://lore.kernel.org/linux-cve-announce/2025100450-CVE-2023-53560-8248@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53561",
"url": "https://lore.kernel.org/linux-cve-announce/2025100450-CVE-2023-53561-75a1@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53562",
"url": "https://lore.kernel.org/linux-cve-announce/2025100450-CVE-2023-53562-a73f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53563",
"url": "https://lore.kernel.org/linux-cve-announce/2025100451-CVE-2023-53563-5cbe@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53564",
"url": "https://lore.kernel.org/linux-cve-announce/2025100451-CVE-2023-53564-e874@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53565",
"url": "https://lore.kernel.org/linux-cve-announce/2025100451-CVE-2023-53565-a882@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53566",
"url": "https://lore.kernel.org/linux-cve-announce/2025100451-CVE-2023-53566-1c57@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53567",
"url": "https://lore.kernel.org/linux-cve-announce/2025100452-CVE-2023-53567-dedf@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53568",
"url": "https://lore.kernel.org/linux-cve-announce/2025100452-CVE-2023-53568-0020@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53569",
"url": "https://lore.kernel.org/linux-cve-announce/2025100452-CVE-2023-53569-181e@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53570",
"url": "https://lore.kernel.org/linux-cve-announce/2025100453-CVE-2023-53570-3733@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53571",
"url": "https://lore.kernel.org/linux-cve-announce/2025100453-CVE-2023-53571-3269@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53572",
"url": "https://lore.kernel.org/linux-cve-announce/2025100453-CVE-2023-53572-ab85@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53573",
"url": "https://lore.kernel.org/linux-cve-announce/2025100453-CVE-2023-53573-a05d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53574",
"url": "https://lore.kernel.org/linux-cve-announce/2025100454-CVE-2023-53574-f72d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53575",
"url": "https://lore.kernel.org/linux-cve-announce/2025100454-CVE-2023-53575-2079@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53576",
"url": "https://lore.kernel.org/linux-cve-announce/2025100454-CVE-2023-53576-c5dd@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53577",
"url": "https://lore.kernel.org/linux-cve-announce/2025100455-CVE-2023-53577-96e9@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53578",
"url": "https://lore.kernel.org/linux-cve-announce/2025100455-CVE-2023-53578-7dbf@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53579",
"url": "https://lore.kernel.org/linux-cve-announce/2025100455-CVE-2023-53579-e030@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53580",
"url": "https://lore.kernel.org/linux-cve-announce/2025100423-CVE-2023-53580-7d16@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53581",
"url": "https://lore.kernel.org/linux-cve-announce/2025100424-CVE-2023-53581-80fa@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53582",
"url": "https://lore.kernel.org/linux-cve-announce/2025100424-CVE-2023-53582-3ed8@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53583",
"url": "https://lore.kernel.org/linux-cve-announce/2025100424-CVE-2023-53583-b831@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53584",
"url": "https://lore.kernel.org/linux-cve-announce/2025100424-CVE-2023-53584-2034@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53585",
"url": "https://lore.kernel.org/linux-cve-announce/2025100425-CVE-2023-53585-b855@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53586",
"url": "https://lore.kernel.org/linux-cve-announce/2025100425-CVE-2023-53586-67e1@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53587",
"url": "https://lore.kernel.org/linux-cve-announce/2025100425-CVE-2023-53587-411f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53588",
"url": "https://lore.kernel.org/linux-cve-announce/2025100426-CVE-2023-53588-1220@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53589",
"url": "https://lore.kernel.org/linux-cve-announce/2025100426-CVE-2023-53589-22f7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53590",
"url": "https://lore.kernel.org/linux-cve-announce/2025100427-CVE-2023-53590-9f1d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53591",
"url": "https://lore.kernel.org/linux-cve-announce/2025100427-CVE-2023-53591-8496@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53592",
"url": "https://lore.kernel.org/linux-cve-announce/2025100427-CVE-2023-53592-3da6@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53593",
"url": "https://lore.kernel.org/linux-cve-announce/2025100428-CVE-2023-53593-228d@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53594",
"url": "https://lore.kernel.org/linux-cve-announce/2025100428-CVE-2023-53594-563f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53595",
"url": "https://lore.kernel.org/linux-cve-announce/2025100428-CVE-2023-53595-91fb@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53596",
"url": "https://lore.kernel.org/linux-cve-announce/2025100429-CVE-2023-53596-dbfb@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53597",
"url": "https://lore.kernel.org/linux-cve-announce/2025100429-CVE-2023-53597-e30c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53598",
"url": "https://lore.kernel.org/linux-cve-announce/2025100429-CVE-2023-53598-cbd8@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53599",
"url": "https://lore.kernel.org/linux-cve-announce/2025100430-CVE-2023-53599-2a93@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53600",
"url": "https://lore.kernel.org/linux-cve-announce/2025100430-CVE-2023-53600-69ba@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53601",
"url": "https://lore.kernel.org/linux-cve-announce/2025100430-CVE-2023-53601-aabe@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53602",
"url": "https://lore.kernel.org/linux-cve-announce/2025100431-CVE-2023-53602-2de6@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53603",
"url": "https://lore.kernel.org/linux-cve-announce/2025100431-CVE-2023-53603-df40@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53604",
"url": "https://lore.kernel.org/linux-cve-announce/2025100431-CVE-2023-53604-31fe@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53605",
"url": "https://lore.kernel.org/linux-cve-announce/2025100432-CVE-2023-53605-a660@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53606",
"url": "https://lore.kernel.org/linux-cve-announce/2025100432-CVE-2023-53606-8c1a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53607",
"url": "https://lore.kernel.org/linux-cve-announce/2025100432-CVE-2023-53607-9638@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53608",
"url": "https://lore.kernel.org/linux-cve-announce/2025100432-CVE-2023-53608-ccb6@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53609",
"url": "https://lore.kernel.org/linux-cve-announce/2025100433-CVE-2023-53609-1c39@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53610",
"url": "https://lore.kernel.org/linux-cve-announce/2025100433-CVE-2023-53610-3f0f@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53611",
"url": "https://lore.kernel.org/linux-cve-announce/2025100433-CVE-2023-53611-a508@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53612",
"url": "https://lore.kernel.org/linux-cve-announce/2025100434-CVE-2023-53612-b146@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53613",
"url": "https://lore.kernel.org/linux-cve-announce/2025100434-CVE-2023-53613-bba8@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53614",
"url": "https://lore.kernel.org/linux-cve-announce/2025100434-CVE-2023-53614-bf24@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53615",
"url": "https://lore.kernel.org/linux-cve-announce/2025100435-CVE-2023-53615-843c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2023-53616",
"url": "https://lore.kernel.org/linux-cve-announce/2025100435-CVE-2023-53616-9379@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39929",
"url": "https://lore.kernel.org/linux-cve-announce/2025100414-CVE-2025-39929-4308@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39931",
"url": "https://lore.kernel.org/linux-cve-announce/2025100416-CVE-2025-39931-8ff7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39932",
"url": "https://lore.kernel.org/linux-cve-announce/2025100416-CVE-2025-39932-bdaf@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39933",
"url": "https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2025-39933-e224@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39934",
"url": "https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2025-39934-4c48@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39935",
"url": "https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2025-39935-3e6a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39936",
"url": "https://lore.kernel.org/linux-cve-announce/2025100417-CVE-2025-39936-840a@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39937",
"url": "https://lore.kernel.org/linux-cve-announce/2025100418-CVE-2025-39937-c8f7@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39938",
"url": "https://lore.kernel.org/linux-cve-announce/2025100418-CVE-2025-39938-6508@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39939",
"url": "https://lore.kernel.org/linux-cve-announce/2025100418-CVE-2025-39939-7ec4@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39940",
"url": "https://lore.kernel.org/linux-cve-announce/2025100418-CVE-2025-39940-6097@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39941",
"url": "https://lore.kernel.org/linux-cve-announce/2025100418-CVE-2025-39941-f256@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39942",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2025-39942-0297@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39943",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2025-39943-f5d8@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39944",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2025-39944-0d67@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39945",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2025-39945-84d4@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39946",
"url": "https://lore.kernel.org/linux-cve-announce/2025100419-CVE-2025-39946-5f17@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39947",
"url": "https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2025-39947-6872@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39948",
"url": "https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2025-39948-7074@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39949",
"url": "https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2025-39949-d909@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39950",
"url": "https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2025-39950-e7d6@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39951",
"url": "https://lore.kernel.org/linux-cve-announce/2025100420-CVE-2025-39951-24b1@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39952",
"url": "https://lore.kernel.org/linux-cve-announce/2025100421-CVE-2025-39952-e36c@gregkh/"
},
{
"category": "external",
"summary": "Linux Kernel CVE Announcement CVE-2025-39953",
"url": "https://lore.kernel.org/linux-cve-announce/2025100421-CVE-2025-39953-4ac6@gregkh/"
},
{
"category": "external",
"summary": "Google Cloud Platform Security Bulletin GCP-2025-056 vom 2025-10-16",
"url": "https://cloud.google.com/support/bulletins#gcp-2025-056"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2LIVEPATCH-2025-277 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2LIVEPATCH-2025-277.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2KERNEL-5.15-2025-093 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2KERNEL-5.15-2025-093.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2KERNEL-5.4-2025-112 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2KERNEL-5.4-2025-112.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2LIVEPATCH-2025-279 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2LIVEPATCH-2025-279.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2KERNEL-5.10-2025-109 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2KERNEL-5.10-2025-109.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2LIVEPATCH-2025-282 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2LIVEPATCH-2025-282.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2KERNEL-5.4-2025-113 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2KERNEL-5.4-2025-113.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2LIVEPATCH-2025-280 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2LIVEPATCH-2025-280.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2-2025-3053 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2-2025-3053.html"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALAS2LIVEPATCH-2025-281 vom 2025-10-27",
"url": "https://alas.aws.amazon.com/AL2/ALAS2LIVEPATCH-2025-281.html"
},
{
"category": "external",
"summary": "Container-Optimized OS release notes vom 2025-10-28",
"url": "https://docs.cloud.google.com/container-optimized-os/docs/release-notes#October_20_2025"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-25754 vom 2025-11-10",
"url": "https://linux.oracle.com/errata/ELSA-2025-25754.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4057-1 vom 2025-11-11",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023254.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-6053 vom 2025-11-12",
"url": "https://lists.debian.org/debian-security-announce/2025/msg00219.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:20994-1 vom 2025-11-12",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023276.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:20996-1 vom 2025-11-12",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023275.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:21463 vom 2025-11-17",
"url": "https://access.redhat.com/errata/RHSA-2025:21463"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4111-1 vom 2025-11-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023294.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4128-1 vom 2025-11-18",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023299.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4135-1 vom 2025-11-18",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023300.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4132-1 vom 2025-11-18",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023302.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4141-1 vom 2025-11-19",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023304.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4139-1 vom 2025-11-19",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023306.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4140-1 vom 2025-11-19",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023305.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4149-1 vom 2025-11-20",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023309.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4189-1 vom 2025-11-24",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023334.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4188-1 vom 2025-11-24",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LVPUJWNDCBFGM2O2EFX4S5QBPKDARVQ7/"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2025-20081-1 vom 2025-11-26",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J4KLZE7HUQJ2N6IQEI3G2KJZ5VB36YBI/"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-4379 vom 2025-11-25",
"url": "https://lists.debian.org/debian-lts-announce/2025/11/msg00022.html"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2025-20091-1 vom 2025-11-27",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QVNKE6YBHUN7AVUHO7UZCJJGK4HYS62H/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21040-1 vom 2025-11-27",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023394.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21064-1 vom 2025-11-27",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023415.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21056-1 vom 2025-11-27",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023419.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21052-1 vom 2025-11-27",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023389.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21080-1 vom 2025-11-28",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023429.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21074-1 vom 2025-11-28",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023431.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4301-1 vom 2025-11-28",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LLIMXFMWOGTFRJZEC4XPGIMNBCRKQ7IF/"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-21118 vom 2025-12-04",
"url": "https://linux.oracle.com/errata/ELSA-2025-21118.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4320-1 vom 2025-12-04",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023445.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-21463 vom 2025-12-05",
"url": "https://linux.oracle.com/errata/ELSA-2025-21463.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-21931 vom 2025-12-05",
"url": "https://linux.oracle.com/errata/ELSA-2025-21931.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:22801 vom 2025-12-08",
"url": "https://access.redhat.com/errata/RHSA-2025:22801"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2025:22800 vom 2025-12-08",
"url": "https://access.redhat.com/errata/RHSA-2025:22800"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-22801 vom 2025-12-09",
"url": "http://linux.oracle.com/errata/ELSA-2025-22801.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21139-1 vom 2025-12-10",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023515.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21180-1 vom 2025-12-10",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023498.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21179-1 vom 2025-12-10",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023499.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:21147-1 vom 2025-12-10",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023511.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7921-1 vom 2025-12-10",
"url": "https://ubuntu.com/security/notices/USN-7921-1"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2025:22800 vom 2025-12-13",
"url": "https://errata.build.resf.org/RLSA-2025:22800"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-28049 vom 2025-12-15",
"url": "https://oss.oracle.com/pipermail/el-errata/2025-December/019260.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-4404 vom 2025-12-12",
"url": "https://lists.debian.org/debian-lts-announce/2025/12/msg00015.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-28048 vom 2025-12-12",
"url": "https://linux.oracle.com/errata/ELSA-2025-28048.html"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2025:22801 vom 2025-12-13",
"url": "https://errata.build.resf.org/RLSA-2025:22801"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2025-28049 vom 2025-12-15",
"url": "https://linux.oracle.com/errata/ELSA-2025-28049.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7934-1 vom 2025-12-15",
"url": "https://ubuntu.com/security/notices/USN-7934-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-7936-1 vom 2025-12-16",
"url": "https://ubuntu.com/security/notices/USN-7936-1"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4393-1 vom 2025-12-15",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023538.html"
},
{
"category": "external",
"summary": "IBM Security Bulletin 7255154 vom 2025-12-17",
"url": "https://www.ibm.com/support/pages/node/7255154"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4422-1 vom 2025-12-17",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023573.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4505-1 vom 2025-12-23",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3D5W2444LYTUJVXYGB63LTMU25GRLRJR/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4515-1 vom 2025-12-24",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023647.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4517-1 vom 2025-12-24",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023649.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4516-1 vom 2025-12-24",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023646.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2025:4521-1 vom 2025-12-24",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023651.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20021-1 vom 2026-01-09",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023723.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20012-1 vom 2026-01-09",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023715.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20015-1 vom 2026-01-09",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023727.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0090-1 vom 2026-01-12",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023732.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0107-1 vom 2026-01-12",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OJE4AD3YG7YMRUG6STSQJA6AUB5UHH72/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0107-1 vom 2026-01-12",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023731.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:0534 vom 2026-01-14",
"url": "https://access.redhat.com/errata/RHSA-2026:0534"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:0537 vom 2026-01-14",
"url": "https://access.redhat.com/errata/RHSA-2026:0537"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:0535 vom 2026-01-14",
"url": "https://access.redhat.com/errata/RHSA-2026:0535"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:0576 vom 2026-01-14",
"url": "https://access.redhat.com/errata/RHSA-2026:0576"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20059-1 vom 2026-01-15",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023751.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20039-1 vom 2026-01-15",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023767.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:0760 vom 2026-01-19",
"url": "https://access.redhat.com/errata/RHSA-2026:0760"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:0759 vom 2026-01-19",
"url": "https://access.redhat.com/errata/RHSA-2026:0759"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:0793 vom 2026-01-19",
"url": "https://access.redhat.com/errata/RHSA-2026:0793"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0163-1 vom 2026-01-19",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023795.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0166-1 vom 2026-01-19",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023794.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0176-1 vom 2026-01-20",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PSMTB6JYSBEU2CF3OD7SW3ZIJGKEKBZA/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0173-1 vom 2026-01-20",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/C7EZZMG5MOJB6A2OZ4KLGVN4SVE4LWEL/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0168-1 vom 2026-01-20",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DUZFNORTIL7FT4JAMWNYAWMBHYUP24BR/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0174-1 vom 2026-01-20",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/EYNRLMEYZG4OCUWVVR7BLL22PT3MTAV7/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0180-1 vom 2026-01-20",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023805.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0187-1 vom 2026-01-21",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023824.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0184-1 vom 2026-01-20",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023822.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0188-1 vom 2026-01-21",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023823.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0186-1 vom 2026-01-21",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023825.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0185-1 vom 2026-01-20",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023821.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0191-1 vom 2026-01-21",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023827.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-0759 vom 2026-01-21",
"url": "https://linux.oracle.com/errata/ELSA-2026-0759.html"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-0793 vom 2026-01-21",
"url": "https://linux.oracle.com/errata/ELSA-2026-0793.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0206-1 vom 2026-01-21",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023836.html"
},
{
"category": "external",
"summary": "NetApp Security Advisory NTAP-20260121-0010 vom 2026-01-21",
"url": "https://security.netapp.com/advisory/NTAP-20260121-0010"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0246-1 vom 2026-01-22",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023844.html"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:0759 vom 2026-01-24",
"url": "https://errata.build.resf.org/RLSA-2026:0759"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:0793 vom 2026-01-24",
"url": "https://errata.build.resf.org/RLSA-2026:0793"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:0760 vom 2026-01-24",
"url": "https://errata.build.resf.org/RLSA-2026:0760"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-50071 vom 2026-01-26",
"url": "https://linux.oracle.com/errata/ELSA-2026-50071.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:1445 vom 2026-01-28",
"url": "https://access.redhat.com/errata/RHSA-2026:1445"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:1441 vom 2026-01-28",
"url": "https://access.redhat.com/errata/RHSA-2026:1441"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:1443 vom 2026-01-28",
"url": "https://access.redhat.com/errata/RHSA-2026:1443"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:1494 vom 2026-01-28",
"url": "https://access.redhat.com/errata/RHSA-2026:1494"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:1495 vom 2026-01-28",
"url": "https://access.redhat.com/errata/RHSA-2026:1495"
},
{
"category": "external",
"summary": "Dell Security Advisory DSA-2026-030 vom 2026-01-30",
"url": "https://www.dell.com/support/kbdoc/de-de/000421570/dsa-2026-030-security-update-for-dell-networker-vproxy-multiple-third-party-component-vulnerabilities"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:1727 vom 2026-02-02",
"url": "https://access.redhat.com/errata/RHSA-2026:1727"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-50100 vom 2026-02-10",
"url": "http://linux.oracle.com/errata/ELSA-2026-50100.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:2282 vom 2026-02-09",
"url": "https://access.redhat.com/errata/RHSA-2026:2282"
},
{
"category": "external",
"summary": "Oracle Linux Security Advisory ELSA-2026-2282 vom 2026-02-10",
"url": "https://linux.oracle.com/errata/ELSA-2026-2282.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:2490 vom 2026-02-11",
"url": "https://access.redhat.com/errata/RHSA-2026:2490"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8028-1 vom 2026-02-11",
"url": "https://ubuntu.com/security/notices/USN-8028-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8033-2 vom 2026-02-12",
"url": "https://ubuntu.com/security/notices/USN-8033-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8028-2 vom 2026-02-12",
"url": "https://ubuntu.com/security/notices/USN-8028-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8033-3 vom 2026-02-12",
"url": "https://ubuntu.com/security/notices/USN-8033-3"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8033-1 vom 2026-02-12",
"url": "https://ubuntu.com/security/notices/USN-8033-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8034-1 vom 2026-02-12",
"url": "https://ubuntu.com/security/notices/USN-8034-1"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:2664 vom 2026-02-12",
"url": "https://access.redhat.com/errata/RHSA-2026:2664"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0475-1 vom 2026-02-12",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024139.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8033-4 vom 2026-02-13",
"url": "https://ubuntu.com/security/notices/USN-8033-4"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20334-1 vom 2026-02-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024161.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0495-1 vom 2026-02-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024159.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20333-1 vom 2026-02-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024162.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20317-1 vom 2026-02-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024177.html"
},
{
"category": "external",
"summary": "Rocky Linux Security Advisory RLSA-2026:2282 vom 2026-02-15",
"url": "https://errata.build.resf.org/RLSA-2026:2282"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:2759 vom 2026-02-16",
"url": "https://access.redhat.com/errata/RHSA-2026:2759"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:2766 vom 2026-02-17",
"url": "https://access.redhat.com/errata/RHSA-2026:2766"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8033-5 vom 2026-02-17",
"url": "https://ubuntu.com/security/notices/USN-8033-5"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8034-2 vom 2026-02-17",
"url": "https://ubuntu.com/security/notices/USN-8034-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8028-5 vom 2026-02-17",
"url": "https://ubuntu.com/security/notices/USN-8028-5"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8033-6 vom 2026-02-17",
"url": "https://ubuntu.com/security/notices/USN-8033-6"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8028-3 vom 2026-02-17",
"url": "https://ubuntu.com/security/notices/USN-8028-3"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8028-4 vom 2026-02-17",
"url": "https://ubuntu.com/security/notices/USN-8028-4"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8031-2 vom 2026-02-18",
"url": "https://ubuntu.com/security/notices/USN-8031-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8028-6 vom 2026-02-19",
"url": "https://ubuntu.com/security/notices/USN-8028-6"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8052-1 vom 2026-02-19",
"url": "https://ubuntu.com/security/notices/USN-8052-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8031-3 vom 2026-02-19",
"url": "https://ubuntu.com/security/notices/USN-8031-3"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8033-7 vom 2026-02-19",
"url": "https://ubuntu.com/security/notices/USN-8033-7"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8028-7 vom 2026-02-19",
"url": "https://ubuntu.com/security/notices/USN-8028-7"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8033-8 vom 2026-02-19",
"url": "https://ubuntu.com/security/notices/USN-8033-8"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8052-2 vom 2026-02-24",
"url": "https://ubuntu.com/security/notices/USN-8052-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8028-8 vom 2026-02-24",
"url": "https://ubuntu.com/security/notices/USN-8028-8"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:3268 vom 2026-02-25",
"url": "https://access.redhat.com/errata/RHSA-2026:3268"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:3277 vom 2026-02-25",
"url": "https://access.redhat.com/errata/RHSA-2026:3277"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:3267 vom 2026-02-25",
"url": "https://access.redhat.com/errata/RHSA-2026:3267"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:3293 vom 2026-02-25",
"url": "https://access.redhat.com/errata/RHSA-2026:3293"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:3360 vom 2026-02-25",
"url": "https://access.redhat.com/errata/RHSA-2026:3360"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:3375 vom 2026-02-25",
"url": "https://access.redhat.com/errata/RHSA-2026:3375"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:3358 vom 2026-02-25",
"url": "https://access.redhat.com/errata/RHSA-2026:3358"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20473-1 vom 2026-02-26",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024411.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20478-1 vom 2026-02-26",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024408.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20496-1 vom 2026-02-27",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024477.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20519-1 vom 2026-02-27",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-February/024456.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8074-2 vom 2026-03-04",
"url": "https://ubuntu.com/security/notices/USN-8074-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8074-1 vom 2026-03-04",
"url": "https://ubuntu.com/security/notices/USN-8074-1"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20561-1 vom 2026-03-05",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024578.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20560-1 vom 2026-03-05",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024586.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20562-1 vom 2026-03-05",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-March/024577.html"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8095-1 vom 2026-03-17",
"url": "https://ubuntu.com/security/notices/USN-8095-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8100-1 vom 2026-03-17",
"url": "https://ubuntu.com/security/notices/USN-8100-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8095-2 vom 2026-03-17",
"url": "https://ubuntu.com/security/notices/USN-8095-2"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8095-3 vom 2026-03-17",
"url": "https://ubuntu.com/security/notices/USN-8095-3"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8095-4 vom 2026-03-23",
"url": "https://ubuntu.com/security/notices/USN-8095-4"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2026:5691 vom 2026-03-25",
"url": "https://access.redhat.com/errata/RHSA-2026:5691"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8126-1 vom 2026-03-25",
"url": "https://ubuntu.com/security/notices/USN-8126-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8125-1 vom 2026-03-25",
"url": "https://ubuntu.com/security/notices/USN-8125-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8095-5 vom 2026-04-01",
"url": "https://ubuntu.com/security/notices/USN-8095-5"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8141-1 vom 2026-04-01",
"url": "https://ubuntu.com/security/notices/USN-8141-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8165-1 vom 2026-04-10",
"url": "https://ubuntu.com/security/notices/USN-8165-1"
},
{
"category": "external",
"summary": "Ubuntu Security Notice USN-8163-1 vom 2026-04-10",
"url": "https://ubuntu.com/security/notices/USN-8163-1"
}
],
"source_lang": "en-US",
"title": "Linux Kernel: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-04-09T22:00:00.000+00:00",
"generator": {
"date": "2026-04-10T07:44:59.087+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2025-2194",
"initial_release_date": "2025-10-05T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-10-05T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-10-16T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Google aufgenommen"
},
{
"date": "2025-10-27T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2025-10-28T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates aufgenommen"
},
{
"date": "2025-11-10T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2025-11-11T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE und Debian aufgenommen"
},
{
"date": "2025-11-12T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-11-16T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2025-11-18T23:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-11-19T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-11-20T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-11-24T23:00:00.000+00:00",
"number": "12",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-11-25T23:00:00.000+00:00",
"number": "13",
"summary": "Neue Updates von openSUSE und Debian aufgenommen"
},
{
"date": "2025-11-26T23:00:00.000+00:00",
"number": "14",
"summary": "Neue Updates von openSUSE aufgenommen"
},
{
"date": "2025-11-27T23:00:00.000+00:00",
"number": "15",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-11-30T23:00:00.000+00:00",
"number": "16",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-12-03T23:00:00.000+00:00",
"number": "17",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2025-12-04T23:00:00.000+00:00",
"number": "18",
"summary": "Neue Updates von SUSE und Oracle Linux aufgenommen"
},
{
"date": "2025-12-07T23:00:00.000+00:00",
"number": "19",
"summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen"
},
{
"date": "2025-12-08T23:00:00.000+00:00",
"number": "20",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2025-12-10T23:00:00.000+00:00",
"number": "21",
"summary": "Neue Updates von SUSE und Ubuntu aufgenommen"
},
{
"date": "2025-12-14T23:00:00.000+00:00",
"number": "22",
"summary": "Neue Updates von Rocky Enterprise Software Foundation, Oracle Linux und Debian aufgenommen"
},
{
"date": "2025-12-15T23:00:00.000+00:00",
"number": "23",
"summary": "Neue Updates von Ubuntu und SUSE aufgenommen"
},
{
"date": "2025-12-17T23:00:00.000+00:00",
"number": "24",
"summary": "Neue Updates von IBM und SUSE aufgenommen"
},
{
"date": "2025-12-22T23:00:00.000+00:00",
"number": "25",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-12-23T23:00:00.000+00:00",
"number": "26",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2025-12-28T23:00:00.000+00:00",
"number": "27",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-11T23:00:00.000+00:00",
"number": "28",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-12T23:00:00.000+00:00",
"number": "29",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-13T23:00:00.000+00:00",
"number": "30",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-01-14T23:00:00.000+00:00",
"number": "31",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-18T23:00:00.000+00:00",
"number": "32",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-01-19T23:00:00.000+00:00",
"number": "33",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-20T23:00:00.000+00:00",
"number": "34",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-21T23:00:00.000+00:00",
"number": "35",
"summary": "Neue Updates von SUSE, Oracle Linux und NetApp aufgenommen"
},
{
"date": "2026-01-22T23:00:00.000+00:00",
"number": "36",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-25T23:00:00.000+00:00",
"number": "37",
"summary": "Neue Updates von Rocky Enterprise Software Foundation aufgenommen"
},
{
"date": "2026-01-26T23:00:00.000+00:00",
"number": "38",
"summary": "Neue Updates von Oracle Linux aufgenommen"
},
{
"date": "2026-01-27T23:00:00.000+00:00",
"number": "39",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-01-28T23:00:00.000+00:00",
"number": "40",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-01-29T23:00:00.000+00:00",
"number": "41",
"summary": "Neue Updates von Dell aufgenommen"
},
{
"date": "2026-02-02T23:00:00.000+00:00",
"number": "42",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-02-09T23:00:00.000+00:00",
"number": "43",
"summary": "Neue Updates von Oracle Linux und Red Hat aufgenommen"
},
{
"date": "2026-02-10T23:00:00.000+00:00",
"number": "44",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-02-11T23:00:00.000+00:00",
"number": "45",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-02-12T23:00:00.000+00:00",
"number": "46",
"summary": "Neue Updates von Red Hat und SUSE aufgenommen"
},
{
"date": "2026-02-15T23:00:00.000+00:00",
"number": "47",
"summary": "Neue Updates von SUSE und Rocky Enterprise Software Foundation aufgenommen"
},
{
"date": "2026-02-16T23:00:00.000+00:00",
"number": "48",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-02-17T23:00:00.000+00:00",
"number": "49",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-02-18T23:00:00.000+00:00",
"number": "50",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-02-19T23:00:00.000+00:00",
"number": "51",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-02-24T23:00:00.000+00:00",
"number": "52",
"summary": "Neue Updates von Ubuntu und Red Hat aufgenommen"
},
{
"date": "2026-02-25T23:00:00.000+00:00",
"number": "53",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-02-26T23:00:00.000+00:00",
"number": "54",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-03-01T23:00:00.000+00:00",
"number": "55",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-03-04T23:00:00.000+00:00",
"number": "56",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-03-05T23:00:00.000+00:00",
"number": "57",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-03-16T23:00:00.000+00:00",
"number": "58",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-03-17T23:00:00.000+00:00",
"number": "59",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-03-23T23:00:00.000+00:00",
"number": "60",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-03-24T23:00:00.000+00:00",
"number": "61",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2026-03-25T23:00:00.000+00:00",
"number": "62",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-04-01T22:00:00.000+00:00",
"number": "63",
"summary": "Neue Updates von Ubuntu aufgenommen"
},
{
"date": "2026-04-09T22:00:00.000+00:00",
"number": "64",
"summary": "Neue Updates von Ubuntu aufgenommen"
}
],
"status": "final",
"version": "64"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Amazon Linux 2",
"product": {
"name": "Amazon Linux 2",
"product_id": "398363",
"product_identification_helper": {
"cpe": "cpe:/o:amazon:linux_2:-"
}
}
}
],
"category": "vendor",
"name": "Amazon"
},
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vProxy \u003c19.14",
"product": {
"name": "Dell NetWorker vProxy \u003c19.14",
"product_id": "T050451"
}
},
{
"category": "product_version",
"name": "vProxy 19.14",
"product": {
"name": "Dell NetWorker vProxy 19.14",
"product_id": "T050451-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:dell:networker:vproxy__19.14"
}
}
}
],
"category": "product_name",
"name": "NetWorker"
}
],
"category": "vendor",
"name": "Dell"
},
{
"branches": [
{
"category": "product_name",
"name": "Google Cloud Platform",
"product": {
"name": "Google Cloud Platform",
"product_id": "393401",
"product_identification_helper": {
"cpe": "cpe:/a:google:cloud_platform:-"
}
}
},
{
"category": "product_name",
"name": "Google Container-Optimized OS",
"product": {
"name": "Google Container-Optimized OS",
"product_id": "1607324",
"product_identification_helper": {
"cpe": "cpe:/o:google:container-optimized_os:-"
}
}
}
],
"category": "vendor",
"name": "Google"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c7.5.0 UP14 IF03",
"product": {
"name": "IBM QRadar SIEM \u003c7.5.0 UP14 IF03",
"product_id": "T049499"
}
},
{
"category": "product_version",
"name": "7.5.0 UP14 IF03",
"product": {
"name": "IBM QRadar SIEM 7.5.0 UP14 IF03",
"product_id": "T049499-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ibm:qradar_siem:7.5.0_up14_if03"
}
}
}
],
"category": "product_name",
"name": "QRadar SIEM"
}
],
"category": "vendor",
"name": "IBM"
},
{
"branches": [
{
"category": "product_name",
"name": "NetApp ActiveIQ Unified Manager",
"product": {
"name": "NetApp ActiveIQ Unified Manager",
"product_id": "T043317",
"product_identification_helper": {
"cpe": "cpe:/a:netapp:active_iq_unified_manager:vsphere"
}
}
}
],
"category": "vendor",
"name": "NetApp"
},
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "5.10.0-60.18.0.50.h602",
"product": {
"name": "Open Source Linux Kernel 5.10.0-60.18.0.50.h602",
"product_id": "T028462",
"product_identification_helper": {
"cpe": "cpe:/o:linux:linux_kernel:unspecified"
}
}
}
],
"category": "product_name",
"name": "Linux Kernel"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Oracle Linux",
"product": {
"name": "Oracle Linux",
"product_id": "T004914",
"product_identification_helper": {
"cpe": "cpe:/o:oracle:linux:-"
}
}
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"category": "product_name",
"name": "RESF Rocky Linux",
"product": {
"name": "RESF Rocky Linux",
"product_id": "T032255",
"product_identification_helper": {
"cpe": "cpe:/o:resf:rocky_linux:-"
}
}
}
],
"category": "vendor",
"name": "RESF"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
},
{
"category": "product_name",
"name": "SUSE openSUSE",
"product": {
"name": "SUSE openSUSE",
"product_id": "T027843",
"product_identification_helper": {
"cpe": "cpe:/o:suse:opensuse:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"category": "product_name",
"name": "Ubuntu Linux",
"product": {
"name": "Ubuntu Linux",
"product_id": "T000126",
"product_identification_helper": {
"cpe": "cpe:/o:canonical:ubuntu_linux:-"
}
}
}
],
"category": "vendor",
"name": "Ubuntu"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-50470",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50470"
},
{
"cve": "CVE-2022-50471",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50471"
},
{
"cve": "CVE-2022-50472",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50472"
},
{
"cve": "CVE-2022-50473",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50473"
},
{
"cve": "CVE-2022-50474",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50474"
},
{
"cve": "CVE-2022-50475",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50475"
},
{
"cve": "CVE-2022-50476",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50476"
},
{
"cve": "CVE-2022-50477",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50477"
},
{
"cve": "CVE-2022-50478",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50478"
},
{
"cve": "CVE-2022-50479",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50479"
},
{
"cve": "CVE-2022-50480",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50480"
},
{
"cve": "CVE-2022-50481",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50481"
},
{
"cve": "CVE-2022-50482",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50482"
},
{
"cve": "CVE-2022-50483",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50483"
},
{
"cve": "CVE-2022-50484",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50484"
},
{
"cve": "CVE-2022-50485",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50485"
},
{
"cve": "CVE-2022-50486",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50486"
},
{
"cve": "CVE-2022-50487",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50487"
},
{
"cve": "CVE-2022-50488",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50488"
},
{
"cve": "CVE-2022-50489",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50489"
},
{
"cve": "CVE-2022-50490",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50490"
},
{
"cve": "CVE-2022-50491",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50491"
},
{
"cve": "CVE-2022-50492",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50492"
},
{
"cve": "CVE-2022-50493",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50493"
},
{
"cve": "CVE-2022-50494",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50494"
},
{
"cve": "CVE-2022-50495",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50495"
},
{
"cve": "CVE-2022-50496",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50496"
},
{
"cve": "CVE-2022-50497",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50497"
},
{
"cve": "CVE-2022-50498",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50498"
},
{
"cve": "CVE-2022-50499",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50499"
},
{
"cve": "CVE-2022-50500",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50500"
},
{
"cve": "CVE-2022-50501",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50501"
},
{
"cve": "CVE-2022-50502",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50502"
},
{
"cve": "CVE-2022-50503",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50503"
},
{
"cve": "CVE-2022-50504",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50504"
},
{
"cve": "CVE-2022-50505",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50505"
},
{
"cve": "CVE-2022-50506",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50506"
},
{
"cve": "CVE-2022-50507",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50507"
},
{
"cve": "CVE-2022-50508",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2022-50508"
},
{
"cve": "CVE-2023-3773",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-3773"
},
{
"cve": "CVE-2023-53533",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53533"
},
{
"cve": "CVE-2023-53534",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53534"
},
{
"cve": "CVE-2023-53535",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53535"
},
{
"cve": "CVE-2023-53536",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53536"
},
{
"cve": "CVE-2023-53537",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53537"
},
{
"cve": "CVE-2023-53538",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53538"
},
{
"cve": "CVE-2023-53539",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53539"
},
{
"cve": "CVE-2023-53540",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53540"
},
{
"cve": "CVE-2023-53541",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53541"
},
{
"cve": "CVE-2023-53542",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53542"
},
{
"cve": "CVE-2023-53543",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53543"
},
{
"cve": "CVE-2023-53544",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53544"
},
{
"cve": "CVE-2023-53545",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53545"
},
{
"cve": "CVE-2023-53546",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53546"
},
{
"cve": "CVE-2023-53547",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53547"
},
{
"cve": "CVE-2023-53548",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53548"
},
{
"cve": "CVE-2023-53549",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53549"
},
{
"cve": "CVE-2023-53550",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53550"
},
{
"cve": "CVE-2023-53551",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53551"
},
{
"cve": "CVE-2023-53552",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53552"
},
{
"cve": "CVE-2023-53553",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53553"
},
{
"cve": "CVE-2023-53554",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53554"
},
{
"cve": "CVE-2023-53555",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53555"
},
{
"cve": "CVE-2023-53556",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53556"
},
{
"cve": "CVE-2023-53557",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53557"
},
{
"cve": "CVE-2023-53558",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53558"
},
{
"cve": "CVE-2023-53559",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53559"
},
{
"cve": "CVE-2023-53560",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53560"
},
{
"cve": "CVE-2023-53561",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53561"
},
{
"cve": "CVE-2023-53562",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53562"
},
{
"cve": "CVE-2023-53563",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53563"
},
{
"cve": "CVE-2023-53564",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53564"
},
{
"cve": "CVE-2023-53565",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53565"
},
{
"cve": "CVE-2023-53566",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53566"
},
{
"cve": "CVE-2023-53567",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53567"
},
{
"cve": "CVE-2023-53568",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53568"
},
{
"cve": "CVE-2023-53569",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53569"
},
{
"cve": "CVE-2023-53570",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53570"
},
{
"cve": "CVE-2023-53571",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53571"
},
{
"cve": "CVE-2023-53572",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53572"
},
{
"cve": "CVE-2023-53573",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53573"
},
{
"cve": "CVE-2023-53574",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53574"
},
{
"cve": "CVE-2023-53575",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53575"
},
{
"cve": "CVE-2023-53576",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53576"
},
{
"cve": "CVE-2023-53577",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53577"
},
{
"cve": "CVE-2023-53578",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53578"
},
{
"cve": "CVE-2023-53579",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53579"
},
{
"cve": "CVE-2023-53580",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53580"
},
{
"cve": "CVE-2023-53581",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53581"
},
{
"cve": "CVE-2023-53582",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53582"
},
{
"cve": "CVE-2023-53583",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53583"
},
{
"cve": "CVE-2023-53584",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53584"
},
{
"cve": "CVE-2023-53585",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53585"
},
{
"cve": "CVE-2023-53586",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53586"
},
{
"cve": "CVE-2023-53587",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53587"
},
{
"cve": "CVE-2023-53588",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53588"
},
{
"cve": "CVE-2023-53589",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53589"
},
{
"cve": "CVE-2023-53590",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53590"
},
{
"cve": "CVE-2023-53591",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53591"
},
{
"cve": "CVE-2023-53592",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53592"
},
{
"cve": "CVE-2023-53593",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53593"
},
{
"cve": "CVE-2023-53594",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53594"
},
{
"cve": "CVE-2023-53595",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53595"
},
{
"cve": "CVE-2023-53596",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53596"
},
{
"cve": "CVE-2023-53597",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53597"
},
{
"cve": "CVE-2023-53598",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53598"
},
{
"cve": "CVE-2023-53599",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53599"
},
{
"cve": "CVE-2023-53600",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53600"
},
{
"cve": "CVE-2023-53601",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53601"
},
{
"cve": "CVE-2023-53602",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53602"
},
{
"cve": "CVE-2023-53603",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53603"
},
{
"cve": "CVE-2023-53604",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53604"
},
{
"cve": "CVE-2023-53605",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53605"
},
{
"cve": "CVE-2023-53606",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53606"
},
{
"cve": "CVE-2023-53607",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53607"
},
{
"cve": "CVE-2023-53608",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53608"
},
{
"cve": "CVE-2023-53609",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53609"
},
{
"cve": "CVE-2023-53610",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53610"
},
{
"cve": "CVE-2023-53611",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53611"
},
{
"cve": "CVE-2023-53612",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53612"
},
{
"cve": "CVE-2023-53613",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53613"
},
{
"cve": "CVE-2023-53614",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53614"
},
{
"cve": "CVE-2023-53615",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53615"
},
{
"cve": "CVE-2023-53616",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2023-53616"
},
{
"cve": "CVE-2025-39929",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39929"
},
{
"cve": "CVE-2025-39931",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39931"
},
{
"cve": "CVE-2025-39932",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39932"
},
{
"cve": "CVE-2025-39933",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39933"
},
{
"cve": "CVE-2025-39934",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39934"
},
{
"cve": "CVE-2025-39935",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39935"
},
{
"cve": "CVE-2025-39936",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39936"
},
{
"cve": "CVE-2025-39937",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39937"
},
{
"cve": "CVE-2025-39938",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39938"
},
{
"cve": "CVE-2025-39939",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39939"
},
{
"cve": "CVE-2025-39940",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39940"
},
{
"cve": "CVE-2025-39941",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39941"
},
{
"cve": "CVE-2025-39942",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39942"
},
{
"cve": "CVE-2025-39943",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39943"
},
{
"cve": "CVE-2025-39944",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39944"
},
{
"cve": "CVE-2025-39945",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39945"
},
{
"cve": "CVE-2025-39946",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39946"
},
{
"cve": "CVE-2025-39947",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39947"
},
{
"cve": "CVE-2025-39948",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39948"
},
{
"cve": "CVE-2025-39949",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39949"
},
{
"cve": "CVE-2025-39950",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39950"
},
{
"cve": "CVE-2025-39951",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39951"
},
{
"cve": "CVE-2025-39952",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39952"
},
{
"cve": "CVE-2025-39953",
"product_status": {
"known_affected": [
"T028462",
"67646",
"393401",
"T004914",
"T050451",
"T032255",
"2951",
"T002207",
"T000126",
"T043317",
"T027843",
"T049499",
"398363",
"1607324"
]
},
"release_date": "2025-10-05T22:00:00.000+00:00",
"title": "CVE-2025-39953"
}
]
}
CVE-2023-53603 (GCVE-0-2023-53603)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-29 10:50
VLAI?
EPSS
Title
scsi: qla2xxx: Avoid fcport pointer dereference
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Avoid fcport pointer dereference
Klocwork reported warning of NULL pointer may be dereferenced. The routine
exits when sa_ctl is NULL and fcport is allocated after the exit call thus
causing NULL fcport pointer to dereference at the time of exit.
To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
7b2fbfa4b2cd3a24c1760b85d842e928070d4744 , < 4406fe8a96a946c7ea5724ee59625755a1d9c59d
(git)
Affected: e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09 , < 477bc74ad1add644b606bff6ba1284943c42818a (git) Affected: e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09 , < 7bbeff613ec0560fb2f6f8b405288f3f043adf64 (git) Affected: e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09 , < 6b504d06976fe4a61cc05dedc68b84fadb397f77 (git) Affected: 47b583ad1f7e459689eb1bdd222279a6986ccd69 (git) Affected: d2deafaef0330a863b5e046c1154b605588d19f7 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_edif.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4406fe8a96a946c7ea5724ee59625755a1d9c59d",
"status": "affected",
"version": "7b2fbfa4b2cd3a24c1760b85d842e928070d4744",
"versionType": "git"
},
{
"lessThan": "477bc74ad1add644b606bff6ba1284943c42818a",
"status": "affected",
"version": "e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09",
"versionType": "git"
},
{
"lessThan": "7bbeff613ec0560fb2f6f8b405288f3f043adf64",
"status": "affected",
"version": "e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09",
"versionType": "git"
},
{
"lessThan": "6b504d06976fe4a61cc05dedc68b84fadb397f77",
"status": "affected",
"version": "e0fb8ce2bb9e52c846e54ad2c58b5b7beb13eb09",
"versionType": "git"
},
{
"status": "affected",
"version": "47b583ad1f7e459689eb1bdd222279a6986ccd69",
"versionType": "git"
},
{
"status": "affected",
"version": "d2deafaef0330a863b5e046c1154b605588d19f7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_edif.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.121",
"versionStartIncluding": "5.15.61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.40",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.19.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Avoid fcport pointer dereference\n\nKlocwork reported warning of NULL pointer may be dereferenced. The routine\nexits when sa_ctl is NULL and fcport is allocated after the exit call thus\ncausing NULL fcport pointer to dereference at the time of exit.\n\nTo avoid fcport pointer dereference, exit the routine when sa_ctl is NULL."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-29T10:50:33.875Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4406fe8a96a946c7ea5724ee59625755a1d9c59d"
},
{
"url": "https://git.kernel.org/stable/c/477bc74ad1add644b606bff6ba1284943c42818a"
},
{
"url": "https://git.kernel.org/stable/c/7bbeff613ec0560fb2f6f8b405288f3f043adf64"
},
{
"url": "https://git.kernel.org/stable/c/6b504d06976fe4a61cc05dedc68b84fadb397f77"
}
],
"title": "scsi: qla2xxx: Avoid fcport pointer dereference",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53603",
"datePublished": "2025-10-04T15:44:13.820Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-29T10:50:33.875Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50473 (GCVE-0-2022-50473)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
cpufreq: Init completion before kobject_init_and_add()
Summary
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: Init completion before kobject_init_and_add()
In cpufreq_policy_alloc(), it will call uninitialed completion in
cpufreq_sysfs_release() when kobject_init_and_add() fails. And
that will cause a crash such as the following page fault in complete:
BUG: unable to handle page fault for address: fffffffffffffff8
[..]
RIP: 0010:complete+0x98/0x1f0
[..]
Call Trace:
kobject_put+0x1be/0x4c0
cpufreq_online.cold+0xee/0x1fd
cpufreq_add_dev+0x183/0x1e0
subsys_interface_register+0x3f5/0x4e0
cpufreq_register_driver+0x3b7/0x670
acpi_cpufreq_init+0x56c/0x1000 [acpi_cpufreq]
do_one_initcall+0x13d/0x780
do_init_module+0x1c3/0x630
load_module+0x6e67/0x73b0
__do_sys_finit_module+0x181/0x240
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4ebe36c94aed95de71a8ce6a6762226d31c938ee , < 3cdd91a9163248935720927531066b74f57aa43b
(git)
Affected: 4ebe36c94aed95de71a8ce6a6762226d31c938ee , < e379b88a8f8cffc99b318e028705ed9e3da0e1e0 (git) Affected: 4ebe36c94aed95de71a8ce6a6762226d31c938ee , < 8fb4c98f20dfca1237de2e3dfdbe78d156784fd3 (git) Affected: 4ebe36c94aed95de71a8ce6a6762226d31c938ee , < d88540acfc7a17079021d866de914112c396edb1 (git) Affected: 4ebe36c94aed95de71a8ce6a6762226d31c938ee , < e7c0c943ed675b66d4bbb16c51c6a3bb58da047e (git) Affected: 4ebe36c94aed95de71a8ce6a6762226d31c938ee , < 5c51054896bcce1d33d39fead2af73fec24f40b6 (git) Affected: e977b1477a6725868302957e6b5c330220391797 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/cpufreq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3cdd91a9163248935720927531066b74f57aa43b",
"status": "affected",
"version": "4ebe36c94aed95de71a8ce6a6762226d31c938ee",
"versionType": "git"
},
{
"lessThan": "e379b88a8f8cffc99b318e028705ed9e3da0e1e0",
"status": "affected",
"version": "4ebe36c94aed95de71a8ce6a6762226d31c938ee",
"versionType": "git"
},
{
"lessThan": "8fb4c98f20dfca1237de2e3dfdbe78d156784fd3",
"status": "affected",
"version": "4ebe36c94aed95de71a8ce6a6762226d31c938ee",
"versionType": "git"
},
{
"lessThan": "d88540acfc7a17079021d866de914112c396edb1",
"status": "affected",
"version": "4ebe36c94aed95de71a8ce6a6762226d31c938ee",
"versionType": "git"
},
{
"lessThan": "e7c0c943ed675b66d4bbb16c51c6a3bb58da047e",
"status": "affected",
"version": "4ebe36c94aed95de71a8ce6a6762226d31c938ee",
"versionType": "git"
},
{
"lessThan": "5c51054896bcce1d33d39fead2af73fec24f40b6",
"status": "affected",
"version": "4ebe36c94aed95de71a8ce6a6762226d31c938ee",
"versionType": "git"
},
{
"status": "affected",
"version": "e977b1477a6725868302957e6b5c330220391797",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/cpufreq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.87",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.18",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.4",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.1.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: Init completion before kobject_init_and_add()\n\nIn cpufreq_policy_alloc(), it will call uninitialed completion in\ncpufreq_sysfs_release() when kobject_init_and_add() fails. And\nthat will cause a crash such as the following page fault in complete:\n\nBUG: unable to handle page fault for address: fffffffffffffff8\n[..]\nRIP: 0010:complete+0x98/0x1f0\n[..]\nCall Trace:\n kobject_put+0x1be/0x4c0\n cpufreq_online.cold+0xee/0x1fd\n cpufreq_add_dev+0x183/0x1e0\n subsys_interface_register+0x3f5/0x4e0\n cpufreq_register_driver+0x3b7/0x670\n acpi_cpufreq_init+0x56c/0x1000 [acpi_cpufreq]\n do_one_initcall+0x13d/0x780\n do_init_module+0x1c3/0x630\n load_module+0x6e67/0x73b0\n __do_sys_finit_module+0x181/0x240\n do_syscall_64+0x35/0x80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:34.859Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3cdd91a9163248935720927531066b74f57aa43b"
},
{
"url": "https://git.kernel.org/stable/c/e379b88a8f8cffc99b318e028705ed9e3da0e1e0"
},
{
"url": "https://git.kernel.org/stable/c/8fb4c98f20dfca1237de2e3dfdbe78d156784fd3"
},
{
"url": "https://git.kernel.org/stable/c/d88540acfc7a17079021d866de914112c396edb1"
},
{
"url": "https://git.kernel.org/stable/c/e7c0c943ed675b66d4bbb16c51c6a3bb58da047e"
},
{
"url": "https://git.kernel.org/stable/c/5c51054896bcce1d33d39fead2af73fec24f40b6"
}
],
"title": "cpufreq: Init completion before kobject_init_and_add()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50473",
"datePublished": "2025-10-04T15:16:34.859Z",
"dateReserved": "2025-10-04T15:13:33.467Z",
"dateUpdated": "2025-10-04T15:16:34.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50470 (GCVE-0-2022-50470)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-12-23 13:29
VLAI?
EPSS
Title
xhci: Remove device endpoints from bandwidth list when freeing the device
Summary
In the Linux kernel, the following vulnerability has been resolved:
xhci: Remove device endpoints from bandwidth list when freeing the device
Endpoints are normally deleted from the bandwidth list when they are
dropped, before the virt device is freed.
If xHC host is dying or being removed then the endpoints aren't dropped
cleanly due to functions returning early to avoid interacting with a
non-accessible host controller.
So check and delete endpoints that are still on the bandwidth list when
freeing the virt device.
Solves a list_del corruption kernel crash when unbinding xhci-pci,
caused by xhci_mem_cleanup() when it later tried to delete already freed
endpoints from the bandwidth list.
This only affects hosts that use software bandwidth checking, which
currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
2e27980e6eb78114c4ecbaad1ba71836e3887d18 , < 5e4ce28ad907aa54f13b21d5f1dc490525957b0c
(git)
Affected: 2e27980e6eb78114c4ecbaad1ba71836e3887d18 , < f0de39474078adef6ece7a183e34c15ce2c1d8d1 (git) Affected: 2e27980e6eb78114c4ecbaad1ba71836e3887d18 , < cebbc8d335d6bcc1316584f779c08f80287c6af8 (git) Affected: 2e27980e6eb78114c4ecbaad1ba71836e3887d18 , < 8f1cd9633d1f21efc13e8fc75be8f2b6bb85e38c (git) Affected: 2e27980e6eb78114c4ecbaad1ba71836e3887d18 , < 678d2cc2041cc6ce05030852dce9ad42719abcfc (git) Affected: 2e27980e6eb78114c4ecbaad1ba71836e3887d18 , < c892a81c7424b4f6a660cb9c249d354ccf3afeca (git) Affected: 2e27980e6eb78114c4ecbaad1ba71836e3887d18 , < 3bf860a41e0f2fcea0ac3aae8f7ef887a7994b70 (git) Affected: 2e27980e6eb78114c4ecbaad1ba71836e3887d18 , < 5aed5b7c2430ce318a8e62f752f181e66f0d1053 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci-mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5e4ce28ad907aa54f13b21d5f1dc490525957b0c",
"status": "affected",
"version": "2e27980e6eb78114c4ecbaad1ba71836e3887d18",
"versionType": "git"
},
{
"lessThan": "f0de39474078adef6ece7a183e34c15ce2c1d8d1",
"status": "affected",
"version": "2e27980e6eb78114c4ecbaad1ba71836e3887d18",
"versionType": "git"
},
{
"lessThan": "cebbc8d335d6bcc1316584f779c08f80287c6af8",
"status": "affected",
"version": "2e27980e6eb78114c4ecbaad1ba71836e3887d18",
"versionType": "git"
},
{
"lessThan": "8f1cd9633d1f21efc13e8fc75be8f2b6bb85e38c",
"status": "affected",
"version": "2e27980e6eb78114c4ecbaad1ba71836e3887d18",
"versionType": "git"
},
{
"lessThan": "678d2cc2041cc6ce05030852dce9ad42719abcfc",
"status": "affected",
"version": "2e27980e6eb78114c4ecbaad1ba71836e3887d18",
"versionType": "git"
},
{
"lessThan": "c892a81c7424b4f6a660cb9c249d354ccf3afeca",
"status": "affected",
"version": "2e27980e6eb78114c4ecbaad1ba71836e3887d18",
"versionType": "git"
},
{
"lessThan": "3bf860a41e0f2fcea0ac3aae8f7ef887a7994b70",
"status": "affected",
"version": "2e27980e6eb78114c4ecbaad1ba71836e3887d18",
"versionType": "git"
},
{
"lessThan": "5aed5b7c2430ce318a8e62f752f181e66f0d1053",
"status": "affected",
"version": "2e27980e6eb78114c4ecbaad1ba71836e3887d18",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/host/xhci-mem.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.2"
},
{
"lessThan": "3.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.332",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.298",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.264",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.223",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.153",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.332",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.298",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.264",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.223",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.153",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.77",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.7",
"versionStartIncluding": "3.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "3.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxhci: Remove device endpoints from bandwidth list when freeing the device\n\nEndpoints are normally deleted from the bandwidth list when they are\ndropped, before the virt device is freed.\n\nIf xHC host is dying or being removed then the endpoints aren\u0027t dropped\ncleanly due to functions returning early to avoid interacting with a\nnon-accessible host controller.\n\nSo check and delete endpoints that are still on the bandwidth list when\nfreeing the virt device.\n\nSolves a list_del corruption kernel crash when unbinding xhci-pci,\ncaused by xhci_mem_cleanup() when it later tried to delete already freed\nendpoints from the bandwidth list.\n\nThis only affects hosts that use software bandwidth checking, which\ncurrenty is only the xHC in intel Panther Point PCH (Ivy Bridge)"
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T13:29:32.754Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5e4ce28ad907aa54f13b21d5f1dc490525957b0c"
},
{
"url": "https://git.kernel.org/stable/c/f0de39474078adef6ece7a183e34c15ce2c1d8d1"
},
{
"url": "https://git.kernel.org/stable/c/cebbc8d335d6bcc1316584f779c08f80287c6af8"
},
{
"url": "https://git.kernel.org/stable/c/8f1cd9633d1f21efc13e8fc75be8f2b6bb85e38c"
},
{
"url": "https://git.kernel.org/stable/c/678d2cc2041cc6ce05030852dce9ad42719abcfc"
},
{
"url": "https://git.kernel.org/stable/c/c892a81c7424b4f6a660cb9c249d354ccf3afeca"
},
{
"url": "https://git.kernel.org/stable/c/3bf860a41e0f2fcea0ac3aae8f7ef887a7994b70"
},
{
"url": "https://git.kernel.org/stable/c/5aed5b7c2430ce318a8e62f752f181e66f0d1053"
}
],
"title": "xhci: Remove device endpoints from bandwidth list when freeing the device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50470",
"datePublished": "2025-10-04T15:16:32.764Z",
"dateReserved": "2025-10-04T15:13:33.466Z",
"dateUpdated": "2025-12-23T13:29:32.754Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39946 (GCVE-0-2025-39946)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2026-04-02 08:39
VLAI?
EPSS
Title
tls: make sure to abort the stream if headers are bogus
Summary
In the Linux kernel, the following vulnerability has been resolved:
tls: make sure to abort the stream if headers are bogus
Normally we wait for the socket to buffer up the whole record
before we service it. If the socket has a tiny buffer, however,
we read out the data sooner, to prevent connection stalls.
Make sure that we abort the connection when we find out late
that the record is actually invalid. Retrying the parsing is
fine in itself but since we copy some more data each time
before we parse we can overflow the allocated skb space.
Constructing a scenario in which we're under pressure without
enough data in the socket to parse the length upfront is quite
hard. syzbot figured out a way to do this by serving us the header
in small OOB sends, and then filling in the recvbuf with a large
normal send.
Make sure that tls_rx_msg_size() aborts strp, if we reach
an invalid record there's really no way to recover.
Severity ?
9.8 (Critical)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
84c61fe1a75b4255df1e1e7c054c9e6d048da417 , < b36462146d86b1f22e594fe4dae611dffacfb203
(git)
Affected: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 , < 4cefe5be73886f383639fe0850bb72d5b568a7b9 (git) Affected: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 , < 208640e6225cc929a05adbf79d1df558add3e231 (git) Affected: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 , < 61ca2da5fb8f433ce8bbd1657c84a86272133e6b (git) Affected: 84c61fe1a75b4255df1e1e7c054c9e6d048da417 , < 0aeb54ac4cd5cf8f60131b4d9ec0b6dc9c27b20d (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/tls/tls.h",
"net/tls/tls_strp.c",
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b36462146d86b1f22e594fe4dae611dffacfb203",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "4cefe5be73886f383639fe0850bb72d5b568a7b9",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "208640e6225cc929a05adbf79d1df558add3e231",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "61ca2da5fb8f433ce8bbd1657c84a86272133e6b",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
},
{
"lessThan": "0aeb54ac4cd5cf8f60131b4d9ec0b6dc9c27b20d",
"status": "affected",
"version": "84c61fe1a75b4255df1e1e7c054c9e6d048da417",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/tls/tls.h",
"net/tls/tls_strp.c",
"net/tls/tls_sw.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntls: make sure to abort the stream if headers are bogus\n\nNormally we wait for the socket to buffer up the whole record\nbefore we service it. If the socket has a tiny buffer, however,\nwe read out the data sooner, to prevent connection stalls.\nMake sure that we abort the connection when we find out late\nthat the record is actually invalid. Retrying the parsing is\nfine in itself but since we copy some more data each time\nbefore we parse we can overflow the allocated skb space.\n\nConstructing a scenario in which we\u0027re under pressure without\nenough data in the socket to parse the length upfront is quite\nhard. syzbot figured out a way to do this by serving us the header\nin small OOB sends, and then filling in the recvbuf with a large\nnormal send.\n\nMake sure that tls_rx_msg_size() aborts strp, if we reach\nan invalid record there\u0027s really no way to recover."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-02T08:39:33.990Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b36462146d86b1f22e594fe4dae611dffacfb203"
},
{
"url": "https://git.kernel.org/stable/c/4cefe5be73886f383639fe0850bb72d5b568a7b9"
},
{
"url": "https://git.kernel.org/stable/c/208640e6225cc929a05adbf79d1df558add3e231"
},
{
"url": "https://git.kernel.org/stable/c/61ca2da5fb8f433ce8bbd1657c84a86272133e6b"
},
{
"url": "https://git.kernel.org/stable/c/0aeb54ac4cd5cf8f60131b4d9ec0b6dc9c27b20d"
}
],
"title": "tls: make sure to abort the stream if headers are bogus",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39946",
"datePublished": "2025-10-04T07:31:07.871Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2026-04-02T08:39:33.990Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53582 (GCVE-0-2023-53582)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds
Fix a stack-out-of-bounds read in brcmfmac that occurs
when 'buf' that is not null-terminated is passed as an argument of
strreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with
a CLM version string by memcpy() in brcmf_fil_iovar_data_get().
Ensure buf is null-terminated.
Found by a modified version of syzkaller.
[ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available
[ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22
[ 33.021554][ T1896] ==================================================================
[ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110
[ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896
[ 33.023852][ T1896]
[ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132
[ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event
[ 33.026581][ T1896] Call Trace:
[ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d
[ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334
[ 33.028037][ T1896] ? strreplace+0xf2/0x110
[ 33.028403][ T1896] ? strreplace+0xf2/0x110
[ 33.028807][ T1896] kasan_report.cold+0x83/0xdf
[ 33.029283][ T1896] ? strreplace+0xf2/0x110
[ 33.029666][ T1896] strreplace+0xf2/0x110
[ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40
[ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100
[ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0
[ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0
[ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0
[ 33.032091][ T1896] ? find_held_lock+0x2d/0x110
[ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260
[ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0
[ 33.033582][ T1896] brcmf_attach+0x246/0xd40
[ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50
[ 33.034383][ T1896] ? kmemdup+0x30/0x40
[ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690
[ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470
[ 33.035833][ T1896] usb_probe_interface+0x25f/0x710
[ 33.036315][ T1896] really_probe+0x1be/0xa90
[ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460
[ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0
[ 33.037383][ T1896] driver_probe_device+0x49/0x120
[ 33.037790][ T1896] __device_attach_driver+0x18a/0x250
[ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120
[ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0
[ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20
[ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0
[ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120
[ 33.042330][ T1896] __device_attach+0x207/0x330
[ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0
[ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0
[ 33.043515][ T1896] bus_probe_device+0x1a2/0x260
[ 33.043914][ T1896] device_add+0xa61/0x1ce0
[ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660
[ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550
[ 33.045531][ T1896] usb_set_configuration+0x984/0x1770
[ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230
[ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90
[ 33.046931][ T1896] usb_probe_device+0x9c/0x220
[ 33.047434][ T1896] really_probe+0x1be/0xa90
[ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460
[ 33.048134][ T1896] driver_probe_device+0x49/0x120
[ 33.048516][ T1896] __device_attach_driver+0x18a/0x250
[ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120
---truncated---
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
fdd0bd88ceaecf729db103ac8836af5805dd2dc1 , < 3b173b4ad9c001a555f44adc7836d6fe3afbe9ec
(git)
Affected: fdd0bd88ceaecf729db103ac8836af5805dd2dc1 , < 423a1297ea72bbddf64dbb0957f2879c0f2aa5d0 (git) Affected: fdd0bd88ceaecf729db103ac8836af5805dd2dc1 , < 0ca2efea4f11c6255061e852ac188264c469c197 (git) Affected: fdd0bd88ceaecf729db103ac8836af5805dd2dc1 , < a0f0ce1c8ab9fe90618dc394e3d1568b5a9ac154 (git) Affected: fdd0bd88ceaecf729db103ac8836af5805dd2dc1 , < ecb980dc79709c02f579a9c03cb92ccec189ab38 (git) Affected: fdd0bd88ceaecf729db103ac8836af5805dd2dc1 , < c02f733024d70105f22de8dd0a1252a0350cd516 (git) Affected: fdd0bd88ceaecf729db103ac8836af5805dd2dc1 , < 660145d708be52f946a82e5b633c020f58f996de (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3b173b4ad9c001a555f44adc7836d6fe3afbe9ec",
"status": "affected",
"version": "fdd0bd88ceaecf729db103ac8836af5805dd2dc1",
"versionType": "git"
},
{
"lessThan": "423a1297ea72bbddf64dbb0957f2879c0f2aa5d0",
"status": "affected",
"version": "fdd0bd88ceaecf729db103ac8836af5805dd2dc1",
"versionType": "git"
},
{
"lessThan": "0ca2efea4f11c6255061e852ac188264c469c197",
"status": "affected",
"version": "fdd0bd88ceaecf729db103ac8836af5805dd2dc1",
"versionType": "git"
},
{
"lessThan": "a0f0ce1c8ab9fe90618dc394e3d1568b5a9ac154",
"status": "affected",
"version": "fdd0bd88ceaecf729db103ac8836af5805dd2dc1",
"versionType": "git"
},
{
"lessThan": "ecb980dc79709c02f579a9c03cb92ccec189ab38",
"status": "affected",
"version": "fdd0bd88ceaecf729db103ac8836af5805dd2dc1",
"versionType": "git"
},
{
"lessThan": "c02f733024d70105f22de8dd0a1252a0350cd516",
"status": "affected",
"version": "fdd0bd88ceaecf729db103ac8836af5805dd2dc1",
"versionType": "git"
},
{
"lessThan": "660145d708be52f946a82e5b633c020f58f996de",
"status": "affected",
"version": "fdd0bd88ceaecf729db103ac8836af5805dd2dc1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.276",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.276",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.235",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds\n\nFix a stack-out-of-bounds read in brcmfmac that occurs\nwhen \u0027buf\u0027 that is not null-terminated is passed as an argument of\nstrreplace() in brcmf_c_preinit_dcmds(). This buffer is filled with\na CLM version string by memcpy() in brcmf_fil_iovar_data_get().\nEnsure buf is null-terminated.\n\nFound by a modified version of syzkaller.\n\n[ 33.004414][ T1896] brcmfmac: brcmf_c_process_clm_blob: no clm_blob available (err=-2), device may have limited channels available\n[ 33.013486][ T1896] brcmfmac: brcmf_c_preinit_dcmds: Firmware: BCM43236/3 wl0: Nov 30 2011 17:33:42 version 5.90.188.22\n[ 33.021554][ T1896] ==================================================================\n[ 33.022379][ T1896] BUG: KASAN: stack-out-of-bounds in strreplace+0xf2/0x110\n[ 33.023122][ T1896] Read of size 1 at addr ffffc90001d6efc8 by task kworker/0:2/1896\n[ 33.023852][ T1896]\n[ 33.024096][ T1896] CPU: 0 PID: 1896 Comm: kworker/0:2 Tainted: G O 5.14.0+ #132\n[ 33.024927][ T1896] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014\n[ 33.026065][ T1896] Workqueue: usb_hub_wq hub_event\n[ 33.026581][ T1896] Call Trace:\n[ 33.026896][ T1896] dump_stack_lvl+0x57/0x7d\n[ 33.027372][ T1896] print_address_description.constprop.0.cold+0xf/0x334\n[ 33.028037][ T1896] ? strreplace+0xf2/0x110\n[ 33.028403][ T1896] ? strreplace+0xf2/0x110\n[ 33.028807][ T1896] kasan_report.cold+0x83/0xdf\n[ 33.029283][ T1896] ? strreplace+0xf2/0x110\n[ 33.029666][ T1896] strreplace+0xf2/0x110\n[ 33.029966][ T1896] brcmf_c_preinit_dcmds+0xab1/0xc40\n[ 33.030351][ T1896] ? brcmf_c_set_joinpref_default+0x100/0x100\n[ 33.030787][ T1896] ? rcu_read_lock_sched_held+0xa1/0xd0\n[ 33.031223][ T1896] ? rcu_read_lock_bh_held+0xb0/0xb0\n[ 33.031661][ T1896] ? lock_acquire+0x19d/0x4e0\n[ 33.032091][ T1896] ? find_held_lock+0x2d/0x110\n[ 33.032605][ T1896] ? brcmf_usb_deq+0x1a7/0x260\n[ 33.033087][ T1896] ? brcmf_usb_rx_fill_all+0x5a/0xf0\n[ 33.033582][ T1896] brcmf_attach+0x246/0xd40\n[ 33.034022][ T1896] ? wiphy_new_nm+0x1476/0x1d50\n[ 33.034383][ T1896] ? kmemdup+0x30/0x40\n[ 33.034722][ T1896] brcmf_usb_probe+0x12de/0x1690\n[ 33.035223][ T1896] ? brcmf_usbdev_qinit.constprop.0+0x470/0x470\n[ 33.035833][ T1896] usb_probe_interface+0x25f/0x710\n[ 33.036315][ T1896] really_probe+0x1be/0xa90\n[ 33.036656][ T1896] __driver_probe_device+0x2ab/0x460\n[ 33.037026][ T1896] ? usb_match_id.part.0+0x88/0xc0\n[ 33.037383][ T1896] driver_probe_device+0x49/0x120\n[ 33.037790][ T1896] __device_attach_driver+0x18a/0x250\n[ 33.038300][ T1896] ? driver_allows_async_probing+0x120/0x120\n[ 33.038986][ T1896] bus_for_each_drv+0x123/0x1a0\n[ 33.039906][ T1896] ? bus_rescan_devices+0x20/0x20\n[ 33.041412][ T1896] ? lockdep_hardirqs_on_prepare+0x273/0x3e0\n[ 33.041861][ T1896] ? trace_hardirqs_on+0x1c/0x120\n[ 33.042330][ T1896] __device_attach+0x207/0x330\n[ 33.042664][ T1896] ? device_bind_driver+0xb0/0xb0\n[ 33.043026][ T1896] ? kobject_uevent_env+0x230/0x12c0\n[ 33.043515][ T1896] bus_probe_device+0x1a2/0x260\n[ 33.043914][ T1896] device_add+0xa61/0x1ce0\n[ 33.044227][ T1896] ? __mutex_unlock_slowpath+0xe7/0x660\n[ 33.044891][ T1896] ? __fw_devlink_link_to_suppliers+0x550/0x550\n[ 33.045531][ T1896] usb_set_configuration+0x984/0x1770\n[ 33.046051][ T1896] ? kernfs_create_link+0x175/0x230\n[ 33.046548][ T1896] usb_generic_driver_probe+0x69/0x90\n[ 33.046931][ T1896] usb_probe_device+0x9c/0x220\n[ 33.047434][ T1896] really_probe+0x1be/0xa90\n[ 33.047760][ T1896] __driver_probe_device+0x2ab/0x460\n[ 33.048134][ T1896] driver_probe_device+0x49/0x120\n[ 33.048516][ T1896] __device_attach_driver+0x18a/0x250\n[ 33.048910][ T1896] ? driver_allows_async_probing+0x120/0x120\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:24.054Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3b173b4ad9c001a555f44adc7836d6fe3afbe9ec"
},
{
"url": "https://git.kernel.org/stable/c/423a1297ea72bbddf64dbb0957f2879c0f2aa5d0"
},
{
"url": "https://git.kernel.org/stable/c/0ca2efea4f11c6255061e852ac188264c469c197"
},
{
"url": "https://git.kernel.org/stable/c/a0f0ce1c8ab9fe90618dc394e3d1568b5a9ac154"
},
{
"url": "https://git.kernel.org/stable/c/ecb980dc79709c02f579a9c03cb92ccec189ab38"
},
{
"url": "https://git.kernel.org/stable/c/c02f733024d70105f22de8dd0a1252a0350cd516"
},
{
"url": "https://git.kernel.org/stable/c/660145d708be52f946a82e5b633c020f58f996de"
}
],
"title": "wifi: brcmfmac: ensure CLM version is null-terminated to prevent stack-out-of-bounds",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53582",
"datePublished": "2025-10-04T15:43:58.493Z",
"dateReserved": "2025-10-04T15:14:15.926Z",
"dateUpdated": "2026-01-05T10:21:24.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53607 (GCVE-0-2023-53607)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
ALSA: ymfpci: Fix BUG_ON in probe function
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: ymfpci: Fix BUG_ON in probe function
The snd_dma_buffer.bytes field now contains the aligned size, which this
snd_BUG_ON() did not account for, resulting in the following:
[ 9.625915] ------------[ cut here ]------------
[ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci]
[ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy
[ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da
[ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014
[ 9.732204] Workqueue: events work_for_cpu_fn
[ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci]
[ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb
[ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287
[ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8
[ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020
[ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00
[ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918
[ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200
[ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000
[ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0
[ 9.823301] Call Trace:
[ 9.825747] <TASK>
[ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615]
[ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0
[ 9.841918] local_pci_probe+0x45/0x80
[ 9.845680] work_for_cpu_fn+0x1a/0x30
[ 9.849431] process_one_work+0x1c7/0x380
[ 9.853464] worker_thread+0x1af/0x390
[ 9.857225] ? rescuer_thread+0x3b0/0x3b0
[ 9.861254] kthread+0xde/0x110
[ 9.864414] ? kthread_complete_and_exit+0x20/0x20
[ 9.869210] ret_from_fork+0x22/0x30
[ 9.872792] </TASK>
[ 9.874985] ---[ end trace 0000000000000000 ]---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4faf4bbc2d600a921052ff45b1b5914d583d9046 , < 96e34c88000febc83e41aa7db0b0a41676314818
(git)
Affected: 5c1733e33c888a3cb7f576564d8ad543d5ad4a9e , < 81d2a7e93c8322ca6b858f6736d7fc3d034e6c23 (git) Affected: 5c1733e33c888a3cb7f576564d8ad543d5ad4a9e , < 32b9bd7cfc2e2d92d595386add4e111b232b351f (git) Affected: 5c1733e33c888a3cb7f576564d8ad543d5ad4a9e , < d0217b09910c081b6471181345ea5b24025edf51 (git) Affected: 5c1733e33c888a3cb7f576564d8ad543d5ad4a9e , < 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 (git) Affected: f52ac912c14c5bf426c0f9e0c6236dbcdf61664e (git) Affected: 19241a56c5d6e74b32b1fbb1bd3ba7edef421f16 (git) Affected: 05243cf88f7fa5e9dd5659399bc9307ff3fb675f (git) Affected: 015af30d373d33548c9afcffbbaaf266459731de (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/pci/ymfpci/ymfpci_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96e34c88000febc83e41aa7db0b0a41676314818",
"status": "affected",
"version": "4faf4bbc2d600a921052ff45b1b5914d583d9046",
"versionType": "git"
},
{
"lessThan": "81d2a7e93c8322ca6b858f6736d7fc3d034e6c23",
"status": "affected",
"version": "5c1733e33c888a3cb7f576564d8ad543d5ad4a9e",
"versionType": "git"
},
{
"lessThan": "32b9bd7cfc2e2d92d595386add4e111b232b351f",
"status": "affected",
"version": "5c1733e33c888a3cb7f576564d8ad543d5ad4a9e",
"versionType": "git"
},
{
"lessThan": "d0217b09910c081b6471181345ea5b24025edf51",
"status": "affected",
"version": "5c1733e33c888a3cb7f576564d8ad543d5ad4a9e",
"versionType": "git"
},
{
"lessThan": "6be2e7522eb529b41c16d459f33bbdbcddbf5c15",
"status": "affected",
"version": "5c1733e33c888a3cb7f576564d8ad543d5ad4a9e",
"versionType": "git"
},
{
"status": "affected",
"version": "f52ac912c14c5bf426c0f9e0c6236dbcdf61664e",
"versionType": "git"
},
{
"status": "affected",
"version": "19241a56c5d6e74b32b1fbb1bd3ba7edef421f16",
"versionType": "git"
},
{
"status": "affected",
"version": "05243cf88f7fa5e9dd5659399bc9307ff3fb675f",
"versionType": "git"
},
{
"status": "affected",
"version": "015af30d373d33548c9afcffbbaaf266459731de",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/pci/ymfpci/ymfpci_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.177",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.106",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.23",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.177",
"versionStartIncluding": "5.10.134",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.106",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.23",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.10",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.9.325",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.14.290",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.254",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.208",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: ymfpci: Fix BUG_ON in probe function\n\nThe snd_dma_buffer.bytes field now contains the aligned size, which this\nsnd_BUG_ON() did not account for, resulting in the following:\n\n[ 9.625915] ------------[ cut here ]------------\n[ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci]\n[ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy\n[ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da\n[ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014\n[ 9.732204] Workqueue: events work_for_cpu_fn\n[ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci]\n[ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 \u003c0f\u003e 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb\n[ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287\n[ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8\n[ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020\n[ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00\n[ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918\n[ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200\n[ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000\n[ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0\n[ 9.823301] Call Trace:\n[ 9.825747] \u003cTASK\u003e\n[ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615]\n[ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0\n[ 9.841918] local_pci_probe+0x45/0x80\n[ 9.845680] work_for_cpu_fn+0x1a/0x30\n[ 9.849431] process_one_work+0x1c7/0x380\n[ 9.853464] worker_thread+0x1af/0x390\n[ 9.857225] ? rescuer_thread+0x3b0/0x3b0\n[ 9.861254] kthread+0xde/0x110\n[ 9.864414] ? kthread_complete_and_exit+0x20/0x20\n[ 9.869210] ret_from_fork+0x22/0x30\n[ 9.872792] \u003c/TASK\u003e\n[ 9.874985] ---[ end trace 0000000000000000 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:16.598Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96e34c88000febc83e41aa7db0b0a41676314818"
},
{
"url": "https://git.kernel.org/stable/c/81d2a7e93c8322ca6b858f6736d7fc3d034e6c23"
},
{
"url": "https://git.kernel.org/stable/c/32b9bd7cfc2e2d92d595386add4e111b232b351f"
},
{
"url": "https://git.kernel.org/stable/c/d0217b09910c081b6471181345ea5b24025edf51"
},
{
"url": "https://git.kernel.org/stable/c/6be2e7522eb529b41c16d459f33bbdbcddbf5c15"
}
],
"title": "ALSA: ymfpci: Fix BUG_ON in probe function",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53607",
"datePublished": "2025-10-04T15:44:16.598Z",
"dateReserved": "2025-10-04T15:40:38.480Z",
"dateUpdated": "2025-10-04T15:44:16.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53545 (GCVE-0-2023-53545)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-03-25 10:19
VLAI?
EPSS
Title
drm/amdgpu: unmap and remove csa_va properly
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: unmap and remove csa_va properly
Root PD BO should be reserved before unmap and remove
a bo_va from VM otherwise lockdep will complain.
v2: check fpriv->csa_va is not NULL instead of amdgpu_mcbp (christian)
[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu]
[14616.937096] Call Trace:
[14616.937097] <TASK>
[14616.937102] amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu]
[14616.937187] drm_file_free+0x1d6/0x300 [drm]
[14616.937207] drm_close_helper.isra.0+0x62/0x70 [drm]
[14616.937220] drm_release+0x5e/0x100 [drm]
[14616.937234] __fput+0x9f/0x280
[14616.937239] ____fput+0xe/0x20
[14616.937241] task_work_run+0x61/0x90
[14616.937246] exit_to_user_mode_prepare+0x215/0x220
[14616.937251] syscall_exit_to_user_mode+0x2a/0x60
[14616.937254] do_syscall_64+0x48/0x90
[14616.937257] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < ae325b245208394279a1dc412c831ebd71befb0d
(git)
Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 5daff15cd013422bc6d1efcfe82b586800025384 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c",
"drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h",
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ae325b245208394279a1dc412c831ebd71befb0d",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
},
{
"lessThan": "5daff15cd013422bc6d1efcfe82b586800025384",
"status": "affected",
"version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c",
"drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h",
"drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.12",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: unmap and remove csa_va properly\n\nRoot PD BO should be reserved before unmap and remove\na bo_va from VM otherwise lockdep will complain.\n\nv2: check fpriv-\u003ecsa_va is not NULL instead of amdgpu_mcbp (christian)\n\n[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu]\n[14616.937096] Call Trace:\n[14616.937097] \u003cTASK\u003e\n[14616.937102] amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu]\n[14616.937187] drm_file_free+0x1d6/0x300 [drm]\n[14616.937207] drm_close_helper.isra.0+0x62/0x70 [drm]\n[14616.937220] drm_release+0x5e/0x100 [drm]\n[14616.937234] __fput+0x9f/0x280\n[14616.937239] ____fput+0xe/0x20\n[14616.937241] task_work_run+0x61/0x90\n[14616.937246] exit_to_user_mode_prepare+0x215/0x220\n[14616.937251] syscall_exit_to_user_mode+0x2a/0x60\n[14616.937254] do_syscall_64+0x48/0x90\n[14616.937257] entry_SYSCALL_64_after_hwframe+0x63/0xcd"
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T10:19:06.886Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ae325b245208394279a1dc412c831ebd71befb0d"
},
{
"url": "https://git.kernel.org/stable/c/a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0"
},
{
"url": "https://git.kernel.org/stable/c/5daff15cd013422bc6d1efcfe82b586800025384"
}
],
"title": "drm/amdgpu: unmap and remove csa_va properly",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53545",
"datePublished": "2025-10-04T15:16:53.452Z",
"dateReserved": "2025-10-04T15:14:15.920Z",
"dateUpdated": "2026-03-25T10:19:06.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-3773 (GCVE-0-2023-3773)
Vulnerability from cvelistv5 – Published: 2023-07-25 15:47 – Updated: 2025-11-14 14:21
VLAI?
EPSS
Title
Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr
Summary
A flaw was found in the Linux kernel’s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace.
Severity ?
5.5 (Medium)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:5.14.0-362.8.1.el9_3 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9::appstream cpe:/a:redhat:enterprise_linux:9::nfv cpe:/a:redhat:enterprise_linux:9::realtime cpe:/o:redhat:enterprise_linux:9::baseos cpe:/a:redhat:enterprise_linux:9::crb |
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
Date Public ?
2023-07-23 00:00
Credits
Red Hat would like to thank Lin Ma (ZJU & Ant Security Light-Year Lab) for reporting this issue.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T07:08:49.757Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2023:6583",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2023:6583"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2023-3773"
},
{
"name": "RHBZ#2218944",
"tags": [
"issue-tracking",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218944"
},
{
"tags": [
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.debian.org/security/2023/dsa-5492"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-3773",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-05T18:33:27.598158Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-05T18:47:25.761Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::nfv",
"cpe:/a:redhat:enterprise_linux:9::realtime",
"cpe:/o:redhat:enterprise_linux:9::baseos",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-362.8.1.el9_3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::nfv",
"cpe:/a:redhat:enterprise_linux:9::realtime",
"cpe:/o:redhat:enterprise_linux:9::baseos",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"defaultStatus": "affected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.14.0-362.8.1.el9_3",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "kernel-rt",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
}
],
"credits": [
{
"lang": "en",
"value": "Red Hat would like to thank Lin Ma (ZJU \u0026 Ant Security Light-Year Lab) for reporting this issue."
}
],
"datePublic": "2023-07-23T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Linux kernel\u2019s IP framework for transforming packets (XFRM subsystem). This issue may allow a malicious user with CAP_NET_ADMIN privileges to cause a 4 byte out-of-bounds read of XFRMA_MTIMER_THRESH when parsing netlink attributes, leading to potential leakage of sensitive heap data to userspace."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-14T14:21:06.184Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2023:6583",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2023:6583"
},
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2023-3773"
},
{
"name": "RHBZ#2218944",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2218944"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-06-29T00:00:00.000Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2023-07-23T00:00:00.000Z",
"value": "Made public."
}
],
"title": "Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr",
"x_redhatCweChain": "CWE-125: Out-of-bounds Read"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2023-3773",
"datePublished": "2023-07-25T15:47:40.391Z",
"dateReserved": "2023-07-19T13:55:13.694Z",
"dateUpdated": "2025-11-14T14:21:06.184Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39950 (GCVE-0-2025-39950)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:31
VLAI?
EPSS
Title
net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR
A NULL pointer dereference can occur in tcp_ao_finish_connect() during a
connect() system call on a socket with a TCP-AO key added and TCP_REPAIR
enabled.
The function is called with skb being NULL and attempts to dereference it
on tcp_hdr(skb)->seq without a prior skb validation.
Fix this by checking if skb is NULL before dereferencing it.
The commentary is taken from bpf_skops_established(), which is also called
in the same flow. Unlike the function being patched,
bpf_skops_established() validates the skb before dereferencing it.
int main(void){
struct sockaddr_in sockaddr;
struct tcp_ao_add tcp_ao;
int sk;
int one = 1;
memset(&sockaddr,'\0',sizeof(sockaddr));
memset(&tcp_ao,'\0',sizeof(tcp_ao));
sk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
sockaddr.sin_family = AF_INET;
memcpy(tcp_ao.alg_name,"cmac(aes128)",12);
memcpy(tcp_ao.key,"ABCDEFGHABCDEFGH",16);
tcp_ao.keylen = 16;
memcpy(&tcp_ao.addr,&sockaddr,sizeof(sockaddr));
setsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, &tcp_ao,
sizeof(tcp_ao));
setsockopt(sk, IPPROTO_TCP, TCP_REPAIR, &one, sizeof(one));
sockaddr.sin_family = AF_INET;
sockaddr.sin_port = htobe16(123);
inet_aton("127.0.0.1", &sockaddr.sin_addr);
connect(sk,(struct sockaddr *)&sockaddr,sizeof(sockaddr));
return 0;
}
$ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall
$ unshare -Urn
BUG: kernel NULL pointer dereference, address: 00000000000000b6
PGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0
Oops: Oops: 0000 [#1] SMP NOPTI
Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop
Reference Platform, BIOS 6.00 11/12/2020
RIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f , < 5f445eb259906b61a518487a790e11d07d31738c
(git)
Affected: 7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f , < 993b734d31ab804747ac961b1ee664b023c3b5fa (git) Affected: 7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f , < 2e7bba08923ebc675b1f0e0e0959e68e53047838 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_ao.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5f445eb259906b61a518487a790e11d07d31738c",
"status": "affected",
"version": "7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f",
"versionType": "git"
},
{
"lessThan": "993b734d31ab804747ac961b1ee664b023c3b5fa",
"status": "affected",
"version": "7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f",
"versionType": "git"
},
{
"lessThan": "2e7bba08923ebc675b1f0e0e0959e68e53047838",
"status": "affected",
"version": "7c2ffaf21bd67f73d21560995ce17eaf5fc1d37f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/tcp_ao.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.7"
},
{
"lessThan": "6.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR\n\nA NULL pointer dereference can occur in tcp_ao_finish_connect() during a\nconnect() system call on a socket with a TCP-AO key added and TCP_REPAIR\nenabled.\n\nThe function is called with skb being NULL and attempts to dereference it\non tcp_hdr(skb)-\u003eseq without a prior skb validation.\n\nFix this by checking if skb is NULL before dereferencing it.\n\nThe commentary is taken from bpf_skops_established(), which is also called\nin the same flow. Unlike the function being patched,\nbpf_skops_established() validates the skb before dereferencing it.\n\nint main(void){\n\tstruct sockaddr_in sockaddr;\n\tstruct tcp_ao_add tcp_ao;\n\tint sk;\n\tint one = 1;\n\n\tmemset(\u0026sockaddr,\u0027\\0\u0027,sizeof(sockaddr));\n\tmemset(\u0026tcp_ao,\u0027\\0\u0027,sizeof(tcp_ao));\n\n\tsk = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);\n\n\tsockaddr.sin_family = AF_INET;\n\n\tmemcpy(tcp_ao.alg_name,\"cmac(aes128)\",12);\n\tmemcpy(tcp_ao.key,\"ABCDEFGHABCDEFGH\",16);\n\ttcp_ao.keylen = 16;\n\n\tmemcpy(\u0026tcp_ao.addr,\u0026sockaddr,sizeof(sockaddr));\n\n\tsetsockopt(sk, IPPROTO_TCP, TCP_AO_ADD_KEY, \u0026tcp_ao,\n\tsizeof(tcp_ao));\n\tsetsockopt(sk, IPPROTO_TCP, TCP_REPAIR, \u0026one, sizeof(one));\n\n\tsockaddr.sin_family = AF_INET;\n\tsockaddr.sin_port = htobe16(123);\n\n\tinet_aton(\"127.0.0.1\", \u0026sockaddr.sin_addr);\n\n\tconnect(sk,(struct sockaddr *)\u0026sockaddr,sizeof(sockaddr));\n\nreturn 0;\n}\n\n$ gcc tcp-ao-nullptr.c -o tcp-ao-nullptr -Wall\n$ unshare -Urn\n\nBUG: kernel NULL pointer dereference, address: 00000000000000b6\nPGD 1f648d067 P4D 1f648d067 PUD 1982e8067 PMD 0\nOops: Oops: 0000 [#1] SMP NOPTI\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop\nReference Platform, BIOS 6.00 11/12/2020\nRIP: 0010:tcp_ao_finish_connect (net/ipv4/tcp_ao.c:1182)"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:31:10.926Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5f445eb259906b61a518487a790e11d07d31738c"
},
{
"url": "https://git.kernel.org/stable/c/993b734d31ab804747ac961b1ee664b023c3b5fa"
},
{
"url": "https://git.kernel.org/stable/c/2e7bba08923ebc675b1f0e0e0959e68e53047838"
}
],
"title": "net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39950",
"datePublished": "2025-10-04T07:31:10.926Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:31:10.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50500 (GCVE-0-2022-50500)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed
Summary
In the Linux kernel, the following vulnerability has been resolved:
netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed
If some items in nsim_dev_resources_register() fail, memory leak will
occur. The following is the memory leak information.
unreferenced object 0xffff888074c02600 (size 128):
comm "echo", pid 8159, jiffies 4294945184 (age 493.530s)
hex dump (first 32 bytes):
40 47 ea 89 ff ff ff ff 01 00 00 00 00 00 00 00 @G..............
ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................
backtrace:
[<0000000011a31c98>] kmalloc_trace+0x22/0x60
[<0000000027384c69>] devl_resource_register+0x144/0x4e0
[<00000000a16db248>] nsim_drv_probe+0x37a/0x1260
[<000000007d1f448c>] really_probe+0x20b/0xb10
[<00000000c416848a>] __driver_probe_device+0x1b3/0x4a0
[<00000000077e0351>] driver_probe_device+0x49/0x140
[<0000000054f2465a>] __device_attach_driver+0x18c/0x2a0
[<000000008538f359>] bus_for_each_drv+0x151/0x1d0
[<0000000038e09747>] __device_attach+0x1c9/0x4e0
[<00000000dd86e533>] bus_probe_device+0x1d5/0x280
[<00000000839bea35>] device_add+0xae0/0x1cb0
[<000000009c2abf46>] new_device_store+0x3b6/0x5f0
[<00000000fb823d7f>] bus_attr_store+0x72/0xa0
[<000000007acc4295>] sysfs_kf_write+0x106/0x160
[<000000005f50cb4d>] kernfs_fop_write_iter+0x3a8/0x5a0
[<0000000075eb41bf>] vfs_write+0x8f0/0xc80
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/netdevsim/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7c4957fe40e2a628b7cceaf4c9bfb5b701774d05",
"status": "affected",
"version": "37923ed6b8cea94d7d76038e2f72c57a0b45daab",
"versionType": "git"
},
{
"lessThan": "6b1da9f7126f05e857da6db24c6a04aa7974d644",
"status": "affected",
"version": "37923ed6b8cea94d7d76038e2f72c57a0b45daab",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/netdevsim/dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.7",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed\n\nIf some items in nsim_dev_resources_register() fail, memory leak will\noccur. The following is the memory leak information.\n\nunreferenced object 0xffff888074c02600 (size 128):\n comm \"echo\", pid 8159, jiffies 4294945184 (age 493.530s)\n hex dump (first 32 bytes):\n 40 47 ea 89 ff ff ff ff 01 00 00 00 00 00 00 00 @G..............\n ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ................\n backtrace:\n [\u003c0000000011a31c98\u003e] kmalloc_trace+0x22/0x60\n [\u003c0000000027384c69\u003e] devl_resource_register+0x144/0x4e0\n [\u003c00000000a16db248\u003e] nsim_drv_probe+0x37a/0x1260\n [\u003c000000007d1f448c\u003e] really_probe+0x20b/0xb10\n [\u003c00000000c416848a\u003e] __driver_probe_device+0x1b3/0x4a0\n [\u003c00000000077e0351\u003e] driver_probe_device+0x49/0x140\n [\u003c0000000054f2465a\u003e] __device_attach_driver+0x18c/0x2a0\n [\u003c000000008538f359\u003e] bus_for_each_drv+0x151/0x1d0\n [\u003c0000000038e09747\u003e] __device_attach+0x1c9/0x4e0\n [\u003c00000000dd86e533\u003e] bus_probe_device+0x1d5/0x280\n [\u003c00000000839bea35\u003e] device_add+0xae0/0x1cb0\n [\u003c000000009c2abf46\u003e] new_device_store+0x3b6/0x5f0\n [\u003c00000000fb823d7f\u003e] bus_attr_store+0x72/0xa0\n [\u003c000000007acc4295\u003e] sysfs_kf_write+0x106/0x160\n [\u003c000000005f50cb4d\u003e] kernfs_fop_write_iter+0x3a8/0x5a0\n [\u003c0000000075eb41bf\u003e] vfs_write+0x8f0/0xc80"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:50.792Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7c4957fe40e2a628b7cceaf4c9bfb5b701774d05"
},
{
"url": "https://git.kernel.org/stable/c/6b1da9f7126f05e857da6db24c6a04aa7974d644"
}
],
"title": "netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50500",
"datePublished": "2025-10-04T15:43:50.792Z",
"dateReserved": "2025-10-04T15:39:19.464Z",
"dateUpdated": "2025-10-04T15:43:50.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53535 (GCVE-0-2023-53535)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
net: bcmgenet: Add a check for oversized packets
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: bcmgenet: Add a check for oversized packets
Occasionnaly we may get oversized packets from the hardware which
exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early
check which drops the packet to avoid invoking skb_over_panic() and move
on to processing the next packet.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1c1008c793fa46703a2fee469f4235e1c7984333 , < 7cdb07e10c1258c08f31b24898930e4ece88d163
(git)
Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < c34b1c0870323649d45c5074828d7f754dea2673 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 87363d1ab55e497702a9506ff423c422639c8a25 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 841881320562cbeac7046b537b91cd000480cea2 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 124ca24e0de958d2e20e0aa1e2434af7b72f8887 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 5f56767fb5f2df875b6553e08dbec6a45431c988 (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 411317d2a4a7d6049d8efeef0d32ae43f8baefce (git) Affected: 1c1008c793fa46703a2fee469f4235e1c7984333 , < 5c0862c2c962052ed5055220a00ac1cefb92fbcd (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7cdb07e10c1258c08f31b24898930e4ece88d163",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "c34b1c0870323649d45c5074828d7f754dea2673",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "87363d1ab55e497702a9506ff423c422639c8a25",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "841881320562cbeac7046b537b91cd000480cea2",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "124ca24e0de958d2e20e0aa1e2434af7b72f8887",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "5f56767fb5f2df875b6553e08dbec6a45431c988",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "411317d2a4a7d6049d8efeef0d32ae43f8baefce",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
},
{
"lessThan": "5c0862c2c962052ed5055220a00ac1cefb92fbcd",
"status": "affected",
"version": "1c1008c793fa46703a2fee469f4235e1c7984333",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/genet/bcmgenet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.308",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.276",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.308",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.276",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.235",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: bcmgenet: Add a check for oversized packets\n\nOccasionnaly we may get oversized packets from the hardware which\nexceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early\ncheck which drops the packet to avoid invoking skb_over_panic() and move\non to processing the next packet."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:12.644Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7cdb07e10c1258c08f31b24898930e4ece88d163"
},
{
"url": "https://git.kernel.org/stable/c/c34b1c0870323649d45c5074828d7f754dea2673"
},
{
"url": "https://git.kernel.org/stable/c/87363d1ab55e497702a9506ff423c422639c8a25"
},
{
"url": "https://git.kernel.org/stable/c/841881320562cbeac7046b537b91cd000480cea2"
},
{
"url": "https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887"
},
{
"url": "https://git.kernel.org/stable/c/5f56767fb5f2df875b6553e08dbec6a45431c988"
},
{
"url": "https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce"
},
{
"url": "https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd"
}
],
"title": "net: bcmgenet: Add a check for oversized packets",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53535",
"datePublished": "2025-10-04T15:16:46.583Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2026-01-05T10:21:12.644Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39936 (GCVE-0-2025-39936)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2025-10-04 07:30
VLAI?
EPSS
Title
crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()
When
9770b428b1a2 ("crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown")
moved the error messages dumping so that they don't need to be issued by
the callers, it missed the case where __sev_firmware_shutdown() calls
__sev_platform_shutdown_locked() with a NULL argument which leads to
a NULL ptr deref on the shutdown path, during suspend to disk:
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 0 UID: 0 PID: 983 Comm: hib.sh Not tainted 6.17.0-rc4+ #1 PREEMPT(voluntary)
Hardware name: Supermicro Super Server/H12SSL-i, BIOS 2.5 09/08/2022
RIP: 0010:__sev_platform_shutdown_locked.cold+0x0/0x21 [ccp]
That rIP is:
00000000000006fd <__sev_platform_shutdown_locked.cold>:
6fd: 8b 13 mov (%rbx),%edx
6ff: 48 8b 7d 00 mov 0x0(%rbp),%rdi
703: 89 c1 mov %eax,%ecx
Code: 74 05 31 ff 41 89 3f 49 8b 3e 89 ea 48 c7 c6 a0 8e 54 a0 41 bf 92 ff ff ff e8 e5 2e 09 e1 c6 05 2a d4 38 00 01 e9 26 af ff ff <8b> 13 48 8b 7d 00 89 c1 48 c7 c6 18 90 54 a0 89 44 24 04 e8 c1 2e
RSP: 0018:ffffc90005467d00 EFLAGS: 00010282
RAX: 00000000ffffff92 RBX: 0000000000000000 RCX: 0000000000000000
^^^^^^^^^^^^^^^^
and %rbx is nice and clean.
Call Trace:
<TASK>
__sev_firmware_shutdown.isra.0
sev_dev_destroy
psp_dev_destroy
sp_destroy
pci_device_shutdown
device_shutdown
kernel_power_off
hibernate.cold
state_store
kernfs_fop_write_iter
vfs_write
ksys_write
do_syscall_64
entry_SYSCALL_64_after_hwframe
Pass in a pointer to the function-local error var in the caller.
With that addressed, suspending the ccp shows the error properly at
least:
ccp 0000:47:00.1: sev command 0x2 timed out, disabling PSP
ccp 0000:47:00.1: SEV: failed to SHUTDOWN error 0x0, rc -110
SEV-SNP: Leaking PFN range 0x146800-0x146a00
SEV-SNP: PFN 0x146800 unassigned, dumping non-zero entries in 2M PFN region: [0x146800 - 0x146a00]
...
ccp 0000:47:00.1: SEV-SNP firmware shutdown failed, rc -16, error 0x0
ACPI: PM: Preparing to enter system sleep state S5
kvm: exiting hardware virtualization
reboot: Power down
Btw, this driver is crying to be cleaned up to pass in a proper I/O
struct which can be used to store information between the different
functions, otherwise stuff like that will happen in the future again.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bc509293c9d4f4f74e776f4a0bbb61f63c041938",
"status": "affected",
"version": "9770b428b1a28360663f1f5e524ee458b4cf454b",
"versionType": "git"
},
{
"lessThan": "46834d90a9a13549264b9581067d8f746b4b36cc",
"status": "affected",
"version": "9770b428b1a28360663f1f5e524ee458b4cf454b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/crypto/ccp/sev-dev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.16"
},
{
"lessThan": "6.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()\n\nWhen\n\n 9770b428b1a2 (\"crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown\")\n\nmoved the error messages dumping so that they don\u0027t need to be issued by\nthe callers, it missed the case where __sev_firmware_shutdown() calls\n__sev_platform_shutdown_locked() with a NULL argument which leads to\na NULL ptr deref on the shutdown path, during suspend to disk:\n\n #PF: supervisor read access in kernel mode\n #PF: error_code(0x0000) - not-present page\n PGD 0 P4D 0\n Oops: Oops: 0000 [#1] SMP NOPTI\n CPU: 0 UID: 0 PID: 983 Comm: hib.sh Not tainted 6.17.0-rc4+ #1 PREEMPT(voluntary)\n Hardware name: Supermicro Super Server/H12SSL-i, BIOS 2.5 09/08/2022\n RIP: 0010:__sev_platform_shutdown_locked.cold+0x0/0x21 [ccp]\n\nThat rIP is:\n\n 00000000000006fd \u003c__sev_platform_shutdown_locked.cold\u003e:\n 6fd: 8b 13 mov (%rbx),%edx\n 6ff: 48 8b 7d 00 mov 0x0(%rbp),%rdi\n 703: 89 c1 mov %eax,%ecx\n\n Code: 74 05 31 ff 41 89 3f 49 8b 3e 89 ea 48 c7 c6 a0 8e 54 a0 41 bf 92 ff ff ff e8 e5 2e 09 e1 c6 05 2a d4 38 00 01 e9 26 af ff ff \u003c8b\u003e 13 48 8b 7d 00 89 c1 48 c7 c6 18 90 54 a0 89 44 24 04 e8 c1 2e\n RSP: 0018:ffffc90005467d00 EFLAGS: 00010282\n RAX: 00000000ffffff92 RBX: 0000000000000000 RCX: 0000000000000000\n \t\t\t ^^^^^^^^^^^^^^^^\nand %rbx is nice and clean.\n\n Call Trace:\n \u003cTASK\u003e\n __sev_firmware_shutdown.isra.0\n sev_dev_destroy\n psp_dev_destroy\n sp_destroy\n pci_device_shutdown\n device_shutdown\n kernel_power_off\n hibernate.cold\n state_store\n kernfs_fop_write_iter\n vfs_write\n ksys_write\n do_syscall_64\n entry_SYSCALL_64_after_hwframe\n\nPass in a pointer to the function-local error var in the caller.\n\nWith that addressed, suspending the ccp shows the error properly at\nleast:\n\n ccp 0000:47:00.1: sev command 0x2 timed out, disabling PSP\n ccp 0000:47:00.1: SEV: failed to SHUTDOWN error 0x0, rc -110\n SEV-SNP: Leaking PFN range 0x146800-0x146a00\n SEV-SNP: PFN 0x146800 unassigned, dumping non-zero entries in 2M PFN region: [0x146800 - 0x146a00]\n ...\n ccp 0000:47:00.1: SEV-SNP firmware shutdown failed, rc -16, error 0x0\n ACPI: PM: Preparing to enter system sleep state S5\n kvm: exiting hardware virtualization\n reboot: Power down\n\nBtw, this driver is crying to be cleaned up to pass in a proper I/O\nstruct which can be used to store information between the different\nfunctions, otherwise stuff like that will happen in the future again."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:30:59.857Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bc509293c9d4f4f74e776f4a0bbb61f63c041938"
},
{
"url": "https://git.kernel.org/stable/c/46834d90a9a13549264b9581067d8f746b4b36cc"
}
],
"title": "crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39936",
"datePublished": "2025-10-04T07:30:59.857Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:30:59.857Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39935 (GCVE-0-2025-39935)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2025-10-04 07:30
VLAI?
EPSS
Title
ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()
The sma1307->set.header_size is how many integers are in the header
(there are 8 of them) but instead of allocating space of 8 integers
we allocate 8 bytes. This leads to memory corruption when we copy data
it on the next line:
memcpy(sma1307->set.header, data,
sma1307->set.header_size * sizeof(int));
Also since we're immediately copying over the memory in ->set.header,
there is no need to zero it in the allocator. Use devm_kmalloc_array()
to allocate the memory instead.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/sma1307.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cd59ca8f75dbb42a67fcae975c766114644e36c4",
"status": "affected",
"version": "576c57e6b4c1d734bcb7cc33dde9a99a9383b520",
"versionType": "git"
},
{
"lessThan": "78338108b5a856dc98223a335f147846a8a18c51",
"status": "affected",
"version": "576c57e6b4c1d734bcb7cc33dde9a99a9383b520",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/codecs/sma1307.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.13"
},
{
"lessThan": "6.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()\n\nThe sma1307-\u003eset.header_size is how many integers are in the header\n(there are 8 of them) but instead of allocating space of 8 integers\nwe allocate 8 bytes. This leads to memory corruption when we copy data\nit on the next line:\n\n memcpy(sma1307-\u003eset.header, data,\n sma1307-\u003eset.header_size * sizeof(int));\n\nAlso since we\u0027re immediately copying over the memory in -\u003eset.header,\nthere is no need to zero it in the allocator. Use devm_kmalloc_array()\nto allocate the memory instead."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:30:59.102Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cd59ca8f75dbb42a67fcae975c766114644e36c4"
},
{
"url": "https://git.kernel.org/stable/c/78338108b5a856dc98223a335f147846a8a18c51"
}
],
"title": "ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39935",
"datePublished": "2025-10-04T07:30:59.102Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:30:59.102Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50489 (GCVE-0-2022-50489)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
drm/mipi-dsi: Detach devices when removing the host
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/mipi-dsi: Detach devices when removing the host
Whenever the MIPI-DSI host is unregistered, the code of
mipi_dsi_host_unregister() loops over every device currently found on that
bus and will unregister it.
However, it doesn't detach it from the bus first, which leads to all kind
of resource leaks if the host wants to perform some clean up whenever a
device is detached.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
068a00233969833f1ba925e7627797489efd6041 , < c202cda08cd5693645d4990ad1eb2e8068a884ec
(git)
Affected: 068a00233969833f1ba925e7627797489efd6041 , < 262364574b05676d4b9ebde2ddd3588cd2efd8ce (git) Affected: 068a00233969833f1ba925e7627797489efd6041 , < 95ae458209f5a556bba98aff872f933694914eb7 (git) Affected: 068a00233969833f1ba925e7627797489efd6041 , < 8242167cfc83dd7e4c96f44b45f108db9bb88146 (git) Affected: 068a00233969833f1ba925e7627797489efd6041 , < 45120fa5e522d444e3fc1c5a9afc5d53eed91d00 (git) Affected: 068a00233969833f1ba925e7627797489efd6041 , < 26c1b4cfe56f040f71a51c92da1f4cac2e3b9455 (git) Affected: 068a00233969833f1ba925e7627797489efd6041 , < 353ab1c13fdd6e524edde780235a8ce9b892c81c (git) Affected: 068a00233969833f1ba925e7627797489efd6041 , < 6fc2cd40db1969ba372ce9536dcfcdb87271eac4 (git) Affected: 068a00233969833f1ba925e7627797489efd6041 , < 668a8f17b5290d04ef7343636a5588a0692731a1 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_mipi_dsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c202cda08cd5693645d4990ad1eb2e8068a884ec",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
},
{
"lessThan": "262364574b05676d4b9ebde2ddd3588cd2efd8ce",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
},
{
"lessThan": "95ae458209f5a556bba98aff872f933694914eb7",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
},
{
"lessThan": "8242167cfc83dd7e4c96f44b45f108db9bb88146",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
},
{
"lessThan": "45120fa5e522d444e3fc1c5a9afc5d53eed91d00",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
},
{
"lessThan": "26c1b4cfe56f040f71a51c92da1f4cac2e3b9455",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
},
{
"lessThan": "353ab1c13fdd6e524edde780235a8ce9b892c81c",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
},
{
"lessThan": "6fc2cd40db1969ba372ce9536dcfcdb87271eac4",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
},
{
"lessThan": "668a8f17b5290d04ef7343636a5588a0692731a1",
"status": "affected",
"version": "068a00233969833f1ba925e7627797489efd6041",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/drm_mipi_dsi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.331",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.296",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.262",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.331",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.296",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.262",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.220",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.150",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.75",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.17",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mipi-dsi: Detach devices when removing the host\n\nWhenever the MIPI-DSI host is unregistered, the code of\nmipi_dsi_host_unregister() loops over every device currently found on that\nbus and will unregister it.\n\nHowever, it doesn\u0027t detach it from the bus first, which leads to all kind\nof resource leaks if the host wants to perform some clean up whenever a\ndevice is detached."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:43.124Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c202cda08cd5693645d4990ad1eb2e8068a884ec"
},
{
"url": "https://git.kernel.org/stable/c/262364574b05676d4b9ebde2ddd3588cd2efd8ce"
},
{
"url": "https://git.kernel.org/stable/c/95ae458209f5a556bba98aff872f933694914eb7"
},
{
"url": "https://git.kernel.org/stable/c/8242167cfc83dd7e4c96f44b45f108db9bb88146"
},
{
"url": "https://git.kernel.org/stable/c/45120fa5e522d444e3fc1c5a9afc5d53eed91d00"
},
{
"url": "https://git.kernel.org/stable/c/26c1b4cfe56f040f71a51c92da1f4cac2e3b9455"
},
{
"url": "https://git.kernel.org/stable/c/353ab1c13fdd6e524edde780235a8ce9b892c81c"
},
{
"url": "https://git.kernel.org/stable/c/6fc2cd40db1969ba372ce9536dcfcdb87271eac4"
},
{
"url": "https://git.kernel.org/stable/c/668a8f17b5290d04ef7343636a5588a0692731a1"
}
],
"title": "drm/mipi-dsi: Detach devices when removing the host",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50489",
"datePublished": "2025-10-04T15:43:43.124Z",
"dateReserved": "2025-10-04T15:13:33.469Z",
"dateUpdated": "2025-10-04T15:43:43.124Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53586 (GCVE-0-2023-53586)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
scsi: target: Fix multiple LUN_RESET handling
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: Fix multiple LUN_RESET handling
This fixes a bug where an initiator thinks a LUN_RESET has cleaned up
running commands when it hasn't. The bug was added in commit 51ec502a3266
("target: Delete tmr from list before processing").
The problem occurs when:
1. We have N I/O cmds running in the target layer spread over 2 sessions.
2. The initiator sends a LUN_RESET for each session.
3. session1's LUN_RESET loops over all the running commands from both
sessions and moves them to its local drain_task_list.
4. session2's LUN_RESET does not see the LUN_RESET from session1 because
the commit above has it remove itself. session2 also does not see any
commands since the other reset moved them off the state lists.
5. sessions2's LUN_RESET will then complete with a successful response.
6. sessions2's inititor believes the running commands on its session are
now cleaned up due to the successful response and cleans up the running
commands from its side. It then restarts them.
7. The commands do eventually complete on the backend and the target
starts to return aborted task statuses for them. The initiator will
either throw a invalid ITT error or might accidentally lookup a new
task if the ITT has been reallocated already.
Fix the bug by reverting the patch, and serialize the execution of
LUN_RESETs and Preempt and Aborts.
Also prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list,
because it turns out the original patch fixed a bug that was not
mentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second
LUN_RESET and wait on it. Then the second reset will run
core_tmr_drain_tmr_list and see the first reset and wait on it resulting in
a deadlock.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
51ec502a32665fed66c7f03799ede4023b212536 , < e1f59cd18a10969d08a082264b557876ca38766e
(git)
Affected: 51ec502a32665fed66c7f03799ede4023b212536 , < 9158c86fd3237acaea8f0181c7836d90fd6eea10 (git) Affected: 51ec502a32665fed66c7f03799ede4023b212536 , < eacfe32c3650bfd0e54224d160c431013d7f6998 (git) Affected: 51ec502a32665fed66c7f03799ede4023b212536 , < ed18526289b5603bf2253dee50f1d7ec245cf397 (git) Affected: 51ec502a32665fed66c7f03799ede4023b212536 , < 2c43de56f9220dca3e28c774d1c5e2cab574223a (git) Affected: 51ec502a32665fed66c7f03799ede4023b212536 , < 673db054d7a2b5a470d7a25baf65956d005ad729 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_device.c",
"drivers/target/target_core_tmr.c",
"include/target/target_core_base.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e1f59cd18a10969d08a082264b557876ca38766e",
"status": "affected",
"version": "51ec502a32665fed66c7f03799ede4023b212536",
"versionType": "git"
},
{
"lessThan": "9158c86fd3237acaea8f0181c7836d90fd6eea10",
"status": "affected",
"version": "51ec502a32665fed66c7f03799ede4023b212536",
"versionType": "git"
},
{
"lessThan": "eacfe32c3650bfd0e54224d160c431013d7f6998",
"status": "affected",
"version": "51ec502a32665fed66c7f03799ede4023b212536",
"versionType": "git"
},
{
"lessThan": "ed18526289b5603bf2253dee50f1d7ec245cf397",
"status": "affected",
"version": "51ec502a32665fed66c7f03799ede4023b212536",
"versionType": "git"
},
{
"lessThan": "2c43de56f9220dca3e28c774d1c5e2cab574223a",
"status": "affected",
"version": "51ec502a32665fed66c7f03799ede4023b212536",
"versionType": "git"
},
{
"lessThan": "673db054d7a2b5a470d7a25baf65956d005ad729",
"status": "affected",
"version": "51ec502a32665fed66c7f03799ede4023b212536",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/target/target_core_device.c",
"drivers/target/target_core_tmr.c",
"include/target/target_core_base.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: target: Fix multiple LUN_RESET handling\n\nThis fixes a bug where an initiator thinks a LUN_RESET has cleaned up\nrunning commands when it hasn\u0027t. The bug was added in commit 51ec502a3266\n(\"target: Delete tmr from list before processing\").\n\nThe problem occurs when:\n\n 1. We have N I/O cmds running in the target layer spread over 2 sessions.\n\n 2. The initiator sends a LUN_RESET for each session.\n\n 3. session1\u0027s LUN_RESET loops over all the running commands from both\n sessions and moves them to its local drain_task_list.\n\n 4. session2\u0027s LUN_RESET does not see the LUN_RESET from session1 because\n the commit above has it remove itself. session2 also does not see any\n commands since the other reset moved them off the state lists.\n\n 5. sessions2\u0027s LUN_RESET will then complete with a successful response.\n\n 6. sessions2\u0027s inititor believes the running commands on its session are\n now cleaned up due to the successful response and cleans up the running\n commands from its side. It then restarts them.\n\n 7. The commands do eventually complete on the backend and the target\n starts to return aborted task statuses for them. The initiator will\n either throw a invalid ITT error or might accidentally lookup a new\n task if the ITT has been reallocated already.\n\nFix the bug by reverting the patch, and serialize the execution of\nLUN_RESETs and Preempt and Aborts.\n\nAlso prevent us from waiting on LUN_RESETs in core_tmr_drain_tmr_list,\nbecause it turns out the original patch fixed a bug that was not\nmentioned. For LUN_RESET1 core_tmr_drain_tmr_list can see a second\nLUN_RESET and wait on it. Then the second reset will run\ncore_tmr_drain_tmr_list and see the first reset and wait on it resulting in\na deadlock."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:01.809Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e1f59cd18a10969d08a082264b557876ca38766e"
},
{
"url": "https://git.kernel.org/stable/c/9158c86fd3237acaea8f0181c7836d90fd6eea10"
},
{
"url": "https://git.kernel.org/stable/c/eacfe32c3650bfd0e54224d160c431013d7f6998"
},
{
"url": "https://git.kernel.org/stable/c/ed18526289b5603bf2253dee50f1d7ec245cf397"
},
{
"url": "https://git.kernel.org/stable/c/2c43de56f9220dca3e28c774d1c5e2cab574223a"
},
{
"url": "https://git.kernel.org/stable/c/673db054d7a2b5a470d7a25baf65956d005ad729"
}
],
"title": "scsi: target: Fix multiple LUN_RESET handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53586",
"datePublished": "2025-10-04T15:44:01.809Z",
"dateReserved": "2025-10-04T15:40:38.477Z",
"dateUpdated": "2025-10-04T15:44:01.809Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53547 (GCVE-0-2023-53547)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-29 10:50
VLAI?
EPSS
Title
drm/amdgpu: Fix sdma v4 sw fini error
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amdgpu: Fix sdma v4 sw fini error
Fix sdma v4 sw fini error for sdma 4.2.2 to
solve the following general protection fault
[ +0.108196] general protection fault, probably for non-canonical
address 0xd5e5a4ae79d24a32: 0000 [#1] PREEMPT SMP PTI
[ +0.000018] RIP: 0010:free_fw_priv+0xd/0x70
[ +0.000022] Call Trace:
[ +0.000012] <TASK>
[ +0.000011] release_firmware+0x55/0x80
[ +0.000021] amdgpu_ucode_release+0x11/0x20 [amdgpu]
[ +0.000415] amdgpu_sdma_destroy_inst_ctx+0x4f/0x90 [amdgpu]
[ +0.000360] sdma_v4_0_sw_fini+0xce/0x110 [amdgpu]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
a2d3b4b81fd49b14782ce0ff68ca74e40f16609a , < 210ef6cd8e634f18fd889421012192b81325b27b
(git)
Affected: a2d3b4b81fd49b14782ce0ff68ca74e40f16609a , < 0ebc02d9ff85626a526353584526da6aa9c96792 (git) Affected: a2d3b4b81fd49b14782ce0ff68ca74e40f16609a , < 5e08e9c742a00384e5abe74bd40cf4dc15cb3a2e (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "210ef6cd8e634f18fd889421012192b81325b27b",
"status": "affected",
"version": "a2d3b4b81fd49b14782ce0ff68ca74e40f16609a",
"versionType": "git"
},
{
"lessThan": "0ebc02d9ff85626a526353584526da6aa9c96792",
"status": "affected",
"version": "a2d3b4b81fd49b14782ce0ff68ca74e40f16609a",
"versionType": "git"
},
{
"lessThan": "5e08e9c742a00384e5abe74bd40cf4dc15cb3a2e",
"status": "affected",
"version": "a2d3b4b81fd49b14782ce0ff68ca74e40f16609a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.30",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: Fix sdma v4 sw fini error\n\nFix sdma v4 sw fini error for sdma 4.2.2 to\nsolve the following general protection fault\n\n[ +0.108196] general protection fault, probably for non-canonical\naddress 0xd5e5a4ae79d24a32: 0000 [#1] PREEMPT SMP PTI\n[ +0.000018] RIP: 0010:free_fw_priv+0xd/0x70\n[ +0.000022] Call Trace:\n[ +0.000012] \u003cTASK\u003e\n[ +0.000011] release_firmware+0x55/0x80\n[ +0.000021] amdgpu_ucode_release+0x11/0x20 [amdgpu]\n[ +0.000415] amdgpu_sdma_destroy_inst_ctx+0x4f/0x90 [amdgpu]\n[ +0.000360] sdma_v4_0_sw_fini+0xce/0x110 [amdgpu]"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-29T10:50:29.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/210ef6cd8e634f18fd889421012192b81325b27b"
},
{
"url": "https://git.kernel.org/stable/c/0ebc02d9ff85626a526353584526da6aa9c96792"
},
{
"url": "https://git.kernel.org/stable/c/5e08e9c742a00384e5abe74bd40cf4dc15cb3a2e"
}
],
"title": "drm/amdgpu: Fix sdma v4 sw fini error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53547",
"datePublished": "2025-10-04T15:16:54.794Z",
"dateReserved": "2025-10-04T15:14:15.921Z",
"dateUpdated": "2025-10-29T10:50:29.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50493 (GCVE-0-2022-50493)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
scsi: qla2xxx: Fix crash when I/O abort times out
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix crash when I/O abort times out
While performing CPU hotplug, a crash with the following stack was seen:
Call Trace:
qla24xx_process_response_queue+0x42a/0x970 [qla2xxx]
qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx]
qla_nvme_post_cmd+0x166/0x240 [qla2xxx]
nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc]
blk_mq_dispatch_rq_list+0x17b/0x610
__blk_mq_sched_dispatch_requests+0xb0/0x140
blk_mq_sched_dispatch_requests+0x30/0x60
__blk_mq_run_hw_queue+0x35/0x90
__blk_mq_delay_run_hw_queue+0x161/0x180
blk_execute_rq+0xbe/0x160
__nvme_submit_sync_cmd+0x16f/0x220 [nvme_core]
nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics]
nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc]
nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc]
process_one_work+0x1e8/0x3c0
On abort timeout, completion was called without checking if the I/O was
already completed.
Verify that I/O and abort request are indeed outstanding before attempting
completion.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 , < d3871af13aa03fbbe7fbb812eaf140501229a72e
(git)
Affected: 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 , < cb4dff498468b62e8c520568559b3a9007e104d7 (git) Affected: 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 , < 05382ed9142cf8a8a3fb662224477eecc415778b (git) Affected: 71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12 , < 68ad83188d782b2ecef2e41ac245d27e0710fe8e (git) Affected: 457173c8b43ecd3ac48c8ace8d4437a50f7ad77b (git) Affected: b7abcc7df5e131c0b4bf89cb2411c5301ee83d26 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d3871af13aa03fbbe7fbb812eaf140501229a72e",
"status": "affected",
"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
"versionType": "git"
},
{
"lessThan": "cb4dff498468b62e8c520568559b3a9007e104d7",
"status": "affected",
"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
"versionType": "git"
},
{
"lessThan": "05382ed9142cf8a8a3fb662224477eecc415778b",
"status": "affected",
"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
"versionType": "git"
},
{
"lessThan": "68ad83188d782b2ecef2e41ac245d27e0710fe8e",
"status": "affected",
"version": "71c80b75ce8f08c0978ce9a9816b81b5c3ce5e12",
"versionType": "git"
},
{
"status": "affected",
"version": "457173c8b43ecd3ac48c8ace8d4437a50f7ad77b",
"versionType": "git"
},
{
"status": "affected",
"version": "b7abcc7df5e131c0b4bf89cb2411c5301ee83d26",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix crash when I/O abort times out\n\nWhile performing CPU hotplug, a crash with the following stack was seen:\n\nCall Trace:\n qla24xx_process_response_queue+0x42a/0x970 [qla2xxx]\n qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx]\n qla_nvme_post_cmd+0x166/0x240 [qla2xxx]\n nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc]\n blk_mq_dispatch_rq_list+0x17b/0x610\n __blk_mq_sched_dispatch_requests+0xb0/0x140\n blk_mq_sched_dispatch_requests+0x30/0x60\n __blk_mq_run_hw_queue+0x35/0x90\n __blk_mq_delay_run_hw_queue+0x161/0x180\n blk_execute_rq+0xbe/0x160\n __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core]\n nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics]\n nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc]\n nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc]\n process_one_work+0x1e8/0x3c0\n\nOn abort timeout, completion was called without checking if the I/O was\nalready completed.\n\nVerify that I/O and abort request are indeed outstanding before attempting\ncompletion."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:45.895Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d3871af13aa03fbbe7fbb812eaf140501229a72e"
},
{
"url": "https://git.kernel.org/stable/c/cb4dff498468b62e8c520568559b3a9007e104d7"
},
{
"url": "https://git.kernel.org/stable/c/05382ed9142cf8a8a3fb662224477eecc415778b"
},
{
"url": "https://git.kernel.org/stable/c/68ad83188d782b2ecef2e41ac245d27e0710fe8e"
}
],
"title": "scsi: qla2xxx: Fix crash when I/O abort times out",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50493",
"datePublished": "2025-10-04T15:43:45.895Z",
"dateReserved": "2025-10-04T15:39:19.464Z",
"dateUpdated": "2025-10-04T15:43:45.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39945 (GCVE-0-2025-39945)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:37
VLAI?
EPSS
Title
cnic: Fix use-after-free bugs in cnic_delete_task
Summary
In the Linux kernel, the following vulnerability has been resolved:
cnic: Fix use-after-free bugs in cnic_delete_task
The original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(),
which does not guarantee that the delayed work item 'delete_task' has
fully completed if it was already running. Additionally, the delayed work
item is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only
blocks and waits for work items that were already queued to the
workqueue prior to its invocation. Any work items submitted after
flush_workqueue() is called are not included in the set of tasks that the
flush operation awaits. This means that after the cyclic work items have
finished executing, a delayed work item may still exist in the workqueue.
This leads to use-after-free scenarios where the cnic_dev is deallocated
by cnic_free_dev(), while delete_task remains active and attempt to
dereference cnic_dev in cnic_delete_task().
A typical race condition is illustrated below:
CPU 0 (cleanup) | CPU 1 (delayed work callback)
cnic_netdev_event() |
cnic_stop_hw() | cnic_delete_task()
cnic_cm_stop_bnx2x_hw() | ...
cancel_delayed_work() | /* the queue_delayed_work()
flush_workqueue() | executes after flush_workqueue()*/
| queue_delayed_work()
cnic_free_dev(dev)//free | cnic_delete_task() //new instance
| dev = cp->dev; //use
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the cyclic delayed work item is properly canceled and that any
ongoing execution of the work item completes before the cnic_dev is
deallocated. Furthermore, since cancel_delayed_work_sync() uses
__flush_work(work, true) to synchronously wait for any currently
executing instance of the work item to finish, the flush_workqueue()
becomes redundant and should be removed.
This bug was identified through static analysis. To reproduce the issue
and validate the fix, I simulated the cnic PCI device in QEMU and
introduced intentional delays — such as inserting calls to ssleep()
within the cnic_delete_task() function — to increase the likelihood
of triggering the bug.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
fdf24086f4752aee5dfb40143c736250df017820 , < fde6e73189f40ebcf0633aed2b68e731c25f3aa3
(git)
Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 7b6a5b0a6b392263c3767fc945b311ea04b34bbd (git) Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 0405055930264ea8fd26f4131466fa7652e5e47d (git) Affected: fdf24086f4752aee5dfb40143c736250df017820 , < e1fcd4a9c09feac0902a65615e866dbf22616125 (git) Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 8eeb2091e72d75df8ceaa2172638d61b4cf8929a (git) Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 6e33a7eed587062ca8161ad1f4584882a860d697 (git) Affected: fdf24086f4752aee5dfb40143c736250df017820 , < 0627e1481676669cae2df0d85b5ff13e7d24c390 (git) Affected: fdf24086f4752aee5dfb40143c736250df017820 , < cfa7d9b1e3a8604afc84e9e51d789c29574fb216 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/cnic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fde6e73189f40ebcf0633aed2b68e731c25f3aa3",
"status": "affected",
"version": "fdf24086f4752aee5dfb40143c736250df017820",
"versionType": "git"
},
{
"lessThan": "7b6a5b0a6b392263c3767fc945b311ea04b34bbd",
"status": "affected",
"version": "fdf24086f4752aee5dfb40143c736250df017820",
"versionType": "git"
},
{
"lessThan": "0405055930264ea8fd26f4131466fa7652e5e47d",
"status": "affected",
"version": "fdf24086f4752aee5dfb40143c736250df017820",
"versionType": "git"
},
{
"lessThan": "e1fcd4a9c09feac0902a65615e866dbf22616125",
"status": "affected",
"version": "fdf24086f4752aee5dfb40143c736250df017820",
"versionType": "git"
},
{
"lessThan": "8eeb2091e72d75df8ceaa2172638d61b4cf8929a",
"status": "affected",
"version": "fdf24086f4752aee5dfb40143c736250df017820",
"versionType": "git"
},
{
"lessThan": "6e33a7eed587062ca8161ad1f4584882a860d697",
"status": "affected",
"version": "fdf24086f4752aee5dfb40143c736250df017820",
"versionType": "git"
},
{
"lessThan": "0627e1481676669cae2df0d85b5ff13e7d24c390",
"status": "affected",
"version": "fdf24086f4752aee5dfb40143c736250df017820",
"versionType": "git"
},
{
"lessThan": "cfa7d9b1e3a8604afc84e9e51d789c29574fb216",
"status": "affected",
"version": "fdf24086f4752aee5dfb40143c736250df017820",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/broadcom/cnic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.37"
},
{
"lessThan": "2.6.37",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.300",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.245",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.300",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.245",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.194",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "2.6.37",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "2.6.37",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncnic: Fix use-after-free bugs in cnic_delete_task\n\nThe original code uses cancel_delayed_work() in cnic_cm_stop_bnx2x_hw(),\nwhich does not guarantee that the delayed work item \u0027delete_task\u0027 has\nfully completed if it was already running. Additionally, the delayed work\nitem is cyclic, the flush_workqueue() in cnic_cm_stop_bnx2x_hw() only\nblocks and waits for work items that were already queued to the\nworkqueue prior to its invocation. Any work items submitted after\nflush_workqueue() is called are not included in the set of tasks that the\nflush operation awaits. This means that after the cyclic work items have\nfinished executing, a delayed work item may still exist in the workqueue.\nThis leads to use-after-free scenarios where the cnic_dev is deallocated\nby cnic_free_dev(), while delete_task remains active and attempt to\ndereference cnic_dev in cnic_delete_task().\n\nA typical race condition is illustrated below:\n\nCPU 0 (cleanup) | CPU 1 (delayed work callback)\ncnic_netdev_event() |\n cnic_stop_hw() | cnic_delete_task()\n cnic_cm_stop_bnx2x_hw() | ...\n cancel_delayed_work() | /* the queue_delayed_work()\n flush_workqueue() | executes after flush_workqueue()*/\n | queue_delayed_work()\n cnic_free_dev(dev)//free | cnic_delete_task() //new instance\n | dev = cp-\u003edev; //use\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the cyclic delayed work item is properly canceled and that any\nongoing execution of the work item completes before the cnic_dev is\ndeallocated. Furthermore, since cancel_delayed_work_sync() uses\n__flush_work(work, true) to synchronously wait for any currently\nexecuting instance of the work item to finish, the flush_workqueue()\nbecomes redundant and should be removed.\n\nThis bug was identified through static analysis. To reproduce the issue\nand validate the fix, I simulated the cnic PCI device in QEMU and\nintroduced intentional delays \u2014 such as inserting calls to ssleep()\nwithin the cnic_delete_task() function \u2014 to increase the likelihood\nof triggering the bug."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:37:04.574Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fde6e73189f40ebcf0633aed2b68e731c25f3aa3"
},
{
"url": "https://git.kernel.org/stable/c/7b6a5b0a6b392263c3767fc945b311ea04b34bbd"
},
{
"url": "https://git.kernel.org/stable/c/0405055930264ea8fd26f4131466fa7652e5e47d"
},
{
"url": "https://git.kernel.org/stable/c/e1fcd4a9c09feac0902a65615e866dbf22616125"
},
{
"url": "https://git.kernel.org/stable/c/8eeb2091e72d75df8ceaa2172638d61b4cf8929a"
},
{
"url": "https://git.kernel.org/stable/c/6e33a7eed587062ca8161ad1f4584882a860d697"
},
{
"url": "https://git.kernel.org/stable/c/0627e1481676669cae2df0d85b5ff13e7d24c390"
},
{
"url": "https://git.kernel.org/stable/c/cfa7d9b1e3a8604afc84e9e51d789c29574fb216"
}
],
"title": "cnic: Fix use-after-free bugs in cnic_delete_task",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39945",
"datePublished": "2025-10-04T07:31:07.109Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:37:04.574Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53548 (GCVE-0-2023-53548)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb
The syzbot fuzzer identified a problem in the usbnet driver:
usb 1-1: BOGUS urb xfer, pipe 3 != type 1
WARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504
Modules linked in:
CPU: 0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Workqueue: mld mld_ifc_work
RIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504
Code: 7c 24 18 e8 2c b4 5b fb 48 8b 7c 24 18 e8 42 07 f0 fe 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 c9 fc 8a e8 5a 6f 23 fb <0f> 0b e9 58 f8 ff ff e8 fe b3 5b fb 48 81 c5 c0 05 00 00 e9 84 f7
RSP: 0018:ffffc9000463f568 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000
RDX: ffff88801eb28000 RSI: ffffffff814c03b7 RDI: 0000000000000001
RBP: ffff8881443b7190 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003
R13: ffff88802a77cb18 R14: 0000000000000003 R15: ffff888018262500
FS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000556a99c15a18 CR3: 0000000028c71000 CR4: 0000000000350ef0
Call Trace:
<TASK>
usbnet_start_xmit+0xfe5/0x2190 drivers/net/usb/usbnet.c:1453
__netdev_start_xmit include/linux/netdevice.h:4918 [inline]
netdev_start_xmit include/linux/netdevice.h:4932 [inline]
xmit_one net/core/dev.c:3578 [inline]
dev_hard_start_xmit+0x187/0x700 net/core/dev.c:3594
...
This bug is caused by the fact that usbnet trusts the bulk endpoint
addresses its probe routine receives in the driver_info structure, and
it does not check to see that these endpoints actually exist and have
the expected type and directions.
The fix is simply to add such a check.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
2e55cc7210fef90f88201e860d8767594974574e , < a0715d04cf687a7e21f0d6ac8c1d479294a3f6f8
(git)
Affected: 2e55cc7210fef90f88201e860d8767594974574e , < 53c250ea57cf03af41339234b9855ae284f9db91 (git) Affected: 2e55cc7210fef90f88201e860d8767594974574e , < a05ac5d00eb7fcb2fda806caa4f56e88df6bc6bb (git) Affected: 2e55cc7210fef90f88201e860d8767594974574e , < ec0d0be41721aca683c5606354a58ee2c687e3f8 (git) Affected: 2e55cc7210fef90f88201e860d8767594974574e , < 27d0f755d649d388fcd12f01436c9a33289e14e3 (git) Affected: 2e55cc7210fef90f88201e860d8767594974574e , < 1bebbd9b8037a9cc75984317cb495dec4824c399 (git) Affected: 2e55cc7210fef90f88201e860d8767594974574e , < 0dd3e0c31bf3e933fb85faf1443833aef90b8e46 (git) Affected: 2e55cc7210fef90f88201e860d8767594974574e , < 5e1627cb43ddf1b24b92eb26f8d958a3f5676ccb (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/usbnet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a0715d04cf687a7e21f0d6ac8c1d479294a3f6f8",
"status": "affected",
"version": "2e55cc7210fef90f88201e860d8767594974574e",
"versionType": "git"
},
{
"lessThan": "53c250ea57cf03af41339234b9855ae284f9db91",
"status": "affected",
"version": "2e55cc7210fef90f88201e860d8767594974574e",
"versionType": "git"
},
{
"lessThan": "a05ac5d00eb7fcb2fda806caa4f56e88df6bc6bb",
"status": "affected",
"version": "2e55cc7210fef90f88201e860d8767594974574e",
"versionType": "git"
},
{
"lessThan": "ec0d0be41721aca683c5606354a58ee2c687e3f8",
"status": "affected",
"version": "2e55cc7210fef90f88201e860d8767594974574e",
"versionType": "git"
},
{
"lessThan": "27d0f755d649d388fcd12f01436c9a33289e14e3",
"status": "affected",
"version": "2e55cc7210fef90f88201e860d8767594974574e",
"versionType": "git"
},
{
"lessThan": "1bebbd9b8037a9cc75984317cb495dec4824c399",
"status": "affected",
"version": "2e55cc7210fef90f88201e860d8767594974574e",
"versionType": "git"
},
{
"lessThan": "0dd3e0c31bf3e933fb85faf1443833aef90b8e46",
"status": "affected",
"version": "2e55cc7210fef90f88201e860d8767594974574e",
"versionType": "git"
},
{
"lessThan": "5e1627cb43ddf1b24b92eb26f8d958a3f5676ccb",
"status": "affected",
"version": "2e55cc7210fef90f88201e860d8767594974574e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/usb/usbnet.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"lessThan": "2.6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.322",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.291",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.126",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.322",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.291",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.253",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.190",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.126",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.45",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.10",
"versionStartIncluding": "2.6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "2.6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb\n\nThe syzbot fuzzer identified a problem in the usbnet driver:\n\nusb 1-1: BOGUS urb xfer, pipe 3 != type 1\nWARNING: CPU: 0 PID: 754 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504\nModules linked in:\nCPU: 0 PID: 754 Comm: kworker/0:2 Not tainted 6.4.0-rc7-syzkaller-00014-g692b7dc87ca6 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023\nWorkqueue: mld mld_ifc_work\nRIP: 0010:usb_submit_urb+0xed6/0x1880 drivers/usb/core/urb.c:504\nCode: 7c 24 18 e8 2c b4 5b fb 48 8b 7c 24 18 e8 42 07 f0 fe 41 89 d8 44 89 e1 4c 89 ea 48 89 c6 48 c7 c7 a0 c9 fc 8a e8 5a 6f 23 fb \u003c0f\u003e 0b e9 58 f8 ff ff e8 fe b3 5b fb 48 81 c5 c0 05 00 00 e9 84 f7\nRSP: 0018:ffffc9000463f568 EFLAGS: 00010086\nRAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000\nRDX: ffff88801eb28000 RSI: ffffffff814c03b7 RDI: 0000000000000001\nRBP: ffff8881443b7190 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000003\nR13: ffff88802a77cb18 R14: 0000000000000003 R15: ffff888018262500\nFS: 0000000000000000(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000556a99c15a18 CR3: 0000000028c71000 CR4: 0000000000350ef0\nCall Trace:\n \u003cTASK\u003e\n usbnet_start_xmit+0xfe5/0x2190 drivers/net/usb/usbnet.c:1453\n __netdev_start_xmit include/linux/netdevice.h:4918 [inline]\n netdev_start_xmit include/linux/netdevice.h:4932 [inline]\n xmit_one net/core/dev.c:3578 [inline]\n dev_hard_start_xmit+0x187/0x700 net/core/dev.c:3594\n...\n\nThis bug is caused by the fact that usbnet trusts the bulk endpoint\naddresses its probe routine receives in the driver_info structure, and\nit does not check to see that these endpoints actually exist and have\nthe expected type and directions.\n\nThe fix is simply to add such a check."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:18.247Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a0715d04cf687a7e21f0d6ac8c1d479294a3f6f8"
},
{
"url": "https://git.kernel.org/stable/c/53c250ea57cf03af41339234b9855ae284f9db91"
},
{
"url": "https://git.kernel.org/stable/c/a05ac5d00eb7fcb2fda806caa4f56e88df6bc6bb"
},
{
"url": "https://git.kernel.org/stable/c/ec0d0be41721aca683c5606354a58ee2c687e3f8"
},
{
"url": "https://git.kernel.org/stable/c/27d0f755d649d388fcd12f01436c9a33289e14e3"
},
{
"url": "https://git.kernel.org/stable/c/1bebbd9b8037a9cc75984317cb495dec4824c399"
},
{
"url": "https://git.kernel.org/stable/c/0dd3e0c31bf3e933fb85faf1443833aef90b8e46"
},
{
"url": "https://git.kernel.org/stable/c/5e1627cb43ddf1b24b92eb26f8d958a3f5676ccb"
}
],
"title": "net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53548",
"datePublished": "2025-10-04T15:16:55.612Z",
"dateReserved": "2025-10-04T15:14:15.921Z",
"dateUpdated": "2026-01-05T10:21:18.247Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-50502 (GCVE-0-2022-50502)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-10 16:05
VLAI?
EPSS
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2025-10-10T16:05:13.216Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50502",
"datePublished": "2025-10-04T15:43:52.178Z",
"dateRejected": "2025-10-10T16:05:13.216Z",
"dateReserved": "2025-10-04T15:39:19.465Z",
"dateUpdated": "2025-10-10T16:05:13.216Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39947 (GCVE-0-2025-39947)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:31
VLAI?
EPSS
Title
net/mlx5e: Harden uplink netdev access against device unbind
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Harden uplink netdev access against device unbind
The function mlx5_uplink_netdev_get() gets the uplink netdevice
pointer from mdev->mlx5e_res.uplink_netdev. However, the netdevice can
be removed and its pointer cleared when unbound from the mlx5_core.eth
driver. This results in a NULL pointer, causing a kernel panic.
BUG: unable to handle page fault for address: 0000000000001300
at RIP: 0010:mlx5e_vport_rep_load+0x22a/0x270 [mlx5_core]
Call Trace:
<TASK>
mlx5_esw_offloads_rep_load+0x68/0xe0 [mlx5_core]
esw_offloads_enable+0x593/0x910 [mlx5_core]
mlx5_eswitch_enable_locked+0x341/0x420 [mlx5_core]
mlx5_devlink_eswitch_mode_set+0x17e/0x3a0 [mlx5_core]
devlink_nl_eswitch_set_doit+0x60/0xd0
genl_family_rcv_msg_doit+0xe0/0x130
genl_rcv_msg+0x183/0x290
netlink_rcv_skb+0x4b/0xf0
genl_rcv+0x24/0x40
netlink_unicast+0x255/0x380
netlink_sendmsg+0x1f3/0x420
__sock_sendmsg+0x38/0x60
__sys_sendto+0x119/0x180
do_syscall_64+0x53/0x1d0
entry_SYSCALL_64_after_hwframe+0x4b/0x53
Ensure the pointer is valid before use by checking it for NULL. If it
is valid, immediately call netdev_hold() to take a reference, and
preventing the netdevice from being freed while it is in use.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
7a9fb35e8c3a67145fca262c304de65cb2f83abf , < 2cb17c88edd3a1c7aa6bc880dcdb35a6866fcb2e
(git)
Affected: 7a9fb35e8c3a67145fca262c304de65cb2f83abf , < d1f3db4e7a3be29fc17f01850f162363f919370d (git) Affected: 7a9fb35e8c3a67145fca262c304de65cb2f83abf , < 8df354eb2dd63d111ed5ae2e956e0dbb22bcf93b (git) Affected: 7a9fb35e8c3a67145fca262c304de65cb2f83abf , < 6b4be64fd9fec16418f365c2d8e47a7566e9eba5 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rep.c",
"drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c",
"drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h",
"include/linux/mlx5/driver.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2cb17c88edd3a1c7aa6bc880dcdb35a6866fcb2e",
"status": "affected",
"version": "7a9fb35e8c3a67145fca262c304de65cb2f83abf",
"versionType": "git"
},
{
"lessThan": "d1f3db4e7a3be29fc17f01850f162363f919370d",
"status": "affected",
"version": "7a9fb35e8c3a67145fca262c304de65cb2f83abf",
"versionType": "git"
},
{
"lessThan": "8df354eb2dd63d111ed5ae2e956e0dbb22bcf93b",
"status": "affected",
"version": "7a9fb35e8c3a67145fca262c304de65cb2f83abf",
"versionType": "git"
},
{
"lessThan": "6b4be64fd9fec16418f365c2d8e47a7566e9eba5",
"status": "affected",
"version": "7a9fb35e8c3a67145fca262c304de65cb2f83abf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_rep.c",
"drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c",
"drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h",
"include/linux/mlx5/driver.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Harden uplink netdev access against device unbind\n\nThe function mlx5_uplink_netdev_get() gets the uplink netdevice\npointer from mdev-\u003emlx5e_res.uplink_netdev. However, the netdevice can\nbe removed and its pointer cleared when unbound from the mlx5_core.eth\ndriver. This results in a NULL pointer, causing a kernel panic.\n\n BUG: unable to handle page fault for address: 0000000000001300\n at RIP: 0010:mlx5e_vport_rep_load+0x22a/0x270 [mlx5_core]\n Call Trace:\n \u003cTASK\u003e\n mlx5_esw_offloads_rep_load+0x68/0xe0 [mlx5_core]\n esw_offloads_enable+0x593/0x910 [mlx5_core]\n mlx5_eswitch_enable_locked+0x341/0x420 [mlx5_core]\n mlx5_devlink_eswitch_mode_set+0x17e/0x3a0 [mlx5_core]\n devlink_nl_eswitch_set_doit+0x60/0xd0\n genl_family_rcv_msg_doit+0xe0/0x130\n genl_rcv_msg+0x183/0x290\n netlink_rcv_skb+0x4b/0xf0\n genl_rcv+0x24/0x40\n netlink_unicast+0x255/0x380\n netlink_sendmsg+0x1f3/0x420\n __sock_sendmsg+0x38/0x60\n __sys_sendto+0x119/0x180\n do_syscall_64+0x53/0x1d0\n entry_SYSCALL_64_after_hwframe+0x4b/0x53\n\nEnsure the pointer is valid before use by checking it for NULL. If it\nis valid, immediately call netdev_hold() to take a reference, and\npreventing the netdevice from being freed while it is in use."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:31:08.636Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2cb17c88edd3a1c7aa6bc880dcdb35a6866fcb2e"
},
{
"url": "https://git.kernel.org/stable/c/d1f3db4e7a3be29fc17f01850f162363f919370d"
},
{
"url": "https://git.kernel.org/stable/c/8df354eb2dd63d111ed5ae2e956e0dbb22bcf93b"
},
{
"url": "https://git.kernel.org/stable/c/6b4be64fd9fec16418f365c2d8e47a7566e9eba5"
}
],
"title": "net/mlx5e: Harden uplink netdev access against device unbind",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39947",
"datePublished": "2025-10-04T07:31:08.636Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:31:08.636Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53604 (GCVE-0-2023-53604)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-29 10:50
VLAI?
EPSS
Title
dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path
Otherwise the journal_io_cache will leak if dm_register_target() fails.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < ff4d6b5b38429a7731e5593680d2138bf74dd546
(git)
Affected: 7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < ca8b634fdf07dee3f6dfde57079c4511480b525e (git) Affected: 7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < 6d126899b0747305c9d39a0bcf87e0df9c3f555b (git) Affected: 7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < 44f29e93a55b544dc961b6f8b4e93abaeaafb9ee (git) Affected: 7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < a5d8c6bf58e5b2e70fbc15f3b08dfc1ba6f269ac (git) Affected: 7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < 3877b5c1509b16eeb1f275228fd91789cd88cf17 (git) Affected: 7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < c8c9c50268729bf35f6c9bb1205f490db920454e (git) Affected: 7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < e09a592fdd6c716506774bdbebb5f6c537b47767 (git) Affected: 7eada909bfd7ac90a4522e56aa3179d1fd68cd14 , < 6b79a428c02769f2a11f8ae76bf866226d134887 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff4d6b5b38429a7731e5593680d2138bf74dd546",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
},
{
"lessThan": "ca8b634fdf07dee3f6dfde57079c4511480b525e",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
},
{
"lessThan": "6d126899b0747305c9d39a0bcf87e0df9c3f555b",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
},
{
"lessThan": "44f29e93a55b544dc961b6f8b4e93abaeaafb9ee",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
},
{
"lessThan": "a5d8c6bf58e5b2e70fbc15f3b08dfc1ba6f269ac",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
},
{
"lessThan": "3877b5c1509b16eeb1f275228fd91789cd88cf17",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
},
{
"lessThan": "c8c9c50268729bf35f6c9bb1205f490db920454e",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
},
{
"lessThan": "e09a592fdd6c716506774bdbebb5f6c537b47767",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
},
{
"lessThan": "6b79a428c02769f2a11f8ae76bf866226d134887",
"status": "affected",
"version": "7eada909bfd7ac90a4522e56aa3179d1fd68cd14",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-integrity.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.315",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.283",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.243",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.315",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.283",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.243",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm integrity: call kmem_cache_destroy() in dm_integrity_init() error path\n\nOtherwise the journal_io_cache will leak if dm_register_target() fails."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-29T10:50:36.153Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff4d6b5b38429a7731e5593680d2138bf74dd546"
},
{
"url": "https://git.kernel.org/stable/c/ca8b634fdf07dee3f6dfde57079c4511480b525e"
},
{
"url": "https://git.kernel.org/stable/c/6d126899b0747305c9d39a0bcf87e0df9c3f555b"
},
{
"url": "https://git.kernel.org/stable/c/44f29e93a55b544dc961b6f8b4e93abaeaafb9ee"
},
{
"url": "https://git.kernel.org/stable/c/a5d8c6bf58e5b2e70fbc15f3b08dfc1ba6f269ac"
},
{
"url": "https://git.kernel.org/stable/c/3877b5c1509b16eeb1f275228fd91789cd88cf17"
},
{
"url": "https://git.kernel.org/stable/c/c8c9c50268729bf35f6c9bb1205f490db920454e"
},
{
"url": "https://git.kernel.org/stable/c/e09a592fdd6c716506774bdbebb5f6c537b47767"
},
{
"url": "https://git.kernel.org/stable/c/6b79a428c02769f2a11f8ae76bf866226d134887"
}
],
"title": "dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53604",
"datePublished": "2025-10-04T15:44:14.568Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-29T10:50:36.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53587 (GCVE-0-2023-53587)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
ring-buffer: Sync IRQ works before buffer destruction
Summary
In the Linux kernel, the following vulnerability has been resolved:
ring-buffer: Sync IRQ works before buffer destruction
If something was written to the buffer just before destruction,
it may be possible (maybe not in a real system, but it did
happen in ARCH=um with time-travel) to destroy the ringbuffer
before the IRQ work ran, leading this KASAN report (or a crash
without KASAN):
BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a
Read of size 8 at addr 000000006d640a48 by task swapper/0
CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7
Stack:
60c4f20f 0c203d48 41b58ab3 60f224fc
600477fa 60f35687 60c4f20f 601273dd
00000008 6101eb00 6101eab0 615be548
Call Trace:
[<60047a58>] show_stack+0x25e/0x282
[<60c609e0>] dump_stack_lvl+0x96/0xfd
[<60c50d4c>] print_report+0x1a7/0x5a8
[<603078d3>] kasan_report+0xc1/0xe9
[<60308950>] __asan_report_load8_noabort+0x1b/0x1d
[<60232844>] irq_work_run_list+0x11a/0x13a
[<602328b4>] irq_work_tick+0x24/0x34
[<6017f9dc>] update_process_times+0x162/0x196
[<6019f335>] tick_sched_handle+0x1a4/0x1c3
[<6019fd9e>] tick_sched_timer+0x79/0x10c
[<601812b9>] __hrtimer_run_queues.constprop.0+0x425/0x695
[<60182913>] hrtimer_interrupt+0x16c/0x2c4
[<600486a3>] um_timer+0x164/0x183
[...]
Allocated by task 411:
save_stack_trace+0x99/0xb5
stack_trace_save+0x81/0x9b
kasan_save_stack+0x2d/0x54
kasan_set_track+0x34/0x3e
kasan_save_alloc_info+0x25/0x28
____kasan_kmalloc+0x8b/0x97
__kasan_kmalloc+0x10/0x12
__kmalloc+0xb2/0xe8
load_elf_phdrs+0xee/0x182
[...]
The buggy address belongs to the object at 000000006d640800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 584 bytes inside of
freed 1024-byte region [000000006d640800, 000000006d640c00)
Add the appropriate irq_work_sync() so the work finishes before
the buffers are destroyed.
Prior to the commit in the Fixes tag below, there was only a
single global IRQ work, so this issue didn't exist.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
15693458c4bc0693fd63a50d60f35b628fcf4e29 , < 372c5ee537b8366b64b691ba29e9335525e1655e
(git)
Affected: 15693458c4bc0693fd63a50d60f35b628fcf4e29 , < 2702b67f59d455072a08dc40312f9b090d4dec04 (git) Affected: 15693458c4bc0693fd63a50d60f35b628fcf4e29 , < 2399b1fda025e939b6fb1ac94505bcf718534e65 (git) Affected: 15693458c4bc0693fd63a50d60f35b628fcf4e29 , < 1c99f65d6af2a454bfd5207b4f6a97c8474a1191 (git) Affected: 15693458c4bc0693fd63a50d60f35b628fcf4e29 , < c63741e872fcfb10e153517750f7908f0c00f60d (git) Affected: 15693458c4bc0693fd63a50d60f35b628fcf4e29 , < d9834abd8b24d1fe8092859e436fe1e0fd467c61 (git) Affected: 15693458c4bc0693fd63a50d60f35b628fcf4e29 , < fc6858b7f8e1221f62ce8c6ff8a13a349c32cd76 (git) Affected: 15693458c4bc0693fd63a50d60f35b628fcf4e29 , < 0a65165bd24ee9231191597b7c232376fcd70cdb (git) Affected: 15693458c4bc0693fd63a50d60f35b628fcf4e29 , < 675751bb20634f981498c7d66161584080cc061e (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "372c5ee537b8366b64b691ba29e9335525e1655e",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
},
{
"lessThan": "2702b67f59d455072a08dc40312f9b090d4dec04",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
},
{
"lessThan": "2399b1fda025e939b6fb1ac94505bcf718534e65",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
},
{
"lessThan": "1c99f65d6af2a454bfd5207b4f6a97c8474a1191",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
},
{
"lessThan": "c63741e872fcfb10e153517750f7908f0c00f60d",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
},
{
"lessThan": "d9834abd8b24d1fe8092859e436fe1e0fd467c61",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
},
{
"lessThan": "fc6858b7f8e1221f62ce8c6ff8a13a349c32cd76",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
},
{
"lessThan": "0a65165bd24ee9231191597b7c232376fcd70cdb",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
},
{
"lessThan": "675751bb20634f981498c7d66161584080cc061e",
"status": "affected",
"version": "15693458c4bc0693fd63a50d60f35b628fcf4e29",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/ring_buffer.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.315",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.283",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.243",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.315",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.283",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.243",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nring-buffer: Sync IRQ works before buffer destruction\n\nIf something was written to the buffer just before destruction,\nit may be possible (maybe not in a real system, but it did\nhappen in ARCH=um with time-travel) to destroy the ringbuffer\nbefore the IRQ work ran, leading this KASAN report (or a crash\nwithout KASAN):\n\n BUG: KASAN: slab-use-after-free in irq_work_run_list+0x11a/0x13a\n Read of size 8 at addr 000000006d640a48 by task swapper/0\n\n CPU: 0 PID: 0 Comm: swapper Tainted: G W O 6.3.0-rc1 #7\n Stack:\n 60c4f20f 0c203d48 41b58ab3 60f224fc\n 600477fa 60f35687 60c4f20f 601273dd\n 00000008 6101eb00 6101eab0 615be548\n Call Trace:\n [\u003c60047a58\u003e] show_stack+0x25e/0x282\n [\u003c60c609e0\u003e] dump_stack_lvl+0x96/0xfd\n [\u003c60c50d4c\u003e] print_report+0x1a7/0x5a8\n [\u003c603078d3\u003e] kasan_report+0xc1/0xe9\n [\u003c60308950\u003e] __asan_report_load8_noabort+0x1b/0x1d\n [\u003c60232844\u003e] irq_work_run_list+0x11a/0x13a\n [\u003c602328b4\u003e] irq_work_tick+0x24/0x34\n [\u003c6017f9dc\u003e] update_process_times+0x162/0x196\n [\u003c6019f335\u003e] tick_sched_handle+0x1a4/0x1c3\n [\u003c6019fd9e\u003e] tick_sched_timer+0x79/0x10c\n [\u003c601812b9\u003e] __hrtimer_run_queues.constprop.0+0x425/0x695\n [\u003c60182913\u003e] hrtimer_interrupt+0x16c/0x2c4\n [\u003c600486a3\u003e] um_timer+0x164/0x183\n [...]\n\n Allocated by task 411:\n save_stack_trace+0x99/0xb5\n stack_trace_save+0x81/0x9b\n kasan_save_stack+0x2d/0x54\n kasan_set_track+0x34/0x3e\n kasan_save_alloc_info+0x25/0x28\n ____kasan_kmalloc+0x8b/0x97\n __kasan_kmalloc+0x10/0x12\n __kmalloc+0xb2/0xe8\n load_elf_phdrs+0xee/0x182\n [...]\n\n The buggy address belongs to the object at 000000006d640800\n which belongs to the cache kmalloc-1k of size 1024\n The buggy address is located 584 bytes inside of\n freed 1024-byte region [000000006d640800, 000000006d640c00)\n\nAdd the appropriate irq_work_sync() so the work finishes before\nthe buffers are destroyed.\n\nPrior to the commit in the Fixes tag below, there was only a\nsingle global IRQ work, so this issue didn\u0027t exist."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:02.679Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/372c5ee537b8366b64b691ba29e9335525e1655e"
},
{
"url": "https://git.kernel.org/stable/c/2702b67f59d455072a08dc40312f9b090d4dec04"
},
{
"url": "https://git.kernel.org/stable/c/2399b1fda025e939b6fb1ac94505bcf718534e65"
},
{
"url": "https://git.kernel.org/stable/c/1c99f65d6af2a454bfd5207b4f6a97c8474a1191"
},
{
"url": "https://git.kernel.org/stable/c/c63741e872fcfb10e153517750f7908f0c00f60d"
},
{
"url": "https://git.kernel.org/stable/c/d9834abd8b24d1fe8092859e436fe1e0fd467c61"
},
{
"url": "https://git.kernel.org/stable/c/fc6858b7f8e1221f62ce8c6ff8a13a349c32cd76"
},
{
"url": "https://git.kernel.org/stable/c/0a65165bd24ee9231191597b7c232376fcd70cdb"
},
{
"url": "https://git.kernel.org/stable/c/675751bb20634f981498c7d66161584080cc061e"
}
],
"title": "ring-buffer: Sync IRQ works before buffer destruction",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53587",
"datePublished": "2025-10-04T15:44:02.679Z",
"dateReserved": "2025-10-04T15:40:38.477Z",
"dateUpdated": "2025-10-04T15:44:02.679Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39932 (GCVE-0-2025-39932)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2025-10-04 07:30
VLAI?
EPSS
Title
smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)
In smbd_destroy() we may destroy the memory so we better
wait until post_send_credits_work is no longer pending
and will never be started again.
I actually just hit the case using rxe:
WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe]
...
[ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs]
[ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
[ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30
[ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs]
[ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
[ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
[ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60
[ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
[ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs]
[ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs]
[ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs]
[ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10
[ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10
[ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0
[ 5305.687889] [ T138] process_one_work+0x629/0xf80
[ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5
[ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30
[ 5305.687933] [ T138] worker_thread+0x87f/0x1570
...
It means rxe_post_recv was called after rdma_destroy_qp().
This happened because put_receive_buffer() was triggered
by ib_drain_qp() and called:
queue_work(info->workqueue, &info->post_send_credits_work);
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
f198186aa9bbd60fae7a2061f4feec614d880299 , < 6ae90a2baf923e85eb037b636aa641250bf4220f
(git)
Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < 3fabb1236f2e3ad78d531be0a4ad9f4a4ccdda87 (git) Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < d9dcbbcf9145b68aa85c40947311a6907277e097 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smbdirect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6ae90a2baf923e85eb037b636aa641250bf4220f",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "3fabb1236f2e3ad78d531be0a4ad9f4a4ccdda87",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "d9dcbbcf9145b68aa85c40947311a6907277e097",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smbdirect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: let smbd_destroy() call disable_work_sync(\u0026info-\u003epost_send_credits_work)\n\nIn smbd_destroy() we may destroy the memory so we better\nwait until post_send_credits_work is no longer pending\nand will never be started again.\n\nI actually just hit the case using rxe:\n\nWARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe]\n...\n[ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs]\n[ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30\n[ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs]\n[ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n[ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60\n[ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs]\n[ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs]\n[ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs]\n[ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10\n[ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10\n[ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0\n[ 5305.687889] [ T138] process_one_work+0x629/0xf80\n[ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5\n[ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30\n[ 5305.687933] [ T138] worker_thread+0x87f/0x1570\n...\n\nIt means rxe_post_recv was called after rdma_destroy_qp().\nThis happened because put_receive_buffer() was triggered\nby ib_drain_qp() and called:\nqueue_work(info-\u003eworkqueue, \u0026info-\u003epost_send_credits_work);"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:30:56.726Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6ae90a2baf923e85eb037b636aa641250bf4220f"
},
{
"url": "https://git.kernel.org/stable/c/3fabb1236f2e3ad78d531be0a4ad9f4a4ccdda87"
},
{
"url": "https://git.kernel.org/stable/c/d9dcbbcf9145b68aa85c40947311a6907277e097"
}
],
"title": "smb: client: let smbd_destroy() call disable_work_sync(\u0026info-\u003epost_send_credits_work)",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39932",
"datePublished": "2025-10-04T07:30:56.726Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:30:56.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53534 (GCVE-0-2023-53534)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc
As the devm_kcalloc may return NULL, the return value needs to be checked
to avoid NULL poineter dereference.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
31c5558dae0513bd2bae33ea37543f584c6c35a5 , < b64b6dff15a38468b8cd33fc7864fa4e02b0933a
(git)
Affected: 31c5558dae0513bd2bae33ea37543f584c6c35a5 , < 62952905e195f7350bc230cf0960a74ddbceed5d (git) Affected: 31c5558dae0513bd2bae33ea37543f584c6c35a5 , < 67ea657c7891c2f86a7750395640d9bdf2555926 (git) Affected: 31c5558dae0513bd2bae33ea37543f584c6c35a5 , < 7d569ae98ee5490585929be69fea68047679b7b2 (git) Affected: 31c5558dae0513bd2bae33ea37543f584c6c35a5 , < 5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/mediatek/mtk_drm_crtc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b64b6dff15a38468b8cd33fc7864fa4e02b0933a",
"status": "affected",
"version": "31c5558dae0513bd2bae33ea37543f584c6c35a5",
"versionType": "git"
},
{
"lessThan": "62952905e195f7350bc230cf0960a74ddbceed5d",
"status": "affected",
"version": "31c5558dae0513bd2bae33ea37543f584c6c35a5",
"versionType": "git"
},
{
"lessThan": "67ea657c7891c2f86a7750395640d9bdf2555926",
"status": "affected",
"version": "31c5558dae0513bd2bae33ea37543f584c6c35a5",
"versionType": "git"
},
{
"lessThan": "7d569ae98ee5490585929be69fea68047679b7b2",
"status": "affected",
"version": "31c5558dae0513bd2bae33ea37543f584c6c35a5",
"versionType": "git"
},
{
"lessThan": "5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c",
"status": "affected",
"version": "31c5558dae0513bd2bae33ea37543f584c6c35a5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/mediatek/mtk_drm_crtc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc\n\nAs the devm_kcalloc may return NULL, the return value needs to be checked\nto avoid NULL poineter dereference."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:45.909Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b64b6dff15a38468b8cd33fc7864fa4e02b0933a"
},
{
"url": "https://git.kernel.org/stable/c/62952905e195f7350bc230cf0960a74ddbceed5d"
},
{
"url": "https://git.kernel.org/stable/c/67ea657c7891c2f86a7750395640d9bdf2555926"
},
{
"url": "https://git.kernel.org/stable/c/7d569ae98ee5490585929be69fea68047679b7b2"
},
{
"url": "https://git.kernel.org/stable/c/5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c"
}
],
"title": "drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53534",
"datePublished": "2025-10-04T15:16:45.909Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2025-10-04T15:16:45.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50482 (GCVE-0-2022-50482)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
iommu/vt-d: Clean up si_domain in the init_dmars() error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/vt-d: Clean up si_domain in the init_dmars() error path
A splat from kmem_cache_destroy() was seen with a kernel prior to
commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mempool")
when there was a failure in init_dmars(), because the iommu_domain
cache still had objects. While the mempool code is now gone, there
still is a leak of the si_domain memory if init_dmars() fails. So
clean up si_domain in the init_dmars() error path.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
86080ccc223aabf8d0b85a504f4f06aa88e82fb3 , < 749bea542b67513e99240dc58bbfc099e842d508
(git)
Affected: 86080ccc223aabf8d0b85a504f4f06aa88e82fb3 , < 5cecfe151874b835331efe086bbdcaeaf64f6b90 (git) Affected: 86080ccc223aabf8d0b85a504f4f06aa88e82fb3 , < 724483b585a1b1e063d42ac5aa835707ff2ec165 (git) Affected: 86080ccc223aabf8d0b85a504f4f06aa88e82fb3 , < d74196bb278b8f8af88e16bd595997dfa3d6fdb0 (git) Affected: 86080ccc223aabf8d0b85a504f4f06aa88e82fb3 , < 0365d6af75f9f2696e94a0fef24a2c8464c037c8 (git) Affected: 86080ccc223aabf8d0b85a504f4f06aa88e82fb3 , < c4ad3ae4c6be9d8b0701761c839771116bca6ea3 (git) Affected: 86080ccc223aabf8d0b85a504f4f06aa88e82fb3 , < 620bf9f981365c18cc2766c53d92bf8131c63f32 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "749bea542b67513e99240dc58bbfc099e842d508",
"status": "affected",
"version": "86080ccc223aabf8d0b85a504f4f06aa88e82fb3",
"versionType": "git"
},
{
"lessThan": "5cecfe151874b835331efe086bbdcaeaf64f6b90",
"status": "affected",
"version": "86080ccc223aabf8d0b85a504f4f06aa88e82fb3",
"versionType": "git"
},
{
"lessThan": "724483b585a1b1e063d42ac5aa835707ff2ec165",
"status": "affected",
"version": "86080ccc223aabf8d0b85a504f4f06aa88e82fb3",
"versionType": "git"
},
{
"lessThan": "d74196bb278b8f8af88e16bd595997dfa3d6fdb0",
"status": "affected",
"version": "86080ccc223aabf8d0b85a504f4f06aa88e82fb3",
"versionType": "git"
},
{
"lessThan": "0365d6af75f9f2696e94a0fef24a2c8464c037c8",
"status": "affected",
"version": "86080ccc223aabf8d0b85a504f4f06aa88e82fb3",
"versionType": "git"
},
{
"lessThan": "c4ad3ae4c6be9d8b0701761c839771116bca6ea3",
"status": "affected",
"version": "86080ccc223aabf8d0b85a504f4f06aa88e82fb3",
"versionType": "git"
},
{
"lessThan": "620bf9f981365c18cc2766c53d92bf8131c63f32",
"status": "affected",
"version": "86080ccc223aabf8d0b85a504f4f06aa88e82fb3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/intel/iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.298",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.264",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.221",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.76",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.298",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.264",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.221",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.152",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.76",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.6",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/vt-d: Clean up si_domain in the init_dmars() error path\n\nA splat from kmem_cache_destroy() was seen with a kernel prior to\ncommit ee2653bbe89d (\"iommu/vt-d: Remove domain and devinfo mempool\")\nwhen there was a failure in init_dmars(), because the iommu_domain\ncache still had objects. While the mempool code is now gone, there\nstill is a leak of the si_domain memory if init_dmars() fails. So\nclean up si_domain in the init_dmars() error path."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:41.033Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/749bea542b67513e99240dc58bbfc099e842d508"
},
{
"url": "https://git.kernel.org/stable/c/5cecfe151874b835331efe086bbdcaeaf64f6b90"
},
{
"url": "https://git.kernel.org/stable/c/724483b585a1b1e063d42ac5aa835707ff2ec165"
},
{
"url": "https://git.kernel.org/stable/c/d74196bb278b8f8af88e16bd595997dfa3d6fdb0"
},
{
"url": "https://git.kernel.org/stable/c/0365d6af75f9f2696e94a0fef24a2c8464c037c8"
},
{
"url": "https://git.kernel.org/stable/c/c4ad3ae4c6be9d8b0701761c839771116bca6ea3"
},
{
"url": "https://git.kernel.org/stable/c/620bf9f981365c18cc2766c53d92bf8131c63f32"
}
],
"title": "iommu/vt-d: Clean up si_domain in the init_dmars() error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50482",
"datePublished": "2025-10-04T15:16:41.033Z",
"dateReserved": "2025-10-04T15:13:33.468Z",
"dateUpdated": "2025-10-04T15:16:41.033Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53606 (GCVE-0-2023-53606)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
Summary
In the Linux kernel, the following vulnerability has been resolved:
nfsd: clean up potential nfsd_file refcount leaks in COPY codepath
There are two different flavors of the nfsd4_copy struct. One is
embedded in the compound and is used directly in synchronous copies. The
other is dynamically allocated, refcounted and tracked in the client
struture. For the embedded one, the cleanup just involves releasing any
nfsd_files held on its behalf. For the async one, the cleanup is a bit
more involved, and we need to dequeue it from lists, unhash it, etc.
There is at least one potential refcount leak in this code now. If the
kthread_create call fails, then both the src and dst nfsd_files in the
original nfsd4_copy object are leaked.
The cleanup in this codepath is also sort of weird. In the async copy
case, we'll have up to four nfsd_file references (src and dst for both
flavors of copy structure). They are both put at the end of
nfsd4_do_async_copy, even though the ones held on behalf of the embedded
one outlive that structure.
Change it so that we always clean up the nfsd_file refs held by the
embedded copy structure before nfsd4_copy returns. Rework
cleanup_async_copy to handle both inter and intra copies. Eliminate
nfsd4_cleanup_intra_ssc since it now becomes a no-op.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 , < fd63299db8090307eae66f2aef17c8f00aafa0a9
(git)
Affected: e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 , < b3169b6ffe036b549c296a9e71591d29a1fb3209 (git) Affected: e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 , < 75b8c681c563ef7e85da6862354efc18d2a08b1b (git) Affected: e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 , < 8f565846fbe8182961498d4cbe618b15076a683b (git) Affected: e0639dc5805a9d4faaa2c07ad98fa853b9529dd3 , < 6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd63299db8090307eae66f2aef17c8f00aafa0a9",
"status": "affected",
"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
"versionType": "git"
},
{
"lessThan": "b3169b6ffe036b549c296a9e71591d29a1fb3209",
"status": "affected",
"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
"versionType": "git"
},
{
"lessThan": "75b8c681c563ef7e85da6862354efc18d2a08b1b",
"status": "affected",
"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
"versionType": "git"
},
{
"lessThan": "8f565846fbe8182961498d4cbe618b15076a683b",
"status": "affected",
"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
"versionType": "git"
},
{
"lessThan": "6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f",
"status": "affected",
"version": "e0639dc5805a9d4faaa2c07ad98fa853b9529dd3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nfsd/nfs4proc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.220",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.154",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnfsd: clean up potential nfsd_file refcount leaks in COPY codepath\n\nThere are two different flavors of the nfsd4_copy struct. One is\nembedded in the compound and is used directly in synchronous copies. The\nother is dynamically allocated, refcounted and tracked in the client\nstruture. For the embedded one, the cleanup just involves releasing any\nnfsd_files held on its behalf. For the async one, the cleanup is a bit\nmore involved, and we need to dequeue it from lists, unhash it, etc.\n\nThere is at least one potential refcount leak in this code now. If the\nkthread_create call fails, then both the src and dst nfsd_files in the\noriginal nfsd4_copy object are leaked.\n\nThe cleanup in this codepath is also sort of weird. In the async copy\ncase, we\u0027ll have up to four nfsd_file references (src and dst for both\nflavors of copy structure). They are both put at the end of\nnfsd4_do_async_copy, even though the ones held on behalf of the embedded\none outlive that structure.\n\nChange it so that we always clean up the nfsd_file refs held by the\nembedded copy structure before nfsd4_copy returns. Rework\ncleanup_async_copy to handle both inter and intra copies. Eliminate\nnfsd4_cleanup_intra_ssc since it now becomes a no-op."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:28.540Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd63299db8090307eae66f2aef17c8f00aafa0a9"
},
{
"url": "https://git.kernel.org/stable/c/b3169b6ffe036b549c296a9e71591d29a1fb3209"
},
{
"url": "https://git.kernel.org/stable/c/75b8c681c563ef7e85da6862354efc18d2a08b1b"
},
{
"url": "https://git.kernel.org/stable/c/8f565846fbe8182961498d4cbe618b15076a683b"
},
{
"url": "https://git.kernel.org/stable/c/6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f"
}
],
"title": "nfsd: clean up potential nfsd_file refcount leaks in COPY codepath",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53606",
"datePublished": "2025-10-04T15:44:15.908Z",
"dateReserved": "2025-10-04T15:40:38.480Z",
"dateUpdated": "2026-01-05T10:21:28.540Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53616 (GCVE-0-2023-53616)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
Summary
In the Linux kernel, the following vulnerability has been resolved:
jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
syzbot found an invalid-free in diUnmount:
BUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline]
BUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3674
Free of addr ffff88806f410000 by task syz-executor131/3632
CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
print_address_description+0x74/0x340 mm/kasan/report.c:284
print_report+0x107/0x1f0 mm/kasan/report.c:395
kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:460
____kasan_slab_free+0xfb/0x120
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0x71/0x110 mm/slub.c:3674
diUnmount+0xef/0x100 fs/jfs/jfs_imap.c:195
jfs_umount+0x108/0x370 fs/jfs/jfs_umount.c:63
jfs_put_super+0x86/0x190 fs/jfs/super.c:194
generic_shutdown_super+0x130/0x310 fs/super.c:492
kill_block_super+0x79/0xd0 fs/super.c:1428
deactivate_locked_super+0xa7/0xf0 fs/super.c:332
cleanup_mnt+0x494/0x520 fs/namespace.c:1186
task_work_run+0x243/0x300 kernel/task_work.c:179
exit_task_work include/linux/task_work.h:38 [inline]
do_exit+0x664/0x2070 kernel/exit.c:820
do_group_exit+0x1fd/0x2b0 kernel/exit.c:950
__do_sys_exit_group kernel/exit.c:961 [inline]
__se_sys_exit_group kernel/exit.c:959 [inline]
__x64_sys_exit_group+0x3b/0x40 kernel/exit.c:959
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
[...]
JFS_IP(ipimap)->i_imap is not setting to NULL after free in diUnmount.
If jfs_remount() free JFS_IP(ipimap)->i_imap but then failed at diMount().
JFS_IP(ipimap)->i_imap will be freed once again.
Fix this problem by setting JFS_IP(ipimap)->i_imap to NULL after free.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c3c0f0ddd851b3fa3e9d3450bbcd561f4f850469
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 114ea3cb13ab25f7178cb60283adb93d2f96dad7 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 5873df0195124be2f357de11bfd473ead4f90ed8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 756747d4b439e3e1159282ae89f17eefebbe9b25 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ef7311101ca43dd73b45bca7a30ac72d9535ff87 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 4de3a603010e0ca334487de24c6aab0777b7f808 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 88484bde6f12126616b38e43b6c00edcd941f615 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6e2bda2c192d0244b5a78b787ef20aa10cb319b7 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/jfs/jfs_imap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c3c0f0ddd851b3fa3e9d3450bbcd561f4f850469",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "114ea3cb13ab25f7178cb60283adb93d2f96dad7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "5873df0195124be2f357de11bfd473ead4f90ed8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "756747d4b439e3e1159282ae89f17eefebbe9b25",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ef7311101ca43dd73b45bca7a30ac72d9535ff87",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "4de3a603010e0ca334487de24c6aab0777b7f808",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "88484bde6f12126616b38e43b6c00edcd941f615",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6e2bda2c192d0244b5a78b787ef20aa10cb319b7",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/jfs/jfs_imap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.326",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.295",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.257",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.197",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.133",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.326",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.295",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.257",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.197",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.133",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.55",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.5",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\njfs: fix invalid free of JFS_IP(ipimap)-\u003ei_imap in diUnmount\n\nsyzbot found an invalid-free in diUnmount:\n\nBUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline]\nBUG: KASAN: double-free in __kmem_cache_free+0x71/0x110 mm/slub.c:3674\nFree of addr ffff88806f410000 by task syz-executor131/3632\n\n CPU: 0 PID: 3632 Comm: syz-executor131 Not tainted 6.1.0-rc7-syzkaller-00012-gca57f02295f1 #0\n Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022\n Call Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n print_address_description+0x74/0x340 mm/kasan/report.c:284\n print_report+0x107/0x1f0 mm/kasan/report.c:395\n kasan_report_invalid_free+0xac/0xd0 mm/kasan/report.c:460\n ____kasan_slab_free+0xfb/0x120\n kasan_slab_free include/linux/kasan.h:177 [inline]\n slab_free_hook mm/slub.c:1724 [inline]\n slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750\n slab_free mm/slub.c:3661 [inline]\n __kmem_cache_free+0x71/0x110 mm/slub.c:3674\n diUnmount+0xef/0x100 fs/jfs/jfs_imap.c:195\n jfs_umount+0x108/0x370 fs/jfs/jfs_umount.c:63\n jfs_put_super+0x86/0x190 fs/jfs/super.c:194\n generic_shutdown_super+0x130/0x310 fs/super.c:492\n kill_block_super+0x79/0xd0 fs/super.c:1428\n deactivate_locked_super+0xa7/0xf0 fs/super.c:332\n cleanup_mnt+0x494/0x520 fs/namespace.c:1186\n task_work_run+0x243/0x300 kernel/task_work.c:179\n exit_task_work include/linux/task_work.h:38 [inline]\n do_exit+0x664/0x2070 kernel/exit.c:820\n do_group_exit+0x1fd/0x2b0 kernel/exit.c:950\n __do_sys_exit_group kernel/exit.c:961 [inline]\n __se_sys_exit_group kernel/exit.c:959 [inline]\n __x64_sys_exit_group+0x3b/0x40 kernel/exit.c:959\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[...]\n\nJFS_IP(ipimap)-\u003ei_imap is not setting to NULL after free in diUnmount.\nIf jfs_remount() free JFS_IP(ipimap)-\u003ei_imap but then failed at diMount().\nJFS_IP(ipimap)-\u003ei_imap will be freed once again.\nFix this problem by setting JFS_IP(ipimap)-\u003ei_imap to NULL after free."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:32.958Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c3c0f0ddd851b3fa3e9d3450bbcd561f4f850469"
},
{
"url": "https://git.kernel.org/stable/c/114ea3cb13ab25f7178cb60283adb93d2f96dad7"
},
{
"url": "https://git.kernel.org/stable/c/5873df0195124be2f357de11bfd473ead4f90ed8"
},
{
"url": "https://git.kernel.org/stable/c/756747d4b439e3e1159282ae89f17eefebbe9b25"
},
{
"url": "https://git.kernel.org/stable/c/ef7311101ca43dd73b45bca7a30ac72d9535ff87"
},
{
"url": "https://git.kernel.org/stable/c/4de3a603010e0ca334487de24c6aab0777b7f808"
},
{
"url": "https://git.kernel.org/stable/c/88484bde6f12126616b38e43b6c00edcd941f615"
},
{
"url": "https://git.kernel.org/stable/c/6e2bda2c192d0244b5a78b787ef20aa10cb319b7"
}
],
"title": "jfs: fix invalid free of JFS_IP(ipimap)-\u003ei_imap in diUnmount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53616",
"datePublished": "2025-10-04T15:44:23.056Z",
"dateReserved": "2025-10-04T15:40:38.481Z",
"dateUpdated": "2026-01-05T10:21:32.958Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53590 (GCVE-0-2023-53590)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
Summary
In the Linux kernel, the following vulnerability has been resolved:
sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop
With this refcnt added in sctp_stream_priorities, we don't need to
traverse all streams to check if the prio is used by other streams
when freeing one stream's prio in sctp_sched_prio_free_sid(). This
can avoid a nested loop (up to 65535 * 65535), which may cause a
stuck as Ying reported:
watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136]
Call Trace:
<TASK>
sctp_sched_prio_free_sid+0xab/0x100 [sctp]
sctp_stream_free_ext+0x64/0xa0 [sctp]
sctp_stream_free+0x31/0x50 [sctp]
sctp_association_free+0xa5/0x200 [sctp]
Note that it doesn't need to use refcount_t type for this counter,
as its accessing is always protected under the sock lock.
v1->v2:
- add a check in sctp_sched_prio_set to avoid the possible prio_head
refcnt overflow.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
a7555681e50bdebed2c40ff7404ee73c2e932993 , < cec326443f01283ef68ea00c06ea073b1835a562
(git)
Affected: 176ee6c673ccd118e9392fd2dbb165423bdb99ca , < 8ee401f89cdb10f39098c0656d695b2bc4052100 (git) Affected: 0dfb9a566327182387c90100ea54d8426cee8c67 , < bf5540cbd20e2dae2c81ab9b31deef41ef147d0a (git) Affected: 9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9 , < 03c3a5584a0a29821e59b7834635ce823050caaa (git) Affected: 9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9 , < 6d529928ea212127851a2df8c40d822237ca946b (git) Affected: 9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9 , < 68ba44639537de6f91fe32783766322d41848127 (git) Affected: fa20f88271259d42ebe66f0a8c4c20199e888c99 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/net/sctp/structs.h",
"net/sctp/stream_sched_prio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cec326443f01283ef68ea00c06ea073b1835a562",
"status": "affected",
"version": "a7555681e50bdebed2c40ff7404ee73c2e932993",
"versionType": "git"
},
{
"lessThan": "8ee401f89cdb10f39098c0656d695b2bc4052100",
"status": "affected",
"version": "176ee6c673ccd118e9392fd2dbb165423bdb99ca",
"versionType": "git"
},
{
"lessThan": "bf5540cbd20e2dae2c81ab9b31deef41ef147d0a",
"status": "affected",
"version": "0dfb9a566327182387c90100ea54d8426cee8c67",
"versionType": "git"
},
{
"lessThan": "03c3a5584a0a29821e59b7834635ce823050caaa",
"status": "affected",
"version": "9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9",
"versionType": "git"
},
{
"lessThan": "6d529928ea212127851a2df8c40d822237ca946b",
"status": "affected",
"version": "9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9",
"versionType": "git"
},
{
"lessThan": "68ba44639537de6f91fe32783766322d41848127",
"status": "affected",
"version": "9ed7bfc79542119ac0a9e1ce8a2a5285e43433e9",
"versionType": "git"
},
{
"status": "affected",
"version": "fa20f88271259d42ebe66f0a8c4c20199e888c99",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/net/sctp/structs.h",
"net/sctp/stream_sched_prio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.100",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.235",
"versionStartIncluding": "5.4.226",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "5.10.158",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.100",
"versionStartIncluding": "5.15.82",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.18",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.5",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsctp: add a refcnt in sctp_stream_priorities to avoid a nested loop\n\nWith this refcnt added in sctp_stream_priorities, we don\u0027t need to\ntraverse all streams to check if the prio is used by other streams\nwhen freeing one stream\u0027s prio in sctp_sched_prio_free_sid(). This\ncan avoid a nested loop (up to 65535 * 65535), which may cause a\nstuck as Ying reported:\n\n watchdog: BUG: soft lockup - CPU#23 stuck for 26s! [ksoftirqd/23:136]\n Call Trace:\n \u003cTASK\u003e\n sctp_sched_prio_free_sid+0xab/0x100 [sctp]\n sctp_stream_free_ext+0x64/0xa0 [sctp]\n sctp_stream_free+0x31/0x50 [sctp]\n sctp_association_free+0xa5/0x200 [sctp]\n\nNote that it doesn\u0027t need to use refcount_t type for this counter,\nas its accessing is always protected under the sock lock.\n\nv1-\u003ev2:\n - add a check in sctp_sched_prio_set to avoid the possible prio_head\n refcnt overflow."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:04.733Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cec326443f01283ef68ea00c06ea073b1835a562"
},
{
"url": "https://git.kernel.org/stable/c/8ee401f89cdb10f39098c0656d695b2bc4052100"
},
{
"url": "https://git.kernel.org/stable/c/bf5540cbd20e2dae2c81ab9b31deef41ef147d0a"
},
{
"url": "https://git.kernel.org/stable/c/03c3a5584a0a29821e59b7834635ce823050caaa"
},
{
"url": "https://git.kernel.org/stable/c/6d529928ea212127851a2df8c40d822237ca946b"
},
{
"url": "https://git.kernel.org/stable/c/68ba44639537de6f91fe32783766322d41848127"
}
],
"title": "sctp: add a refcnt in sctp_stream_priorities to avoid a nested loop",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53590",
"datePublished": "2025-10-04T15:44:04.733Z",
"dateReserved": "2025-10-04T15:40:38.478Z",
"dateUpdated": "2025-10-04T15:44:04.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50471 (GCVE-0-2022-50471)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
xen/gntdev: Accommodate VMA splitting
Summary
In the Linux kernel, the following vulnerability has been resolved:
xen/gntdev: Accommodate VMA splitting
Prior to this commit, the gntdev driver code did not handle the
following scenario correctly with paravirtualized (PV) Xen domains:
* User process sets up a gntdev mapping composed of two grant mappings
(i.e., two pages shared by another Xen domain).
* User process munmap()s one of the pages.
* User process munmap()s the remaining page.
* User process exits.
In the scenario above, the user process would cause the kernel to log
the following messages in dmesg for the first munmap(), and the second
munmap() call would result in similar log messages:
BUG: Bad page map in process doublemap.test pte:... pmd:...
page:0000000057c97bff refcount:1 mapcount:-1 \
mapping:0000000000000000 index:0x0 pfn:...
...
page dumped because: bad pte
...
file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0
...
Call Trace:
<TASK>
dump_stack_lvl+0x46/0x5e
print_bad_pte.cold+0x66/0xb6
unmap_page_range+0x7e5/0xdc0
unmap_vmas+0x78/0xf0
unmap_region+0xa8/0x110
__do_munmap+0x1ea/0x4e0
__vm_munmap+0x75/0x120
__x64_sys_munmap+0x28/0x40
do_syscall_64+0x38/0x90
entry_SYSCALL_64_after_hwframe+0x61/0xcb
...
For each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG)
would print out the following and trigger a general protection fault in
the affected Xen PV domain:
(XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...
(XEN) d0v... Attempt to implicitly unmap d0's grant PTE ...
As of this writing, gntdev_grant_map structure's vma field (referred to
as map->vma below) is mainly used for checking the start and end
addresses of mappings. However, with split VMAs, these may change, and
there could be more than one VMA associated with a gntdev mapping.
Hence, remove the use of map->vma and rely on map->pages_vm_start for
the original start address and on (map->count << PAGE_SHIFT) for the
original mapping size. Let the invalidate() and find_special_page()
hooks use these.
Also, given that there can be multiple VMAs associated with a gntdev
mapping, move the "mmu_interval_notifier_remove(&map->notifier)" call to
the end of gntdev_put_map, so that the MMU notifier is only removed
after the closing of the last remaining VMA.
Finally, use an atomic to prevent inadvertent gntdev mapping re-use,
instead of using the map->live_grants atomic counter and/or the map->vma
pointer (the latter of which is now removed). This prevents the
userspace from mmap()'ing (with MAP_FIXED) a gntdev mapping over the
same address range as a previously set up gntdev mapping. This scenario
can be summarized with the following call-trace, which was valid prior
to this commit:
mmap
gntdev_mmap
mmap (repeat mmap with MAP_FIXED over the same address range)
gntdev_invalidate
unmap_grant_pages (sets 'being_removed' entries to true)
gnttab_unmap_refs_async
unmap_single_vma
gntdev_mmap (maps the shared pages again)
munmap
gntdev_invalidate
unmap_grant_pages
(no-op because 'being_removed' entries are true)
unmap_single_vma (For PV domains, Xen reports that a granted page
is being unmapped and triggers a general protection fault in the
affected domain, if Xen was built with CONFIG_DEBUG)
The fix for this last scenario could be worth its own commit, but we
opted for a single commit, because removing the gntdev_grant_map
structure's vma field requires guarding the entry to gntdev_mmap(), and
the live_grants atomic counter is not sufficient on its own to prevent
the mmap() over a pre-existing mapping.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
ab31523c2fcac557226bac72cbdf5fafe01f9a26 , < 3c6a888e352283a14f37b9b433cd598a1a3a7dd0
(git)
Affected: ab31523c2fcac557226bac72cbdf5fafe01f9a26 , < 7c16d0a4e6a436b4e7c92bead3fab55aaa4c1141 (git) Affected: ab31523c2fcac557226bac72cbdf5fafe01f9a26 , < 4fb4053d90caa9985b87ec0e0c32c66a55bdfa3a (git) Affected: ab31523c2fcac557226bac72cbdf5fafe01f9a26 , < cdafa219ace013c594e2491158ad1b51f9923dde (git) Affected: ab31523c2fcac557226bac72cbdf5fafe01f9a26 , < 5c13a4a0291b30191eff9ead8d010e1ca43a4d0c (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/xen/gntdev-common.h",
"drivers/xen/gntdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3c6a888e352283a14f37b9b433cd598a1a3a7dd0",
"status": "affected",
"version": "ab31523c2fcac557226bac72cbdf5fafe01f9a26",
"versionType": "git"
},
{
"lessThan": "7c16d0a4e6a436b4e7c92bead3fab55aaa4c1141",
"status": "affected",
"version": "ab31523c2fcac557226bac72cbdf5fafe01f9a26",
"versionType": "git"
},
{
"lessThan": "4fb4053d90caa9985b87ec0e0c32c66a55bdfa3a",
"status": "affected",
"version": "ab31523c2fcac557226bac72cbdf5fafe01f9a26",
"versionType": "git"
},
{
"lessThan": "cdafa219ace013c594e2491158ad1b51f9923dde",
"status": "affected",
"version": "ab31523c2fcac557226bac72cbdf5fafe01f9a26",
"versionType": "git"
},
{
"lessThan": "5c13a4a0291b30191eff9ead8d010e1ca43a4d0c",
"status": "affected",
"version": "ab31523c2fcac557226bac72cbdf5fafe01f9a26",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/xen/gntdev-common.h",
"drivers/xen/gntdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.152",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.152",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.75",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.17",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxen/gntdev: Accommodate VMA splitting\n\nPrior to this commit, the gntdev driver code did not handle the\nfollowing scenario correctly with paravirtualized (PV) Xen domains:\n\n* User process sets up a gntdev mapping composed of two grant mappings\n (i.e., two pages shared by another Xen domain).\n* User process munmap()s one of the pages.\n* User process munmap()s the remaining page.\n* User process exits.\n\nIn the scenario above, the user process would cause the kernel to log\nthe following messages in dmesg for the first munmap(), and the second\nmunmap() call would result in similar log messages:\n\n BUG: Bad page map in process doublemap.test pte:... pmd:...\n page:0000000057c97bff refcount:1 mapcount:-1 \\\n mapping:0000000000000000 index:0x0 pfn:...\n ...\n page dumped because: bad pte\n ...\n file:gntdev fault:0x0 mmap:gntdev_mmap [xen_gntdev] readpage:0x0\n ...\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x46/0x5e\n print_bad_pte.cold+0x66/0xb6\n unmap_page_range+0x7e5/0xdc0\n unmap_vmas+0x78/0xf0\n unmap_region+0xa8/0x110\n __do_munmap+0x1ea/0x4e0\n __vm_munmap+0x75/0x120\n __x64_sys_munmap+0x28/0x40\n do_syscall_64+0x38/0x90\n entry_SYSCALL_64_after_hwframe+0x61/0xcb\n ...\n\nFor each munmap() call, the Xen hypervisor (if built with CONFIG_DEBUG)\nwould print out the following and trigger a general protection fault in\nthe affected Xen PV domain:\n\n (XEN) d0v... Attempt to implicitly unmap d0\u0027s grant PTE ...\n (XEN) d0v... Attempt to implicitly unmap d0\u0027s grant PTE ...\n\nAs of this writing, gntdev_grant_map structure\u0027s vma field (referred to\nas map-\u003evma below) is mainly used for checking the start and end\naddresses of mappings. However, with split VMAs, these may change, and\nthere could be more than one VMA associated with a gntdev mapping.\nHence, remove the use of map-\u003evma and rely on map-\u003epages_vm_start for\nthe original start address and on (map-\u003ecount \u003c\u003c PAGE_SHIFT) for the\noriginal mapping size. Let the invalidate() and find_special_page()\nhooks use these.\n\nAlso, given that there can be multiple VMAs associated with a gntdev\nmapping, move the \"mmu_interval_notifier_remove(\u0026map-\u003enotifier)\" call to\nthe end of gntdev_put_map, so that the MMU notifier is only removed\nafter the closing of the last remaining VMA.\n\nFinally, use an atomic to prevent inadvertent gntdev mapping re-use,\ninstead of using the map-\u003elive_grants atomic counter and/or the map-\u003evma\npointer (the latter of which is now removed). This prevents the\nuserspace from mmap()\u0027ing (with MAP_FIXED) a gntdev mapping over the\nsame address range as a previously set up gntdev mapping. This scenario\ncan be summarized with the following call-trace, which was valid prior\nto this commit:\n\n mmap\n gntdev_mmap\n mmap (repeat mmap with MAP_FIXED over the same address range)\n gntdev_invalidate\n unmap_grant_pages (sets \u0027being_removed\u0027 entries to true)\n gnttab_unmap_refs_async\n unmap_single_vma\n gntdev_mmap (maps the shared pages again)\n munmap\n gntdev_invalidate\n unmap_grant_pages\n (no-op because \u0027being_removed\u0027 entries are true)\n unmap_single_vma (For PV domains, Xen reports that a granted page\n is being unmapped and triggers a general protection fault in the\n affected domain, if Xen was built with CONFIG_DEBUG)\n\nThe fix for this last scenario could be worth its own commit, but we\nopted for a single commit, because removing the gntdev_grant_map\nstructure\u0027s vma field requires guarding the entry to gntdev_mmap(), and\nthe live_grants atomic counter is not sufficient on its own to prevent\nthe mmap() over a pre-existing mapping."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:33.489Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3c6a888e352283a14f37b9b433cd598a1a3a7dd0"
},
{
"url": "https://git.kernel.org/stable/c/7c16d0a4e6a436b4e7c92bead3fab55aaa4c1141"
},
{
"url": "https://git.kernel.org/stable/c/4fb4053d90caa9985b87ec0e0c32c66a55bdfa3a"
},
{
"url": "https://git.kernel.org/stable/c/cdafa219ace013c594e2491158ad1b51f9923dde"
},
{
"url": "https://git.kernel.org/stable/c/5c13a4a0291b30191eff9ead8d010e1ca43a4d0c"
}
],
"title": "xen/gntdev: Accommodate VMA splitting",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50471",
"datePublished": "2025-10-04T15:16:33.489Z",
"dateReserved": "2025-10-04T15:13:33.466Z",
"dateUpdated": "2025-10-04T15:16:33.489Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53554 (GCVE-0-2023-53554)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
Summary
In the Linux kernel, the following vulnerability has been resolved:
staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()
The "exc->key_len" is a u16 that comes from the user. If it's over
IW_ENCODING_TOKEN_MAX (64) that could lead to memory corruption.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
b121d84882b97b8668be0b95e9ba50cfd01aa0f1 , < 9496fb96ddeb740dc6b966f4a7d8dfb8b93921c6
(git)
Affected: b121d84882b97b8668be0b95e9ba50cfd01aa0f1 , < 663fff29fd613e2b0d30c4138157312ba93c4939 (git) Affected: b121d84882b97b8668be0b95e9ba50cfd01aa0f1 , < 5373a1aa91b2298f9305794b8270cf9896be96b6 (git) Affected: b121d84882b97b8668be0b95e9ba50cfd01aa0f1 , < caac4b6c15b66feae4d83f602e1e46f124540202 (git) Affected: b121d84882b97b8668be0b95e9ba50cfd01aa0f1 , < baf420e30364ef9efe3e29a5c0e01e612aebf3fe (git) Affected: b121d84882b97b8668be0b95e9ba50cfd01aa0f1 , < 7ae9f55a495077f838bab466411ee6f38574df9b (git) Affected: b121d84882b97b8668be0b95e9ba50cfd01aa0f1 , < b1b04b56745bc79286c80aa876fabfab1e08ebf1 (git) Affected: b121d84882b97b8668be0b95e9ba50cfd01aa0f1 , < 5f1c7031e044cb2fba82836d55cc235e2ad619dc (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/staging/ks7010/ks_wlan_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9496fb96ddeb740dc6b966f4a7d8dfb8b93921c6",
"status": "affected",
"version": "b121d84882b97b8668be0b95e9ba50cfd01aa0f1",
"versionType": "git"
},
{
"lessThan": "663fff29fd613e2b0d30c4138157312ba93c4939",
"status": "affected",
"version": "b121d84882b97b8668be0b95e9ba50cfd01aa0f1",
"versionType": "git"
},
{
"lessThan": "5373a1aa91b2298f9305794b8270cf9896be96b6",
"status": "affected",
"version": "b121d84882b97b8668be0b95e9ba50cfd01aa0f1",
"versionType": "git"
},
{
"lessThan": "caac4b6c15b66feae4d83f602e1e46f124540202",
"status": "affected",
"version": "b121d84882b97b8668be0b95e9ba50cfd01aa0f1",
"versionType": "git"
},
{
"lessThan": "baf420e30364ef9efe3e29a5c0e01e612aebf3fe",
"status": "affected",
"version": "b121d84882b97b8668be0b95e9ba50cfd01aa0f1",
"versionType": "git"
},
{
"lessThan": "7ae9f55a495077f838bab466411ee6f38574df9b",
"status": "affected",
"version": "b121d84882b97b8668be0b95e9ba50cfd01aa0f1",
"versionType": "git"
},
{
"lessThan": "b1b04b56745bc79286c80aa876fabfab1e08ebf1",
"status": "affected",
"version": "b121d84882b97b8668be0b95e9ba50cfd01aa0f1",
"versionType": "git"
},
{
"lessThan": "5f1c7031e044cb2fba82836d55cc235e2ad619dc",
"status": "affected",
"version": "b121d84882b97b8668be0b95e9ba50cfd01aa0f1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/staging/ks7010/ks_wlan_net.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.12"
},
{
"lessThan": "4.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.322",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.291",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.124",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.43",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.322",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.291",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.253",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.190",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.124",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.43",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.8",
"versionStartIncluding": "4.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "4.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nstaging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()\n\nThe \"exc-\u003ekey_len\" is a u16 that comes from the user. If it\u0027s over\nIW_ENCODING_TOKEN_MAX (64) that could lead to memory corruption."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:59.749Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9496fb96ddeb740dc6b966f4a7d8dfb8b93921c6"
},
{
"url": "https://git.kernel.org/stable/c/663fff29fd613e2b0d30c4138157312ba93c4939"
},
{
"url": "https://git.kernel.org/stable/c/5373a1aa91b2298f9305794b8270cf9896be96b6"
},
{
"url": "https://git.kernel.org/stable/c/caac4b6c15b66feae4d83f602e1e46f124540202"
},
{
"url": "https://git.kernel.org/stable/c/baf420e30364ef9efe3e29a5c0e01e612aebf3fe"
},
{
"url": "https://git.kernel.org/stable/c/7ae9f55a495077f838bab466411ee6f38574df9b"
},
{
"url": "https://git.kernel.org/stable/c/b1b04b56745bc79286c80aa876fabfab1e08ebf1"
},
{
"url": "https://git.kernel.org/stable/c/5f1c7031e044cb2fba82836d55cc235e2ad619dc"
}
],
"title": "staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53554",
"datePublished": "2025-10-04T15:16:59.749Z",
"dateReserved": "2025-10-04T15:14:15.922Z",
"dateUpdated": "2025-10-04T15:16:59.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50492 (GCVE-0-2022-50492)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
drm/msm: fix use-after-free on probe deferral
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: fix use-after-free on probe deferral
The bridge counter was never reset when tearing down the DRM device so
that stale pointers to deallocated structures would be accessed on the
next tear down (e.g. after a second late bind deferral).
Given enough bridges and a few probe deferrals this could currently also
lead to data beyond the bridge array being corrupted.
Patchwork: https://patchwork.freedesktop.org/patch/502665/
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0a30a47741b6df1f9555a0fac6aebb7e8c363bad",
"status": "affected",
"version": "a3376e3ec81c5dd0622cbc187db76d2824d31c1c",
"versionType": "git"
},
{
"lessThan": "6808abdb33bf90330e70a687d29f038507e06ebb",
"status": "affected",
"version": "a3376e3ec81c5dd0622cbc187db76d2824d31c1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.12"
},
{
"lessThan": "3.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.7",
"versionStartIncluding": "3.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "3.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: fix use-after-free on probe deferral\n\nThe bridge counter was never reset when tearing down the DRM device so\nthat stale pointers to deallocated structures would be accessed on the\nnext tear down (e.g. after a second late bind deferral).\n\nGiven enough bridges and a few probe deferrals this could currently also\nlead to data beyond the bridge array being corrupted.\n\nPatchwork: https://patchwork.freedesktop.org/patch/502665/"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:45.204Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0a30a47741b6df1f9555a0fac6aebb7e8c363bad"
},
{
"url": "https://git.kernel.org/stable/c/6808abdb33bf90330e70a687d29f038507e06ebb"
}
],
"title": "drm/msm: fix use-after-free on probe deferral",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50492",
"datePublished": "2025-10-04T15:43:45.204Z",
"dateReserved": "2025-10-04T15:39:19.463Z",
"dateUpdated": "2025-10-04T15:43:45.204Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50479 (GCVE-0-2022-50479)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-06 09:07
VLAI?
EPSS
Title
drm/amd: fix potential memory leak
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/amd: fix potential memory leak
This patch fix potential memory leak (clk_src) when function run
into last return NULL.
s/free/kfree/ - Alex
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a6e6ab9caeac96b277a3fe7da1dfa8f69a591759",
"status": "affected",
"version": "3a83e4e64bb1522ddac67ffc787d1c38291e1a65",
"versionType": "git"
},
{
"lessThan": "6160216fd2c97107e8a9ab39863b056d677fcd85",
"status": "affected",
"version": "3a83e4e64bb1522ddac67ffc787d1c38291e1a65",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/dcn314/dcn314_resource.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amd: fix potential memory leak\n\nThis patch fix potential memory leak (clk_src) when function run\ninto last return NULL.\n\ns/free/kfree/ - Alex"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T09:07:15.985Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a6e6ab9caeac96b277a3fe7da1dfa8f69a591759"
},
{
"url": "https://git.kernel.org/stable/c/6160216fd2c97107e8a9ab39863b056d677fcd85"
}
],
"title": "drm/amd: fix potential memory leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50479",
"datePublished": "2025-10-04T15:16:39.021Z",
"dateReserved": "2025-10-04T15:13:33.467Z",
"dateUpdated": "2025-10-06T09:07:15.985Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53553 (GCVE-0-2023-53553)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
HID: hyperv: avoid struct memcpy overrun warning
Summary
In the Linux kernel, the following vulnerability has been resolved:
HID: hyperv: avoid struct memcpy overrun warning
A previous patch addressed the fortified memcpy warning for most
builds, but I still see this one with gcc-9:
In file included from include/linux/string.h:254,
from drivers/hid/hid-hyperv.c:8:
In function 'fortify_memcpy_chk',
inlined from 'mousevsc_on_receive' at drivers/hid/hid-hyperv.c:272:3:
include/linux/fortify-string.h:583:4: error: call to '__write_overflow_field' declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
583 | __write_overflow_field(p_size_field, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
My guess is that the WARN_ON() itself is what confuses gcc, so it no
longer sees that there is a correct range check. Rework the code in a
way that helps readability and avoids the warning.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-hyperv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a7902cc5f5b9c95997017c8e309da760fb1deb6e",
"status": "affected",
"version": "542f25a94471570e2594be5b422b9ca572cf88a1",
"versionType": "git"
},
{
"lessThan": "5f151364b1da6bd217632fd4ee8cc24eaf66a497",
"status": "affected",
"version": "542f25a94471570e2594be5b422b9ca572cf88a1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hid/hid-hyperv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.5",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: hyperv: avoid struct memcpy overrun warning\n\nA previous patch addressed the fortified memcpy warning for most\nbuilds, but I still see this one with gcc-9:\n\nIn file included from include/linux/string.h:254,\n from drivers/hid/hid-hyperv.c:8:\nIn function \u0027fortify_memcpy_chk\u0027,\n inlined from \u0027mousevsc_on_receive\u0027 at drivers/hid/hid-hyperv.c:272:3:\ninclude/linux/fortify-string.h:583:4: error: call to \u0027__write_overflow_field\u0027 declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]\n 583 | __write_overflow_field(p_size_field, size);\n | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMy guess is that the WARN_ON() itself is what confuses gcc, so it no\nlonger sees that there is a correct range check. Rework the code in a\nway that helps readability and avoids the warning."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:59.091Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a7902cc5f5b9c95997017c8e309da760fb1deb6e"
},
{
"url": "https://git.kernel.org/stable/c/5f151364b1da6bd217632fd4ee8cc24eaf66a497"
}
],
"title": "HID: hyperv: avoid struct memcpy overrun warning",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53553",
"datePublished": "2025-10-04T15:16:59.091Z",
"dateReserved": "2025-10-04T15:14:15.922Z",
"dateUpdated": "2025-10-04T15:16:59.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53599 (GCVE-0-2023-53599)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
crypto: af_alg - Fix missing initialisation affecting gcm-aes-s390
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Fix missing initialisation affecting gcm-aes-s390
Fix af_alg_alloc_areq() to initialise areq->first_rsgl.sgl.sgt.sgl to point
to the scatterlist array in areq->first_rsgl.sgl.sgl.
Without this, the gcm-aes-s390 driver will oops when it tries to do
gcm_walk_start() on req->dst because req->dst is set to the value of
areq->first_rsgl.sgl.sgl by _aead_recvmsg() calling
aead_request_set_crypt().
The problem comes if an empty ciphertext is passed: the loop in
af_alg_get_rsgl() just passes straight out and doesn't set areq->first_rsgl
up.
This isn't a problem on x86_64 using gcmaes_crypt_by_sg() because, as far
as I can tell, that ignores req->dst and only uses req->src[*].
[*] Is this a bug in aesni-intel_glue.c?
The s390x oops looks something like:
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 0000000a00000000 TEID: 0000000a00000803
Fault in home space mode while using kernel ASCE.
AS:00000000a43a0007 R3:0000000000000024
Oops: 003b ilc:2 [#1] SMP
...
Call Trace:
[<000003ff7fc3d47e>] gcm_walk_start+0x16/0x28 [aes_s390]
[<00000000a2a342f2>] crypto_aead_decrypt+0x9a/0xb8
[<00000000a2a60888>] aead_recvmsg+0x478/0x698
[<00000000a2e519a0>] sock_recvmsg+0x70/0xb0
[<00000000a2e51a56>] sock_read_iter+0x76/0xa0
[<00000000a273e066>] vfs_read+0x26e/0x2a8
[<00000000a273e8c4>] ksys_read+0xbc/0x100
[<00000000a311d808>] __do_syscall+0x1d0/0x1f8
[<00000000a312ff30>] system_call+0x70/0x98
Last Breaking-Event-Address:
[<000003ff7fc3e6b4>] gcm_aes_crypt+0x104/0xa68 [aes_s390]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2c9d205040d7c0eaccc473917f9b0bb0a923e440",
"status": "affected",
"version": "c1abe6f570aff4b6d396dc551e60570d2f50bd79",
"versionType": "git"
},
{
"lessThan": "6a4b8aa0a916b39a39175584c07222434fa6c6ef",
"status": "affected",
"version": "c1abe6f570aff4b6d396dc551e60570d2f50bd79",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.5"
},
{
"lessThan": "6.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.3",
"versionStartIncluding": "6.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "6.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Fix missing initialisation affecting gcm-aes-s390\n\nFix af_alg_alloc_areq() to initialise areq-\u003efirst_rsgl.sgl.sgt.sgl to point\nto the scatterlist array in areq-\u003efirst_rsgl.sgl.sgl.\n\nWithout this, the gcm-aes-s390 driver will oops when it tries to do\ngcm_walk_start() on req-\u003edst because req-\u003edst is set to the value of\nareq-\u003efirst_rsgl.sgl.sgl by _aead_recvmsg() calling\naead_request_set_crypt().\n\nThe problem comes if an empty ciphertext is passed: the loop in\naf_alg_get_rsgl() just passes straight out and doesn\u0027t set areq-\u003efirst_rsgl\nup.\n\nThis isn\u0027t a problem on x86_64 using gcmaes_crypt_by_sg() because, as far\nas I can tell, that ignores req-\u003edst and only uses req-\u003esrc[*].\n\n[*] Is this a bug in aesni-intel_glue.c?\n\nThe s390x oops looks something like:\n\n Unable to handle kernel pointer dereference in virtual kernel address space\n Failing address: 0000000a00000000 TEID: 0000000a00000803\n Fault in home space mode while using kernel ASCE.\n AS:00000000a43a0007 R3:0000000000000024\n Oops: 003b ilc:2 [#1] SMP\n ...\n Call Trace:\n [\u003c000003ff7fc3d47e\u003e] gcm_walk_start+0x16/0x28 [aes_s390]\n [\u003c00000000a2a342f2\u003e] crypto_aead_decrypt+0x9a/0xb8\n [\u003c00000000a2a60888\u003e] aead_recvmsg+0x478/0x698\n [\u003c00000000a2e519a0\u003e] sock_recvmsg+0x70/0xb0\n [\u003c00000000a2e51a56\u003e] sock_read_iter+0x76/0xa0\n [\u003c00000000a273e066\u003e] vfs_read+0x26e/0x2a8\n [\u003c00000000a273e8c4\u003e] ksys_read+0xbc/0x100\n [\u003c00000000a311d808\u003e] __do_syscall+0x1d0/0x1f8\n [\u003c00000000a312ff30\u003e] system_call+0x70/0x98\n Last Breaking-Event-Address:\n [\u003c000003ff7fc3e6b4\u003e] gcm_aes_crypt+0x104/0xa68 [aes_s390]"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:11.096Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2c9d205040d7c0eaccc473917f9b0bb0a923e440"
},
{
"url": "https://git.kernel.org/stable/c/6a4b8aa0a916b39a39175584c07222434fa6c6ef"
}
],
"title": "crypto: af_alg - Fix missing initialisation affecting gcm-aes-s390",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53599",
"datePublished": "2025-10-04T15:44:11.096Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-04T15:44:11.096Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53537 (GCVE-0-2023-53537)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
f2fs: fix to avoid use-after-free for cached IPU bio
Summary
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid use-after-free for cached IPU bio
xfstest generic/019 reports a bug:
kernel BUG at mm/filemap.c:1619!
RIP: 0010:folio_end_writeback+0x8a/0x90
Call Trace:
end_page_writeback+0x1c/0x60
f2fs_write_end_io+0x199/0x420
bio_endio+0x104/0x180
submit_bio_noacct+0xa5/0x510
submit_bio+0x48/0x80
f2fs_submit_write_bio+0x35/0x300
f2fs_submit_merged_ipu_write+0x2a0/0x2b0
f2fs_write_single_data_page+0x838/0x8b0
f2fs_write_cache_pages+0x379/0xa30
f2fs_write_data_pages+0x30c/0x340
do_writepages+0xd8/0x1b0
__writeback_single_inode+0x44/0x370
writeback_sb_inodes+0x233/0x4d0
__writeback_inodes_wb+0x56/0xf0
wb_writeback+0x1dd/0x2d0
wb_workfn+0x367/0x4a0
process_one_work+0x21d/0x430
worker_thread+0x4e/0x3c0
kthread+0x103/0x130
ret_from_fork+0x2c/0x50
The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write()
in f2fs_write_single_data_page() tries to flush IPU bio in cache, however
f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter,
result in submitting random cached bio which belong to other IO context,
then it will cause use-after-free issue, fix it by adding additional
validity check.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
0b20fcec8651569935a10afe03fedc0b812d044e , < b2f423fda64fb49213aa0ed5056079cf295a5df2
(git)
Affected: 0b20fcec8651569935a10afe03fedc0b812d044e , < 9a7f63283af6befc0f91d549f4f6917dff7479a9 (git) Affected: 0b20fcec8651569935a10afe03fedc0b812d044e , < 7d058f0ab161437369ad6e45a4b67c2886e71373 (git) Affected: 0b20fcec8651569935a10afe03fedc0b812d044e , < 97ec6f1788cc6bee3f8c89cb908e1a2a1cd859bb (git) Affected: 0b20fcec8651569935a10afe03fedc0b812d044e , < af4ce124d7bd74cb839bbdaccffbb416771a56b5 (git) Affected: 0b20fcec8651569935a10afe03fedc0b812d044e , < 5cdb422c839134273866208dad5360835ddb9794 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/f2fs/data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b2f423fda64fb49213aa0ed5056079cf295a5df2",
"status": "affected",
"version": "0b20fcec8651569935a10afe03fedc0b812d044e",
"versionType": "git"
},
{
"lessThan": "9a7f63283af6befc0f91d549f4f6917dff7479a9",
"status": "affected",
"version": "0b20fcec8651569935a10afe03fedc0b812d044e",
"versionType": "git"
},
{
"lessThan": "7d058f0ab161437369ad6e45a4b67c2886e71373",
"status": "affected",
"version": "0b20fcec8651569935a10afe03fedc0b812d044e",
"versionType": "git"
},
{
"lessThan": "97ec6f1788cc6bee3f8c89cb908e1a2a1cd859bb",
"status": "affected",
"version": "0b20fcec8651569935a10afe03fedc0b812d044e",
"versionType": "git"
},
{
"lessThan": "af4ce124d7bd74cb839bbdaccffbb416771a56b5",
"status": "affected",
"version": "0b20fcec8651569935a10afe03fedc0b812d044e",
"versionType": "git"
},
{
"lessThan": "5cdb422c839134273866208dad5360835ddb9794",
"status": "affected",
"version": "0b20fcec8651569935a10afe03fedc0b812d044e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/f2fs/data.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid use-after-free for cached IPU bio\n\nxfstest generic/019 reports a bug:\n\nkernel BUG at mm/filemap.c:1619!\nRIP: 0010:folio_end_writeback+0x8a/0x90\nCall Trace:\n end_page_writeback+0x1c/0x60\n f2fs_write_end_io+0x199/0x420\n bio_endio+0x104/0x180\n submit_bio_noacct+0xa5/0x510\n submit_bio+0x48/0x80\n f2fs_submit_write_bio+0x35/0x300\n f2fs_submit_merged_ipu_write+0x2a0/0x2b0\n f2fs_write_single_data_page+0x838/0x8b0\n f2fs_write_cache_pages+0x379/0xa30\n f2fs_write_data_pages+0x30c/0x340\n do_writepages+0xd8/0x1b0\n __writeback_single_inode+0x44/0x370\n writeback_sb_inodes+0x233/0x4d0\n __writeback_inodes_wb+0x56/0xf0\n wb_writeback+0x1dd/0x2d0\n wb_workfn+0x367/0x4a0\n process_one_work+0x21d/0x430\n worker_thread+0x4e/0x3c0\n kthread+0x103/0x130\n ret_from_fork+0x2c/0x50\n\nThe root cause is: after cp_error is set, f2fs_submit_merged_ipu_write()\nin f2fs_write_single_data_page() tries to flush IPU bio in cache, however\nf2fs_submit_merged_ipu_write() missed to check validity of @bio parameter,\nresult in submitting random cached bio which belong to other IO context,\nthen it will cause use-after-free issue, fix it by adding additional\nvalidity check."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:48.006Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b2f423fda64fb49213aa0ed5056079cf295a5df2"
},
{
"url": "https://git.kernel.org/stable/c/9a7f63283af6befc0f91d549f4f6917dff7479a9"
},
{
"url": "https://git.kernel.org/stable/c/7d058f0ab161437369ad6e45a4b67c2886e71373"
},
{
"url": "https://git.kernel.org/stable/c/97ec6f1788cc6bee3f8c89cb908e1a2a1cd859bb"
},
{
"url": "https://git.kernel.org/stable/c/af4ce124d7bd74cb839bbdaccffbb416771a56b5"
},
{
"url": "https://git.kernel.org/stable/c/5cdb422c839134273866208dad5360835ddb9794"
}
],
"title": "f2fs: fix to avoid use-after-free for cached IPU bio",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53537",
"datePublished": "2025-10-04T15:16:48.006Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2025-10-04T15:16:48.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53579 (GCVE-0-2023-53579)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
gpio: mvebu: fix irq domain leak
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: mvebu: fix irq domain leak
Uwe Kleine-König pointed out we still have one resource leak in the mvebu
driver triggered on driver detach. Let's address it with a custom devm
action.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
812d47889a8e418d7bea9bec383581a34c19183e , < b19e90521286a03bc3793fd598f20277a8f99c85
(git)
Affected: 812d47889a8e418d7bea9bec383581a34c19183e , < 44e2afbf650f3264519643fcc9e6b4d2f6e8d547 (git) Affected: 812d47889a8e418d7bea9bec383581a34c19183e , < d9b791d8362359d241b4e8f4b4767c681ffdb6ef (git) Affected: 812d47889a8e418d7bea9bec383581a34c19183e , < 644ee70267a934be27370f9aa618b29af7290544 (git) Affected: f0cde54863da281cec1ed85497b4ec58d29c1460 (git) Affected: 7a9239fd04802ee6ddf82d211cff3ee7df9c473a (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-mvebu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b19e90521286a03bc3793fd598f20277a8f99c85",
"status": "affected",
"version": "812d47889a8e418d7bea9bec383581a34c19183e",
"versionType": "git"
},
{
"lessThan": "44e2afbf650f3264519643fcc9e6b4d2f6e8d547",
"status": "affected",
"version": "812d47889a8e418d7bea9bec383581a34c19183e",
"versionType": "git"
},
{
"lessThan": "d9b791d8362359d241b4e8f4b4767c681ffdb6ef",
"status": "affected",
"version": "812d47889a8e418d7bea9bec383581a34c19183e",
"versionType": "git"
},
{
"lessThan": "644ee70267a934be27370f9aa618b29af7290544",
"status": "affected",
"version": "812d47889a8e418d7bea9bec383581a34c19183e",
"versionType": "git"
},
{
"status": "affected",
"version": "f0cde54863da281cec1ed85497b4ec58d29c1460",
"versionType": "git"
},
{
"status": "affected",
"version": "7a9239fd04802ee6ddf82d211cff3ee7df9c473a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-mvebu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.124",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.43",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.8",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.124",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.43",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.8",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.16.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: mvebu: fix irq domain leak\n\nUwe Kleine-K\u00f6nig pointed out we still have one resource leak in the mvebu\ndriver triggered on driver detach. Let\u0027s address it with a custom devm\naction."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:18.040Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b19e90521286a03bc3793fd598f20277a8f99c85"
},
{
"url": "https://git.kernel.org/stable/c/44e2afbf650f3264519643fcc9e6b4d2f6e8d547"
},
{
"url": "https://git.kernel.org/stable/c/d9b791d8362359d241b4e8f4b4767c681ffdb6ef"
},
{
"url": "https://git.kernel.org/stable/c/644ee70267a934be27370f9aa618b29af7290544"
}
],
"title": "gpio: mvebu: fix irq domain leak",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53579",
"datePublished": "2025-10-04T15:17:18.040Z",
"dateReserved": "2025-10-04T15:14:15.926Z",
"dateUpdated": "2025-10-04T15:17:18.040Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50499 (GCVE-0-2022-50499)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
media: dvb-core: Fix double free in dvb_register_device()
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: dvb-core: Fix double free in dvb_register_device()
In function dvb_register_device() -> dvb_register_media_device() ->
dvb_create_media_entity(), dvb->entity is allocated and initialized. If
the initialization fails, it frees the dvb->entity, and return an error
code. The caller takes the error code and handles the error by calling
dvb_media_device_free(), which unregisters the entity and frees the
field again if it is not NULL. As dvb->entity may not NULLed in
dvb_create_media_entity() when the allocation of dvbdev->pad fails, a
double free may occur. This may also cause an Use After free in
media_device_unregister_entity().
Fix this by storing NULL to dvb->entity when it is freed.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
9db28659aa893c68f162b11fd63bb7f6a713e52f , < 0588b12c418c3e4f927ced11f27b02ef4a5bfb07
(git)
Affected: 1399a136127bfe1b9bb7c951d9851da62a519121 , < e9a78485b658361fab6a5547377be6c1af6f1b3d (git) Affected: 4df2427a5148093987437054bb82da4d014dcd59 , < 70bc51303871159796b55ba1a8f16637b46c2511 (git) Affected: fcd5ce4b3936242e6679875a4d3c3acfc8743e15 , < b21f62b49ee9c3e0216d685d9cfd6003e5727271 (git) Affected: fcd5ce4b3936242e6679875a4d3c3acfc8743e15 , < 7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8 (git) Affected: fcd5ce4b3936242e6679875a4d3c3acfc8743e15 , < acf984a3718c2458eb9e08b6714490a04f213c58 (git) Affected: fcd5ce4b3936242e6679875a4d3c3acfc8743e15 , < 772892b29ac50c2c5e918fc80104aa6ede81d837 (git) Affected: fcd5ce4b3936242e6679875a4d3c3acfc8743e15 , < 123eddf92a114e03919942641d2c2b1f4ca56ea6 (git) Affected: fcd5ce4b3936242e6679875a4d3c3acfc8743e15 , < 6b0d0477fce747d4137aa65856318b55fba72198 (git) Affected: 8c17f6f5d0d6aab72a2af25c9911ac66e984be06 (git) Affected: 202be5d6e46f682b9d1d79cd4dc6ab726e62ef1c (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/dvb-core/dvbdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0588b12c418c3e4f927ced11f27b02ef4a5bfb07",
"status": "affected",
"version": "9db28659aa893c68f162b11fd63bb7f6a713e52f",
"versionType": "git"
},
{
"lessThan": "e9a78485b658361fab6a5547377be6c1af6f1b3d",
"status": "affected",
"version": "1399a136127bfe1b9bb7c951d9851da62a519121",
"versionType": "git"
},
{
"lessThan": "70bc51303871159796b55ba1a8f16637b46c2511",
"status": "affected",
"version": "4df2427a5148093987437054bb82da4d014dcd59",
"versionType": "git"
},
{
"lessThan": "b21f62b49ee9c3e0216d685d9cfd6003e5727271",
"status": "affected",
"version": "fcd5ce4b3936242e6679875a4d3c3acfc8743e15",
"versionType": "git"
},
{
"lessThan": "7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8",
"status": "affected",
"version": "fcd5ce4b3936242e6679875a4d3c3acfc8743e15",
"versionType": "git"
},
{
"lessThan": "acf984a3718c2458eb9e08b6714490a04f213c58",
"status": "affected",
"version": "fcd5ce4b3936242e6679875a4d3c3acfc8743e15",
"versionType": "git"
},
{
"lessThan": "772892b29ac50c2c5e918fc80104aa6ede81d837",
"status": "affected",
"version": "fcd5ce4b3936242e6679875a4d3c3acfc8743e15",
"versionType": "git"
},
{
"lessThan": "123eddf92a114e03919942641d2c2b1f4ca56ea6",
"status": "affected",
"version": "fcd5ce4b3936242e6679875a4d3c3acfc8743e15",
"versionType": "git"
},
{
"lessThan": "6b0d0477fce747d4137aa65856318b55fba72198",
"status": "affected",
"version": "fcd5ce4b3936242e6679875a4d3c3acfc8743e15",
"versionType": "git"
},
{
"status": "affected",
"version": "8c17f6f5d0d6aab72a2af25c9911ac66e984be06",
"versionType": "git"
},
{
"status": "affected",
"version": "202be5d6e46f682b9d1d79cd4dc6ab726e62ef1c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/dvb-core/dvbdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "4.9.195",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "4.14.147",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "4.19.77",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.87",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.18",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.4",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.2.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.3.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: dvb-core: Fix double free in dvb_register_device()\n\nIn function dvb_register_device() -\u003e dvb_register_media_device() -\u003e\ndvb_create_media_entity(), dvb-\u003eentity is allocated and initialized. If\nthe initialization fails, it frees the dvb-\u003eentity, and return an error\ncode. The caller takes the error code and handles the error by calling\ndvb_media_device_free(), which unregisters the entity and frees the\nfield again if it is not NULL. As dvb-\u003eentity may not NULLed in\ndvb_create_media_entity() when the allocation of dvbdev-\u003epad fails, a\ndouble free may occur. This may also cause an Use After free in\nmedia_device_unregister_entity().\n\nFix this by storing NULL to dvb-\u003eentity when it is freed."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:50.064Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0588b12c418c3e4f927ced11f27b02ef4a5bfb07"
},
{
"url": "https://git.kernel.org/stable/c/e9a78485b658361fab6a5547377be6c1af6f1b3d"
},
{
"url": "https://git.kernel.org/stable/c/70bc51303871159796b55ba1a8f16637b46c2511"
},
{
"url": "https://git.kernel.org/stable/c/b21f62b49ee9c3e0216d685d9cfd6003e5727271"
},
{
"url": "https://git.kernel.org/stable/c/7dd5a68cdbbbe7fc67ba701cb52ba10d8ba149f8"
},
{
"url": "https://git.kernel.org/stable/c/acf984a3718c2458eb9e08b6714490a04f213c58"
},
{
"url": "https://git.kernel.org/stable/c/772892b29ac50c2c5e918fc80104aa6ede81d837"
},
{
"url": "https://git.kernel.org/stable/c/123eddf92a114e03919942641d2c2b1f4ca56ea6"
},
{
"url": "https://git.kernel.org/stable/c/6b0d0477fce747d4137aa65856318b55fba72198"
}
],
"title": "media: dvb-core: Fix double free in dvb_register_device()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50499",
"datePublished": "2025-10-04T15:43:50.064Z",
"dateReserved": "2025-10-04T15:39:19.464Z",
"dateUpdated": "2025-10-04T15:43:50.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39939 (GCVE-0-2025-39939)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:31
VLAI?
EPSS
Title
iommu/s390: Fix memory corruption when using identity domain
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/s390: Fix memory corruption when using identity domain
zpci_get_iommu_ctrs() returns counter information to be reported as part
of device statistics; these counters are stored as part of the s390_domain.
The problem, however, is that the identity domain is not backed by an
s390_domain and so the conversion via to_s390_domain() yields a bad address
that is zero'd initially and read on-demand later via a sysfs read.
These counters aren't necessary for the identity domain; just return NULL
in this case.
This issue was discovered via KASAN with reports that look like:
BUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device
when using the identity domain for a device on s390.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/s390-iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "17a58caf3863163c4a84a218a9649be2c8061443",
"status": "affected",
"version": "64af12c6ec3afd7d44bc8b2044eee59f98059087",
"versionType": "git"
},
{
"lessThan": "b3506e9bcc777ed6af2ab631c86a9990ed97b474",
"status": "affected",
"version": "64af12c6ec3afd7d44bc8b2044eee59f98059087",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/s390-iommu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.15"
},
{
"lessThan": "6.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/s390: Fix memory corruption when using identity domain\n\nzpci_get_iommu_ctrs() returns counter information to be reported as part\nof device statistics; these counters are stored as part of the s390_domain.\nThe problem, however, is that the identity domain is not backed by an\ns390_domain and so the conversion via to_s390_domain() yields a bad address\nthat is zero\u0027d initially and read on-demand later via a sysfs read.\nThese counters aren\u0027t necessary for the identity domain; just return NULL\nin this case.\n\nThis issue was discovered via KASAN with reports that look like:\nBUG: KASAN: global-out-of-bounds in zpci_fmb_enable_device\nwhen using the identity domain for a device on s390."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:31:02.521Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/17a58caf3863163c4a84a218a9649be2c8061443"
},
{
"url": "https://git.kernel.org/stable/c/b3506e9bcc777ed6af2ab631c86a9990ed97b474"
}
],
"title": "iommu/s390: Fix memory corruption when using identity domain",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39939",
"datePublished": "2025-10-04T07:31:02.521Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:31:02.521Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53589 (GCVE-0-2023-53589)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
wifi: iwlwifi: mvm: don't trust firmware n_channels
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: don't trust firmware n_channels
If the firmware sends us a corrupted MCC response with
n_channels much larger than the command response can be,
we might copy far too much (uninitialized) memory and
even crash if the n_channels is large enough to make it
run out of the one page allocated for the FW response.
Fix that by checking the lengths. Doing a < comparison
would be sufficient, but the firmware should be doing
it correctly, so check more strictly.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < e519a404a5bbba37693cb10fa61794a5fce4fd9b
(git)
Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < d0d39bed9e95f27a246be91c5929254ac043ed30 (git) Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < 05ad5a4d421ce65652fcb24d46b7e273130240d6 (git) Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < 557ba100d8cf3661ff8d71c0b4a2cba8db555ec2 (git) Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < c176f03350954b795322de0bfe1d7b514db41f45 (git) Affected: dcaf9f5ecb6f395152609bdc40660d9b593dca63 , < 682b6dc29d98e857e6ca4bbc077c7dc2899b7473 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/nvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e519a404a5bbba37693cb10fa61794a5fce4fd9b",
"status": "affected",
"version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
"versionType": "git"
},
{
"lessThan": "d0d39bed9e95f27a246be91c5929254ac043ed30",
"status": "affected",
"version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
"versionType": "git"
},
{
"lessThan": "05ad5a4d421ce65652fcb24d46b7e273130240d6",
"status": "affected",
"version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
"versionType": "git"
},
{
"lessThan": "557ba100d8cf3661ff8d71c0b4a2cba8db555ec2",
"status": "affected",
"version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
"versionType": "git"
},
{
"lessThan": "c176f03350954b795322de0bfe1d7b514db41f45",
"status": "affected",
"version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
"versionType": "git"
},
{
"lessThan": "682b6dc29d98e857e6ca4bbc077c7dc2899b7473",
"status": "affected",
"version": "dcaf9f5ecb6f395152609bdc40660d9b593dca63",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/nvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.1"
},
{
"lessThan": "4.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.244",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.181",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.244",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.181",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.113",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.30",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "4.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "4.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: don\u0027t trust firmware n_channels\n\nIf the firmware sends us a corrupted MCC response with\nn_channels much larger than the command response can be,\nwe might copy far too much (uninitialized) memory and\neven crash if the n_channels is large enough to make it\nrun out of the one page allocated for the FW response.\n\nFix that by checking the lengths. Doing a \u003c comparison\nwould be sufficient, but the firmware should be doing\nit correctly, so check more strictly."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:04.047Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e519a404a5bbba37693cb10fa61794a5fce4fd9b"
},
{
"url": "https://git.kernel.org/stable/c/d0d39bed9e95f27a246be91c5929254ac043ed30"
},
{
"url": "https://git.kernel.org/stable/c/05ad5a4d421ce65652fcb24d46b7e273130240d6"
},
{
"url": "https://git.kernel.org/stable/c/557ba100d8cf3661ff8d71c0b4a2cba8db555ec2"
},
{
"url": "https://git.kernel.org/stable/c/c176f03350954b795322de0bfe1d7b514db41f45"
},
{
"url": "https://git.kernel.org/stable/c/682b6dc29d98e857e6ca4bbc077c7dc2899b7473"
}
],
"title": "wifi: iwlwifi: mvm: don\u0027t trust firmware n_channels",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53589",
"datePublished": "2025-10-04T15:44:04.047Z",
"dateReserved": "2025-10-04T15:40:38.478Z",
"dateUpdated": "2025-10-04T15:44:04.047Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53533 (GCVE-0-2023-53533)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
Summary
In the Linux kernel, the following vulnerability has been resolved:
Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
rpi_firmware_get() take reference, we need to release it in error paths
as well. Use devm_rpi_firmware_get() helper to handling the resources.
Also remove the existing rpi_firmware_put().
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
0b9f28fed3f70ff9a0380fe308739dd72a30a6f6 , < 1dfa3c9dd27bdc347733d06e980395768520bc3e
(git)
Affected: 0b9f28fed3f70ff9a0380fe308739dd72a30a6f6 , < 0d6a5c9489c8a3d434e685066119c4333476dccd (git) Affected: 0b9f28fed3f70ff9a0380fe308739dd72a30a6f6 , < 7acad58049acc6ac148e8b613a6eceeca4bcb4a7 (git) Affected: 0b9f28fed3f70ff9a0380fe308739dd72a30a6f6 , < 36d087e49dabd28d2c13a7532dac72d625ce69fb (git) Affected: 0b9f28fed3f70ff9a0380fe308739dd72a30a6f6 , < 9dbbe9db224c23a60dc7b1e00c701be93328c873 (git) Affected: 0b9f28fed3f70ff9a0380fe308739dd72a30a6f6 , < 9216aa5cfd86809a2681be3683cd9ac30432de0c (git) Affected: 0b9f28fed3f70ff9a0380fe308739dd72a30a6f6 , < 5bca3688bdbc3b58a2894b8671a8e2378efe28bd (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/raspberrypi-ts.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "1dfa3c9dd27bdc347733d06e980395768520bc3e",
"status": "affected",
"version": "0b9f28fed3f70ff9a0380fe308739dd72a30a6f6",
"versionType": "git"
},
{
"lessThan": "0d6a5c9489c8a3d434e685066119c4333476dccd",
"status": "affected",
"version": "0b9f28fed3f70ff9a0380fe308739dd72a30a6f6",
"versionType": "git"
},
{
"lessThan": "7acad58049acc6ac148e8b613a6eceeca4bcb4a7",
"status": "affected",
"version": "0b9f28fed3f70ff9a0380fe308739dd72a30a6f6",
"versionType": "git"
},
{
"lessThan": "36d087e49dabd28d2c13a7532dac72d625ce69fb",
"status": "affected",
"version": "0b9f28fed3f70ff9a0380fe308739dd72a30a6f6",
"versionType": "git"
},
{
"lessThan": "9dbbe9db224c23a60dc7b1e00c701be93328c873",
"status": "affected",
"version": "0b9f28fed3f70ff9a0380fe308739dd72a30a6f6",
"versionType": "git"
},
{
"lessThan": "9216aa5cfd86809a2681be3683cd9ac30432de0c",
"status": "affected",
"version": "0b9f28fed3f70ff9a0380fe308739dd72a30a6f6",
"versionType": "git"
},
{
"lessThan": "5bca3688bdbc3b58a2894b8671a8e2378efe28bd",
"status": "affected",
"version": "0b9f28fed3f70ff9a0380fe308739dd72a30a6f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/input/touchscreen/raspberrypi-ts.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.243",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.243",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nInput: raspberrypi-ts - fix refcount leak in rpi_ts_probe\n\nrpi_firmware_get() take reference, we need to release it in error paths\nas well. Use devm_rpi_firmware_get() helper to handling the resources.\nAlso remove the existing rpi_firmware_put()."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:45.207Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/1dfa3c9dd27bdc347733d06e980395768520bc3e"
},
{
"url": "https://git.kernel.org/stable/c/0d6a5c9489c8a3d434e685066119c4333476dccd"
},
{
"url": "https://git.kernel.org/stable/c/7acad58049acc6ac148e8b613a6eceeca4bcb4a7"
},
{
"url": "https://git.kernel.org/stable/c/36d087e49dabd28d2c13a7532dac72d625ce69fb"
},
{
"url": "https://git.kernel.org/stable/c/9dbbe9db224c23a60dc7b1e00c701be93328c873"
},
{
"url": "https://git.kernel.org/stable/c/9216aa5cfd86809a2681be3683cd9ac30432de0c"
},
{
"url": "https://git.kernel.org/stable/c/5bca3688bdbc3b58a2894b8671a8e2378efe28bd"
}
],
"title": "Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53533",
"datePublished": "2025-10-04T15:16:45.207Z",
"dateReserved": "2025-10-04T15:14:15.918Z",
"dateUpdated": "2025-10-04T15:16:45.207Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39938 (GCVE-0-2025-39938)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:31
VLAI?
EPSS
Title
ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
Summary
In the Linux kernel, the following vulnerability has been resolved:
ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed
If earlier opening of source graph fails (e.g. ADSP rejects due to
incorrect audioreach topology), the graph is closed and
"dai_data->graph[dai->id]" is assigned NULL. Preparing the DAI for sink
graph continues though and next call to q6apm_lpass_dai_prepare()
receives dai_data->graph[dai->id]=NULL leading to NULL pointer
exception:
qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd
qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1
q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: fail to start APM port 78
q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: ASoC: error at snd_soc_pcm_dai_prepare on TX_CODEC_DMA_TX_3: -22
Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8
...
Call trace:
q6apm_graph_media_format_pcm+0x48/0x120 (P)
q6apm_lpass_dai_prepare+0x110/0x1b4
snd_soc_pcm_dai_prepare+0x74/0x108
__soc_pcm_prepare+0x44/0x160
dpcm_be_dai_prepare+0x124/0x1c0
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
30ad723b93ade607a678698e5947a55a4375c3a1 , < 01d1ba106c9e02a2e7d41e07be49031a0ff0ecaa
(git)
Affected: 30ad723b93ade607a678698e5947a55a4375c3a1 , < 411f7d4f7038200cdf6d4f71ee31026ebf2dfedb (git) Affected: 30ad723b93ade607a678698e5947a55a4375c3a1 , < 9c534dbfd1726502abcf0bd393a04214f62c050b (git) Affected: 30ad723b93ade607a678698e5947a55a4375c3a1 , < cc336b242ea7e7a09b3ab9f885341455ca0a3bdb (git) Affected: 30ad723b93ade607a678698e5947a55a4375c3a1 , < 68f27f7c7708183e7873c585ded2f1b057ac5b97 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm-lpass-dais.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "01d1ba106c9e02a2e7d41e07be49031a0ff0ecaa",
"status": "affected",
"version": "30ad723b93ade607a678698e5947a55a4375c3a1",
"versionType": "git"
},
{
"lessThan": "411f7d4f7038200cdf6d4f71ee31026ebf2dfedb",
"status": "affected",
"version": "30ad723b93ade607a678698e5947a55a4375c3a1",
"versionType": "git"
},
{
"lessThan": "9c534dbfd1726502abcf0bd393a04214f62c050b",
"status": "affected",
"version": "30ad723b93ade607a678698e5947a55a4375c3a1",
"versionType": "git"
},
{
"lessThan": "cc336b242ea7e7a09b3ab9f885341455ca0a3bdb",
"status": "affected",
"version": "30ad723b93ade607a678698e5947a55a4375c3a1",
"versionType": "git"
},
{
"lessThan": "68f27f7c7708183e7873c585ded2f1b057ac5b97",
"status": "affected",
"version": "30ad723b93ade607a678698e5947a55a4375c3a1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/soc/qcom/qdsp6/q6apm-lpass-dais.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed\n\nIf earlier opening of source graph fails (e.g. ADSP rejects due to\nincorrect audioreach topology), the graph is closed and\n\"dai_data-\u003egraph[dai-\u003eid]\" is assigned NULL. Preparing the DAI for sink\ngraph continues though and next call to q6apm_lpass_dai_prepare()\nreceives dai_data-\u003egraph[dai-\u003eid]=NULL leading to NULL pointer\nexception:\n\n qcom-apm gprsvc:service:2:1: Error (1) Processing 0x01001002 cmd\n qcom-apm gprsvc:service:2:1: DSP returned error[1001002] 1\n q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: fail to start APM port 78\n q6apm-lpass-dais 30000000.remoteproc:glink-edge:gpr:service@1:bedais: ASoC: error at snd_soc_pcm_dai_prepare on TX_CODEC_DMA_TX_3: -22\n Unable to handle kernel NULL pointer dereference at virtual address 00000000000000a8\n ...\n Call trace:\n q6apm_graph_media_format_pcm+0x48/0x120 (P)\n q6apm_lpass_dai_prepare+0x110/0x1b4\n snd_soc_pcm_dai_prepare+0x74/0x108\n __soc_pcm_prepare+0x44/0x160\n dpcm_be_dai_prepare+0x124/0x1c0"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:31:01.736Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/01d1ba106c9e02a2e7d41e07be49031a0ff0ecaa"
},
{
"url": "https://git.kernel.org/stable/c/411f7d4f7038200cdf6d4f71ee31026ebf2dfedb"
},
{
"url": "https://git.kernel.org/stable/c/9c534dbfd1726502abcf0bd393a04214f62c050b"
},
{
"url": "https://git.kernel.org/stable/c/cc336b242ea7e7a09b3ab9f885341455ca0a3bdb"
},
{
"url": "https://git.kernel.org/stable/c/68f27f7c7708183e7873c585ded2f1b057ac5b97"
}
],
"title": "ASoC: qcom: q6apm-lpass-dais: Fix NULL pointer dereference if source graph failed",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39938",
"datePublished": "2025-10-04T07:31:01.736Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:31:01.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53538 (GCVE-0-2023-53538)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
btrfs: insert tree mod log move in push_node_left
Summary
In the Linux kernel, the following vulnerability has been resolved:
btrfs: insert tree mod log move in push_node_left
There is a fairly unlikely race condition in tree mod log rewind that
can result in a kernel panic which has the following trace:
[530.569] BTRFS critical (device sda3): unable to find logical 0 length 4096
[530.585] BTRFS critical (device sda3): unable to find logical 0 length 4096
[530.602] BUG: kernel NULL pointer dereference, address: 0000000000000002
[530.618] #PF: supervisor read access in kernel mode
[530.629] #PF: error_code(0x0000) - not-present page
[530.641] PGD 0 P4D 0
[530.647] Oops: 0000 [#1] SMP
[530.654] CPU: 30 PID: 398973 Comm: below Kdump: loaded Tainted: G S O K 5.12.0-0_fbk13_clang_7455_gb24de3bdb045 #1
[530.680] Hardware name: Quanta Mono Lake-M.2 SATA 1HY9U9Z001G/Mono Lake-M.2 SATA, BIOS F20_3A15 08/16/2017
[530.703] RIP: 0010:__btrfs_map_block+0xaa/0xd00
[530.755] RSP: 0018:ffffc9002c2f7600 EFLAGS: 00010246
[530.767] RAX: ffffffffffffffea RBX: ffff888292e41000 RCX: f2702d8b8be15100
[530.784] RDX: ffff88885fda6fb8 RSI: ffff88885fd973c8 RDI: ffff88885fd973c8
[530.800] RBP: ffff888292e410d0 R08: ffffffff82fd7fd0 R09: 00000000fffeffff
[530.816] R10: ffffffff82e57fd0 R11: ffffffff82e57d70 R12: 0000000000000000
[530.832] R13: 0000000000001000 R14: 0000000000001000 R15: ffffc9002c2f76f0
[530.848] FS: 00007f38d64af000(0000) GS:ffff88885fd80000(0000) knlGS:0000000000000000
[530.866] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[530.880] CR2: 0000000000000002 CR3: 00000002b6770004 CR4: 00000000003706e0
[530.896] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[530.912] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[530.928] Call Trace:
[530.934] ? btrfs_printk+0x13b/0x18c
[530.943] ? btrfs_bio_counter_inc_blocked+0x3d/0x130
[530.955] btrfs_map_bio+0x75/0x330
[530.963] ? kmem_cache_alloc+0x12a/0x2d0
[530.973] ? btrfs_submit_metadata_bio+0x63/0x100
[530.984] btrfs_submit_metadata_bio+0xa4/0x100
[530.995] submit_extent_page+0x30f/0x360
[531.004] read_extent_buffer_pages+0x49e/0x6d0
[531.015] ? submit_extent_page+0x360/0x360
[531.025] btree_read_extent_buffer_pages+0x5f/0x150
[531.037] read_tree_block+0x37/0x60
[531.046] read_block_for_search+0x18b/0x410
[531.056] btrfs_search_old_slot+0x198/0x2f0
[531.066] resolve_indirect_ref+0xfe/0x6f0
[531.076] ? ulist_alloc+0x31/0x60
[531.084] ? kmem_cache_alloc_trace+0x12e/0x2b0
[531.095] find_parent_nodes+0x720/0x1830
[531.105] ? ulist_alloc+0x10/0x60
[531.113] iterate_extent_inodes+0xea/0x370
[531.123] ? btrfs_previous_extent_item+0x8f/0x110
[531.134] ? btrfs_search_path_in_tree+0x240/0x240
[531.146] iterate_inodes_from_logical+0x98/0xd0
[531.157] ? btrfs_search_path_in_tree+0x240/0x240
[531.168] btrfs_ioctl_logical_to_ino+0xd9/0x180
[531.179] btrfs_ioctl+0xe2/0x2eb0
This occurs when logical inode resolution takes a tree mod log sequence
number, and then while backref walking hits a rewind on a busy node
which has the following sequence of tree mod log operations (numbers
filled in from a specific example, but they are somewhat arbitrary)
REMOVE_WHILE_FREEING slot 532
REMOVE_WHILE_FREEING slot 531
REMOVE_WHILE_FREEING slot 530
...
REMOVE_WHILE_FREEING slot 0
REMOVE slot 455
REMOVE slot 454
REMOVE slot 453
...
REMOVE slot 0
ADD slot 455
ADD slot 454
ADD slot 453
...
ADD slot 0
MOVE src slot 0 -> dst slot 456 nritems 533
REMOVE slot 455
REMOVE slot 454
REMOVE slot 453
...
REMOVE slot 0
When this sequence gets applied via btrfs_tree_mod_log_rewind, it
allocates a fresh rewind eb, and first inserts the correct key info for
the 533 elements, then overwrites the first 456 of them, then decrements
the count by 456 via the add ops, then rewinds the move by doing a
memmove from 456:988->0:532. We have never written anything past 532,
---truncated---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/btrfs/ctree.c",
"fs/btrfs/tree-mod-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "11f14402fe3437852cb44945b3b9f1bdb4032956",
"status": "affected",
"version": "57911b8ba814fae01306376a0d02bc7cdc88dc94",
"versionType": "git"
},
{
"lessThan": "5cead5422a0e3d13b0bcee986c0f5c4ebb94100b",
"status": "affected",
"version": "57911b8ba814fae01306376a0d02bc7cdc88dc94",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/btrfs/ctree.c",
"fs/btrfs/tree-mod-log.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.4",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: insert tree mod log move in push_node_left\n\nThere is a fairly unlikely race condition in tree mod log rewind that\ncan result in a kernel panic which has the following trace:\n\n [530.569] BTRFS critical (device sda3): unable to find logical 0 length 4096\n [530.585] BTRFS critical (device sda3): unable to find logical 0 length 4096\n [530.602] BUG: kernel NULL pointer dereference, address: 0000000000000002\n [530.618] #PF: supervisor read access in kernel mode\n [530.629] #PF: error_code(0x0000) - not-present page\n [530.641] PGD 0 P4D 0\n [530.647] Oops: 0000 [#1] SMP\n [530.654] CPU: 30 PID: 398973 Comm: below Kdump: loaded Tainted: G S O K 5.12.0-0_fbk13_clang_7455_gb24de3bdb045 #1\n [530.680] Hardware name: Quanta Mono Lake-M.2 SATA 1HY9U9Z001G/Mono Lake-M.2 SATA, BIOS F20_3A15 08/16/2017\n [530.703] RIP: 0010:__btrfs_map_block+0xaa/0xd00\n [530.755] RSP: 0018:ffffc9002c2f7600 EFLAGS: 00010246\n [530.767] RAX: ffffffffffffffea RBX: ffff888292e41000 RCX: f2702d8b8be15100\n [530.784] RDX: ffff88885fda6fb8 RSI: ffff88885fd973c8 RDI: ffff88885fd973c8\n [530.800] RBP: ffff888292e410d0 R08: ffffffff82fd7fd0 R09: 00000000fffeffff\n [530.816] R10: ffffffff82e57fd0 R11: ffffffff82e57d70 R12: 0000000000000000\n [530.832] R13: 0000000000001000 R14: 0000000000001000 R15: ffffc9002c2f76f0\n [530.848] FS: 00007f38d64af000(0000) GS:ffff88885fd80000(0000) knlGS:0000000000000000\n [530.866] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n [530.880] CR2: 0000000000000002 CR3: 00000002b6770004 CR4: 00000000003706e0\n [530.896] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n [530.912] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n [530.928] Call Trace:\n [530.934] ? btrfs_printk+0x13b/0x18c\n [530.943] ? btrfs_bio_counter_inc_blocked+0x3d/0x130\n [530.955] btrfs_map_bio+0x75/0x330\n [530.963] ? kmem_cache_alloc+0x12a/0x2d0\n [530.973] ? btrfs_submit_metadata_bio+0x63/0x100\n [530.984] btrfs_submit_metadata_bio+0xa4/0x100\n [530.995] submit_extent_page+0x30f/0x360\n [531.004] read_extent_buffer_pages+0x49e/0x6d0\n [531.015] ? submit_extent_page+0x360/0x360\n [531.025] btree_read_extent_buffer_pages+0x5f/0x150\n [531.037] read_tree_block+0x37/0x60\n [531.046] read_block_for_search+0x18b/0x410\n [531.056] btrfs_search_old_slot+0x198/0x2f0\n [531.066] resolve_indirect_ref+0xfe/0x6f0\n [531.076] ? ulist_alloc+0x31/0x60\n [531.084] ? kmem_cache_alloc_trace+0x12e/0x2b0\n [531.095] find_parent_nodes+0x720/0x1830\n [531.105] ? ulist_alloc+0x10/0x60\n [531.113] iterate_extent_inodes+0xea/0x370\n [531.123] ? btrfs_previous_extent_item+0x8f/0x110\n [531.134] ? btrfs_search_path_in_tree+0x240/0x240\n [531.146] iterate_inodes_from_logical+0x98/0xd0\n [531.157] ? btrfs_search_path_in_tree+0x240/0x240\n [531.168] btrfs_ioctl_logical_to_ino+0xd9/0x180\n [531.179] btrfs_ioctl+0xe2/0x2eb0\n\nThis occurs when logical inode resolution takes a tree mod log sequence\nnumber, and then while backref walking hits a rewind on a busy node\nwhich has the following sequence of tree mod log operations (numbers\nfilled in from a specific example, but they are somewhat arbitrary)\n\n REMOVE_WHILE_FREEING slot 532\n REMOVE_WHILE_FREEING slot 531\n REMOVE_WHILE_FREEING slot 530\n ...\n REMOVE_WHILE_FREEING slot 0\n REMOVE slot 455\n REMOVE slot 454\n REMOVE slot 453\n ...\n REMOVE slot 0\n ADD slot 455\n ADD slot 454\n ADD slot 453\n ...\n ADD slot 0\n MOVE src slot 0 -\u003e dst slot 456 nritems 533\n REMOVE slot 455\n REMOVE slot 454\n REMOVE slot 453\n ...\n REMOVE slot 0\n\nWhen this sequence gets applied via btrfs_tree_mod_log_rewind, it\nallocates a fresh rewind eb, and first inserts the correct key info for\nthe 533 elements, then overwrites the first 456 of them, then decrements\nthe count by 456 via the add ops, then rewinds the move by doing a\nmemmove from 456:988-\u003e0:532. We have never written anything past 532,\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:14.006Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/11f14402fe3437852cb44945b3b9f1bdb4032956"
},
{
"url": "https://git.kernel.org/stable/c/5cead5422a0e3d13b0bcee986c0f5c4ebb94100b"
}
],
"title": "btrfs: insert tree mod log move in push_node_left",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53538",
"datePublished": "2025-10-04T15:16:48.694Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2026-01-05T10:21:14.006Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53546 (GCVE-0-2023-53546)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
when mlx5_cmd_exec failed in mlx5dr_cmd_create_reformat_ctx, the memory
pointed by 'in' is not released, which will cause memory leak. Move memory
release after mlx5_cmd_exec.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1d9186476e12c85dc81a0f01f5c614a9683af7f2 , < 800d8c96bf997da5eb76ccf8d88795c4231c83fb
(git)
Affected: 1d9186476e12c85dc81a0f01f5c614a9683af7f2 , < 165159854757dbae0dfd1812b27051da35aa6223 (git) Affected: 1d9186476e12c85dc81a0f01f5c614a9683af7f2 , < 00cecb0a8f9e7a21754d5ad85813ab6b47b3308f (git) Affected: 1d9186476e12c85dc81a0f01f5c614a9683af7f2 , < 3169c3854397f3070a63b1b772db16dcb8cba7b4 (git) Affected: 1d9186476e12c85dc81a0f01f5c614a9683af7f2 , < 622d71d99124e69f7bf2e2b7a89f5f444a24d235 (git) Affected: 1d9186476e12c85dc81a0f01f5c614a9683af7f2 , < 5dd77585dd9d0e03dd1bceb95f0269a7eaf6b936 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "800d8c96bf997da5eb76ccf8d88795c4231c83fb",
"status": "affected",
"version": "1d9186476e12c85dc81a0f01f5c614a9683af7f2",
"versionType": "git"
},
{
"lessThan": "165159854757dbae0dfd1812b27051da35aa6223",
"status": "affected",
"version": "1d9186476e12c85dc81a0f01f5c614a9683af7f2",
"versionType": "git"
},
{
"lessThan": "00cecb0a8f9e7a21754d5ad85813ab6b47b3308f",
"status": "affected",
"version": "1d9186476e12c85dc81a0f01f5c614a9683af7f2",
"versionType": "git"
},
{
"lessThan": "3169c3854397f3070a63b1b772db16dcb8cba7b4",
"status": "affected",
"version": "1d9186476e12c85dc81a0f01f5c614a9683af7f2",
"versionType": "git"
},
{
"lessThan": "622d71d99124e69f7bf2e2b7a89f5f444a24d235",
"status": "affected",
"version": "1d9186476e12c85dc81a0f01f5c614a9683af7f2",
"versionType": "git"
},
{
"lessThan": "5dd77585dd9d0e03dd1bceb95f0269a7eaf6b936",
"status": "affected",
"version": "1d9186476e12c85dc81a0f01f5c614a9683af7f2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.253",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.190",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.126",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.253",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.190",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.126",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.45",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.10",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx\n\nwhen mlx5_cmd_exec failed in mlx5dr_cmd_create_reformat_ctx, the memory\npointed by \u0027in\u0027 is not released, which will cause memory leak. Move memory\nrelease after mlx5_cmd_exec."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:54.132Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/800d8c96bf997da5eb76ccf8d88795c4231c83fb"
},
{
"url": "https://git.kernel.org/stable/c/165159854757dbae0dfd1812b27051da35aa6223"
},
{
"url": "https://git.kernel.org/stable/c/00cecb0a8f9e7a21754d5ad85813ab6b47b3308f"
},
{
"url": "https://git.kernel.org/stable/c/3169c3854397f3070a63b1b772db16dcb8cba7b4"
},
{
"url": "https://git.kernel.org/stable/c/622d71d99124e69f7bf2e2b7a89f5f444a24d235"
},
{
"url": "https://git.kernel.org/stable/c/5dd77585dd9d0e03dd1bceb95f0269a7eaf6b936"
}
],
"title": "net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53546",
"datePublished": "2025-10-04T15:16:54.132Z",
"dateReserved": "2025-10-04T15:14:15.921Z",
"dateUpdated": "2025-10-04T15:16:54.132Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39941 (GCVE-0-2025-39941)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:31
VLAI?
EPSS
Title
zram: fix slot write race condition
Summary
In the Linux kernel, the following vulnerability has been resolved:
zram: fix slot write race condition
Parallel concurrent writes to the same zram index result in leaked
zsmalloc handles. Schematically we can have something like this:
CPU0 CPU1
zram_slot_lock()
zs_free(handle)
zram_slot_lock()
zram_slot_lock()
zs_free(handle)
zram_slot_lock()
compress compress
handle = zs_malloc() handle = zs_malloc()
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock
zram_slot_lock
zram_set_handle(handle)
zram_slot_lock
Either CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done
too early. In fact, we need to reset zram entry right before we set its
new handle, all under the same slot lock scope.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/zram/zram_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff750e9f2c4d63854c33967d1646b5e89a9a19a2",
"status": "affected",
"version": "71268035f5d734ad6373d953298bd5779985497a",
"versionType": "git"
},
{
"lessThan": "ce4be9e4307c5a60701ff6e0cafa74caffdc54ce",
"status": "affected",
"version": "71268035f5d734ad6373d953298bd5779985497a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/zram/zram_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nzram: fix slot write race condition\n\nParallel concurrent writes to the same zram index result in leaked\nzsmalloc handles. Schematically we can have something like this:\n\nCPU0 CPU1\nzram_slot_lock()\nzs_free(handle)\nzram_slot_lock()\n\t\t\t\tzram_slot_lock()\n\t\t\t\tzs_free(handle)\n\t\t\t\tzram_slot_lock()\n\ncompress\t\t\tcompress\nhandle = zs_malloc()\t\thandle = zs_malloc()\nzram_slot_lock\nzram_set_handle(handle)\nzram_slot_lock\n\t\t\t\tzram_slot_lock\n\t\t\t\tzram_set_handle(handle)\n\t\t\t\tzram_slot_lock\n\nEither CPU0 or CPU1 zsmalloc handle will leak because zs_free() is done\ntoo early. In fact, we need to reset zram entry right before we set its\nnew handle, all under the same slot lock scope."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:31:04.080Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff750e9f2c4d63854c33967d1646b5e89a9a19a2"
},
{
"url": "https://git.kernel.org/stable/c/ce4be9e4307c5a60701ff6e0cafa74caffdc54ce"
}
],
"title": "zram: fix slot write race condition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39941",
"datePublished": "2025-10-04T07:31:04.080Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:31:04.080Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53544 (GCVE-0-2023-53544)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
cpufreq: davinci: Fix clk use after free
Summary
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: davinci: Fix clk use after free
The remove function first frees the clks and only then calls
cpufreq_unregister_driver(). If one of the cpufreq callbacks is called
just before cpufreq_unregister_driver() is run, the freed clks might be
used.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
6601b8030de3e9c29930684eeac15302a59f991a , < 66b3bbe6fbd8dd410868e5b53ac3944a934b9310
(git)
Affected: 6601b8030de3e9c29930684eeac15302a59f991a , < a5f024d0e6f91e05c816ad4ee8837173369dd5cb (git) Affected: 6601b8030de3e9c29930684eeac15302a59f991a , < ab05ae4ab831f64bbc427592c86f599ed9c4324f (git) Affected: 6601b8030de3e9c29930684eeac15302a59f991a , < 5d8f384a9b4fc50f6a18405f1c08e5a87a77b5b3 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/davinci-cpufreq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "66b3bbe6fbd8dd410868e5b53ac3944a934b9310",
"status": "affected",
"version": "6601b8030de3e9c29930684eeac15302a59f991a",
"versionType": "git"
},
{
"lessThan": "a5f024d0e6f91e05c816ad4ee8837173369dd5cb",
"status": "affected",
"version": "6601b8030de3e9c29930684eeac15302a59f991a",
"versionType": "git"
},
{
"lessThan": "ab05ae4ab831f64bbc427592c86f599ed9c4324f",
"status": "affected",
"version": "6601b8030de3e9c29930684eeac15302a59f991a",
"versionType": "git"
},
{
"lessThan": "5d8f384a9b4fc50f6a18405f1c08e5a87a77b5b3",
"status": "affected",
"version": "6601b8030de3e9c29930684eeac15302a59f991a",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/davinci-cpufreq.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.33"
},
{
"lessThan": "2.6.33",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.308",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.308",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "2.6.33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "2.6.33",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: davinci: Fix clk use after free\n\nThe remove function first frees the clks and only then calls\ncpufreq_unregister_driver(). If one of the cpufreq callbacks is called\njust before cpufreq_unregister_driver() is run, the freed clks might be\nused."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:52.791Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/66b3bbe6fbd8dd410868e5b53ac3944a934b9310"
},
{
"url": "https://git.kernel.org/stable/c/a5f024d0e6f91e05c816ad4ee8837173369dd5cb"
},
{
"url": "https://git.kernel.org/stable/c/ab05ae4ab831f64bbc427592c86f599ed9c4324f"
},
{
"url": "https://git.kernel.org/stable/c/5d8f384a9b4fc50f6a18405f1c08e5a87a77b5b3"
}
],
"title": "cpufreq: davinci: Fix clk use after free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53544",
"datePublished": "2025-10-04T15:16:52.791Z",
"dateReserved": "2025-10-04T15:14:15.920Z",
"dateUpdated": "2025-10-04T15:16:52.791Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53597 (GCVE-0-2023-53597)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
cifs: fix mid leak during reconnection after timeout threshold
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: fix mid leak during reconnection after timeout threshold
When the number of responses with status of STATUS_IO_TIMEOUT
exceeds a specified threshold (NUM_STATUS_IO_TIMEOUT), we reconnect
the connection. But we do not return the mid, or the credits
returned for the mid, or reduce the number of in-flight requests.
This bug could result in the server->in_flight count to go bad,
and also cause a leak in the mids.
This change moves the check to a few lines below where the
response is decrypted, even of the response is read from the
transform header. This way, the code for returning the mids
can be reused.
Also, the cifs_reconnect was reconnecting just the transport
connection before. In case of multi-channel, this may not be
what we want to do after several timeouts. Changed that to
reconnect the session and the tree too.
Also renamed NUM_STATUS_IO_TIMEOUT to a more appropriate name
MAX_STATUS_IO_TIMEOUT.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
8e670f77c4a55013db6d23b962f9bf6673a5e7b6 , < df31d05f0678cdd0796ea19983a2b93edca18bb0
(git)
Affected: 8e670f77c4a55013db6d23b962f9bf6673a5e7b6 , < c55901d381a22300c9922170e59704059f50977b (git) Affected: 8e670f77c4a55013db6d23b962f9bf6673a5e7b6 , < 57d25e9905c71133e201f6d06b56a3403d4ad433 (git) Affected: 8e670f77c4a55013db6d23b962f9bf6673a5e7b6 , < 69cba9d3c1284e0838ae408830a02c4a063104bc (git) Affected: fa6d7a5853f93efb088aba36af12cb1944156411 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "df31d05f0678cdd0796ea19983a2b93edca18bb0",
"status": "affected",
"version": "8e670f77c4a55013db6d23b962f9bf6673a5e7b6",
"versionType": "git"
},
{
"lessThan": "c55901d381a22300c9922170e59704059f50977b",
"status": "affected",
"version": "8e670f77c4a55013db6d23b962f9bf6673a5e7b6",
"versionType": "git"
},
{
"lessThan": "57d25e9905c71133e201f6d06b56a3403d4ad433",
"status": "affected",
"version": "8e670f77c4a55013db6d23b962f9bf6673a5e7b6",
"versionType": "git"
},
{
"lessThan": "69cba9d3c1284e0838ae408830a02c4a063104bc",
"status": "affected",
"version": "8e670f77c4a55013db6d23b962f9bf6673a5e7b6",
"versionType": "git"
},
{
"status": "affected",
"version": "fa6d7a5853f93efb088aba36af12cb1944156411",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/connect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.150",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.42",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.7",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.9.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: fix mid leak during reconnection after timeout threshold\n\nWhen the number of responses with status of STATUS_IO_TIMEOUT\nexceeds a specified threshold (NUM_STATUS_IO_TIMEOUT), we reconnect\nthe connection. But we do not return the mid, or the credits\nreturned for the mid, or reduce the number of in-flight requests.\n\nThis bug could result in the server-\u003ein_flight count to go bad,\nand also cause a leak in the mids.\n\nThis change moves the check to a few lines below where the\nresponse is decrypted, even of the response is read from the\ntransform header. This way, the code for returning the mids\ncan be reused.\n\nAlso, the cifs_reconnect was reconnecting just the transport\nconnection before. In case of multi-channel, this may not be\nwhat we want to do after several timeouts. Changed that to\nreconnect the session and the tree too.\n\nAlso renamed NUM_STATUS_IO_TIMEOUT to a more appropriate name\nMAX_STATUS_IO_TIMEOUT."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:09.616Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/df31d05f0678cdd0796ea19983a2b93edca18bb0"
},
{
"url": "https://git.kernel.org/stable/c/c55901d381a22300c9922170e59704059f50977b"
},
{
"url": "https://git.kernel.org/stable/c/57d25e9905c71133e201f6d06b56a3403d4ad433"
},
{
"url": "https://git.kernel.org/stable/c/69cba9d3c1284e0838ae408830a02c4a063104bc"
}
],
"title": "cifs: fix mid leak during reconnection after timeout threshold",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53597",
"datePublished": "2025-10-04T15:44:09.616Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-04T15:44:09.616Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39934 (GCVE-0-2025-39934)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2025-10-04 07:37
VLAI?
EPSS
Title
drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ
If the interrupt occurs before resource initialization is complete, the
interrupt handler/worker may access uninitialized data such as the I2C
tcpc_client device, potentially leading to NULL pointer dereference.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730 , < 51a501e990a353a4f15da6bab295b28e5d118f64
(git)
Affected: 8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730 , < f9a089d0a6d537d0f2061c8a37a7de535ce0310e (git) Affected: 8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730 , < 15a77e1ab0a994d69b471c76b8d01117128dda26 (git) Affected: 8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730 , < 0da73f7827691a5e2265b110d5fe12f29535ec92 (git) Affected: 8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730 , < 1a7ea294d57fb61485d11b3f2241d631d73025cb (git) Affected: 8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730 , < a10f910c77f280327b481e77eab909934ec508f0 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/bridge/analogix/anx7625.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "51a501e990a353a4f15da6bab295b28e5d118f64",
"status": "affected",
"version": "8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730",
"versionType": "git"
},
{
"lessThan": "f9a089d0a6d537d0f2061c8a37a7de535ce0310e",
"status": "affected",
"version": "8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730",
"versionType": "git"
},
{
"lessThan": "15a77e1ab0a994d69b471c76b8d01117128dda26",
"status": "affected",
"version": "8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730",
"versionType": "git"
},
{
"lessThan": "0da73f7827691a5e2265b110d5fe12f29535ec92",
"status": "affected",
"version": "8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730",
"versionType": "git"
},
{
"lessThan": "1a7ea294d57fb61485d11b3f2241d631d73025cb",
"status": "affected",
"version": "8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730",
"versionType": "git"
},
{
"lessThan": "a10f910c77f280327b481e77eab909934ec508f0",
"status": "affected",
"version": "8bdfc5dae4e3ba4d99dfb430ef43249e5f1b7730",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/bridge/analogix/anx7625.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.194",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: bridge: anx7625: Fix NULL pointer dereference with early IRQ\n\nIf the interrupt occurs before resource initialization is complete, the\ninterrupt handler/worker may access uninitialized data such as the I2C\ntcpc_client device, potentially leading to NULL pointer dereference."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:37:00.467Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/51a501e990a353a4f15da6bab295b28e5d118f64"
},
{
"url": "https://git.kernel.org/stable/c/f9a089d0a6d537d0f2061c8a37a7de535ce0310e"
},
{
"url": "https://git.kernel.org/stable/c/15a77e1ab0a994d69b471c76b8d01117128dda26"
},
{
"url": "https://git.kernel.org/stable/c/0da73f7827691a5e2265b110d5fe12f29535ec92"
},
{
"url": "https://git.kernel.org/stable/c/1a7ea294d57fb61485d11b3f2241d631d73025cb"
},
{
"url": "https://git.kernel.org/stable/c/a10f910c77f280327b481e77eab909934ec508f0"
}
],
"title": "drm: bridge: anx7625: Fix NULL pointer dereference with early IRQ",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39934",
"datePublished": "2025-10-04T07:30:58.284Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:37:00.467Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50496 (GCVE-0-2022-50496)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
dm cache: Fix UAF in destroy()
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm cache: Fix UAF in destroy()
Dm_cache also has the same UAF problem when dm_resume()
and dm_destroy() are concurrent.
Therefore, cancelling timer again in destroy().
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < 034cbc8d3b47a56acd89453c29632a9c117de09d
(git)
Affected: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < 993406104d2b28fe470126a062ad37a1e21e792e (git) Affected: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < 4d20032dd90664de09f2902a7ea49ae2f7771746 (git) Affected: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < 2f097dfac7579fd84ff98eb1d3acd41d53a485f3 (git) Affected: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < 2b17026685a270b2beaf1cdd9857fcedd3505c7e (git) Affected: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < d2a0b298ebf83ab6236f66788a3541e91ce75a70 (git) Affected: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < 6ac4f36910764cb510bafc4c3768544f86ca48ca (git) Affected: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < 6a3e412c2ab131c54945327a7676b006f000a209 (git) Affected: c6b4fcbad044e6fffcc75bba160e720eb8d67d17 , < 6a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "034cbc8d3b47a56acd89453c29632a9c117de09d",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
},
{
"lessThan": "993406104d2b28fe470126a062ad37a1e21e792e",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
},
{
"lessThan": "4d20032dd90664de09f2902a7ea49ae2f7771746",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
},
{
"lessThan": "2f097dfac7579fd84ff98eb1d3acd41d53a485f3",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
},
{
"lessThan": "2b17026685a270b2beaf1cdd9857fcedd3505c7e",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
},
{
"lessThan": "d2a0b298ebf83ab6236f66788a3541e91ce75a70",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
},
{
"lessThan": "6ac4f36910764cb510bafc4c3768544f86ca48ca",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
},
{
"lessThan": "6a3e412c2ab131c54945327a7676b006f000a209",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
},
{
"lessThan": "6a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa",
"status": "affected",
"version": "c6b4fcbad044e6fffcc75bba160e720eb8d67d17",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-cache-target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.87",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.18",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.4",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm cache: Fix UAF in destroy()\n\nDm_cache also has the same UAF problem when dm_resume()\nand dm_destroy() are concurrent.\n\nTherefore, cancelling timer again in destroy()."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:47.948Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/034cbc8d3b47a56acd89453c29632a9c117de09d"
},
{
"url": "https://git.kernel.org/stable/c/993406104d2b28fe470126a062ad37a1e21e792e"
},
{
"url": "https://git.kernel.org/stable/c/4d20032dd90664de09f2902a7ea49ae2f7771746"
},
{
"url": "https://git.kernel.org/stable/c/2f097dfac7579fd84ff98eb1d3acd41d53a485f3"
},
{
"url": "https://git.kernel.org/stable/c/2b17026685a270b2beaf1cdd9857fcedd3505c7e"
},
{
"url": "https://git.kernel.org/stable/c/d2a0b298ebf83ab6236f66788a3541e91ce75a70"
},
{
"url": "https://git.kernel.org/stable/c/6ac4f36910764cb510bafc4c3768544f86ca48ca"
},
{
"url": "https://git.kernel.org/stable/c/6a3e412c2ab131c54945327a7676b006f000a209"
},
{
"url": "https://git.kernel.org/stable/c/6a459d8edbdbe7b24db42a5a9f21e6aa9e00c2aa"
}
],
"title": "dm cache: Fix UAF in destroy()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50496",
"datePublished": "2025-10-04T15:43:47.948Z",
"dateReserved": "2025-10-04T15:39:19.464Z",
"dateUpdated": "2025-10-04T15:43:47.948Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39953 (GCVE-0-2025-39953)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:37
VLAI?
EPSS
Title
cgroup: split cgroup_destroy_wq into 3 workqueues
Summary
In the Linux kernel, the following vulnerability has been resolved:
cgroup: split cgroup_destroy_wq into 3 workqueues
A hung task can occur during [1] LTP cgroup testing when repeatedly
mounting/unmounting perf_event and net_prio controllers with
systemd.unified_cgroup_hierarchy=1. The hang manifests in
cgroup_lock_and_drain_offline() during root destruction.
Related case:
cgroup_fj_function_perf_event cgroup_fj_function.sh perf_event
cgroup_fj_function_net_prio cgroup_fj_function.sh net_prio
Call Trace:
cgroup_lock_and_drain_offline+0x14c/0x1e8
cgroup_destroy_root+0x3c/0x2c0
css_free_rwork_fn+0x248/0x338
process_one_work+0x16c/0x3b8
worker_thread+0x22c/0x3b0
kthread+0xec/0x100
ret_from_fork+0x10/0x20
Root Cause:
CPU0 CPU1
mount perf_event umount net_prio
cgroup1_get_tree cgroup_kill_sb
rebind_subsystems // root destruction enqueues
// cgroup_destroy_wq
// kill all perf_event css
// one perf_event css A is dying
// css A offline enqueues cgroup_destroy_wq
// root destruction will be executed first
css_free_rwork_fn
cgroup_destroy_root
cgroup_lock_and_drain_offline
// some perf descendants are dying
// cgroup_destroy_wq max_active = 1
// waiting for css A to die
Problem scenario:
1. CPU0 mounts perf_event (rebind_subsystems)
2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work
3. A dying perf_event CSS gets queued for offline after root destruction
4. Root destruction waits for offline completion, but offline work is
blocked behind root destruction in cgroup_destroy_wq (max_active=1)
Solution:
Split cgroup_destroy_wq into three dedicated workqueues:
cgroup_offline_wq – Handles CSS offline operations
cgroup_release_wq – Manages resource release
cgroup_free_wq – Performs final memory deallocation
This separation eliminates blocking in the CSS free path while waiting for
offline operations to complete.
[1] https://github.com/linux-test-project/ltp/blob/master/runtest/controllers
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
334c3679ec4b2b113c35ebe37d2018b112dd5013 , < cabadd7fd15f97090f752fd22dd7f876a0dc3dc4
(git)
Affected: 334c3679ec4b2b113c35ebe37d2018b112dd5013 , < a0c896bda7077aa5005473e2c5b3c27173313b4c (git) Affected: 334c3679ec4b2b113c35ebe37d2018b112dd5013 , < f2795d1b92506e3adf52a298f7181032a1525e04 (git) Affected: 334c3679ec4b2b113c35ebe37d2018b112dd5013 , < 993049c9b1355c78918344a6403427d53f9ee700 (git) Affected: 334c3679ec4b2b113c35ebe37d2018b112dd5013 , < 4a1e3ec28e8062cd9f339aa6a942df9c5bcb6811 (git) Affected: 334c3679ec4b2b113c35ebe37d2018b112dd5013 , < ded4d207a3209a834b6831ceec7f39b934c74802 (git) Affected: 334c3679ec4b2b113c35ebe37d2018b112dd5013 , < 05e0b03447cf215ec384210441b34b7a3b16e8b0 (git) Affected: 334c3679ec4b2b113c35ebe37d2018b112dd5013 , < 79f919a89c9d06816dbdbbd168fa41d27411a7f9 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "cabadd7fd15f97090f752fd22dd7f876a0dc3dc4",
"status": "affected",
"version": "334c3679ec4b2b113c35ebe37d2018b112dd5013",
"versionType": "git"
},
{
"lessThan": "a0c896bda7077aa5005473e2c5b3c27173313b4c",
"status": "affected",
"version": "334c3679ec4b2b113c35ebe37d2018b112dd5013",
"versionType": "git"
},
{
"lessThan": "f2795d1b92506e3adf52a298f7181032a1525e04",
"status": "affected",
"version": "334c3679ec4b2b113c35ebe37d2018b112dd5013",
"versionType": "git"
},
{
"lessThan": "993049c9b1355c78918344a6403427d53f9ee700",
"status": "affected",
"version": "334c3679ec4b2b113c35ebe37d2018b112dd5013",
"versionType": "git"
},
{
"lessThan": "4a1e3ec28e8062cd9f339aa6a942df9c5bcb6811",
"status": "affected",
"version": "334c3679ec4b2b113c35ebe37d2018b112dd5013",
"versionType": "git"
},
{
"lessThan": "ded4d207a3209a834b6831ceec7f39b934c74802",
"status": "affected",
"version": "334c3679ec4b2b113c35ebe37d2018b112dd5013",
"versionType": "git"
},
{
"lessThan": "05e0b03447cf215ec384210441b34b7a3b16e8b0",
"status": "affected",
"version": "334c3679ec4b2b113c35ebe37d2018b112dd5013",
"versionType": "git"
},
{
"lessThan": "79f919a89c9d06816dbdbbd168fa41d27411a7f9",
"status": "affected",
"version": "334c3679ec4b2b113c35ebe37d2018b112dd5013",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/cgroup/cgroup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.300",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.245",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.300",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.245",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.194",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncgroup: split cgroup_destroy_wq into 3 workqueues\n\nA hung task can occur during [1] LTP cgroup testing when repeatedly\nmounting/unmounting perf_event and net_prio controllers with\nsystemd.unified_cgroup_hierarchy=1. The hang manifests in\ncgroup_lock_and_drain_offline() during root destruction.\n\nRelated case:\ncgroup_fj_function_perf_event cgroup_fj_function.sh perf_event\ncgroup_fj_function_net_prio cgroup_fj_function.sh net_prio\n\nCall Trace:\n\tcgroup_lock_and_drain_offline+0x14c/0x1e8\n\tcgroup_destroy_root+0x3c/0x2c0\n\tcss_free_rwork_fn+0x248/0x338\n\tprocess_one_work+0x16c/0x3b8\n\tworker_thread+0x22c/0x3b0\n\tkthread+0xec/0x100\n\tret_from_fork+0x10/0x20\n\nRoot Cause:\n\nCPU0 CPU1\nmount perf_event umount net_prio\ncgroup1_get_tree cgroup_kill_sb\nrebind_subsystems // root destruction enqueues\n\t\t\t\t// cgroup_destroy_wq\n// kill all perf_event css\n // one perf_event css A is dying\n // css A offline enqueues cgroup_destroy_wq\n // root destruction will be executed first\n css_free_rwork_fn\n cgroup_destroy_root\n cgroup_lock_and_drain_offline\n // some perf descendants are dying\n // cgroup_destroy_wq max_active = 1\n // waiting for css A to die\n\nProblem scenario:\n1. CPU0 mounts perf_event (rebind_subsystems)\n2. CPU1 unmounts net_prio (cgroup_kill_sb), queuing root destruction work\n3. A dying perf_event CSS gets queued for offline after root destruction\n4. Root destruction waits for offline completion, but offline work is\n blocked behind root destruction in cgroup_destroy_wq (max_active=1)\n\nSolution:\nSplit cgroup_destroy_wq into three dedicated workqueues:\ncgroup_offline_wq \u2013 Handles CSS offline operations\ncgroup_release_wq \u2013 Manages resource release\ncgroup_free_wq \u2013 Performs final memory deallocation\n\nThis separation eliminates blocking in the CSS free path while waiting for\noffline operations to complete.\n\n[1] https://github.com/linux-test-project/ltp/blob/master/runtest/controllers"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:37:08.557Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/cabadd7fd15f97090f752fd22dd7f876a0dc3dc4"
},
{
"url": "https://git.kernel.org/stable/c/a0c896bda7077aa5005473e2c5b3c27173313b4c"
},
{
"url": "https://git.kernel.org/stable/c/f2795d1b92506e3adf52a298f7181032a1525e04"
},
{
"url": "https://git.kernel.org/stable/c/993049c9b1355c78918344a6403427d53f9ee700"
},
{
"url": "https://git.kernel.org/stable/c/4a1e3ec28e8062cd9f339aa6a942df9c5bcb6811"
},
{
"url": "https://git.kernel.org/stable/c/ded4d207a3209a834b6831ceec7f39b934c74802"
},
{
"url": "https://git.kernel.org/stable/c/05e0b03447cf215ec384210441b34b7a3b16e8b0"
},
{
"url": "https://git.kernel.org/stable/c/79f919a89c9d06816dbdbbd168fa41d27411a7f9"
}
],
"title": "cgroup: split cgroup_destroy_wq into 3 workqueues",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39953",
"datePublished": "2025-10-04T07:31:13.237Z",
"dateReserved": "2025-04-16T07:20:57.149Z",
"dateUpdated": "2025-10-04T07:37:08.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50487 (GCVE-0-2022-50487)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-10 15:34
VLAI?
EPSS
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2025-10-10T15:34:42.519Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50487",
"datePublished": "2025-10-04T15:16:44.462Z",
"dateRejected": "2025-10-10T15:34:42.519Z",
"dateReserved": "2025-10-04T15:13:33.468Z",
"dateUpdated": "2025-10-10T15:34:42.519Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53555 (GCVE-0-2023-53555)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
mm/damon/core: initialize damo_filter->list from damos_new_filter()
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/damon/core: initialize damo_filter->list from damos_new_filter()
damos_new_filter() is not initializing the list field of newly allocated
filter object. However, DAMON sysfs interface and DAMON_RECLAIM are not
initializing it after calling damos_new_filter(). As a result, accessing
uninitialized memory is possible. Actually, adding multiple DAMOS filters
via DAMON sysfs interface caused NULL pointer dereferencing. Initialize
the field just after the allocation from damos_new_filter().
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/damon/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "da7beebb49c643cd03c54447ed66595936a7a1ce",
"status": "affected",
"version": "98def236f63c66629fb6b2d4b69cecffc5b46539",
"versionType": "git"
},
{
"lessThan": "5f1fc67f2cb8d3035d3acd273b48b97835af8afd",
"status": "affected",
"version": "98def236f63c66629fb6b2d4b69cecffc5b46539",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/damon/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.3"
},
{
"lessThan": "6.3",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.11",
"versionStartIncluding": "6.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/damon/core: initialize damo_filter-\u003elist from damos_new_filter()\n\ndamos_new_filter() is not initializing the list field of newly allocated\nfilter object. However, DAMON sysfs interface and DAMON_RECLAIM are not\ninitializing it after calling damos_new_filter(). As a result, accessing\nuninitialized memory is possible. Actually, adding multiple DAMOS filters\nvia DAMON sysfs interface caused NULL pointer dereferencing. Initialize\nthe field just after the allocation from damos_new_filter()."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:00.514Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/da7beebb49c643cd03c54447ed66595936a7a1ce"
},
{
"url": "https://git.kernel.org/stable/c/5f1fc67f2cb8d3035d3acd273b48b97835af8afd"
}
],
"title": "mm/damon/core: initialize damo_filter-\u003elist from damos_new_filter()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53555",
"datePublished": "2025-10-04T15:17:00.514Z",
"dateReserved": "2025-10-04T15:14:15.922Z",
"dateUpdated": "2025-10-04T15:17:00.514Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53539 (GCVE-0-2023-53539)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
RDMA/rxe: Fix incomplete state save in rxe_requester
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/rxe: Fix incomplete state save in rxe_requester
If a send packet is dropped by the IP layer in rxe_requester()
the call to rxe_xmit_packet() can fail with err == -EAGAIN.
To recover, the state of the wqe is restored to the state before
the packet was sent so it can be resent. However, the routines
that save and restore the state miss a significnt part of the
variable state in the wqe, the dma struct which is used to process
through the sge table. And, the state is not saved before the packet
is built which modifies the dma struct.
Under heavy stress testing with many QPs on a fast node sending
large messages to a slow node dropped packets are observed and
the resent packets are corrupted because the dma struct was not
restored. This patch fixes this behavior and allows the test cases
to succeed.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
3050b99850247695cb07a5c15265afcc08bcf400 , < 70518f3aaf5a059b691867d7d2d46b999319656a
(git)
Affected: 3050b99850247695cb07a5c15265afcc08bcf400 , < 2f2a6422287fe29f9343247d77b645100ece0652 (git) Affected: 3050b99850247695cb07a5c15265afcc08bcf400 , < 255c0e60e1d16874fc151358d94bc8df661600dd (git) Affected: 3050b99850247695cb07a5c15265afcc08bcf400 , < 5d122db2ff80cd2aed4dcd630befb56b51ddf947 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_req.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "70518f3aaf5a059b691867d7d2d46b999319656a",
"status": "affected",
"version": "3050b99850247695cb07a5c15265afcc08bcf400",
"versionType": "git"
},
{
"lessThan": "2f2a6422287fe29f9343247d77b645100ece0652",
"status": "affected",
"version": "3050b99850247695cb07a5c15265afcc08bcf400",
"versionType": "git"
},
{
"lessThan": "255c0e60e1d16874fc151358d94bc8df661600dd",
"status": "affected",
"version": "3050b99850247695cb07a5c15265afcc08bcf400",
"versionType": "git"
},
{
"lessThan": "5d122db2ff80cd2aed4dcd630befb56b51ddf947",
"status": "affected",
"version": "3050b99850247695cb07a5c15265afcc08bcf400",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/sw/rxe/rxe_req.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.8"
},
{
"lessThan": "4.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.53",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.16",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.3",
"versionStartIncluding": "4.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "4.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix incomplete state save in rxe_requester\n\nIf a send packet is dropped by the IP layer in rxe_requester()\nthe call to rxe_xmit_packet() can fail with err == -EAGAIN.\nTo recover, the state of the wqe is restored to the state before\nthe packet was sent so it can be resent. However, the routines\nthat save and restore the state miss a significnt part of the\nvariable state in the wqe, the dma struct which is used to process\nthrough the sge table. And, the state is not saved before the packet\nis built which modifies the dma struct.\n\nUnder heavy stress testing with many QPs on a fast node sending\nlarge messages to a slow node dropped packets are observed and\nthe resent packets are corrupted because the dma struct was not\nrestored. This patch fixes this behavior and allows the test cases\nto succeed."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:49.379Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/70518f3aaf5a059b691867d7d2d46b999319656a"
},
{
"url": "https://git.kernel.org/stable/c/2f2a6422287fe29f9343247d77b645100ece0652"
},
{
"url": "https://git.kernel.org/stable/c/255c0e60e1d16874fc151358d94bc8df661600dd"
},
{
"url": "https://git.kernel.org/stable/c/5d122db2ff80cd2aed4dcd630befb56b51ddf947"
}
],
"title": "RDMA/rxe: Fix incomplete state save in rxe_requester",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53539",
"datePublished": "2025-10-04T15:16:49.379Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2025-10-04T15:16:49.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50475 (GCVE-0-2022-50475)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
RDMA/core: Make sure "ib_port" is valid when access sysfs node
Summary
In the Linux kernel, the following vulnerability has been resolved:
RDMA/core: Make sure "ib_port" is valid when access sysfs node
The "ib_port" structure must be set before adding the sysfs kobject,
and reset after removing it, otherwise it may crash when accessing
the sysfs node:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050
Mem abort info:
ESR = 0x96000006
Exception class = DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000e85f5ba5
[0000000000000050] pgd=0000000848fd9003, pud=000000085b387003, pmd=0000000000000000
Internal error: Oops: 96000006 [#2] PREEMPT SMP
Modules linked in: ib_umad(O) mlx5_ib(O) nfnetlink_cttimeout(E) nfnetlink(E) act_gact(E) cls_flower(E) sch_ingress(E) openvswitch(E) nsh(E) nf_nat_ipv6(E) nf_nat_ipv4(E) nf_conncount(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) mst_pciconf(O) ipmi_devintf(E) ipmi_msghandler(E) ipmb_dev_int(OE) mlx5_core(O) mlxfw(O) mlxdevm(O) auxiliary(O) ib_uverbs(O) ib_core(O) mlx_compat(O) psample(E) sbsa_gwdt(E) uio_pdrv_genirq(E) uio(E) mlxbf_pmc(OE) mlxbf_gige(OE) mlxbf_tmfifo(OE) gpio_mlxbf2(OE) pwr_mlxbf(OE) mlx_trio(OE) i2c_mlxbf(OE) mlx_bootctl(OE) bluefield_edac(OE) knem(O) ip_tables(E) ipv6(E) crc_ccitt(E) [last unloaded: mst_pci]
Process grep (pid: 3372, stack limit = 0x0000000022055c92)
CPU: 5 PID: 3372 Comm: grep Tainted: G D OE 4.19.161-mlnx.47.gadcd9e3 #1
Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS BlueField:3.9.2-15-ga2403ab Sep 8 2022
pstate: 40000005 (nZcv daif -PAN -UAO)
pc : hw_stat_port_show+0x4c/0x80 [ib_core]
lr : port_attr_show+0x40/0x58 [ib_core]
sp : ffff000029f43b50
x29: ffff000029f43b50 x28: 0000000019375000
x27: ffff8007b821a540 x26: ffff000029f43e30
x25: 0000000000008000 x24: ffff000000eaa958
x23: 0000000000001000 x22: ffff8007a4ce3000
x21: ffff8007baff8000 x20: ffff8007b9066ac0
x19: ffff8007bae97578 x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000000000000 x14: 0000000000000000
x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000
x9 : 0000000000000000 x8 : ffff8007a4ce4000
x7 : 0000000000000000 x6 : 000000000000003f
x5 : ffff000000e6a280 x4 : ffff8007a4ce3000
x3 : 0000000000000000 x2 : aaaaaaaaaaaaaaab
x1 : ffff8007b9066a10 x0 : ffff8007baff8000
Call trace:
hw_stat_port_show+0x4c/0x80 [ib_core]
port_attr_show+0x40/0x58 [ib_core]
sysfs_kf_seq_show+0x8c/0x150
kernfs_seq_show+0x44/0x50
seq_read+0x1b4/0x45c
kernfs_fop_read+0x148/0x1d8
__vfs_read+0x58/0x180
vfs_read+0x94/0x154
ksys_read+0x68/0xd8
__arm64_sys_read+0x28/0x34
el0_svc_common+0x88/0x18c
el0_svc_handler+0x78/0x94
el0_svc+0x8/0xe8
Code: f2955562 aa1603e4 aa1503e0 f9405683 (f9402861)
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
d8a5883814b9f7c08d7ff291070687d925b4f859 , < f981c697b2f9bd5dd2f060e47ff8b5e0a2cd0c06
(git)
Affected: d8a5883814b9f7c08d7ff291070687d925b4f859 , < ac7a7d7079124f46180714b2d41a1703d37101bb (git) Affected: d8a5883814b9f7c08d7ff291070687d925b4f859 , < cd06d32a71fbb198b2d43dddf794badd80ffd25d (git) Affected: d8a5883814b9f7c08d7ff291070687d925b4f859 , < 5e15ff29b156bbbdeadae230c8ecd5ecd8ca2477 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f981c697b2f9bd5dd2f060e47ff8b5e0a2cd0c06",
"status": "affected",
"version": "d8a5883814b9f7c08d7ff291070687d925b4f859",
"versionType": "git"
},
{
"lessThan": "ac7a7d7079124f46180714b2d41a1703d37101bb",
"status": "affected",
"version": "d8a5883814b9f7c08d7ff291070687d925b4f859",
"versionType": "git"
},
{
"lessThan": "cd06d32a71fbb198b2d43dddf794badd80ffd25d",
"status": "affected",
"version": "d8a5883814b9f7c08d7ff291070687d925b4f859",
"versionType": "git"
},
{
"lessThan": "5e15ff29b156bbbdeadae230c8ecd5ecd8ca2477",
"status": "affected",
"version": "d8a5883814b9f7c08d7ff291070687d925b4f859",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/sysfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Make sure \"ib_port\" is valid when access sysfs node\n\nThe \"ib_port\" structure must be set before adding the sysfs kobject,\nand reset after removing it, otherwise it may crash when accessing\nthe sysfs node:\n Unable to handle kernel NULL pointer dereference at virtual address 0000000000000050\n Mem abort info:\n ESR = 0x96000006\n Exception class = DABT (current EL), IL = 32 bits\n SET = 0, FnV = 0\n EA = 0, S1PTW = 0\n Data abort info:\n ISV = 0, ISS = 0x00000006\n CM = 0, WnR = 0\n user pgtable: 4k pages, 48-bit VAs, pgdp = 00000000e85f5ba5\n [0000000000000050] pgd=0000000848fd9003, pud=000000085b387003, pmd=0000000000000000\n Internal error: Oops: 96000006 [#2] PREEMPT SMP\n Modules linked in: ib_umad(O) mlx5_ib(O) nfnetlink_cttimeout(E) nfnetlink(E) act_gact(E) cls_flower(E) sch_ingress(E) openvswitch(E) nsh(E) nf_nat_ipv6(E) nf_nat_ipv4(E) nf_conncount(E) nf_nat(E) nf_conntrack(E) nf_defrag_ipv6(E) nf_defrag_ipv4(E) mst_pciconf(O) ipmi_devintf(E) ipmi_msghandler(E) ipmb_dev_int(OE) mlx5_core(O) mlxfw(O) mlxdevm(O) auxiliary(O) ib_uverbs(O) ib_core(O) mlx_compat(O) psample(E) sbsa_gwdt(E) uio_pdrv_genirq(E) uio(E) mlxbf_pmc(OE) mlxbf_gige(OE) mlxbf_tmfifo(OE) gpio_mlxbf2(OE) pwr_mlxbf(OE) mlx_trio(OE) i2c_mlxbf(OE) mlx_bootctl(OE) bluefield_edac(OE) knem(O) ip_tables(E) ipv6(E) crc_ccitt(E) [last unloaded: mst_pci]\n Process grep (pid: 3372, stack limit = 0x0000000022055c92)\n CPU: 5 PID: 3372 Comm: grep Tainted: G D OE 4.19.161-mlnx.47.gadcd9e3 #1\n Hardware name: https://www.mellanox.com BlueField SoC/BlueField SoC, BIOS BlueField:3.9.2-15-ga2403ab Sep 8 2022\n pstate: 40000005 (nZcv daif -PAN -UAO)\n pc : hw_stat_port_show+0x4c/0x80 [ib_core]\n lr : port_attr_show+0x40/0x58 [ib_core]\n sp : ffff000029f43b50\n x29: ffff000029f43b50 x28: 0000000019375000\n x27: ffff8007b821a540 x26: ffff000029f43e30\n x25: 0000000000008000 x24: ffff000000eaa958\n x23: 0000000000001000 x22: ffff8007a4ce3000\n x21: ffff8007baff8000 x20: ffff8007b9066ac0\n x19: ffff8007bae97578 x18: 0000000000000000\n x17: 0000000000000000 x16: 0000000000000000\n x15: 0000000000000000 x14: 0000000000000000\n x13: 0000000000000000 x12: 0000000000000000\n x11: 0000000000000000 x10: 0000000000000000\n x9 : 0000000000000000 x8 : ffff8007a4ce4000\n x7 : 0000000000000000 x6 : 000000000000003f\n x5 : ffff000000e6a280 x4 : ffff8007a4ce3000\n x3 : 0000000000000000 x2 : aaaaaaaaaaaaaaab\n x1 : ffff8007b9066a10 x0 : ffff8007baff8000\n Call trace:\n hw_stat_port_show+0x4c/0x80 [ib_core]\n port_attr_show+0x40/0x58 [ib_core]\n sysfs_kf_seq_show+0x8c/0x150\n kernfs_seq_show+0x44/0x50\n seq_read+0x1b4/0x45c\n kernfs_fop_read+0x148/0x1d8\n __vfs_read+0x58/0x180\n vfs_read+0x94/0x154\n ksys_read+0x68/0xd8\n __arm64_sys_read+0x28/0x34\n el0_svc_common+0x88/0x18c\n el0_svc_handler+0x78/0x94\n el0_svc+0x8/0xe8\n Code: f2955562 aa1603e4 aa1503e0 f9405683 (f9402861)"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:36.235Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f981c697b2f9bd5dd2f060e47ff8b5e0a2cd0c06"
},
{
"url": "https://git.kernel.org/stable/c/ac7a7d7079124f46180714b2d41a1703d37101bb"
},
{
"url": "https://git.kernel.org/stable/c/cd06d32a71fbb198b2d43dddf794badd80ffd25d"
},
{
"url": "https://git.kernel.org/stable/c/5e15ff29b156bbbdeadae230c8ecd5ecd8ca2477"
}
],
"title": "RDMA/core: Make sure \"ib_port\" is valid when access sysfs node",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50475",
"datePublished": "2025-10-04T15:16:36.235Z",
"dateReserved": "2025-10-04T15:13:33.467Z",
"dateUpdated": "2025-10-04T15:16:36.235Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50507 (GCVE-0-2022-50507)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-06 09:07
VLAI?
EPSS
Title
fs/ntfs3: Validate data run offset
Summary
In the Linux kernel, the following vulnerability has been resolved:
fs/ntfs3: Validate data run offset
This adds sanity checks for data run offset. We should make sure data
run offset is legit before trying to unpack them, otherwise we may
encounter use-after-free or some unexpected memory access behaviors.
[ 82.940342] BUG: KASAN: use-after-free in run_unpack+0x2e3/0x570
[ 82.941180] Read of size 1 at addr ffff888008a8487f by task mount/240
[ 82.941670]
[ 82.942069] CPU: 0 PID: 240 Comm: mount Not tainted 5.19.0+ #15
[ 82.942482] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 82.943720] Call Trace:
[ 82.944204] <TASK>
[ 82.944471] dump_stack_lvl+0x49/0x63
[ 82.944908] print_report.cold+0xf5/0x67b
[ 82.945141] ? __wait_on_bit+0x106/0x120
[ 82.945750] ? run_unpack+0x2e3/0x570
[ 82.946626] kasan_report+0xa7/0x120
[ 82.947046] ? run_unpack+0x2e3/0x570
[ 82.947280] __asan_load1+0x51/0x60
[ 82.947483] run_unpack+0x2e3/0x570
[ 82.947709] ? memcpy+0x4e/0x70
[ 82.947927] ? run_pack+0x7a0/0x7a0
[ 82.948158] run_unpack_ex+0xad/0x3f0
[ 82.948399] ? mi_enum_attr+0x14a/0x200
[ 82.948717] ? run_unpack+0x570/0x570
[ 82.949072] ? ni_enum_attr_ex+0x1b2/0x1c0
[ 82.949332] ? ni_fname_type.part.0+0xd0/0xd0
[ 82.949611] ? mi_read+0x262/0x2c0
[ 82.949970] ? ntfs_cmp_names_cpu+0x125/0x180
[ 82.950249] ntfs_iget5+0x632/0x1870
[ 82.950621] ? ntfs_get_block_bmap+0x70/0x70
[ 82.951192] ? evict+0x223/0x280
[ 82.951525] ? iput.part.0+0x286/0x320
[ 82.951969] ntfs_fill_super+0x1321/0x1e20
[ 82.952436] ? put_ntfs+0x1d0/0x1d0
[ 82.952822] ? vsprintf+0x20/0x20
[ 82.953188] ? mutex_unlock+0x81/0xd0
[ 82.953379] ? set_blocksize+0x95/0x150
[ 82.954001] get_tree_bdev+0x232/0x370
[ 82.954438] ? put_ntfs+0x1d0/0x1d0
[ 82.954700] ntfs_fs_get_tree+0x15/0x20
[ 82.955049] vfs_get_tree+0x4c/0x130
[ 82.955292] path_mount+0x645/0xfd0
[ 82.955615] ? putname+0x80/0xa0
[ 82.955955] ? finish_automount+0x2e0/0x2e0
[ 82.956310] ? kmem_cache_free+0x110/0x390
[ 82.956723] ? putname+0x80/0xa0
[ 82.957023] do_mount+0xd6/0xf0
[ 82.957411] ? path_mount+0xfd0/0xfd0
[ 82.957638] ? __kasan_check_write+0x14/0x20
[ 82.957948] __x64_sys_mount+0xca/0x110
[ 82.958310] do_syscall_64+0x3b/0x90
[ 82.958719] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 82.959341] RIP: 0033:0x7fd0d1ce948a
[ 82.960193] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008
[ 82.961532] RSP: 002b:00007ffe59ff69a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5
[ 82.962527] RAX: ffffffffffffffda RBX: 0000564dcc107060 RCX: 00007fd0d1ce948a
[ 82.963266] RDX: 0000564dcc107260 RSI: 0000564dcc1072e0 RDI: 0000564dcc10fce0
[ 82.963686] RBP: 0000000000000000 R08: 0000564dcc107280 R09: 0000000000000020
[ 82.964272] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564dcc10fce0
[ 82.964785] R13: 0000564dcc107260 R14: 0000000000000000 R15: 00000000ffffffff
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < de5e0955248ff90a2ae91e7f5c108392b52152d0
(git)
Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < e0455361d3068066a91fe18282b751925d7b5ee7 (git) Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 9173b89c16a603d73c434b695fe2a7a13491300f (git) Affected: 4534a70b7056fd4b9a1c6db5a4ce3c98546b291e , < 6db620863f8528ed9a9aa5ad323b26554a17881d (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/attrib.c",
"fs/ntfs3/attrlist.c",
"fs/ntfs3/frecord.c",
"fs/ntfs3/fslog.c",
"fs/ntfs3/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "de5e0955248ff90a2ae91e7f5c108392b52152d0",
"status": "affected",
"version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
"versionType": "git"
},
{
"lessThan": "e0455361d3068066a91fe18282b751925d7b5ee7",
"status": "affected",
"version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
"versionType": "git"
},
{
"lessThan": "9173b89c16a603d73c434b695fe2a7a13491300f",
"status": "affected",
"version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
"versionType": "git"
},
{
"lessThan": "6db620863f8528ed9a9aa5ad323b26554a17881d",
"status": "affected",
"version": "4534a70b7056fd4b9a1c6db5a4ce3c98546b291e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ntfs3/attrib.c",
"fs/ntfs3/attrlist.c",
"fs/ntfs3/frecord.c",
"fs/ntfs3/fslog.c",
"fs/ntfs3/inode.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.87",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.17",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.3",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/ntfs3: Validate data run offset\n\nThis adds sanity checks for data run offset. We should make sure data\nrun offset is legit before trying to unpack them, otherwise we may\nencounter use-after-free or some unexpected memory access behaviors.\n\n[ 82.940342] BUG: KASAN: use-after-free in run_unpack+0x2e3/0x570\n[ 82.941180] Read of size 1 at addr ffff888008a8487f by task mount/240\n[ 82.941670]\n[ 82.942069] CPU: 0 PID: 240 Comm: mount Not tainted 5.19.0+ #15\n[ 82.942482] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n[ 82.943720] Call Trace:\n[ 82.944204] \u003cTASK\u003e\n[ 82.944471] dump_stack_lvl+0x49/0x63\n[ 82.944908] print_report.cold+0xf5/0x67b\n[ 82.945141] ? __wait_on_bit+0x106/0x120\n[ 82.945750] ? run_unpack+0x2e3/0x570\n[ 82.946626] kasan_report+0xa7/0x120\n[ 82.947046] ? run_unpack+0x2e3/0x570\n[ 82.947280] __asan_load1+0x51/0x60\n[ 82.947483] run_unpack+0x2e3/0x570\n[ 82.947709] ? memcpy+0x4e/0x70\n[ 82.947927] ? run_pack+0x7a0/0x7a0\n[ 82.948158] run_unpack_ex+0xad/0x3f0\n[ 82.948399] ? mi_enum_attr+0x14a/0x200\n[ 82.948717] ? run_unpack+0x570/0x570\n[ 82.949072] ? ni_enum_attr_ex+0x1b2/0x1c0\n[ 82.949332] ? ni_fname_type.part.0+0xd0/0xd0\n[ 82.949611] ? mi_read+0x262/0x2c0\n[ 82.949970] ? ntfs_cmp_names_cpu+0x125/0x180\n[ 82.950249] ntfs_iget5+0x632/0x1870\n[ 82.950621] ? ntfs_get_block_bmap+0x70/0x70\n[ 82.951192] ? evict+0x223/0x280\n[ 82.951525] ? iput.part.0+0x286/0x320\n[ 82.951969] ntfs_fill_super+0x1321/0x1e20\n[ 82.952436] ? put_ntfs+0x1d0/0x1d0\n[ 82.952822] ? vsprintf+0x20/0x20\n[ 82.953188] ? mutex_unlock+0x81/0xd0\n[ 82.953379] ? set_blocksize+0x95/0x150\n[ 82.954001] get_tree_bdev+0x232/0x370\n[ 82.954438] ? put_ntfs+0x1d0/0x1d0\n[ 82.954700] ntfs_fs_get_tree+0x15/0x20\n[ 82.955049] vfs_get_tree+0x4c/0x130\n[ 82.955292] path_mount+0x645/0xfd0\n[ 82.955615] ? putname+0x80/0xa0\n[ 82.955955] ? finish_automount+0x2e0/0x2e0\n[ 82.956310] ? kmem_cache_free+0x110/0x390\n[ 82.956723] ? putname+0x80/0xa0\n[ 82.957023] do_mount+0xd6/0xf0\n[ 82.957411] ? path_mount+0xfd0/0xfd0\n[ 82.957638] ? __kasan_check_write+0x14/0x20\n[ 82.957948] __x64_sys_mount+0xca/0x110\n[ 82.958310] do_syscall_64+0x3b/0x90\n[ 82.958719] entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[ 82.959341] RIP: 0033:0x7fd0d1ce948a\n[ 82.960193] Code: 48 8b 0d 11 fa 2a 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 008\n[ 82.961532] RSP: 002b:00007ffe59ff69a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a5\n[ 82.962527] RAX: ffffffffffffffda RBX: 0000564dcc107060 RCX: 00007fd0d1ce948a\n[ 82.963266] RDX: 0000564dcc107260 RSI: 0000564dcc1072e0 RDI: 0000564dcc10fce0\n[ 82.963686] RBP: 0000000000000000 R08: 0000564dcc107280 R09: 0000000000000020\n[ 82.964272] R10: 00000000c0ed0000 R11: 0000000000000202 R12: 0000564dcc10fce0\n[ 82.964785] R13: 0000564dcc107260 R14: 0000000000000000 R15: 00000000ffffffff"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T09:07:17.155Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/de5e0955248ff90a2ae91e7f5c108392b52152d0"
},
{
"url": "https://git.kernel.org/stable/c/e0455361d3068066a91fe18282b751925d7b5ee7"
},
{
"url": "https://git.kernel.org/stable/c/9173b89c16a603d73c434b695fe2a7a13491300f"
},
{
"url": "https://git.kernel.org/stable/c/6db620863f8528ed9a9aa5ad323b26554a17881d"
}
],
"title": "fs/ntfs3: Validate data run offset",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50507",
"datePublished": "2025-10-04T15:43:55.675Z",
"dateReserved": "2025-10-04T15:39:19.465Z",
"dateUpdated": "2025-10-06T09:07:17.155Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53613 (GCVE-0-2023-53613)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
dax: Fix dax_mapping_release() use after free
Summary
In the Linux kernel, the following vulnerability has been resolved:
dax: Fix dax_mapping_release() use after free
A CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region
provider (like modprobe -r dax_hmem) yields:
kobject: 'mapping0' (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000)
[..]
DEBUG_LOCKS_WARN_ON(1)
WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260
[..]
RIP: 0010:__lock_acquire+0x9fc/0x2260
[..]
Call Trace:
<TASK>
[..]
lock_acquire+0xd4/0x2c0
? ida_free+0x62/0x130
_raw_spin_lock_irqsave+0x47/0x70
? ida_free+0x62/0x130
ida_free+0x62/0x130
dax_mapping_release+0x1f/0x30
device_release+0x36/0x90
kobject_delayed_cleanup+0x46/0x150
Due to attempting ida_free() on an ida object that has already been
freed. Devices typically only hold a reference on their parent while
registered. If a child needs a parent object to complete its release it
needs to hold a reference that it drops from its release callback.
Arrange for a dax_mapping to pin its parent dev_dax instance until
dax_mapping_release().
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca , < 94a85474f5e3e518bdbf8c9f51cb343d734a04f7
(git)
Affected: 0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca , < 9c2f993b6ca903c030d58451b5bf9ea27d0d17fa (git) Affected: 0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca , < 03859868ab82d57bfdd0cea1bf31f9319a5dded0 (git) Affected: 0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca , < f76db6781d76d8464ec2faa9752cc3fb2e4f6923 (git) Affected: 0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca , < 7310b84821f043dcf77d5e6aa0ad55dc1e10a11d (git) Affected: 0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca , < 6d24b170a9db0456f577b1ab01226a2254c016a8 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/dax/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "94a85474f5e3e518bdbf8c9f51cb343d734a04f7",
"status": "affected",
"version": "0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca",
"versionType": "git"
},
{
"lessThan": "9c2f993b6ca903c030d58451b5bf9ea27d0d17fa",
"status": "affected",
"version": "0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca",
"versionType": "git"
},
{
"lessThan": "03859868ab82d57bfdd0cea1bf31f9319a5dded0",
"status": "affected",
"version": "0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca",
"versionType": "git"
},
{
"lessThan": "f76db6781d76d8464ec2faa9752cc3fb2e4f6923",
"status": "affected",
"version": "0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca",
"versionType": "git"
},
{
"lessThan": "7310b84821f043dcf77d5e6aa0ad55dc1e10a11d",
"status": "affected",
"version": "0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca",
"versionType": "git"
},
{
"lessThan": "6d24b170a9db0456f577b1ab01226a2254c016a8",
"status": "affected",
"version": "0b07ce872a9eca1ff88c0eb7f6e92dde127d21ca",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/dax/bus.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.10"
},
{
"lessThan": "5.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.188",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.121",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.39",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.13",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.4",
"versionStartIncluding": "5.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndax: Fix dax_mapping_release() use after free\n\nA CONFIG_DEBUG_KOBJECT_RELEASE test of removing a device-dax region\nprovider (like modprobe -r dax_hmem) yields:\n\n kobject: \u0027mapping0\u0027 (ffff93eb460e8800): kobject_release, parent 0000000000000000 (delayed 2000)\n [..]\n DEBUG_LOCKS_WARN_ON(1)\n WARNING: CPU: 23 PID: 282 at kernel/locking/lockdep.c:232 __lock_acquire+0x9fc/0x2260\n [..]\n RIP: 0010:__lock_acquire+0x9fc/0x2260\n [..]\n Call Trace:\n \u003cTASK\u003e\n [..]\n lock_acquire+0xd4/0x2c0\n ? ida_free+0x62/0x130\n _raw_spin_lock_irqsave+0x47/0x70\n ? ida_free+0x62/0x130\n ida_free+0x62/0x130\n dax_mapping_release+0x1f/0x30\n device_release+0x36/0x90\n kobject_delayed_cleanup+0x46/0x150\n\nDue to attempting ida_free() on an ida object that has already been\nfreed. Devices typically only hold a reference on their parent while\nregistered. If a child needs a parent object to complete its release it\nneeds to hold a reference that it drops from its release callback.\nArrange for a dax_mapping to pin its parent dev_dax instance until\ndax_mapping_release()."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:20.998Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/94a85474f5e3e518bdbf8c9f51cb343d734a04f7"
},
{
"url": "https://git.kernel.org/stable/c/9c2f993b6ca903c030d58451b5bf9ea27d0d17fa"
},
{
"url": "https://git.kernel.org/stable/c/03859868ab82d57bfdd0cea1bf31f9319a5dded0"
},
{
"url": "https://git.kernel.org/stable/c/f76db6781d76d8464ec2faa9752cc3fb2e4f6923"
},
{
"url": "https://git.kernel.org/stable/c/7310b84821f043dcf77d5e6aa0ad55dc1e10a11d"
},
{
"url": "https://git.kernel.org/stable/c/6d24b170a9db0456f577b1ab01226a2254c016a8"
}
],
"title": "dax: Fix dax_mapping_release() use after free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53613",
"datePublished": "2025-10-04T15:44:20.998Z",
"dateReserved": "2025-10-04T15:40:38.480Z",
"dateUpdated": "2025-10-04T15:44:20.998Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53567 (GCVE-0-2023-53567)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
spi: qup: Don't skip cleanup in remove's error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
spi: qup: Don't skip cleanup in remove's error path
Returning early in a platform driver's remove callback is wrong. In this
case the dma resources are not released in the error path. this is never
retried later and so this is a permanent leak. To fix this, only skip
hardware disabling if waking the device fails.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
64ff247a978facc437d40f0c9b754675846a98f0 , < fd53f41bd86daa39b454fd4637a908ff2123547f
(git)
Affected: 64ff247a978facc437d40f0c9b754675846a98f0 , < 8632384337038b97910c2f7bb5a3f377aa68d001 (git) Affected: 64ff247a978facc437d40f0c9b754675846a98f0 , < bc88243bbe6140d289bb32b4ee4607ba5ce1124a (git) Affected: 64ff247a978facc437d40f0c9b754675846a98f0 , < f345d4d71e87d878437417ffbb9a7d4e16d235eb (git) Affected: 64ff247a978facc437d40f0c9b754675846a98f0 , < 2d0f63077f481f11a07f20eab1c1f4367dfaef32 (git) Affected: 64ff247a978facc437d40f0c9b754675846a98f0 , < 55ecdcd12bc176b86fecbcb125ac814ac8fe857a (git) Affected: 64ff247a978facc437d40f0c9b754675846a98f0 , < 49c17fccae36505550c9121891722fff337f148a (git) Affected: 64ff247a978facc437d40f0c9b754675846a98f0 , < 61f49171a43ab1f80c73c5c88c508770c461e0f2 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-qup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd53f41bd86daa39b454fd4637a908ff2123547f",
"status": "affected",
"version": "64ff247a978facc437d40f0c9b754675846a98f0",
"versionType": "git"
},
{
"lessThan": "8632384337038b97910c2f7bb5a3f377aa68d001",
"status": "affected",
"version": "64ff247a978facc437d40f0c9b754675846a98f0",
"versionType": "git"
},
{
"lessThan": "bc88243bbe6140d289bb32b4ee4607ba5ce1124a",
"status": "affected",
"version": "64ff247a978facc437d40f0c9b754675846a98f0",
"versionType": "git"
},
{
"lessThan": "f345d4d71e87d878437417ffbb9a7d4e16d235eb",
"status": "affected",
"version": "64ff247a978facc437d40f0c9b754675846a98f0",
"versionType": "git"
},
{
"lessThan": "2d0f63077f481f11a07f20eab1c1f4367dfaef32",
"status": "affected",
"version": "64ff247a978facc437d40f0c9b754675846a98f0",
"versionType": "git"
},
{
"lessThan": "55ecdcd12bc176b86fecbcb125ac814ac8fe857a",
"status": "affected",
"version": "64ff247a978facc437d40f0c9b754675846a98f0",
"versionType": "git"
},
{
"lessThan": "49c17fccae36505550c9121891722fff337f148a",
"status": "affected",
"version": "64ff247a978facc437d40f0c9b754675846a98f0",
"versionType": "git"
},
{
"lessThan": "61f49171a43ab1f80c73c5c88c508770c461e0f2",
"status": "affected",
"version": "64ff247a978facc437d40f0c9b754675846a98f0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/spi/spi-qup.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.15"
},
{
"lessThan": "3.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.283",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.243",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.283",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.243",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "3.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "3.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nspi: qup: Don\u0027t skip cleanup in remove\u0027s error path\n\nReturning early in a platform driver\u0027s remove callback is wrong. In this\ncase the dma resources are not released in the error path. this is never\nretried later and so this is a permanent leak. To fix this, only skip\nhardware disabling if waking the device fails."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:09.350Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd53f41bd86daa39b454fd4637a908ff2123547f"
},
{
"url": "https://git.kernel.org/stable/c/8632384337038b97910c2f7bb5a3f377aa68d001"
},
{
"url": "https://git.kernel.org/stable/c/bc88243bbe6140d289bb32b4ee4607ba5ce1124a"
},
{
"url": "https://git.kernel.org/stable/c/f345d4d71e87d878437417ffbb9a7d4e16d235eb"
},
{
"url": "https://git.kernel.org/stable/c/2d0f63077f481f11a07f20eab1c1f4367dfaef32"
},
{
"url": "https://git.kernel.org/stable/c/55ecdcd12bc176b86fecbcb125ac814ac8fe857a"
},
{
"url": "https://git.kernel.org/stable/c/49c17fccae36505550c9121891722fff337f148a"
},
{
"url": "https://git.kernel.org/stable/c/61f49171a43ab1f80c73c5c88c508770c461e0f2"
}
],
"title": "spi: qup: Don\u0027t skip cleanup in remove\u0027s error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53567",
"datePublished": "2025-10-04T15:17:09.350Z",
"dateReserved": "2025-10-04T15:14:15.924Z",
"dateUpdated": "2025-10-04T15:17:09.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53591 (GCVE-0-2023-53591)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
net/mlx5e: Fix deadlock in tc route query code
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Fix deadlock in tc route query code
Cited commit causes ABBA deadlock[0] when peer flows are created while
holding the devcom rw semaphore. Due to peer flows offload implementation
the lock is taken much higher up the call chain and there is no obvious way
to easily fix the deadlock. Instead, since tc route query code needs the
peer eswitch structure only to perform a lookup in xarray and doesn't
perform any sleeping operations with it, refactor the code for lockless
execution in following ways:
- RCUify the devcom 'data' pointer. When resetting the pointer
synchronously wait for RCU grace period before returning. This is fine
since devcom is currently only used for synchronization of
pairing/unpairing of eswitches which is rare and already expensive as-is.
- Wrap all usages of 'paired' boolean in {READ|WRITE}_ONCE(). The flag has
already been used in some unlocked contexts without proper
annotations (e.g. users of mlx5_devcom_is_paired() function), but it wasn't
an issue since all relevant code paths checked it again after obtaining the
devcom semaphore. Now it is also used by mlx5_devcom_get_peer_data_rcu() as
"best effort" check to return NULL when devcom is being unpaired. Note that
while RCU read lock doesn't prevent the unpaired flag from being changed
concurrently it still guarantees that reader can continue to use 'data'.
- Refactor mlx5e_tc_query_route_vport() function to use new
mlx5_devcom_get_peer_data_rcu() API which fixes the deadlock.
[0]:
[ 164.599612] ======================================================
[ 164.600142] WARNING: possible circular locking dependency detected
[ 164.600667] 6.3.0-rc3+ #1 Not tainted
[ 164.601021] ------------------------------------------------------
[ 164.601557] handler1/3456 is trying to acquire lock:
[ 164.601998] ffff88811f1714b0 (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}, at: mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core]
[ 164.603078]
but task is already holding lock:
[ 164.603617] ffff88810137fc98 (&comp->sem){++++}-{3:3}, at: mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core]
[ 164.604459]
which lock already depends on the new lock.
[ 164.605190]
the existing dependency chain (in reverse order) is:
[ 164.605848]
-> #1 (&comp->sem){++++}-{3:3}:
[ 164.606380] down_read+0x39/0x50
[ 164.606772] mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core]
[ 164.607336] mlx5e_tc_query_route_vport+0x86/0xc0 [mlx5_core]
[ 164.607914] mlx5e_tc_tun_route_lookup+0x1a4/0x1d0 [mlx5_core]
[ 164.608495] mlx5e_attach_decap_route+0xc6/0x1e0 [mlx5_core]
[ 164.609063] mlx5e_tc_add_fdb_flow+0x1ea/0x360 [mlx5_core]
[ 164.609627] __mlx5e_add_fdb_flow+0x2d2/0x430 [mlx5_core]
[ 164.610175] mlx5e_configure_flower+0x952/0x1a20 [mlx5_core]
[ 164.610741] tc_setup_cb_add+0xd4/0x200
[ 164.611146] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower]
[ 164.611661] fl_change+0xc95/0x18a0 [cls_flower]
[ 164.612116] tc_new_tfilter+0x3fc/0xd20
[ 164.612516] rtnetlink_rcv_msg+0x418/0x5b0
[ 164.612936] netlink_rcv_skb+0x54/0x100
[ 164.613339] netlink_unicast+0x190/0x250
[ 164.613746] netlink_sendmsg+0x245/0x4a0
[ 164.614150] sock_sendmsg+0x38/0x60
[ 164.614522] ____sys_sendmsg+0x1d0/0x1e0
[ 164.614934] ___sys_sendmsg+0x80/0xc0
[ 164.615320] __sys_sendmsg+0x51/0x90
[ 164.615701] do_syscall_64+0x3d/0x90
[ 164.616083] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[ 164.616568]
-> #0 (&esw->offloads.encap_tbl_lock){+.+.}-{3:3}:
[ 164.617210] __lock_acquire+0x159e/0x26e0
[ 164.617638] lock_acquire+0xc2/0x2a0
[ 164.618018] __mutex_lock+0x92/0xcd0
[ 164.618401] mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core]
[ 164.618943] post_process_attr+0x153/0x2d0 [
---truncated---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
f9d196bd632b8b79261ec3366c30ec3923ea9a02 , < 69966bce28da6aadccfd968b75d128a79da32d17
(git)
Affected: f9d196bd632b8b79261ec3366c30ec3923ea9a02 , < 362063df6ceec80b0b6798b61ae03504dcc125a5 (git) Affected: f9d196bd632b8b79261ec3366c30ec3923ea9a02 , < a7236e420a7d8082b1df4b3e05c739dd2642a662 (git) Affected: f9d196bd632b8b79261ec3366c30ec3923ea9a02 , < 691c041bf20899fc13c793f92ba61ab660fa3a30 (git) Affected: 87a0625cf1c76caeaa15c576a0b2fcad4b9387d0 (git) Affected: 7778fe1a6a6c069a460e4e3ff8ed3722392a4b5b (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
"drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c",
"drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "69966bce28da6aadccfd968b75d128a79da32d17",
"status": "affected",
"version": "f9d196bd632b8b79261ec3366c30ec3923ea9a02",
"versionType": "git"
},
{
"lessThan": "362063df6ceec80b0b6798b61ae03504dcc125a5",
"status": "affected",
"version": "f9d196bd632b8b79261ec3366c30ec3923ea9a02",
"versionType": "git"
},
{
"lessThan": "a7236e420a7d8082b1df4b3e05c739dd2642a662",
"status": "affected",
"version": "f9d196bd632b8b79261ec3366c30ec3923ea9a02",
"versionType": "git"
},
{
"lessThan": "691c041bf20899fc13c793f92ba61ab660fa3a30",
"status": "affected",
"version": "f9d196bd632b8b79261ec3366c30ec3923ea9a02",
"versionType": "git"
},
{
"status": "affected",
"version": "87a0625cf1c76caeaa15c576a0b2fcad4b9387d0",
"versionType": "git"
},
{
"status": "affected",
"version": "7778fe1a6a6c069a460e4e3ff8ed3722392a4b5b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c",
"drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c",
"drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.31",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.115",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.31",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.5",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.13.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.14.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Fix deadlock in tc route query code\n\nCited commit causes ABBA deadlock[0] when peer flows are created while\nholding the devcom rw semaphore. Due to peer flows offload implementation\nthe lock is taken much higher up the call chain and there is no obvious way\nto easily fix the deadlock. Instead, since tc route query code needs the\npeer eswitch structure only to perform a lookup in xarray and doesn\u0027t\nperform any sleeping operations with it, refactor the code for lockless\nexecution in following ways:\n\n- RCUify the devcom \u0027data\u0027 pointer. When resetting the pointer\nsynchronously wait for RCU grace period before returning. This is fine\nsince devcom is currently only used for synchronization of\npairing/unpairing of eswitches which is rare and already expensive as-is.\n\n- Wrap all usages of \u0027paired\u0027 boolean in {READ|WRITE}_ONCE(). The flag has\nalready been used in some unlocked contexts without proper\nannotations (e.g. users of mlx5_devcom_is_paired() function), but it wasn\u0027t\nan issue since all relevant code paths checked it again after obtaining the\ndevcom semaphore. Now it is also used by mlx5_devcom_get_peer_data_rcu() as\n\"best effort\" check to return NULL when devcom is being unpaired. Note that\nwhile RCU read lock doesn\u0027t prevent the unpaired flag from being changed\nconcurrently it still guarantees that reader can continue to use \u0027data\u0027.\n\n- Refactor mlx5e_tc_query_route_vport() function to use new\nmlx5_devcom_get_peer_data_rcu() API which fixes the deadlock.\n\n[0]:\n\n[ 164.599612] ======================================================\n[ 164.600142] WARNING: possible circular locking dependency detected\n[ 164.600667] 6.3.0-rc3+ #1 Not tainted\n[ 164.601021] ------------------------------------------------------\n[ 164.601557] handler1/3456 is trying to acquire lock:\n[ 164.601998] ffff88811f1714b0 (\u0026esw-\u003eoffloads.encap_tbl_lock){+.+.}-{3:3}, at: mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core]\n[ 164.603078]\n but task is already holding lock:\n[ 164.603617] ffff88810137fc98 (\u0026comp-\u003esem){++++}-{3:3}, at: mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core]\n[ 164.604459]\n which lock already depends on the new lock.\n\n[ 164.605190]\n the existing dependency chain (in reverse order) is:\n[ 164.605848]\n -\u003e #1 (\u0026comp-\u003esem){++++}-{3:3}:\n[ 164.606380] down_read+0x39/0x50\n[ 164.606772] mlx5_devcom_get_peer_data+0x37/0x80 [mlx5_core]\n[ 164.607336] mlx5e_tc_query_route_vport+0x86/0xc0 [mlx5_core]\n[ 164.607914] mlx5e_tc_tun_route_lookup+0x1a4/0x1d0 [mlx5_core]\n[ 164.608495] mlx5e_attach_decap_route+0xc6/0x1e0 [mlx5_core]\n[ 164.609063] mlx5e_tc_add_fdb_flow+0x1ea/0x360 [mlx5_core]\n[ 164.609627] __mlx5e_add_fdb_flow+0x2d2/0x430 [mlx5_core]\n[ 164.610175] mlx5e_configure_flower+0x952/0x1a20 [mlx5_core]\n[ 164.610741] tc_setup_cb_add+0xd4/0x200\n[ 164.611146] fl_hw_replace_filter+0x14c/0x1f0 [cls_flower]\n[ 164.611661] fl_change+0xc95/0x18a0 [cls_flower]\n[ 164.612116] tc_new_tfilter+0x3fc/0xd20\n[ 164.612516] rtnetlink_rcv_msg+0x418/0x5b0\n[ 164.612936] netlink_rcv_skb+0x54/0x100\n[ 164.613339] netlink_unicast+0x190/0x250\n[ 164.613746] netlink_sendmsg+0x245/0x4a0\n[ 164.614150] sock_sendmsg+0x38/0x60\n[ 164.614522] ____sys_sendmsg+0x1d0/0x1e0\n[ 164.614934] ___sys_sendmsg+0x80/0xc0\n[ 164.615320] __sys_sendmsg+0x51/0x90\n[ 164.615701] do_syscall_64+0x3d/0x90\n[ 164.616083] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n[ 164.616568]\n -\u003e #0 (\u0026esw-\u003eoffloads.encap_tbl_lock){+.+.}-{3:3}:\n[ 164.617210] __lock_acquire+0x159e/0x26e0\n[ 164.617638] lock_acquire+0xc2/0x2a0\n[ 164.618018] __mutex_lock+0x92/0xcd0\n[ 164.618401] mlx5e_attach_encap+0xd8/0x8b0 [mlx5_core]\n[ 164.618943] post_process_attr+0x153/0x2d0 [\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:05.430Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/69966bce28da6aadccfd968b75d128a79da32d17"
},
{
"url": "https://git.kernel.org/stable/c/362063df6ceec80b0b6798b61ae03504dcc125a5"
},
{
"url": "https://git.kernel.org/stable/c/a7236e420a7d8082b1df4b3e05c739dd2642a662"
},
{
"url": "https://git.kernel.org/stable/c/691c041bf20899fc13c793f92ba61ab660fa3a30"
}
],
"title": "net/mlx5e: Fix deadlock in tc route query code",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53591",
"datePublished": "2025-10-04T15:44:05.430Z",
"dateReserved": "2025-10-04T15:40:38.478Z",
"dateUpdated": "2025-10-04T15:44:05.430Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50486 (GCVE-0-2022-50486)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-12-23 13:29
VLAI?
EPSS
Title
net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed. A
proposed warning in clang aims to catch these at compile time, which
reveals:
drivers/net/ethernet/ti/netcp_core.c:1944:21: error: incompatible function pointer types initializing 'netdev_tx_t (*)(struct sk_buff *, struct net_device *)' (aka 'enum netdev_tx (*)(struct sk_buff *, struct net_device *)') with an expression of type 'int (struct sk_buff *, struct net_device *)' [-Werror,-Wincompatible-function-pointer-types-strict]
.ndo_start_xmit = netcp_ndo_start_xmit,
^~~~~~~~~~~~~~~~~~~~
1 error generated.
->ndo_start_xmit() in 'struct net_device_ops' expects a return type of
'netdev_tx_t', not 'int'. Adjust the return type of
netcp_ndo_start_xmit() to match the prototype's to resolve the warning
and CFI failure.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
84640e27f23041d474c31d3362c3e2185ad68ec2 , < a447479ea2cf35603b5739ea947885024b901222
(git)
Affected: 84640e27f23041d474c31d3362c3e2185ad68ec2 , < 17bb9bdf701f3e811a9f4820b08b9538ade2641c (git) Affected: 84640e27f23041d474c31d3362c3e2185ad68ec2 , < d837d74eae077cc3ef9e191ba8535b5f602d4673 (git) Affected: 84640e27f23041d474c31d3362c3e2185ad68ec2 , < dbe1a6b930ae9647e8ce0b684c903ac67d4398eb (git) Affected: 84640e27f23041d474c31d3362c3e2185ad68ec2 , < 5b0b6553bf4ad3a435a57e02c68d6075f384e1be (git) Affected: 84640e27f23041d474c31d3362c3e2185ad68ec2 , < a413ebb6049edd881c6427cfa25a7efddd6a4f74 (git) Affected: 84640e27f23041d474c31d3362c3e2185ad68ec2 , < 765636e58ba505cfe4927eda7ee83791b1c6402a (git) Affected: 84640e27f23041d474c31d3362c3e2185ad68ec2 , < 1e4953b826e12b31995564a459dbd4e9e4604a35 (git) Affected: 84640e27f23041d474c31d3362c3e2185ad68ec2 , < 63fe6ff674a96cfcfc0fa8df1051a27aa31c70b4 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ti/netcp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a447479ea2cf35603b5739ea947885024b901222",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
},
{
"lessThan": "17bb9bdf701f3e811a9f4820b08b9538ade2641c",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
},
{
"lessThan": "d837d74eae077cc3ef9e191ba8535b5f602d4673",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
},
{
"lessThan": "dbe1a6b930ae9647e8ce0b684c903ac67d4398eb",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
},
{
"lessThan": "5b0b6553bf4ad3a435a57e02c68d6075f384e1be",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
},
{
"lessThan": "a413ebb6049edd881c6427cfa25a7efddd6a4f74",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
},
{
"lessThan": "765636e58ba505cfe4927eda7ee83791b1c6402a",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
},
{
"lessThan": "1e4953b826e12b31995564a459dbd4e9e4604a35",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
},
{
"lessThan": "63fe6ff674a96cfcfc0fa8df1051a27aa31c70b4",
"status": "affected",
"version": "84640e27f23041d474c31d3362c3e2185ad68ec2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/ti/netcp_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.0"
},
{
"lessThan": "4.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ethernet: ti: Fix return type of netcp_ndo_start_xmit()\n\nWith clang\u0027s kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),\nindirect call targets are validated against the expected function\npointer prototype to make sure the call target is valid to help mitigate\nROP attacks. If they are not identical, there is a failure at run time,\nwhich manifests as either a kernel panic or thread getting killed. A\nproposed warning in clang aims to catch these at compile time, which\nreveals:\n\n drivers/net/ethernet/ti/netcp_core.c:1944:21: error: incompatible function pointer types initializing \u0027netdev_tx_t (*)(struct sk_buff *, struct net_device *)\u0027 (aka \u0027enum netdev_tx (*)(struct sk_buff *, struct net_device *)\u0027) with an expression of type \u0027int (struct sk_buff *, struct net_device *)\u0027 [-Werror,-Wincompatible-function-pointer-types-strict]\n .ndo_start_xmit = netcp_ndo_start_xmit,\n ^~~~~~~~~~~~~~~~~~~~\n 1 error generated.\n\n-\u003endo_start_xmit() in \u0027struct net_device_ops\u0027 expects a return type of\n\u0027netdev_tx_t\u0027, not \u0027int\u0027. Adjust the return type of\nnetcp_ndo_start_xmit() to match the prototype\u0027s to resolve the warning\nand CFI failure."
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T13:29:38.718Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a447479ea2cf35603b5739ea947885024b901222"
},
{
"url": "https://git.kernel.org/stable/c/17bb9bdf701f3e811a9f4820b08b9538ade2641c"
},
{
"url": "https://git.kernel.org/stable/c/d837d74eae077cc3ef9e191ba8535b5f602d4673"
},
{
"url": "https://git.kernel.org/stable/c/dbe1a6b930ae9647e8ce0b684c903ac67d4398eb"
},
{
"url": "https://git.kernel.org/stable/c/5b0b6553bf4ad3a435a57e02c68d6075f384e1be"
},
{
"url": "https://git.kernel.org/stable/c/a413ebb6049edd881c6427cfa25a7efddd6a4f74"
},
{
"url": "https://git.kernel.org/stable/c/765636e58ba505cfe4927eda7ee83791b1c6402a"
},
{
"url": "https://git.kernel.org/stable/c/1e4953b826e12b31995564a459dbd4e9e4604a35"
},
{
"url": "https://git.kernel.org/stable/c/63fe6ff674a96cfcfc0fa8df1051a27aa31c70b4"
}
],
"title": "net: ethernet: ti: Fix return type of netcp_ndo_start_xmit()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50486",
"datePublished": "2025-10-04T15:16:43.791Z",
"dateReserved": "2025-10-04T15:13:33.468Z",
"dateUpdated": "2025-12-23T13:29:38.718Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39931 (GCVE-0-2025-39931)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2025-10-04 07:30
VLAI?
EPSS
Title
crypto: af_alg - Set merge to zero early in af_alg_sendmsg
Summary
In the Linux kernel, the following vulnerability has been resolved:
crypto: af_alg - Set merge to zero early in af_alg_sendmsg
If an error causes af_alg_sendmsg to abort, ctx->merge may contain
a garbage value from the previous loop. This may then trigger a
crash on the next entry into af_alg_sendmsg when it attempts to do
a merge that can't be done.
Fix this by setting ctx->merge to zero near the start of the loop.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 6241b9e2809b12da9130894cf5beddf088dc1b8a
(git)
Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 2374c11189ef704a3e4863646369f1b8e6a27d71 (git) Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 24c1106504c625fabd3b7229611af617b4c27ac7 (git) Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 045ee26aa3920a47ec46d7fcb302420bf01fd753 (git) Affected: 8ff590903d5fc7f5a0a988c38267a3d08e6393a2 , < 9574b2330dbd2b5459b74d3b5e9619d39299fc6f (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6241b9e2809b12da9130894cf5beddf088dc1b8a",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "2374c11189ef704a3e4863646369f1b8e6a27d71",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "24c1106504c625fabd3b7229611af617b4c27ac7",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "045ee26aa3920a47ec46d7fcb302420bf01fd753",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
},
{
"lessThan": "9574b2330dbd2b5459b74d3b5e9619d39299fc6f",
"status": "affected",
"version": "8ff590903d5fc7f5a0a988c38267a3d08e6393a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"crypto/af_alg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.38"
},
{
"lessThan": "2.6.38",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "2.6.38",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "2.6.38",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: af_alg - Set merge to zero early in af_alg_sendmsg\n\nIf an error causes af_alg_sendmsg to abort, ctx-\u003emerge may contain\na garbage value from the previous loop. This may then trigger a\ncrash on the next entry into af_alg_sendmsg when it attempts to do\na merge that can\u0027t be done.\n\nFix this by setting ctx-\u003emerge to zero near the start of the loop."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:30:55.964Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6241b9e2809b12da9130894cf5beddf088dc1b8a"
},
{
"url": "https://git.kernel.org/stable/c/2374c11189ef704a3e4863646369f1b8e6a27d71"
},
{
"url": "https://git.kernel.org/stable/c/24c1106504c625fabd3b7229611af617b4c27ac7"
},
{
"url": "https://git.kernel.org/stable/c/045ee26aa3920a47ec46d7fcb302420bf01fd753"
},
{
"url": "https://git.kernel.org/stable/c/9574b2330dbd2b5459b74d3b5e9619d39299fc6f"
}
],
"title": "crypto: af_alg - Set merge to zero early in af_alg_sendmsg",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39931",
"datePublished": "2025-10-04T07:30:55.964Z",
"dateReserved": "2025-04-16T07:20:57.147Z",
"dateUpdated": "2025-10-04T07:30:55.964Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50498 (GCVE-0-2022-50498)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
eth: alx: take rtnl_lock on resume
Summary
In the Linux kernel, the following vulnerability has been resolved:
eth: alx: take rtnl_lock on resume
Zbynek reports that alx trips an rtnl assertion on resume:
RTNL: assertion failed at net/core/dev.c (2891)
RIP: 0010:netif_set_real_num_tx_queues+0x1ac/0x1c0
Call Trace:
<TASK>
__alx_open+0x230/0x570 [alx]
alx_resume+0x54/0x80 [alx]
? pci_legacy_resume+0x80/0x80
dpm_run_callback+0x4a/0x150
device_resume+0x8b/0x190
async_resume+0x19/0x30
async_run_entry_fn+0x30/0x130
process_one_work+0x1e5/0x3b0
indeed the driver does not hold rtnl_lock during its internal close
and re-open functions during suspend/resume. Note that this is not
a huge bug as the driver implements its own locking, and does not
implement changing the number of queues, but we need to silence
the splat.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4a5fe57e775188be96359a1934501be45fe5f705 , < 6f1991a940b90753b34570f093a21dba366e8cc0
(git)
Affected: 4a5fe57e775188be96359a1934501be45fe5f705 , < a845a0c4bdece2c0073ecea2fca7c4d5f0550f78 (git) Affected: 4a5fe57e775188be96359a1934501be45fe5f705 , < c0323c0fd07804d5874699e93f935cda0d989c67 (git) Affected: 4a5fe57e775188be96359a1934501be45fe5f705 , < 6ad1c94e1e7e374d88f0cfd77936dddb8339aaba (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/atheros/alx/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6f1991a940b90753b34570f093a21dba366e8cc0",
"status": "affected",
"version": "4a5fe57e775188be96359a1934501be45fe5f705",
"versionType": "git"
},
{
"lessThan": "a845a0c4bdece2c0073ecea2fca7c4d5f0550f78",
"status": "affected",
"version": "4a5fe57e775188be96359a1934501be45fe5f705",
"versionType": "git"
},
{
"lessThan": "c0323c0fd07804d5874699e93f935cda0d989c67",
"status": "affected",
"version": "4a5fe57e775188be96359a1934501be45fe5f705",
"versionType": "git"
},
{
"lessThan": "6ad1c94e1e7e374d88f0cfd77936dddb8339aaba",
"status": "affected",
"version": "4a5fe57e775188be96359a1934501be45fe5f705",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/atheros/alx/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.75",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.17",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: alx: take rtnl_lock on resume\n\nZbynek reports that alx trips an rtnl assertion on resume:\n\n RTNL: assertion failed at net/core/dev.c (2891)\n RIP: 0010:netif_set_real_num_tx_queues+0x1ac/0x1c0\n Call Trace:\n \u003cTASK\u003e\n __alx_open+0x230/0x570 [alx]\n alx_resume+0x54/0x80 [alx]\n ? pci_legacy_resume+0x80/0x80\n dpm_run_callback+0x4a/0x150\n device_resume+0x8b/0x190\n async_resume+0x19/0x30\n async_run_entry_fn+0x30/0x130\n process_one_work+0x1e5/0x3b0\n\nindeed the driver does not hold rtnl_lock during its internal close\nand re-open functions during suspend/resume. Note that this is not\na huge bug as the driver implements its own locking, and does not\nimplement changing the number of queues, but we need to silence\nthe splat."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:49.383Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6f1991a940b90753b34570f093a21dba366e8cc0"
},
{
"url": "https://git.kernel.org/stable/c/a845a0c4bdece2c0073ecea2fca7c4d5f0550f78"
},
{
"url": "https://git.kernel.org/stable/c/c0323c0fd07804d5874699e93f935cda0d989c67"
},
{
"url": "https://git.kernel.org/stable/c/6ad1c94e1e7e374d88f0cfd77936dddb8339aaba"
}
],
"title": "eth: alx: take rtnl_lock on resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50498",
"datePublished": "2025-10-04T15:43:49.383Z",
"dateReserved": "2025-10-04T15:39:19.464Z",
"dateUpdated": "2025-10-04T15:43:49.383Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53563 (GCVE-0-2023-53563)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver
Summary
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver
After loading the amd-pstate-ut driver, amd_pstate_ut_check_perf()
and amd_pstate_ut_check_freq() use cpufreq_cpu_get() to get the policy
of the CPU and mark it as busy.
In these functions, cpufreq_cpu_put() should be used to release the
policy, but it is not, so any other entity trying to access the policy
is blocked indefinitely.
One such scenario is when amd_pstate mode is changed, leading to the
following splat:
[ 1332.103727] INFO: task bash:2929 blocked for more than 120 seconds.
[ 1332.110001] Not tainted 6.5.0-rc2-amd-pstate-ut #5
[ 1332.115315] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 1332.123140] task:bash state:D stack:0 pid:2929 ppid:2873 flags:0x00004006
[ 1332.123143] Call Trace:
[ 1332.123145] <TASK>
[ 1332.123148] __schedule+0x3c1/0x16a0
[ 1332.123154] ? _raw_read_lock_irqsave+0x2d/0x70
[ 1332.123157] schedule+0x6f/0x110
[ 1332.123160] schedule_timeout+0x14f/0x160
[ 1332.123162] ? preempt_count_add+0x86/0xd0
[ 1332.123165] __wait_for_common+0x92/0x190
[ 1332.123168] ? __pfx_schedule_timeout+0x10/0x10
[ 1332.123170] wait_for_completion+0x28/0x30
[ 1332.123173] cpufreq_policy_put_kobj+0x4d/0x90
[ 1332.123177] cpufreq_policy_free+0x157/0x1d0
[ 1332.123178] ? preempt_count_add+0x58/0xd0
[ 1332.123180] cpufreq_remove_dev+0xb6/0x100
[ 1332.123182] subsys_interface_unregister+0x114/0x120
[ 1332.123185] ? preempt_count_add+0x58/0xd0
[ 1332.123187] ? __pfx_amd_pstate_change_driver_mode+0x10/0x10
[ 1332.123190] cpufreq_unregister_driver+0x3b/0xd0
[ 1332.123192] amd_pstate_change_driver_mode+0x1e/0x50
[ 1332.123194] store_status+0xe9/0x180
[ 1332.123197] dev_attr_store+0x1b/0x30
[ 1332.123199] sysfs_kf_write+0x42/0x50
[ 1332.123202] kernfs_fop_write_iter+0x143/0x1d0
[ 1332.123204] vfs_write+0x2df/0x400
[ 1332.123208] ksys_write+0x6b/0xf0
[ 1332.123210] __x64_sys_write+0x1d/0x30
[ 1332.123213] do_syscall_64+0x60/0x90
[ 1332.123216] ? fpregs_assert_state_consistent+0x2e/0x50
[ 1332.123219] ? exit_to_user_mode_prepare+0x49/0x1a0
[ 1332.123223] ? irqentry_exit_to_user_mode+0xd/0x20
[ 1332.123225] ? irqentry_exit+0x3f/0x50
[ 1332.123226] ? exc_page_fault+0x8e/0x190
[ 1332.123228] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 1332.123232] RIP: 0033:0x7fa74c514a37
[ 1332.123234] RSP: 002b:00007ffe31dd0788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 1332.123238] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007fa74c514a37
[ 1332.123239] RDX: 0000000000000008 RSI: 000055e27c447aa0 RDI: 0000000000000001
[ 1332.123241] RBP: 000055e27c447aa0 R08: 00007fa74c5d1460 R09: 000000007fffffff
[ 1332.123242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008
[ 1332.123244] R13: 00007fa74c61a780 R14: 00007fa74c616600 R15: 00007fa74c615a00
[ 1332.123247] </TASK>
Fix this by calling cpufreq_cpu_put() wherever necessary.
[ rjw: Subject and changelog edits ]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
14eb1c96e3a3fd9cd377ac9af3c7a410f8bf1015 , < fcf78a17bbb94bebaa912f0460a1848f7d374c94
(git)
Affected: 14eb1c96e3a3fd9cd377ac9af3c7a410f8bf1015 , < 84857640c67405eed258c461b3ef909002f1e201 (git) Affected: 14eb1c96e3a3fd9cd377ac9af3c7a410f8bf1015 , < 0f74f12ee042fd72e45f0e8700e063c84ef3883b (git) Affected: 14eb1c96e3a3fd9cd377ac9af3c7a410f8bf1015 , < 60dd283804479c4a52f995b713f448e2cd65b8c8 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/amd-pstate-ut.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fcf78a17bbb94bebaa912f0460a1848f7d374c94",
"status": "affected",
"version": "14eb1c96e3a3fd9cd377ac9af3c7a410f8bf1015",
"versionType": "git"
},
{
"lessThan": "84857640c67405eed258c461b3ef909002f1e201",
"status": "affected",
"version": "14eb1c96e3a3fd9cd377ac9af3c7a410f8bf1015",
"versionType": "git"
},
{
"lessThan": "0f74f12ee042fd72e45f0e8700e063c84ef3883b",
"status": "affected",
"version": "14eb1c96e3a3fd9cd377ac9af3c7a410f8bf1015",
"versionType": "git"
},
{
"lessThan": "60dd283804479c4a52f995b713f448e2cd65b8c8",
"status": "affected",
"version": "14eb1c96e3a3fd9cd377ac9af3c7a410f8bf1015",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/amd-pstate-ut.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.53",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.16",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: amd-pstate-ut: Fix kernel panic when loading the driver\n\nAfter loading the amd-pstate-ut driver, amd_pstate_ut_check_perf()\nand amd_pstate_ut_check_freq() use cpufreq_cpu_get() to get the policy\nof the CPU and mark it as busy.\n\nIn these functions, cpufreq_cpu_put() should be used to release the\npolicy, but it is not, so any other entity trying to access the policy\nis blocked indefinitely.\n\nOne such scenario is when amd_pstate mode is changed, leading to the\nfollowing splat:\n\n[ 1332.103727] INFO: task bash:2929 blocked for more than 120 seconds.\n[ 1332.110001] Not tainted 6.5.0-rc2-amd-pstate-ut #5\n[ 1332.115315] \"echo 0 \u003e /proc/sys/kernel/hung_task_timeout_secs\" disables this message.\n[ 1332.123140] task:bash state:D stack:0 pid:2929 ppid:2873 flags:0x00004006\n[ 1332.123143] Call Trace:\n[ 1332.123145] \u003cTASK\u003e\n[ 1332.123148] __schedule+0x3c1/0x16a0\n[ 1332.123154] ? _raw_read_lock_irqsave+0x2d/0x70\n[ 1332.123157] schedule+0x6f/0x110\n[ 1332.123160] schedule_timeout+0x14f/0x160\n[ 1332.123162] ? preempt_count_add+0x86/0xd0\n[ 1332.123165] __wait_for_common+0x92/0x190\n[ 1332.123168] ? __pfx_schedule_timeout+0x10/0x10\n[ 1332.123170] wait_for_completion+0x28/0x30\n[ 1332.123173] cpufreq_policy_put_kobj+0x4d/0x90\n[ 1332.123177] cpufreq_policy_free+0x157/0x1d0\n[ 1332.123178] ? preempt_count_add+0x58/0xd0\n[ 1332.123180] cpufreq_remove_dev+0xb6/0x100\n[ 1332.123182] subsys_interface_unregister+0x114/0x120\n[ 1332.123185] ? preempt_count_add+0x58/0xd0\n[ 1332.123187] ? __pfx_amd_pstate_change_driver_mode+0x10/0x10\n[ 1332.123190] cpufreq_unregister_driver+0x3b/0xd0\n[ 1332.123192] amd_pstate_change_driver_mode+0x1e/0x50\n[ 1332.123194] store_status+0xe9/0x180\n[ 1332.123197] dev_attr_store+0x1b/0x30\n[ 1332.123199] sysfs_kf_write+0x42/0x50\n[ 1332.123202] kernfs_fop_write_iter+0x143/0x1d0\n[ 1332.123204] vfs_write+0x2df/0x400\n[ 1332.123208] ksys_write+0x6b/0xf0\n[ 1332.123210] __x64_sys_write+0x1d/0x30\n[ 1332.123213] do_syscall_64+0x60/0x90\n[ 1332.123216] ? fpregs_assert_state_consistent+0x2e/0x50\n[ 1332.123219] ? exit_to_user_mode_prepare+0x49/0x1a0\n[ 1332.123223] ? irqentry_exit_to_user_mode+0xd/0x20\n[ 1332.123225] ? irqentry_exit+0x3f/0x50\n[ 1332.123226] ? exc_page_fault+0x8e/0x190\n[ 1332.123228] entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n[ 1332.123232] RIP: 0033:0x7fa74c514a37\n[ 1332.123234] RSP: 002b:00007ffe31dd0788 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ 1332.123238] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00007fa74c514a37\n[ 1332.123239] RDX: 0000000000000008 RSI: 000055e27c447aa0 RDI: 0000000000000001\n[ 1332.123241] RBP: 000055e27c447aa0 R08: 00007fa74c5d1460 R09: 000000007fffffff\n[ 1332.123242] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000008\n[ 1332.123244] R13: 00007fa74c61a780 R14: 00007fa74c616600 R15: 00007fa74c615a00\n[ 1332.123247] \u003c/TASK\u003e\n\nFix this by calling cpufreq_cpu_put() wherever necessary.\n\n[ rjw: Subject and changelog edits ]"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:06.340Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fcf78a17bbb94bebaa912f0460a1848f7d374c94"
},
{
"url": "https://git.kernel.org/stable/c/84857640c67405eed258c461b3ef909002f1e201"
},
{
"url": "https://git.kernel.org/stable/c/0f74f12ee042fd72e45f0e8700e063c84ef3883b"
},
{
"url": "https://git.kernel.org/stable/c/60dd283804479c4a52f995b713f448e2cd65b8c8"
}
],
"title": "cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53563",
"datePublished": "2025-10-04T15:17:06.340Z",
"dateReserved": "2025-10-04T15:14:15.923Z",
"dateUpdated": "2025-10-04T15:17:06.340Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50485 (GCVE-0-2022-50485)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-12-23 13:29
VLAI?
EPSS
Title
ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode
There are many places that will get unhappy (and crash) when ext4_iget()
returns a bad inode. However, if iget the boot loader inode, allows a bad
inode to be returned, because the inode may not be initialized. This
mechanism can be used to bypass some checks and cause panic. To solve this
problem, we add a special iget flag EXT4_IGET_BAD. Only with this flag
we'd be returning bad inode from ext4_iget(), otherwise we always return
the error code if the inode is bad inode.(suggested by Jan Kara)
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
393d1d1d76933886d5e1ce603214c9987589c6d5 , < 2142dfa1de61e25b83198af0308ec7689cca25d3
(git)
Affected: 393d1d1d76933886d5e1ce603214c9987589c6d5 , < c0a738875c2e9c8c3366d792f8bf7fe508d5e5a5 (git) Affected: 393d1d1d76933886d5e1ce603214c9987589c6d5 , < f7e6b5548f915d7aa435d0764d41eacfb49c6e09 (git) Affected: 393d1d1d76933886d5e1ce603214c9987589c6d5 , < f725b290ed79ad61e4f721fee95a287892d8b1ad (git) Affected: 393d1d1d76933886d5e1ce603214c9987589c6d5 , < 488a5c2bf7543c3cd3f07a025f2e62be91599430 (git) Affected: 393d1d1d76933886d5e1ce603214c9987589c6d5 , < 63b1e9bccb71fe7d7e3ddc9877dbdc85e5d2d023 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext4/ext4.h",
"fs/ext4/inode.c",
"fs/ext4/ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2142dfa1de61e25b83198af0308ec7689cca25d3",
"status": "affected",
"version": "393d1d1d76933886d5e1ce603214c9987589c6d5",
"versionType": "git"
},
{
"lessThan": "c0a738875c2e9c8c3366d792f8bf7fe508d5e5a5",
"status": "affected",
"version": "393d1d1d76933886d5e1ce603214c9987589c6d5",
"versionType": "git"
},
{
"lessThan": "f7e6b5548f915d7aa435d0764d41eacfb49c6e09",
"status": "affected",
"version": "393d1d1d76933886d5e1ce603214c9987589c6d5",
"versionType": "git"
},
{
"lessThan": "f725b290ed79ad61e4f721fee95a287892d8b1ad",
"status": "affected",
"version": "393d1d1d76933886d5e1ce603214c9987589c6d5",
"versionType": "git"
},
{
"lessThan": "488a5c2bf7543c3cd3f07a025f2e62be91599430",
"status": "affected",
"version": "393d1d1d76933886d5e1ce603214c9987589c6d5",
"versionType": "git"
},
{
"lessThan": "63b1e9bccb71fe7d7e3ddc9877dbdc85e5d2d023",
"status": "affected",
"version": "393d1d1d76933886d5e1ce603214c9987589c6d5",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext4/ext4.h",
"fs/ext4/inode.c",
"fs/ext4/ioctl.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.10"
},
{
"lessThan": "3.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.87",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.18",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.4",
"versionStartIncluding": "3.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "3.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: add EXT4_IGET_BAD flag to prevent unexpected bad inode\n\nThere are many places that will get unhappy (and crash) when ext4_iget()\nreturns a bad inode. However, if iget the boot loader inode, allows a bad\ninode to be returned, because the inode may not be initialized. This\nmechanism can be used to bypass some checks and cause panic. To solve this\nproblem, we add a special iget flag EXT4_IGET_BAD. Only with this flag\nwe\u0027d be returning bad inode from ext4_iget(), otherwise we always return\nthe error code if the inode is bad inode.(suggested by Jan Kara)"
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T13:29:37.091Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2142dfa1de61e25b83198af0308ec7689cca25d3"
},
{
"url": "https://git.kernel.org/stable/c/c0a738875c2e9c8c3366d792f8bf7fe508d5e5a5"
},
{
"url": "https://git.kernel.org/stable/c/f7e6b5548f915d7aa435d0764d41eacfb49c6e09"
},
{
"url": "https://git.kernel.org/stable/c/f725b290ed79ad61e4f721fee95a287892d8b1ad"
},
{
"url": "https://git.kernel.org/stable/c/488a5c2bf7543c3cd3f07a025f2e62be91599430"
},
{
"url": "https://git.kernel.org/stable/c/63b1e9bccb71fe7d7e3ddc9877dbdc85e5d2d023"
}
],
"title": "ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50485",
"datePublished": "2025-10-04T15:16:43.093Z",
"dateReserved": "2025-10-04T15:13:33.468Z",
"dateUpdated": "2025-12-23T13:29:37.091Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53570 (GCVE-0-2023-53570)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
nl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the
number of MBSSID elements in the nested netlink attribute attrs, which can
lead to an integer overflow if a user of the nl80211 interface specifies
256 or more elements in the corresponding attribute in userspace. The
integer overflow can lead to a heap buffer overflow as num_elems determines
the size of the trailing array in elems, and this array is thereafter
written to for each element in attrs.
Note that this vulnerability only affects devices with the
wiphy->mbssid_max_interfaces member set for the wireless physical device
struct in the device driver, and can only be triggered by a process with
CAP_NET_ADMIN capabilities.
Fix this by checking for a maximum of 255 elements in attrs.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
dc1e3cb8da8b414b37208b2fb6755fef8122504b , < e642eb67b8c10dcce758d549cc81564116e0fa49
(git)
Affected: dc1e3cb8da8b414b37208b2fb6755fef8122504b , < 7d09f9f255a5f78578deba5454923072bb53b16c (git) Affected: dc1e3cb8da8b414b37208b2fb6755fef8122504b , < 6311071a056272e1e761de8d0305e87cc566f734 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e642eb67b8c10dcce758d549cc81564116e0fa49",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
},
{
"lessThan": "7d09f9f255a5f78578deba5454923072bb53b16c",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
},
{
"lessThan": "6311071a056272e1e761de8d0305e87cc566f734",
"status": "affected",
"version": "dc1e3cb8da8b414b37208b2fb6755fef8122504b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/nl80211.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.46",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.11",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()\n\nnl80211_parse_mbssid_elems() uses a u8 variable num_elems to count the\nnumber of MBSSID elements in the nested netlink attribute attrs, which can\nlead to an integer overflow if a user of the nl80211 interface specifies\n256 or more elements in the corresponding attribute in userspace. The\ninteger overflow can lead to a heap buffer overflow as num_elems determines\nthe size of the trailing array in elems, and this array is thereafter\nwritten to for each element in attrs.\n\nNote that this vulnerability only affects devices with the\nwiphy-\u003embssid_max_interfaces member set for the wireless physical device\nstruct in the device driver, and can only be triggered by a process with\nCAP_NET_ADMIN capabilities.\n\nFix this by checking for a maximum of 255 elements in attrs."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:11.525Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e642eb67b8c10dcce758d549cc81564116e0fa49"
},
{
"url": "https://git.kernel.org/stable/c/7d09f9f255a5f78578deba5454923072bb53b16c"
},
{
"url": "https://git.kernel.org/stable/c/6311071a056272e1e761de8d0305e87cc566f734"
}
],
"title": "wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53570",
"datePublished": "2025-10-04T15:17:11.525Z",
"dateReserved": "2025-10-04T15:14:15.925Z",
"dateUpdated": "2025-10-04T15:17:11.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50497 (GCVE-0-2022-50497)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-12-23 13:29
VLAI?
EPSS
Title
binfmt_misc: fix shift-out-of-bounds in check_special_flags
Summary
In the Linux kernel, the following vulnerability has been resolved:
binfmt_misc: fix shift-out-of-bounds in check_special_flags
UBSAN reported a shift-out-of-bounds warning:
left shift of 1 by 31 places cannot be represented in type 'int'
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106
ubsan_epilogue+0xa/0x44 lib/ubsan.c:151
__ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322
check_special_flags fs/binfmt_misc.c:241 [inline]
create_entry fs/binfmt_misc.c:456 [inline]
bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654
vfs_write+0x11e/0x580 fs/read_write.c:582
ksys_write+0xcf/0x120 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x4194e1
Since the type of Node's flags is unsigned long, we should define these
macros with same type too.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0f1a48994b3e516d5c7fd5d12204fdba7a604771
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < ea6145370be8016755c43aca799815fc4b8c88b1 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 97382a2639b1cd9631f6069061e9d7062cd2b098 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 419b808504c26b3e3342365f34ccd0843e09a7f8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < dcbc51d31d0afbd45e830e3cf565a7b3ca7bf0d8 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 88cea1676a09f7c45a1438153a126610c33b1590 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a651bb5ff997b9f02662bcdef3d8b4e6f0d79656 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < a91123d4bda463469f68f0427adabf8108001f94 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 6a46bf558803dd2b959ca7435a5c143efe837217 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/binfmt_misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0f1a48994b3e516d5c7fd5d12204fdba7a604771",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "ea6145370be8016755c43aca799815fc4b8c88b1",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "97382a2639b1cd9631f6069061e9d7062cd2b098",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "419b808504c26b3e3342365f34ccd0843e09a7f8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "dcbc51d31d0afbd45e830e3cf565a7b3ca7bf0d8",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "88cea1676a09f7c45a1438153a126610c33b1590",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a651bb5ff997b9f02662bcdef3d8b4e6f0d79656",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "a91123d4bda463469f68f0427adabf8108001f94",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "6a46bf558803dd2b959ca7435a5c143efe837217",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/binfmt_misc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbinfmt_misc: fix shift-out-of-bounds in check_special_flags\n\nUBSAN reported a shift-out-of-bounds warning:\n\n left shift of 1 by 31 places cannot be represented in type \u0027int\u0027\n Call Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106\n ubsan_epilogue+0xa/0x44 lib/ubsan.c:151\n __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322\n check_special_flags fs/binfmt_misc.c:241 [inline]\n create_entry fs/binfmt_misc.c:456 [inline]\n bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654\n vfs_write+0x11e/0x580 fs/read_write.c:582\n ksys_write+0xcf/0x120 fs/read_write.c:637\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n RIP: 0033:0x4194e1\n\nSince the type of Node\u0027s flags is unsigned long, we should define these\nmacros with same type too."
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T13:29:41.395Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0f1a48994b3e516d5c7fd5d12204fdba7a604771"
},
{
"url": "https://git.kernel.org/stable/c/ea6145370be8016755c43aca799815fc4b8c88b1"
},
{
"url": "https://git.kernel.org/stable/c/97382a2639b1cd9631f6069061e9d7062cd2b098"
},
{
"url": "https://git.kernel.org/stable/c/419b808504c26b3e3342365f34ccd0843e09a7f8"
},
{
"url": "https://git.kernel.org/stable/c/dcbc51d31d0afbd45e830e3cf565a7b3ca7bf0d8"
},
{
"url": "https://git.kernel.org/stable/c/88cea1676a09f7c45a1438153a126610c33b1590"
},
{
"url": "https://git.kernel.org/stable/c/a651bb5ff997b9f02662bcdef3d8b4e6f0d79656"
},
{
"url": "https://git.kernel.org/stable/c/a91123d4bda463469f68f0427adabf8108001f94"
},
{
"url": "https://git.kernel.org/stable/c/6a46bf558803dd2b959ca7435a5c143efe837217"
}
],
"title": "binfmt_misc: fix shift-out-of-bounds in check_special_flags",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50497",
"datePublished": "2025-10-04T15:43:48.656Z",
"dateReserved": "2025-10-04T15:39:19.464Z",
"dateUpdated": "2025-12-23T13:29:41.395Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53592 (GCVE-0-2023-53592)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
gpio: sifive: Fix refcount leak in sifive_gpio_probe
Summary
In the Linux kernel, the following vulnerability has been resolved:
gpio: sifive: Fix refcount leak in sifive_gpio_probe
of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
96868dce644d002383f6d5eb575a6ce3c8779f39 , < f4a2ad1002006548e235255c65a4f1d07312be9d
(git)
Affected: 96868dce644d002383f6d5eb575a6ce3c8779f39 , < 95da1882ce9372ba20278f87cdb7a34f9812c4b5 (git) Affected: 96868dce644d002383f6d5eb575a6ce3c8779f39 , < f9fb4776ebbc16dfc512adbdc0fe218acb47c7cc (git) Affected: 96868dce644d002383f6d5eb575a6ce3c8779f39 , < 9a402a210798662b04cbe6ca466e916a15efa03a (git) Affected: 96868dce644d002383f6d5eb575a6ce3c8779f39 , < 694175cd8a1643cde3acb45c9294bca44a8e08e9 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-sifive.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f4a2ad1002006548e235255c65a4f1d07312be9d",
"status": "affected",
"version": "96868dce644d002383f6d5eb575a6ce3c8779f39",
"versionType": "git"
},
{
"lessThan": "95da1882ce9372ba20278f87cdb7a34f9812c4b5",
"status": "affected",
"version": "96868dce644d002383f6d5eb575a6ce3c8779f39",
"versionType": "git"
},
{
"lessThan": "f9fb4776ebbc16dfc512adbdc0fe218acb47c7cc",
"status": "affected",
"version": "96868dce644d002383f6d5eb575a6ce3c8779f39",
"versionType": "git"
},
{
"lessThan": "9a402a210798662b04cbe6ca466e916a15efa03a",
"status": "affected",
"version": "96868dce644d002383f6d5eb575a6ce3c8779f39",
"versionType": "git"
},
{
"lessThan": "694175cd8a1643cde3acb45c9294bca44a8e08e9",
"status": "affected",
"version": "96868dce644d002383f6d5eb575a6ce3c8779f39",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpio/gpio-sifive.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.87",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.19",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.5",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngpio: sifive: Fix refcount leak in sifive_gpio_probe\n\nof_irq_find_parent() returns a node pointer with refcount incremented,\nWe should use of_node_put() on it when not needed anymore.\nAdd missing of_node_put() to avoid refcount leak."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:06.162Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f4a2ad1002006548e235255c65a4f1d07312be9d"
},
{
"url": "https://git.kernel.org/stable/c/95da1882ce9372ba20278f87cdb7a34f9812c4b5"
},
{
"url": "https://git.kernel.org/stable/c/f9fb4776ebbc16dfc512adbdc0fe218acb47c7cc"
},
{
"url": "https://git.kernel.org/stable/c/9a402a210798662b04cbe6ca466e916a15efa03a"
},
{
"url": "https://git.kernel.org/stable/c/694175cd8a1643cde3acb45c9294bca44a8e08e9"
}
],
"title": "gpio: sifive: Fix refcount leak in sifive_gpio_probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53592",
"datePublished": "2025-10-04T15:44:06.162Z",
"dateReserved": "2025-10-04T15:40:38.478Z",
"dateUpdated": "2025-10-04T15:44:06.162Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50472 (GCVE-0-2022-50472)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
IB/mad: Don't call to function that might sleep while in atomic context
Summary
In the Linux kernel, the following vulnerability has been resolved:
IB/mad: Don't call to function that might sleep while in atomic context
Tracepoints are not allowed to sleep, as such the following splat is
generated due to call to ib_query_pkey() in atomic context.
WARNING: CPU: 0 PID: 1888000 at kernel/trace/ring_buffer.c:2492 rb_commit+0xc1/0x220
CPU: 0 PID: 1888000 Comm: kworker/u9:0 Kdump: loaded Tainted: G OE --------- - - 4.18.0-305.3.1.el8.x86_64 #1
Hardware name: Red Hat KVM, BIOS 1.13.0-2.module_el8.3.0+555+a55c8938 04/01/2014
Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]
RIP: 0010:rb_commit+0xc1/0x220
RSP: 0000:ffffa8ac80f9bca0 EFLAGS: 00010202
RAX: ffff8951c7c01300 RBX: ffff8951c7c14a00 RCX: 0000000000000246
RDX: ffff8951c707c000 RSI: ffff8951c707c57c RDI: ffff8951c7c14a00
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: ffff8951c7c01300 R11: 0000000000000001 R12: 0000000000000246
R13: 0000000000000000 R14: ffffffff964c70c0 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8951fbc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f20e8f39010 CR3: 000000002ca10005 CR4: 0000000000170ef0
Call Trace:
ring_buffer_unlock_commit+0x1d/0xa0
trace_buffer_unlock_commit_regs+0x3b/0x1b0
trace_event_buffer_commit+0x67/0x1d0
trace_event_raw_event_ib_mad_recv_done_handler+0x11c/0x160 [ib_core]
ib_mad_recv_done+0x48b/0xc10 [ib_core]
? trace_event_raw_event_cq_poll+0x6f/0xb0 [ib_core]
__ib_process_cq+0x91/0x1c0 [ib_core]
ib_cq_poll_work+0x26/0x80 [ib_core]
process_one_work+0x1a7/0x360
? create_worker+0x1a0/0x1a0
worker_thread+0x30/0x390
? create_worker+0x1a0/0x1a0
kthread+0x116/0x130
? kthread_flush_work_fn+0x10/0x10
ret_from_fork+0x35/0x40
---[ end trace 78ba8509d3830a16 ]---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
821bf1de45a1a084e2e11b1a2308777434194bfe , < 47e31b86edff36f2d26cbc88ce695d98ff804178
(git)
Affected: 821bf1de45a1a084e2e11b1a2308777434194bfe , < cea70a572c0cb9728d728cfebe7d5bd485e97513 (git) Affected: 821bf1de45a1a084e2e11b1a2308777434194bfe , < fa8a2f3be78e4585996bcf4c15e4504441a4c7a0 (git) Affected: 821bf1de45a1a084e2e11b1a2308777434194bfe , < 5c20311d76cbaeb7ed2ecf9c8b8322f8fc4a7ae3 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/mad.c",
"include/trace/events/ib_mad.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "47e31b86edff36f2d26cbc88ce695d98ff804178",
"status": "affected",
"version": "821bf1de45a1a084e2e11b1a2308777434194bfe",
"versionType": "git"
},
{
"lessThan": "cea70a572c0cb9728d728cfebe7d5bd485e97513",
"status": "affected",
"version": "821bf1de45a1a084e2e11b1a2308777434194bfe",
"versionType": "git"
},
{
"lessThan": "fa8a2f3be78e4585996bcf4c15e4504441a4c7a0",
"status": "affected",
"version": "821bf1de45a1a084e2e11b1a2308777434194bfe",
"versionType": "git"
},
{
"lessThan": "5c20311d76cbaeb7ed2ecf9c8b8322f8fc4a7ae3",
"status": "affected",
"version": "821bf1de45a1a084e2e11b1a2308777434194bfe",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/infiniband/core/mad.c",
"include/trace/events/ib_mad.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mad: Don\u0027t call to function that might sleep while in atomic context\n\nTracepoints are not allowed to sleep, as such the following splat is\ngenerated due to call to ib_query_pkey() in atomic context.\n\nWARNING: CPU: 0 PID: 1888000 at kernel/trace/ring_buffer.c:2492 rb_commit+0xc1/0x220\nCPU: 0 PID: 1888000 Comm: kworker/u9:0 Kdump: loaded Tainted: G OE --------- - - 4.18.0-305.3.1.el8.x86_64 #1\n Hardware name: Red Hat KVM, BIOS 1.13.0-2.module_el8.3.0+555+a55c8938 04/01/2014\n Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core]\n RIP: 0010:rb_commit+0xc1/0x220\n RSP: 0000:ffffa8ac80f9bca0 EFLAGS: 00010202\n RAX: ffff8951c7c01300 RBX: ffff8951c7c14a00 RCX: 0000000000000246\n RDX: ffff8951c707c000 RSI: ffff8951c707c57c RDI: ffff8951c7c14a00\n RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000\n R10: ffff8951c7c01300 R11: 0000000000000001 R12: 0000000000000246\n R13: 0000000000000000 R14: ffffffff964c70c0 R15: 0000000000000000\n FS: 0000000000000000(0000) GS:ffff8951fbc00000(0000) knlGS:0000000000000000\n CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n CR2: 00007f20e8f39010 CR3: 000000002ca10005 CR4: 0000000000170ef0\n Call Trace:\n ring_buffer_unlock_commit+0x1d/0xa0\n trace_buffer_unlock_commit_regs+0x3b/0x1b0\n trace_event_buffer_commit+0x67/0x1d0\n trace_event_raw_event_ib_mad_recv_done_handler+0x11c/0x160 [ib_core]\n ib_mad_recv_done+0x48b/0xc10 [ib_core]\n ? trace_event_raw_event_cq_poll+0x6f/0xb0 [ib_core]\n __ib_process_cq+0x91/0x1c0 [ib_core]\n ib_cq_poll_work+0x26/0x80 [ib_core]\n process_one_work+0x1a7/0x360\n ? create_worker+0x1a0/0x1a0\n worker_thread+0x30/0x390\n ? create_worker+0x1a0/0x1a0\n kthread+0x116/0x130\n ? kthread_flush_work_fn+0x10/0x10\n ret_from_fork+0x35/0x40\n ---[ end trace 78ba8509d3830a16 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:34.180Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/47e31b86edff36f2d26cbc88ce695d98ff804178"
},
{
"url": "https://git.kernel.org/stable/c/cea70a572c0cb9728d728cfebe7d5bd485e97513"
},
{
"url": "https://git.kernel.org/stable/c/fa8a2f3be78e4585996bcf4c15e4504441a4c7a0"
},
{
"url": "https://git.kernel.org/stable/c/5c20311d76cbaeb7ed2ecf9c8b8322f8fc4a7ae3"
}
],
"title": "IB/mad: Don\u0027t call to function that might sleep while in atomic context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50472",
"datePublished": "2025-10-04T15:16:34.180Z",
"dateReserved": "2025-10-04T15:13:33.466Z",
"dateUpdated": "2025-10-04T15:16:34.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50508 (GCVE-0-2022-50508)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power
After 'commit ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct
mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for
vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}.
Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt76x0/phy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bf425c5d7ef6fb4083c1e0d46440f886127b5ee5",
"status": "affected",
"version": "ba45841ca5eb29245f9c9f452a39586d9d68bc12",
"versionType": "git"
},
{
"lessThan": "6e1abc51c945663bddebfa1beb9590ff5b250eb7",
"status": "affected",
"version": "ba45841ca5eb29245f9c9f452a39586d9d68bc12",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/mediatek/mt76/mt76x0/phy.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power\n\nAfter \u0027commit ba45841ca5eb (\"wifi: mt76: mt76x02: simplify struct\nmt76x02_rate_power\")\u0027, mt76x02 relies on ht[0-7] rate_power data for\nvht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}.\nFix a possible out-of-bound access in mt76x0_phy_get_target_power routine."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:56.372Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bf425c5d7ef6fb4083c1e0d46440f886127b5ee5"
},
{
"url": "https://git.kernel.org/stable/c/6e1abc51c945663bddebfa1beb9590ff5b250eb7"
}
],
"title": "wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50508",
"datePublished": "2025-10-04T15:43:56.372Z",
"dateReserved": "2025-10-04T15:39:19.465Z",
"dateUpdated": "2025-10-04T15:43:56.372Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53542 (GCVE-0-2023-53542)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
Summary
In the Linux kernel, the following vulnerability has been resolved:
ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy
For some reason, the driver adding support for Exynos5420 MIPI phy
back in 2016 wasn't used on Exynos5420, which caused a kernel panic.
Add the proper compatible for it.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
d1ed0d21695f632f8ec7bf8588abcf6a8da2b105 , < c075aa3467a799855a92289a3c619afc0a2ad193
(git)
Affected: d1ed0d21695f632f8ec7bf8588abcf6a8da2b105 , < 537bdfc1a67836fbd68bbe4210bc380f72cca47f (git) Affected: d1ed0d21695f632f8ec7bf8588abcf6a8da2b105 , < f10001af0f7246cf3e43530d25f8d59a8db10df6 (git) Affected: d1ed0d21695f632f8ec7bf8588abcf6a8da2b105 , < 199624f3144d79fab1cff533ce6a4b82390520a3 (git) Affected: d1ed0d21695f632f8ec7bf8588abcf6a8da2b105 , < 2e68a0f7bc576318a58335c31c542b358bc63f83 (git) Affected: d1ed0d21695f632f8ec7bf8588abcf6a8da2b105 , < f2a6198f5ed7d6e4e06d87a4de007f2e45cc9583 (git) Affected: d1ed0d21695f632f8ec7bf8588abcf6a8da2b105 , < 29961ee63dd676cc67f7c00f76faa21e11f0d7c6 (git) Affected: d1ed0d21695f632f8ec7bf8588abcf6a8da2b105 , < 5d5aa219a790d61cad2c38e1aa32058f16ad2f0b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/arm/boot/dts/exynos5420.dtsi"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c075aa3467a799855a92289a3c619afc0a2ad193",
"status": "affected",
"version": "d1ed0d21695f632f8ec7bf8588abcf6a8da2b105",
"versionType": "git"
},
{
"lessThan": "537bdfc1a67836fbd68bbe4210bc380f72cca47f",
"status": "affected",
"version": "d1ed0d21695f632f8ec7bf8588abcf6a8da2b105",
"versionType": "git"
},
{
"lessThan": "f10001af0f7246cf3e43530d25f8d59a8db10df6",
"status": "affected",
"version": "d1ed0d21695f632f8ec7bf8588abcf6a8da2b105",
"versionType": "git"
},
{
"lessThan": "199624f3144d79fab1cff533ce6a4b82390520a3",
"status": "affected",
"version": "d1ed0d21695f632f8ec7bf8588abcf6a8da2b105",
"versionType": "git"
},
{
"lessThan": "2e68a0f7bc576318a58335c31c542b358bc63f83",
"status": "affected",
"version": "d1ed0d21695f632f8ec7bf8588abcf6a8da2b105",
"versionType": "git"
},
{
"lessThan": "f2a6198f5ed7d6e4e06d87a4de007f2e45cc9583",
"status": "affected",
"version": "d1ed0d21695f632f8ec7bf8588abcf6a8da2b105",
"versionType": "git"
},
{
"lessThan": "29961ee63dd676cc67f7c00f76faa21e11f0d7c6",
"status": "affected",
"version": "d1ed0d21695f632f8ec7bf8588abcf6a8da2b105",
"versionType": "git"
},
{
"lessThan": "5d5aa219a790d61cad2c38e1aa32058f16ad2f0b",
"status": "affected",
"version": "d1ed0d21695f632f8ec7bf8588abcf6a8da2b105",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/arm/boot/dts/exynos5420.dtsi"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.308",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.276",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.308",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.276",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.235",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy\n\nFor some reason, the driver adding support for Exynos5420 MIPI phy\nback in 2016 wasn\u0027t used on Exynos5420, which caused a kernel panic.\nAdd the proper compatible for it."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:16.678Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c075aa3467a799855a92289a3c619afc0a2ad193"
},
{
"url": "https://git.kernel.org/stable/c/537bdfc1a67836fbd68bbe4210bc380f72cca47f"
},
{
"url": "https://git.kernel.org/stable/c/f10001af0f7246cf3e43530d25f8d59a8db10df6"
},
{
"url": "https://git.kernel.org/stable/c/199624f3144d79fab1cff533ce6a4b82390520a3"
},
{
"url": "https://git.kernel.org/stable/c/2e68a0f7bc576318a58335c31c542b358bc63f83"
},
{
"url": "https://git.kernel.org/stable/c/f2a6198f5ed7d6e4e06d87a4de007f2e45cc9583"
},
{
"url": "https://git.kernel.org/stable/c/29961ee63dd676cc67f7c00f76faa21e11f0d7c6"
},
{
"url": "https://git.kernel.org/stable/c/5d5aa219a790d61cad2c38e1aa32058f16ad2f0b"
}
],
"title": "ARM: dts: exynos: Use Exynos5420 compatible for the MIPI video phy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53542",
"datePublished": "2025-10-04T15:16:51.440Z",
"dateReserved": "2025-10-04T15:14:15.920Z",
"dateUpdated": "2026-01-05T10:21:16.678Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53588 (GCVE-0-2023-53588)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
wifi: mac80211: check for station first in client probe
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: mac80211: check for station first in client probe
When probing a client, first check if we have it, and then
check for the channel context, otherwise you can trigger
the warning there easily by probing when the AP isn't even
started yet. Since a client existing means the AP is also
operating, we can then keep the warning.
Also simplify the moved code a bit.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
55de908ab292c03f1eb280f51170ddb9c6b57e31 , < 7e1cda5cf07f848e6b50b4e5e7761ffbce905a3d
(git)
Affected: 55de908ab292c03f1eb280f51170ddb9c6b57e31 , < 7dce2deb0b03aaf46c87ceedea81ef4153e26c40 (git) Affected: 55de908ab292c03f1eb280f51170ddb9c6b57e31 , < 67dfa589aa8806c7959cbca2f4613b8d41c75a06 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7e1cda5cf07f848e6b50b4e5e7761ffbce905a3d",
"status": "affected",
"version": "55de908ab292c03f1eb280f51170ddb9c6b57e31",
"versionType": "git"
},
{
"lessThan": "7dce2deb0b03aaf46c87ceedea81ef4153e26c40",
"status": "affected",
"version": "55de908ab292c03f1eb280f51170ddb9c6b57e31",
"versionType": "git"
},
{
"lessThan": "67dfa589aa8806c7959cbca2f4613b8d41c75a06",
"status": "affected",
"version": "55de908ab292c03f1eb280f51170ddb9c6b57e31",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/mac80211/cfg.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.8"
},
{
"lessThan": "3.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.55",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.5",
"versionStartIncluding": "3.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "3.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: mac80211: check for station first in client probe\n\nWhen probing a client, first check if we have it, and then\ncheck for the channel context, otherwise you can trigger\nthe warning there easily by probing when the AP isn\u0027t even\nstarted yet. Since a client existing means the AP is also\noperating, we can then keep the warning.\n\nAlso simplify the moved code a bit."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:25.575Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7e1cda5cf07f848e6b50b4e5e7761ffbce905a3d"
},
{
"url": "https://git.kernel.org/stable/c/7dce2deb0b03aaf46c87ceedea81ef4153e26c40"
},
{
"url": "https://git.kernel.org/stable/c/67dfa589aa8806c7959cbca2f4613b8d41c75a06"
}
],
"title": "wifi: mac80211: check for station first in client probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53588",
"datePublished": "2025-10-04T15:44:03.354Z",
"dateReserved": "2025-10-04T15:40:38.477Z",
"dateUpdated": "2026-01-05T10:21:25.575Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53602 (GCVE-0-2023-53602)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-06 09:07
VLAI?
EPSS
Title
wifi: ath11k: fix memory leak in WMI firmware stats
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: ath11k: fix memory leak in WMI firmware stats
Memory allocated for firmware pdev, vdev and beacon statistics
are not released during rmmod.
Fix it by calling ath11k_fw_stats_free() function before hardware
unregister.
While at it, avoid calling ath11k_fw_stats_free() while processing
the firmware stats received in the WMI event because the local list
is getting spliced and reinitialised and hence there are no elements
in the list after splicing.
Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
d5c65159f2895379e11ca13f62feabe93278985d , < 86f9330a49d1464849482298dd34d361859183eb
(git)
Affected: d5c65159f2895379e11ca13f62feabe93278985d , < 55248d36beb79d3a61c9fb3122dc377fff523c89 (git) Affected: d5c65159f2895379e11ca13f62feabe93278985d , < 6aafa1c2d3e3fea2ebe84c018003f2a91722e607 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath11k/mac.c",
"drivers/net/wireless/ath/ath11k/wmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "86f9330a49d1464849482298dd34d361859183eb",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
},
{
"lessThan": "55248d36beb79d3a61c9fb3122dc377fff523c89",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
},
{
"lessThan": "6aafa1c2d3e3fea2ebe84c018003f2a91722e607",
"status": "affected",
"version": "d5c65159f2895379e11ca13f62feabe93278985d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/ath/ath11k/mac.c",
"drivers/net/wireless/ath/ath11k/wmi.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.42",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.7",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: ath11k: fix memory leak in WMI firmware stats\n\nMemory allocated for firmware pdev, vdev and beacon statistics\nare not released during rmmod.\n\nFix it by calling ath11k_fw_stats_free() function before hardware\nunregister.\n\nWhile at it, avoid calling ath11k_fw_stats_free() while processing\nthe firmware stats received in the WMI event because the local list\nis getting spliced and reinitialised and hence there are no elements\nin the list after splicing.\n\nTested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T09:07:20.856Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/86f9330a49d1464849482298dd34d361859183eb"
},
{
"url": "https://git.kernel.org/stable/c/55248d36beb79d3a61c9fb3122dc377fff523c89"
},
{
"url": "https://git.kernel.org/stable/c/6aafa1c2d3e3fea2ebe84c018003f2a91722e607"
}
],
"title": "wifi: ath11k: fix memory leak in WMI firmware stats",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53602",
"datePublished": "2025-10-04T15:44:13.155Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-06T09:07:20.856Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53574 (GCVE-0-2023-53574)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-06 09:07
VLAI?
EPSS
Title
wifi: rtw88: delete timer and free skb queue when unloading
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: rtw88: delete timer and free skb queue when unloading
Fix possible crash and memory leak on driver unload by deleting
TX purge timer and freeing C2H queue in 'rtw_core_deinit()',
shrink critical section in the latter by freeing COEX queue
out of TX report lock scope.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw88/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4128b00a6006870e117ab1841e58f369e9284ecb",
"status": "affected",
"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
"versionType": "git"
},
{
"lessThan": "634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216",
"status": "affected",
"version": "e3037485c68ec1a299ff41160d8fedbd4abc29b9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/realtek/rtw88/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.2"
},
{
"lessThan": "5.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.5",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "5.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: rtw88: delete timer and free skb queue when unloading\n\nFix possible crash and memory leak on driver unload by deleting\nTX purge timer and freeing C2H queue in \u0027rtw_core_deinit()\u0027,\nshrink critical section in the latter by freeing COEX queue\nout of TX report lock scope."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T09:07:18.330Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4128b00a6006870e117ab1841e58f369e9284ecb"
},
{
"url": "https://git.kernel.org/stable/c/634fcbcaa4062db39aeb5ac6ed1bc1feb8dd5216"
}
],
"title": "wifi: rtw88: delete timer and free skb queue when unloading",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53574",
"datePublished": "2025-10-04T15:17:14.532Z",
"dateReserved": "2025-10-04T15:14:15.925Z",
"dateUpdated": "2025-10-06T09:07:18.330Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53584 (GCVE-0-2023-53584)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
Summary
In the Linux kernel, the following vulnerability has been resolved:
ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process
There are two states for ubifs writing pages:
1. Dirty, Private
2. Not Dirty, Not Private
The normal process cannot go to ubifs_releasepage() which means there
exists pages being private but not dirty. Reproducer[1] shows that it
could occur (which maybe related to [2]) with following process:
PA PB PC
lock(page)[PA]
ubifs_write_end
attach_page_private // set Private
__set_page_dirty_nobuffers // set Dirty
unlock(page)
write_cache_pages[PA]
lock(page)
clear_page_dirty_for_io(page) // clear Dirty
ubifs_writepage
do_truncation[PB]
truncate_setsize
i_size_write(inode, newsize) // newsize = 0
i_size = i_size_read(inode) // i_size = 0
end_index = i_size >> PAGE_SHIFT
if (page->index > end_index)
goto out // jump
out:
unlock(page) // Private, Not Dirty
generic_fadvise[PC]
lock(page)
invalidate_inode_page
try_to_release_page
ubifs_releasepage
ubifs_assert(c, 0)
// bad assertion!
unlock(page)
truncate_pagecache[PB]
Then we may get following assertion failed:
UBIFS error (ubi0:0 pid 1683): ubifs_assert_failed [ubifs]:
UBIFS assert failed: 0, in fs/ubifs/file.c:1513
UBIFS warning (ubi0:0 pid 1683): ubifs_ro_mode [ubifs]:
switched to read-only mode, error -22
CPU: 2 PID: 1683 Comm: aa Not tainted 5.16.0-rc5-00184-g0bca5994cacc-dirty #308
Call Trace:
dump_stack+0x13/0x1b
ubifs_ro_mode+0x54/0x60 [ubifs]
ubifs_assert_failed+0x4b/0x80 [ubifs]
ubifs_releasepage+0x67/0x1d0 [ubifs]
try_to_release_page+0x57/0xe0
invalidate_inode_page+0xfb/0x130
__invalidate_mapping_pages+0xb9/0x280
invalidate_mapping_pagevec+0x12/0x20
generic_fadvise+0x303/0x3c0
ksys_fadvise64_64+0x4c/0xb0
[1] https://bugzilla.kernel.org/show_bug.cgi?id=215373
[2] https://linux-mtd.infradead.narkive.com/NQoBeT1u/patch-rfc-ubifs-fix-assert-failed-in-ubifs-set-page-dirty
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 7750be5d3e18500b454714677463b500a0b8b0d8
(git)
Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < bd188ff1c8a1935c93a1e3cacf3be62667fdf762 (git) Affected: 1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d , < 66f4742e93523ab2f062d9d9828b3e590bc61536 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ubifs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "7750be5d3e18500b454714677463b500a0b8b0d8",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "bd188ff1c8a1935c93a1e3cacf3be62667fdf762",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
},
{
"lessThan": "66f4742e93523ab2f062d9d9828b3e590bc61536",
"status": "affected",
"version": "1e51764a3c2ac05a23a22b2a95ddee4d9bffb16d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ubifs/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.18",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.18",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.5",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process\n\nThere are two states for ubifs writing pages:\n1. Dirty, Private\n2. Not Dirty, Not Private\n\nThe normal process cannot go to ubifs_releasepage() which means there\nexists pages being private but not dirty. Reproducer[1] shows that it\ncould occur (which maybe related to [2]) with following process:\n\n PA PB PC\nlock(page)[PA]\nubifs_write_end\n attach_page_private // set Private\n __set_page_dirty_nobuffers // set Dirty\nunlock(page)\n\nwrite_cache_pages[PA]\n lock(page)\n clear_page_dirty_for_io(page)\t// clear Dirty\n ubifs_writepage\n\n do_truncation[PB]\n\t\t\t truncate_setsize\n\t\t\t i_size_write(inode, newsize) // newsize = 0\n\n i_size = i_size_read(inode)\t// i_size = 0\n end_index = i_size \u003e\u003e PAGE_SHIFT\n if (page-\u003eindex \u003e end_index)\n goto out // jump\nout:\nunlock(page) // Private, Not Dirty\n\n\t\t\t\t\t\tgeneric_fadvise[PC]\n\t\t\t\t\t\t lock(page)\n\t\t\t\t\t\t invalidate_inode_page\n\t\t\t\t\t\t try_to_release_page\n\t\t\t\t\t\t ubifs_releasepage\n\t\t\t\t\t\t ubifs_assert(c, 0)\n\t\t // bad assertion!\n\t\t\t\t\t\t unlock(page)\n\t\t\t truncate_pagecache[PB]\n\nThen we may get following assertion failed:\n UBIFS error (ubi0:0 pid 1683): ubifs_assert_failed [ubifs]:\n UBIFS assert failed: 0, in fs/ubifs/file.c:1513\n UBIFS warning (ubi0:0 pid 1683): ubifs_ro_mode [ubifs]:\n switched to read-only mode, error -22\n CPU: 2 PID: 1683 Comm: aa Not tainted 5.16.0-rc5-00184-g0bca5994cacc-dirty #308\n Call Trace:\n dump_stack+0x13/0x1b\n ubifs_ro_mode+0x54/0x60 [ubifs]\n ubifs_assert_failed+0x4b/0x80 [ubifs]\n ubifs_releasepage+0x67/0x1d0 [ubifs]\n try_to_release_page+0x57/0xe0\n invalidate_inode_page+0xfb/0x130\n __invalidate_mapping_pages+0xb9/0x280\n invalidate_mapping_pagevec+0x12/0x20\n generic_fadvise+0x303/0x3c0\n ksys_fadvise64_64+0x4c/0xb0\n\n[1] https://bugzilla.kernel.org/show_bug.cgi?id=215373\n[2] https://linux-mtd.infradead.narkive.com/NQoBeT1u/patch-rfc-ubifs-fix-assert-failed-in-ubifs-set-page-dirty"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:59.835Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/7750be5d3e18500b454714677463b500a0b8b0d8"
},
{
"url": "https://git.kernel.org/stable/c/bd188ff1c8a1935c93a1e3cacf3be62667fdf762"
},
{
"url": "https://git.kernel.org/stable/c/66f4742e93523ab2f062d9d9828b3e590bc61536"
}
],
"title": "ubifs: ubifs_releasepage: Remove ubifs_assert(0) to valid this process",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53584",
"datePublished": "2025-10-04T15:43:59.835Z",
"dateReserved": "2025-10-04T15:40:38.477Z",
"dateUpdated": "2025-10-04T15:43:59.835Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50490 (GCVE-0-2022-50490)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
bpf: Propagate error from htab_lock_bucket() to userspace
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: Propagate error from htab_lock_bucket() to userspace
In __htab_map_lookup_and_delete_batch() if htab_lock_bucket() returns
-EBUSY, it will go to next bucket. Going to next bucket may not only
skip the elements in current bucket silently, but also incur
out-of-bound memory access or expose kernel memory to userspace if
current bucket_cnt is greater than bucket_size or zero.
Fixing it by stopping batch operation and returning -EBUSY when
htab_lock_bucket() fails, and the application can retry or skip the busy
batch as needed.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
20b6cc34ea74b6a84599c1f8a70f3315b56a1883 , < 0e13425104903970a5ede853082d3bbb4edec6f3
(git)
Affected: 20b6cc34ea74b6a84599c1f8a70f3315b56a1883 , < 6bfee6eb3d6b96ae730a542909dd22b5f9f50d58 (git) Affected: 20b6cc34ea74b6a84599c1f8a70f3315b56a1883 , < 4f1f39a8f1ce1b24fee6852d7dcd704ce7c4334d (git) Affected: 20b6cc34ea74b6a84599c1f8a70f3315b56a1883 , < 66a7a92e4d0d091e79148a4c6ec15d1da65f4280 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/hashtab.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0e13425104903970a5ede853082d3bbb4edec6f3",
"status": "affected",
"version": "20b6cc34ea74b6a84599c1f8a70f3315b56a1883",
"versionType": "git"
},
{
"lessThan": "6bfee6eb3d6b96ae730a542909dd22b5f9f50d58",
"status": "affected",
"version": "20b6cc34ea74b6a84599c1f8a70f3315b56a1883",
"versionType": "git"
},
{
"lessThan": "4f1f39a8f1ce1b24fee6852d7dcd704ce7c4334d",
"status": "affected",
"version": "20b6cc34ea74b6a84599c1f8a70f3315b56a1883",
"versionType": "git"
},
{
"lessThan": "66a7a92e4d0d091e79148a4c6ec15d1da65f4280",
"status": "affected",
"version": "20b6cc34ea74b6a84599c1f8a70f3315b56a1883",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/hashtab.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.75",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.17",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Propagate error from htab_lock_bucket() to userspace\n\nIn __htab_map_lookup_and_delete_batch() if htab_lock_bucket() returns\n-EBUSY, it will go to next bucket. Going to next bucket may not only\nskip the elements in current bucket silently, but also incur\nout-of-bound memory access or expose kernel memory to userspace if\ncurrent bucket_cnt is greater than bucket_size or zero.\n\nFixing it by stopping batch operation and returning -EBUSY when\nhtab_lock_bucket() fails, and the application can retry or skip the busy\nbatch as needed."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:43.790Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0e13425104903970a5ede853082d3bbb4edec6f3"
},
{
"url": "https://git.kernel.org/stable/c/6bfee6eb3d6b96ae730a542909dd22b5f9f50d58"
},
{
"url": "https://git.kernel.org/stable/c/4f1f39a8f1ce1b24fee6852d7dcd704ce7c4334d"
},
{
"url": "https://git.kernel.org/stable/c/66a7a92e4d0d091e79148a4c6ec15d1da65f4280"
}
],
"title": "bpf: Propagate error from htab_lock_bucket() to userspace",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50490",
"datePublished": "2025-10-04T15:43:43.790Z",
"dateReserved": "2025-10-04T15:39:19.463Z",
"dateUpdated": "2025-10-04T15:43:43.790Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39948 (GCVE-0-2025-39948)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:31
VLAI?
EPSS
Title
ice: fix Rx page leak on multi-buffer frames
Summary
In the Linux kernel, the following vulnerability has been resolved:
ice: fix Rx page leak on multi-buffer frames
The ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each
buffer in the current frame. This function was introduced as part of
handling multi-buffer XDP support in the ice driver.
It works by iterating over the buffers from first_desc up to 1 plus the
total number of fragments in the frame, cached from before the XDP program
was executed.
If the hardware posts a descriptor with a size of 0, the logic used in
ice_put_rx_mbuf() breaks. Such descriptors get skipped and don't get added
as fragments in ice_add_xdp_frag. Since the buffer isn't counted as a
fragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don't
call ice_put_rx_buf().
Because we don't call ice_put_rx_buf(), we don't attempt to re-use the
page or free it. This leaves a stale page in the ring, as we don't
increment next_to_alloc.
The ice_reuse_rx_page() assumes that the next_to_alloc has been incremented
properly, and that it always points to a buffer with a NULL page. Since
this function doesn't check, it will happily recycle a page over the top
of the next_to_alloc buffer, losing track of the old page.
Note that this leak only occurs for multi-buffer frames. The
ice_put_rx_mbuf() function always handles at least one buffer, so a
single-buffer frame will always get handled correctly. It is not clear
precisely why the hardware hands us descriptors with a size of 0 sometimes,
but it happens somewhat regularly with "jumbo frames" used by 9K MTU.
To fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on
all buffers between first_desc and next_to_clean. Borrow the logic of a
similar function in i40e used for this same purpose. Use the same logic
also in ice_get_pgcnts().
Instead of iterating over just the number of fragments, use a loop which
iterates until the current index reaches to the next_to_clean element just
past the current frame. Unlike i40e, the ice_put_rx_mbuf() function does
call ice_put_rx_buf() on the last buffer of the frame indicating the end of
packet.
For non-linear (multi-buffer) frames, we need to take care when adjusting
the pagecnt_bias. An XDP program might release fragments from the tail of
the frame, in which case that fragment page is already released. Only
update the pagecnt_bias for the first descriptor and fragments still
remaining post-XDP program. Take care to only access the shared info for
fragmented buffers, as this avoids a significant cache miss.
The xdp_xmit value only needs to be updated if an XDP program is run, and
only once per packet. Drop the xdp_xmit pointer argument from
ice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function
directly. This avoids needing to pass the argument and avoids an extra
bit-wise OR for each buffer in the frame.
Move the increment of the ntc local variable to ensure its updated *before*
all calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic
requires the index of the element just after the current frame.
Now that we use an index pointer in the ring to identify the packet, we no
longer need to track or cache the number of fragments in the rx_ring.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
311813ed013c016d4b0b0985a9ee41f778489077 , < 80555adb5c892f0e21d243ae96ed997ee520aea9
(git)
Affected: 743bbd93cf29f653fae0e1416a31f03231689911 , < fcb5718ebfe7fd64144e3399280440cce361a3ae (git) Affected: 743bbd93cf29f653fae0e1416a31f03231689911 , < 84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b (git) Affected: ac1728cf370bec2e74fe6a2adf05b4629980d2b3 (git) Affected: d445b59d30415bb56f4803f622d566bca06e0abc (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_txrx.c",
"drivers/net/ethernet/intel/ice/ice_txrx.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "80555adb5c892f0e21d243ae96ed997ee520aea9",
"status": "affected",
"version": "311813ed013c016d4b0b0985a9ee41f778489077",
"versionType": "git"
},
{
"lessThan": "fcb5718ebfe7fd64144e3399280440cce361a3ae",
"status": "affected",
"version": "743bbd93cf29f653fae0e1416a31f03231689911",
"versionType": "git"
},
{
"lessThan": "84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b",
"status": "affected",
"version": "743bbd93cf29f653fae0e1416a31f03231689911",
"versionType": "git"
},
{
"status": "affected",
"version": "ac1728cf370bec2e74fe6a2adf05b4629980d2b3",
"versionType": "git"
},
{
"status": "affected",
"version": "d445b59d30415bb56f4803f622d566bca06e0abc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/ice/ice_txrx.c",
"drivers/net/ethernet/intel/ice/ice_txrx.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.14"
},
{
"lessThan": "6.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "6.12.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.6.78",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nice: fix Rx page leak on multi-buffer frames\n\nThe ice_put_rx_mbuf() function handles calling ice_put_rx_buf() for each\nbuffer in the current frame. This function was introduced as part of\nhandling multi-buffer XDP support in the ice driver.\n\nIt works by iterating over the buffers from first_desc up to 1 plus the\ntotal number of fragments in the frame, cached from before the XDP program\nwas executed.\n\nIf the hardware posts a descriptor with a size of 0, the logic used in\nice_put_rx_mbuf() breaks. Such descriptors get skipped and don\u0027t get added\nas fragments in ice_add_xdp_frag. Since the buffer isn\u0027t counted as a\nfragment, we do not iterate over it in ice_put_rx_mbuf(), and thus we don\u0027t\ncall ice_put_rx_buf().\n\nBecause we don\u0027t call ice_put_rx_buf(), we don\u0027t attempt to re-use the\npage or free it. This leaves a stale page in the ring, as we don\u0027t\nincrement next_to_alloc.\n\nThe ice_reuse_rx_page() assumes that the next_to_alloc has been incremented\nproperly, and that it always points to a buffer with a NULL page. Since\nthis function doesn\u0027t check, it will happily recycle a page over the top\nof the next_to_alloc buffer, losing track of the old page.\n\nNote that this leak only occurs for multi-buffer frames. The\nice_put_rx_mbuf() function always handles at least one buffer, so a\nsingle-buffer frame will always get handled correctly. It is not clear\nprecisely why the hardware hands us descriptors with a size of 0 sometimes,\nbut it happens somewhat regularly with \"jumbo frames\" used by 9K MTU.\n\nTo fix ice_put_rx_mbuf(), we need to make sure to call ice_put_rx_buf() on\nall buffers between first_desc and next_to_clean. Borrow the logic of a\nsimilar function in i40e used for this same purpose. Use the same logic\nalso in ice_get_pgcnts().\n\nInstead of iterating over just the number of fragments, use a loop which\niterates until the current index reaches to the next_to_clean element just\npast the current frame. Unlike i40e, the ice_put_rx_mbuf() function does\ncall ice_put_rx_buf() on the last buffer of the frame indicating the end of\npacket.\n\nFor non-linear (multi-buffer) frames, we need to take care when adjusting\nthe pagecnt_bias. An XDP program might release fragments from the tail of\nthe frame, in which case that fragment page is already released. Only\nupdate the pagecnt_bias for the first descriptor and fragments still\nremaining post-XDP program. Take care to only access the shared info for\nfragmented buffers, as this avoids a significant cache miss.\n\nThe xdp_xmit value only needs to be updated if an XDP program is run, and\nonly once per packet. Drop the xdp_xmit pointer argument from\nice_put_rx_mbuf(). Instead, set xdp_xmit in the ice_clean_rx_irq() function\ndirectly. This avoids needing to pass the argument and avoids an extra\nbit-wise OR for each buffer in the frame.\n\nMove the increment of the ntc local variable to ensure its updated *before*\nall calls to ice_get_pgcnts() or ice_put_rx_mbuf(), as the loop logic\nrequires the index of the element just after the current frame.\n\nNow that we use an index pointer in the ring to identify the packet, we no\nlonger need to track or cache the number of fragments in the rx_ring."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:31:09.403Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/80555adb5c892f0e21d243ae96ed997ee520aea9"
},
{
"url": "https://git.kernel.org/stable/c/fcb5718ebfe7fd64144e3399280440cce361a3ae"
},
{
"url": "https://git.kernel.org/stable/c/84bf1ac85af84d354c7a2fdbdc0d4efc8aaec34b"
}
],
"title": "ice: fix Rx page leak on multi-buffer frames",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39948",
"datePublished": "2025-10-04T07:31:09.403Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:31:09.403Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50476 (GCVE-0-2022-50476)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
ntb_netdev: Use dev_kfree_skb_any() in interrupt context
Summary
In the Linux kernel, the following vulnerability has been resolved:
ntb_netdev: Use dev_kfree_skb_any() in interrupt context
TX/RX callback handlers (ntb_netdev_tx_handler(),
ntb_netdev_rx_handler()) can be called in interrupt
context via the DMA framework when the respective
DMA operations have completed. As such, any calls
by these routines to free skb's, should use the
interrupt context safe dev_kfree_skb_any() function.
Previously, these callback handlers would call the
interrupt unsafe version of dev_kfree_skb(). This has
not presented an issue on Intel IOAT DMA engines as
that driver utilizes tasklets rather than a hard
interrupt handler, like the AMD PTDMA DMA driver.
On AMD systems, a kernel WARNING message is
encountered, which is being issued from
skb_release_head_state() due to in_hardirq()
being true.
Besides the user visible WARNING from the kernel,
the other symptom of this bug was that TCP/IP performance
across the ntb_netdev interface was very poor, i.e.
approximately an order of magnitude below what was
expected. With the repair to use dev_kfree_skb_any(),
kernel WARNINGs from skb_release_head_state() ceased
and TCP/IP performance, as measured by iperf, was on
par with expected results, approximately 20 Gb/s on
AMD Milan based server. Note that this performance
is comparable with Intel based servers.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
548c237c0a9972df5d1afaca38aa733ee577128d , < d4460c82177899751975180c268f352893302221
(git)
Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < dd860b39aa7c7b82e6c99b6fdb99d4610ce49d67 (git) Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < 8b78493968ed3cef0326183ed059c55e42f24d5b (git) Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < a6b9e09403102bdf8402dae734800e4916c7ea58 (git) Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < 13286ad1c7c49c606fdcba4cf66f953a1a16c1ca (git) Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < 21296a52caa6a6bad6debdfe40ad81d4f1a27e69 (git) Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < 14d245da57a11e80277ab455aa9b6dcc5ed38a19 (git) Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < 07e28a8f450217db679802ebd4de0915556ce846 (git) Affected: 548c237c0a9972df5d1afaca38aa733ee577128d , < 5f7d78b2b12a9d561f48fa00bab29b40f4616dad (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ntb_netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d4460c82177899751975180c268f352893302221",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "dd860b39aa7c7b82e6c99b6fdb99d4610ce49d67",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "8b78493968ed3cef0326183ed059c55e42f24d5b",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "a6b9e09403102bdf8402dae734800e4916c7ea58",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "13286ad1c7c49c606fdcba4cf66f953a1a16c1ca",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "21296a52caa6a6bad6debdfe40ad81d4f1a27e69",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "14d245da57a11e80277ab455aa9b6dcc5ed38a19",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "07e28a8f450217db679802ebd4de0915556ce846",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
},
{
"lessThan": "5f7d78b2b12a9d561f48fa00bab29b40f4616dad",
"status": "affected",
"version": "548c237c0a9972df5d1afaca38aa733ee577128d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ntb_netdev.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nntb_netdev: Use dev_kfree_skb_any() in interrupt context\n\nTX/RX callback handlers (ntb_netdev_tx_handler(),\nntb_netdev_rx_handler()) can be called in interrupt\ncontext via the DMA framework when the respective\nDMA operations have completed. As such, any calls\nby these routines to free skb\u0027s, should use the\ninterrupt context safe dev_kfree_skb_any() function.\n\nPreviously, these callback handlers would call the\ninterrupt unsafe version of dev_kfree_skb(). This has\nnot presented an issue on Intel IOAT DMA engines as\nthat driver utilizes tasklets rather than a hard\ninterrupt handler, like the AMD PTDMA DMA driver.\nOn AMD systems, a kernel WARNING message is\nencountered, which is being issued from\nskb_release_head_state() due to in_hardirq()\nbeing true.\n\nBesides the user visible WARNING from the kernel,\nthe other symptom of this bug was that TCP/IP performance\nacross the ntb_netdev interface was very poor, i.e.\napproximately an order of magnitude below what was\nexpected. With the repair to use dev_kfree_skb_any(),\nkernel WARNINGs from skb_release_head_state() ceased\nand TCP/IP performance, as measured by iperf, was on\npar with expected results, approximately 20 Gb/s on\nAMD Milan based server. Note that this performance\nis comparable with Intel based servers."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:36.895Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d4460c82177899751975180c268f352893302221"
},
{
"url": "https://git.kernel.org/stable/c/dd860b39aa7c7b82e6c99b6fdb99d4610ce49d67"
},
{
"url": "https://git.kernel.org/stable/c/8b78493968ed3cef0326183ed059c55e42f24d5b"
},
{
"url": "https://git.kernel.org/stable/c/a6b9e09403102bdf8402dae734800e4916c7ea58"
},
{
"url": "https://git.kernel.org/stable/c/13286ad1c7c49c606fdcba4cf66f953a1a16c1ca"
},
{
"url": "https://git.kernel.org/stable/c/21296a52caa6a6bad6debdfe40ad81d4f1a27e69"
},
{
"url": "https://git.kernel.org/stable/c/14d245da57a11e80277ab455aa9b6dcc5ed38a19"
},
{
"url": "https://git.kernel.org/stable/c/07e28a8f450217db679802ebd4de0915556ce846"
},
{
"url": "https://git.kernel.org/stable/c/5f7d78b2b12a9d561f48fa00bab29b40f4616dad"
}
],
"title": "ntb_netdev: Use dev_kfree_skb_any() in interrupt context",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50476",
"datePublished": "2025-10-04T15:16:36.895Z",
"dateReserved": "2025-10-04T15:13:33.467Z",
"dateUpdated": "2025-10-04T15:16:36.895Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50506 (GCVE-0-2022-50506)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
drbd: only clone bio if we have a backing device
Summary
In the Linux kernel, the following vulnerability has been resolved:
drbd: only clone bio if we have a backing device
Commit c347a787e34cb (drbd: set ->bi_bdev in drbd_req_new) moved a
bio_set_dev call (which has since been removed) to "earlier", from
drbd_request_prepare to drbd_req_new.
The problem is that this accesses device->ldev->backing_bdev, which is
not NULL-checked at this point. When we don't have an ldev (i.e. when
the DRBD device is diskless), this leads to a null pointer deref.
So, only allocate the private_bio if we actually have a disk. This is
also a small optimization, since we don't clone the bio to only to
immediately free it again in the diskless case.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/drbd/drbd_req.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "05580a3bbf3cec677cb00a85dfeb21d6a9b48eaf",
"status": "affected",
"version": "c347a787e34cba0e5a80a04082dacaf259105605",
"versionType": "git"
},
{
"lessThan": "6d42ddf7f27b6723549ee6d4c8b1b418b59bf6b5",
"status": "affected",
"version": "c347a787e34cba0e5a80a04082dacaf259105605",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/drbd/drbd_req.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.6",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.6",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrbd: only clone bio if we have a backing device\n\nCommit c347a787e34cb (drbd: set -\u003ebi_bdev in drbd_req_new) moved a\nbio_set_dev call (which has since been removed) to \"earlier\", from\ndrbd_request_prepare to drbd_req_new.\n\nThe problem is that this accesses device-\u003eldev-\u003ebacking_bdev, which is\nnot NULL-checked at this point. When we don\u0027t have an ldev (i.e. when\nthe DRBD device is diskless), this leads to a null pointer deref.\n\nSo, only allocate the private_bio if we actually have a disk. This is\nalso a small optimization, since we don\u0027t clone the bio to only to\nimmediately free it again in the diskless case."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:54.955Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/05580a3bbf3cec677cb00a85dfeb21d6a9b48eaf"
},
{
"url": "https://git.kernel.org/stable/c/6d42ddf7f27b6723549ee6d4c8b1b418b59bf6b5"
}
],
"title": "drbd: only clone bio if we have a backing device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50506",
"datePublished": "2025-10-04T15:43:54.955Z",
"dateReserved": "2025-10-04T15:39:19.465Z",
"dateUpdated": "2025-10-04T15:43:54.955Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53549 (GCVE-0-2023-53549)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
netfilter: ipset: Rework long task execution when adding/deleting entries
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ipset: Rework long task execution when adding/deleting entries
When adding/deleting large number of elements in one step in ipset, it can
take a reasonable amount of time and can result in soft lockup errors. The
patch 5f7b51bf09ba ("netfilter: ipset: Limit the maximal range of
consecutive elements to add/delete") tried to fix it by limiting the max
elements to process at all. However it was not enough, it is still possible
that we get hung tasks. Lowering the limit is not reasonable, so the
approach in this patch is as follows: rely on the method used at resizing
sets and save the state when we reach a smaller internal batch limit,
unlock/lock and proceed from the saved state. Thus we can avoid long
continuous tasks and at the same time removed the limit to add/delete large
number of elements in one step.
The nfnl mutex is held during the whole operation which prevents one to
issue other ipset commands in parallel.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
e62e62ea912a49f7230620f1bdc20410b943a44c , < ee756980e491c829ba0495bb420b7224a9ee26b2
(git)
Affected: 5f7b51bf09baca8e4f80cbe879536842bafb5f31 , < a1e1521b463968b4eca7163f61fb6cc54d008061 (git) Affected: 5f7b51bf09baca8e4f80cbe879536842bafb5f31 , < 24a828f5a54bdeca0846526860d72b3766c5fe95 (git) Affected: 5f7b51bf09baca8e4f80cbe879536842bafb5f31 , < 8964cc36ba011dc0e1041131fa2e91fb4c2a811b (git) Affected: 5f7b51bf09baca8e4f80cbe879536842bafb5f31 , < 5e29dc36bd5e2166b834ceb19990d9e68a734d7d (git) Affected: e0f824abe0f412f769fb5468b36c2471430bd885 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"include/linux/netfilter/ipset/ip_set.h",
"net/netfilter/ipset/ip_set_core.c",
"net/netfilter/ipset/ip_set_hash_ip.c",
"net/netfilter/ipset/ip_set_hash_ipmark.c",
"net/netfilter/ipset/ip_set_hash_ipport.c",
"net/netfilter/ipset/ip_set_hash_ipportip.c",
"net/netfilter/ipset/ip_set_hash_ipportnet.c",
"net/netfilter/ipset/ip_set_hash_net.c",
"net/netfilter/ipset/ip_set_hash_netiface.c",
"net/netfilter/ipset/ip_set_hash_netnet.c",
"net/netfilter/ipset/ip_set_hash_netport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee756980e491c829ba0495bb420b7224a9ee26b2",
"status": "affected",
"version": "e62e62ea912a49f7230620f1bdc20410b943a44c",
"versionType": "git"
},
{
"lessThan": "a1e1521b463968b4eca7163f61fb6cc54d008061",
"status": "affected",
"version": "5f7b51bf09baca8e4f80cbe879536842bafb5f31",
"versionType": "git"
},
{
"lessThan": "24a828f5a54bdeca0846526860d72b3766c5fe95",
"status": "affected",
"version": "5f7b51bf09baca8e4f80cbe879536842bafb5f31",
"versionType": "git"
},
{
"lessThan": "8964cc36ba011dc0e1041131fa2e91fb4c2a811b",
"status": "affected",
"version": "5f7b51bf09baca8e4f80cbe879536842bafb5f31",
"versionType": "git"
},
{
"lessThan": "5e29dc36bd5e2166b834ceb19990d9e68a734d7d",
"status": "affected",
"version": "5f7b51bf09baca8e4f80cbe879536842bafb5f31",
"versionType": "git"
},
{
"status": "affected",
"version": "e0f824abe0f412f769fb5468b36c2471430bd885",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"include/linux/netfilter/ipset/ip_set.h",
"net/netfilter/ipset/ip_set_core.c",
"net/netfilter/ipset/ip_set_hash_ip.c",
"net/netfilter/ipset/ip_set_hash_ipmark.c",
"net/netfilter/ipset/ip_set_hash_ipport.c",
"net/netfilter/ipset/ip_set_hash_ipportip.c",
"net/netfilter/ipset/ip_set_hash_ipportnet.c",
"net/netfilter/ipset/ip_set_hash_net.c",
"net/netfilter/ipset/ip_set_hash_netiface.c",
"net/netfilter/ipset/ip_set_hash_netnet.c",
"net/netfilter/ipset/ip_set_hash_netport.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.19",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "5.10.157",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.87",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.19",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.5",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.13.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ipset: Rework long task execution when adding/deleting entries\n\nWhen adding/deleting large number of elements in one step in ipset, it can\ntake a reasonable amount of time and can result in soft lockup errors. The\npatch 5f7b51bf09ba (\"netfilter: ipset: Limit the maximal range of\nconsecutive elements to add/delete\") tried to fix it by limiting the max\nelements to process at all. However it was not enough, it is still possible\nthat we get hung tasks. Lowering the limit is not reasonable, so the\napproach in this patch is as follows: rely on the method used at resizing\nsets and save the state when we reach a smaller internal batch limit,\nunlock/lock and proceed from the saved state. Thus we can avoid long\ncontinuous tasks and at the same time removed the limit to add/delete large\nnumber of elements in one step.\n\nThe nfnl mutex is held during the whole operation which prevents one to\nissue other ipset commands in parallel."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:56.382Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee756980e491c829ba0495bb420b7224a9ee26b2"
},
{
"url": "https://git.kernel.org/stable/c/a1e1521b463968b4eca7163f61fb6cc54d008061"
},
{
"url": "https://git.kernel.org/stable/c/24a828f5a54bdeca0846526860d72b3766c5fe95"
},
{
"url": "https://git.kernel.org/stable/c/8964cc36ba011dc0e1041131fa2e91fb4c2a811b"
},
{
"url": "https://git.kernel.org/stable/c/5e29dc36bd5e2166b834ceb19990d9e68a734d7d"
}
],
"title": "netfilter: ipset: Rework long task execution when adding/deleting entries",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53549",
"datePublished": "2025-10-04T15:16:56.382Z",
"dateReserved": "2025-10-04T15:14:15.922Z",
"dateUpdated": "2025-10-04T15:16:56.382Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53540 (GCVE-0-2023-53540)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
wifi: cfg80211: reject auth/assoc to AP with our address
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: cfg80211: reject auth/assoc to AP with our address
If the AP uses our own address as its MLD address or BSSID, then
clearly something's wrong. Reject such connections so we don't
try and fail later.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
19957bb399e2722719c0e20c9ae91cf8b6aaff04 , < 676a423410131d111a264d29aecbe6aadd57fb22
(git)
Affected: 19957bb399e2722719c0e20c9ae91cf8b6aaff04 , < 07added2c6cd63de047bc786b39436322abb67c0 (git) Affected: 19957bb399e2722719c0e20c9ae91cf8b6aaff04 , < 5d4e04bf3a0f098bd9033de3a5291810fa14c7a6 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/wireless/mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "676a423410131d111a264d29aecbe6aadd57fb22",
"status": "affected",
"version": "19957bb399e2722719c0e20c9ae91cf8b6aaff04",
"versionType": "git"
},
{
"lessThan": "07added2c6cd63de047bc786b39436322abb67c0",
"status": "affected",
"version": "19957bb399e2722719c0e20c9ae91cf8b6aaff04",
"versionType": "git"
},
{
"lessThan": "5d4e04bf3a0f098bd9033de3a5291810fa14c7a6",
"status": "affected",
"version": "19957bb399e2722719c0e20c9ae91cf8b6aaff04",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/wireless/mlme.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.32"
},
{
"lessThan": "2.6.32",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.55",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.55",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.5",
"versionStartIncluding": "2.6.32",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "2.6.32",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: cfg80211: reject auth/assoc to AP with our address\n\nIf the AP uses our own address as its MLD address or BSSID, then\nclearly something\u0027s wrong. Reject such connections so we don\u0027t\ntry and fail later."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:15.251Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/676a423410131d111a264d29aecbe6aadd57fb22"
},
{
"url": "https://git.kernel.org/stable/c/07added2c6cd63de047bc786b39436322abb67c0"
},
{
"url": "https://git.kernel.org/stable/c/5d4e04bf3a0f098bd9033de3a5291810fa14c7a6"
}
],
"title": "wifi: cfg80211: reject auth/assoc to AP with our address",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53540",
"datePublished": "2025-10-04T15:16:50.079Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2026-01-05T10:21:15.251Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53566 (GCVE-0-2023-53566)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
netfilter: nft_set_rbtree: fix null deref on element insertion
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: fix null deref on element insertion
There is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
nft_add_set_elem+0x14b0/0x2990
nf_tables_newsetelem+0x528/0xb30
Furthermore, there is a possible use-after-free while iterating,
'node' can be free'd so we need to cache the next value to use.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
7ab87a326f20c52ff4d9972052d085be951c704b , < b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56
(git)
Affected: 181859bdfb9734aca449512fccaee4cacce64aed , < 899aa5638568abf5d69de7a7bb95e4615157375b (git) Affected: 4aacf3d78424293e318c616016865380b37b9cc5 , < 3fa13203b6d90cc3a33af47b058739f92ab82eef (git) Affected: 2bf1435fa19d2c58054391b3bba40d5510a5758c , < ec5caa765f7f6960011c919c9aeb1467940421f6 (git) Affected: 318cb24a4c3fce8140afaf84e4d45fcb76fb280b , < a836be60a3aabcedcd9c79f545d409ace1f20ba6 (git) Affected: c9e6978e2725a7d4b6cd23b2facd3f11422c0643 , < a337706c1fb35aac3f26b48aca80421bdbe1d33a (git) Affected: c9e6978e2725a7d4b6cd23b2facd3f11422c0643 , < 61ae320a29b0540c16931816299eb86bf2b66c08 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_set_rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56",
"status": "affected",
"version": "7ab87a326f20c52ff4d9972052d085be951c704b",
"versionType": "git"
},
{
"lessThan": "899aa5638568abf5d69de7a7bb95e4615157375b",
"status": "affected",
"version": "181859bdfb9734aca449512fccaee4cacce64aed",
"versionType": "git"
},
{
"lessThan": "3fa13203b6d90cc3a33af47b058739f92ab82eef",
"status": "affected",
"version": "4aacf3d78424293e318c616016865380b37b9cc5",
"versionType": "git"
},
{
"lessThan": "ec5caa765f7f6960011c919c9aeb1467940421f6",
"status": "affected",
"version": "2bf1435fa19d2c58054391b3bba40d5510a5758c",
"versionType": "git"
},
{
"lessThan": "a836be60a3aabcedcd9c79f545d409ace1f20ba6",
"status": "affected",
"version": "318cb24a4c3fce8140afaf84e4d45fcb76fb280b",
"versionType": "git"
},
{
"lessThan": "a337706c1fb35aac3f26b48aca80421bdbe1d33a",
"status": "affected",
"version": "c9e6978e2725a7d4b6cd23b2facd3f11422c0643",
"versionType": "git"
},
{
"lessThan": "61ae320a29b0540c16931816299eb86bf2b66c08",
"status": "affected",
"version": "c9e6978e2725a7d4b6cd23b2facd3f11422c0643",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nft_set_rbtree.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.181",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.181",
"versionStartIncluding": "5.10.166",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.113",
"versionStartIncluding": "5.15.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.30",
"versionStartIncluding": "6.1.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_set_rbtree: fix null deref on element insertion\n\nThere is no guarantee that rb_prev() will not return NULL in nft_rbtree_gc_elem():\n\ngeneral protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN\nKASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n nft_add_set_elem+0x14b0/0x2990\n nf_tables_newsetelem+0x528/0xb30\n\nFurthermore, there is a possible use-after-free while iterating,\n\u0027node\u0027 can be free\u0027d so we need to cache the next value to use."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:08.598Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56"
},
{
"url": "https://git.kernel.org/stable/c/899aa5638568abf5d69de7a7bb95e4615157375b"
},
{
"url": "https://git.kernel.org/stable/c/3fa13203b6d90cc3a33af47b058739f92ab82eef"
},
{
"url": "https://git.kernel.org/stable/c/ec5caa765f7f6960011c919c9aeb1467940421f6"
},
{
"url": "https://git.kernel.org/stable/c/a836be60a3aabcedcd9c79f545d409ace1f20ba6"
},
{
"url": "https://git.kernel.org/stable/c/a337706c1fb35aac3f26b48aca80421bdbe1d33a"
},
{
"url": "https://git.kernel.org/stable/c/61ae320a29b0540c16931816299eb86bf2b66c08"
}
],
"title": "netfilter: nft_set_rbtree: fix null deref on element insertion",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53566",
"datePublished": "2025-10-04T15:17:08.598Z",
"dateReserved": "2025-10-04T15:14:15.924Z",
"dateUpdated": "2025-10-04T15:17:08.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53581 (GCVE-0-2023-53581)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
net/mlx5e: Check for NOT_READY flag state after locking
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/mlx5e: Check for NOT_READY flag state after locking
Currently the check for NOT_READY flag is performed before obtaining the
necessary lock. This opens a possibility for race condition when the flow
is concurrently removed from unready_flows list by the workqueue task,
which causes a double-removal from the list and a crash[0]. Fix the issue
by moving the flag check inside the section protected by
uplink_priv->unready_flows_lock mutex.
[0]:
[44376.389654] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP
[44376.391665] CPU: 7 PID: 59123 Comm: tc Not tainted 6.4.0-rc4+ #1
[44376.392984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[44376.395342] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
[44376.396857] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 <48> 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06
[44376.399167] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246
[44376.399680] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00
[44376.400337] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0
[44376.401001] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001
[44376.401663] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000
[44376.402342] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000
[44376.402999] FS: 00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000
[44376.403787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[44376.404343] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0
[44376.405004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[44376.405665] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[44376.406339] Call Trace:
[44376.406651] <TASK>
[44376.406939] ? die_addr+0x33/0x90
[44376.407311] ? exc_general_protection+0x192/0x390
[44376.407795] ? asm_exc_general_protection+0x22/0x30
[44376.408292] ? mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]
[44376.408876] __mlx5e_tc_del_fdb_peer_flow+0xbc/0xe0 [mlx5_core]
[44376.409482] mlx5e_tc_del_flow+0x42/0x210 [mlx5_core]
[44376.410055] mlx5e_flow_put+0x25/0x50 [mlx5_core]
[44376.410529] mlx5e_delete_flower+0x24b/0x350 [mlx5_core]
[44376.411043] tc_setup_cb_reoffload+0x22/0x80
[44376.411462] fl_reoffload+0x261/0x2f0 [cls_flower]
[44376.411907] ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
[44376.412481] ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]
[44376.413044] tcf_block_playback_offloads+0x76/0x170
[44376.413497] tcf_block_unbind+0x7b/0xd0
[44376.413881] tcf_block_setup+0x17d/0x1c0
[44376.414269] tcf_block_offload_cmd.isra.0+0xf1/0x130
[44376.414725] tcf_block_offload_unbind+0x43/0x70
[44376.415153] __tcf_block_put+0x82/0x150
[44376.415532] ingress_destroy+0x22/0x30 [sch_ingress]
[44376.415986] qdisc_destroy+0x3b/0xd0
[44376.416343] qdisc_graft+0x4d0/0x620
[44376.416706] tc_get_qdisc+0x1c9/0x3b0
[44376.417074] rtnetlink_rcv_msg+0x29c/0x390
[44376.419978] ? rep_movs_alternative+0x3a/0xa0
[44376.420399] ? rtnl_calcit.isra.0+0x120/0x120
[44376.420813] netlink_rcv_skb+0x54/0x100
[44376.421192] netlink_unicast+0x1f6/0x2c0
[44376.421573] netlink_sendmsg+0x232/0x4a0
[44376.421980] sock_sendmsg+0x38/0x60
[44376.422328] ____sys_sendmsg+0x1d0/0x1e0
[44376.422709] ? copy_msghdr_from_user+0x6d/0xa0
[44376.423127] ___sys_sendmsg+0x80/0xc0
[44376.423495] ? ___sys_recvmsg+0x8b/0xc0
[44376.423869] __sys_sendmsg+0x51/0x90
[44376.424226] do_syscall_64+0x3d/0x90
[44376.424587] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[44376.425046] RIP: 0033:0x7f045134f887
[44376.425403] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00
---truncated---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
ad86755b18d5edf1956f6d25c844f27289216877 , < 30c281a77fb1b2d362030ea243dd663201d62a21
(git)
Affected: ad86755b18d5edf1956f6d25c844f27289216877 , < 82ac62d76a000871004f534ad294e763e966d3b0 (git) Affected: ad86755b18d5edf1956f6d25c844f27289216877 , < e962fd5933ebc767ce2a1cf7b7c85035b5a5d04c (git) Affected: ad86755b18d5edf1956f6d25c844f27289216877 , < f7ceedd1d124217a67ed1a67bbd7a7b1288705e3 (git) Affected: ad86755b18d5edf1956f6d25c844f27289216877 , < 65e64640e97c0f223e77f9ea69b5a46186b93470 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "30c281a77fb1b2d362030ea243dd663201d62a21",
"status": "affected",
"version": "ad86755b18d5edf1956f6d25c844f27289216877",
"versionType": "git"
},
{
"lessThan": "82ac62d76a000871004f534ad294e763e966d3b0",
"status": "affected",
"version": "ad86755b18d5edf1956f6d25c844f27289216877",
"versionType": "git"
},
{
"lessThan": "e962fd5933ebc767ce2a1cf7b7c85035b5a5d04c",
"status": "affected",
"version": "ad86755b18d5edf1956f6d25c844f27289216877",
"versionType": "git"
},
{
"lessThan": "f7ceedd1d124217a67ed1a67bbd7a7b1288705e3",
"status": "affected",
"version": "ad86755b18d5edf1956f6d25c844f27289216877",
"versionType": "git"
},
{
"lessThan": "65e64640e97c0f223e77f9ea69b5a46186b93470",
"status": "affected",
"version": "ad86755b18d5edf1956f6d25c844f27289216877",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/mellanox/mlx5/core/en_tc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.4"
},
{
"lessThan": "5.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.188",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.121",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.40",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.5",
"versionStartIncluding": "5.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Check for NOT_READY flag state after locking\n\nCurrently the check for NOT_READY flag is performed before obtaining the\nnecessary lock. This opens a possibility for race condition when the flow\nis concurrently removed from unready_flows list by the workqueue task,\nwhich causes a double-removal from the list and a crash[0]. Fix the issue\nby moving the flag check inside the section protected by\nuplink_priv-\u003eunready_flows_lock mutex.\n\n[0]:\n[44376.389654] general protection fault, probably for non-canonical address 0xdead000000000108: 0000 [#1] SMP\n[44376.391665] CPU: 7 PID: 59123 Comm: tc Not tainted 6.4.0-rc4+ #1\n[44376.392984] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\n[44376.395342] RIP: 0010:mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]\n[44376.396857] Code: 00 48 8b b8 68 ce 02 00 e8 8a 4d 02 00 4c 8d a8 a8 01 00 00 4c 89 ef e8 8b 79 88 e1 48 8b 83 98 06 00 00 48 8b 93 90 06 00 00 \u003c48\u003e 89 42 08 48 89 10 48 b8 00 01 00 00 00 00 ad de 48 89 83 90 06\n[44376.399167] RSP: 0018:ffff88812cc97570 EFLAGS: 00010246\n[44376.399680] RAX: dead000000000122 RBX: ffff8881088e3800 RCX: ffff8881881bac00\n[44376.400337] RDX: dead000000000100 RSI: ffff88812cc97500 RDI: ffff8881242f71b0\n[44376.401001] RBP: ffff88811cbb0940 R08: 0000000000000400 R09: 0000000000000001\n[44376.401663] R10: 0000000000000001 R11: 0000000000000000 R12: ffff88812c944000\n[44376.402342] R13: ffff8881242f71a8 R14: ffff8881222b4000 R15: 0000000000000000\n[44376.402999] FS: 00007f0451104800(0000) GS:ffff88852cb80000(0000) knlGS:0000000000000000\n[44376.403787] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[44376.404343] CR2: 0000000000489108 CR3: 0000000123a79003 CR4: 0000000000370ea0\n[44376.405004] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\n[44376.405665] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n[44376.406339] Call Trace:\n[44376.406651] \u003cTASK\u003e\n[44376.406939] ? die_addr+0x33/0x90\n[44376.407311] ? exc_general_protection+0x192/0x390\n[44376.407795] ? asm_exc_general_protection+0x22/0x30\n[44376.408292] ? mlx5e_tc_del_fdb_flow+0xb3/0x340 [mlx5_core]\n[44376.408876] __mlx5e_tc_del_fdb_peer_flow+0xbc/0xe0 [mlx5_core]\n[44376.409482] mlx5e_tc_del_flow+0x42/0x210 [mlx5_core]\n[44376.410055] mlx5e_flow_put+0x25/0x50 [mlx5_core]\n[44376.410529] mlx5e_delete_flower+0x24b/0x350 [mlx5_core]\n[44376.411043] tc_setup_cb_reoffload+0x22/0x80\n[44376.411462] fl_reoffload+0x261/0x2f0 [cls_flower]\n[44376.411907] ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]\n[44376.412481] ? mlx5e_rep_indr_setup_ft_cb+0x160/0x160 [mlx5_core]\n[44376.413044] tcf_block_playback_offloads+0x76/0x170\n[44376.413497] tcf_block_unbind+0x7b/0xd0\n[44376.413881] tcf_block_setup+0x17d/0x1c0\n[44376.414269] tcf_block_offload_cmd.isra.0+0xf1/0x130\n[44376.414725] tcf_block_offload_unbind+0x43/0x70\n[44376.415153] __tcf_block_put+0x82/0x150\n[44376.415532] ingress_destroy+0x22/0x30 [sch_ingress]\n[44376.415986] qdisc_destroy+0x3b/0xd0\n[44376.416343] qdisc_graft+0x4d0/0x620\n[44376.416706] tc_get_qdisc+0x1c9/0x3b0\n[44376.417074] rtnetlink_rcv_msg+0x29c/0x390\n[44376.419978] ? rep_movs_alternative+0x3a/0xa0\n[44376.420399] ? rtnl_calcit.isra.0+0x120/0x120\n[44376.420813] netlink_rcv_skb+0x54/0x100\n[44376.421192] netlink_unicast+0x1f6/0x2c0\n[44376.421573] netlink_sendmsg+0x232/0x4a0\n[44376.421980] sock_sendmsg+0x38/0x60\n[44376.422328] ____sys_sendmsg+0x1d0/0x1e0\n[44376.422709] ? copy_msghdr_from_user+0x6d/0xa0\n[44376.423127] ___sys_sendmsg+0x80/0xc0\n[44376.423495] ? ___sys_recvmsg+0x8b/0xc0\n[44376.423869] __sys_sendmsg+0x51/0x90\n[44376.424226] do_syscall_64+0x3d/0x90\n[44376.424587] entry_SYSCALL_64_after_hwframe+0x46/0xb0\n[44376.425046] RIP: 0033:0x7f045134f887\n[44376.425403] Code: 0a 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:57.758Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/30c281a77fb1b2d362030ea243dd663201d62a21"
},
{
"url": "https://git.kernel.org/stable/c/82ac62d76a000871004f534ad294e763e966d3b0"
},
{
"url": "https://git.kernel.org/stable/c/e962fd5933ebc767ce2a1cf7b7c85035b5a5d04c"
},
{
"url": "https://git.kernel.org/stable/c/f7ceedd1d124217a67ed1a67bbd7a7b1288705e3"
},
{
"url": "https://git.kernel.org/stable/c/65e64640e97c0f223e77f9ea69b5a46186b93470"
}
],
"title": "net/mlx5e: Check for NOT_READY flag state after locking",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53581",
"datePublished": "2025-10-04T15:43:57.758Z",
"dateReserved": "2025-10-04T15:14:15.926Z",
"dateUpdated": "2025-10-04T15:43:57.758Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50505 (GCVE-0-2022-50505)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
iommu/amd: Fix pci device refcount leak in ppr_notifier()
Summary
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Fix pci device refcount leak in ppr_notifier()
As comment of pci_get_domain_bus_and_slot() says, it returns
a pci device with refcount increment, when finish using it,
the caller must decrement the reference count by calling
pci_dev_put(). So call it before returning from ppr_notifier()
to avoid refcount leak.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
daae2d25a4779b272a66ddd01f5810bcee822b9e , < bdb2113dd8f17a3cc84a2b4be4968a849f69ec72
(git)
Affected: daae2d25a4779b272a66ddd01f5810bcee822b9e , < efd50c65fd1cdef63eb58825f3fe72496443764c (git) Affected: daae2d25a4779b272a66ddd01f5810bcee822b9e , < 8581ec1feb895ff596fe3d326d9ba320083290aa (git) Affected: daae2d25a4779b272a66ddd01f5810bcee822b9e , < 03f51c72997559e73b327608f0cccfded715c9a0 (git) Affected: daae2d25a4779b272a66ddd01f5810bcee822b9e , < 6e501b3fd7a2e1c4372d72bc70717aaca2beb8a5 (git) Affected: daae2d25a4779b272a66ddd01f5810bcee822b9e , < 902cc2507091a81643502d8ceb0e2f105e902518 (git) Affected: daae2d25a4779b272a66ddd01f5810bcee822b9e , < b0637f4bd426925f5c3a15e8f8e36190fe06bac5 (git) Affected: daae2d25a4779b272a66ddd01f5810bcee822b9e , < 6cf0981c2233f97d56938d9d61845383d6eb227c (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/iommu_v2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bdb2113dd8f17a3cc84a2b4be4968a849f69ec72",
"status": "affected",
"version": "daae2d25a4779b272a66ddd01f5810bcee822b9e",
"versionType": "git"
},
{
"lessThan": "efd50c65fd1cdef63eb58825f3fe72496443764c",
"status": "affected",
"version": "daae2d25a4779b272a66ddd01f5810bcee822b9e",
"versionType": "git"
},
{
"lessThan": "8581ec1feb895ff596fe3d326d9ba320083290aa",
"status": "affected",
"version": "daae2d25a4779b272a66ddd01f5810bcee822b9e",
"versionType": "git"
},
{
"lessThan": "03f51c72997559e73b327608f0cccfded715c9a0",
"status": "affected",
"version": "daae2d25a4779b272a66ddd01f5810bcee822b9e",
"versionType": "git"
},
{
"lessThan": "6e501b3fd7a2e1c4372d72bc70717aaca2beb8a5",
"status": "affected",
"version": "daae2d25a4779b272a66ddd01f5810bcee822b9e",
"versionType": "git"
},
{
"lessThan": "902cc2507091a81643502d8ceb0e2f105e902518",
"status": "affected",
"version": "daae2d25a4779b272a66ddd01f5810bcee822b9e",
"versionType": "git"
},
{
"lessThan": "b0637f4bd426925f5c3a15e8f8e36190fe06bac5",
"status": "affected",
"version": "daae2d25a4779b272a66ddd01f5810bcee822b9e",
"versionType": "git"
},
{
"lessThan": "6cf0981c2233f97d56938d9d61845383d6eb227c",
"status": "affected",
"version": "daae2d25a4779b272a66ddd01f5810bcee822b9e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/iommu/amd/iommu_v2.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.14"
},
{
"lessThan": "4.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "4.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "4.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Fix pci device refcount leak in ppr_notifier()\n\nAs comment of pci_get_domain_bus_and_slot() says, it returns\na pci device with refcount increment, when finish using it,\nthe caller must decrement the reference count by calling\npci_dev_put(). So call it before returning from ppr_notifier()\nto avoid refcount leak."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:54.265Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bdb2113dd8f17a3cc84a2b4be4968a849f69ec72"
},
{
"url": "https://git.kernel.org/stable/c/efd50c65fd1cdef63eb58825f3fe72496443764c"
},
{
"url": "https://git.kernel.org/stable/c/8581ec1feb895ff596fe3d326d9ba320083290aa"
},
{
"url": "https://git.kernel.org/stable/c/03f51c72997559e73b327608f0cccfded715c9a0"
},
{
"url": "https://git.kernel.org/stable/c/6e501b3fd7a2e1c4372d72bc70717aaca2beb8a5"
},
{
"url": "https://git.kernel.org/stable/c/902cc2507091a81643502d8ceb0e2f105e902518"
},
{
"url": "https://git.kernel.org/stable/c/b0637f4bd426925f5c3a15e8f8e36190fe06bac5"
},
{
"url": "https://git.kernel.org/stable/c/6cf0981c2233f97d56938d9d61845383d6eb227c"
}
],
"title": "iommu/amd: Fix pci device refcount leak in ppr_notifier()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50505",
"datePublished": "2025-10-04T15:43:54.265Z",
"dateReserved": "2025-10-04T15:39:19.465Z",
"dateUpdated": "2025-10-04T15:43:54.265Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53577 (GCVE-0-2023-53577)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
bpf, cpumap: Make sure kthread is running before map update returns
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf, cpumap: Make sure kthread is running before map update returns
The following warning was reported when running stress-mode enabled
xdp_redirect_cpu with some RT threads:
------------[ cut here ]------------
WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135
CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)
Workqueue: events cpu_map_kthread_stop
RIP: 0010:put_cpu_map_entry+0xda/0x220
......
Call Trace:
<TASK>
? show_regs+0x65/0x70
? __warn+0xa5/0x240
......
? put_cpu_map_entry+0xda/0x220
cpu_map_kthread_stop+0x41/0x60
process_one_work+0x6b0/0xb80
worker_thread+0x96/0x720
kthread+0x1a5/0x1f0
ret_from_fork+0x3a/0x70
ret_from_fork_asm+0x1b/0x30
</TASK>
The root cause is the same as commit 436901649731 ("bpf: cpumap: Fix memory
leak in cpu_map_update_elem"). The kthread is stopped prematurely by
kthread_stop() in cpu_map_kthread_stop(), and kthread() doesn't call
cpu_map_kthread_run() at all but XDP program has already queued some
frames or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks
the ptr_ring, it will find it was not emptied and report a warning.
An alternative fix is to use __cpu_map_ring_cleanup() to drop these
pending frames or skbs when kthread_stop() returns -EINTR, but it may
confuse the user, because these frames or skbs have been handled
correctly by XDP program. So instead of dropping these frames or skbs,
just make sure the per-cpu kthread is running before
__cpu_map_entry_alloc() returns.
After apply the fix, the error handle for kthread_stop() will be
unnecessary because it will always return 0, so just remove it.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
6710e1126934d8b4372b4d2f9ae1646cd3f151bf , < b44d28b98f185d2f2348aa3c3636838c316f889e
(git)
Affected: 6710e1126934d8b4372b4d2f9ae1646cd3f151bf , < 7a1178a3671b40746830d355836b72e47ceb2490 (git) Affected: 6710e1126934d8b4372b4d2f9ae1646cd3f151bf , < ecb45b852af5e88257020b88bea5ff0798d72aca (git) Affected: 6710e1126934d8b4372b4d2f9ae1646cd3f151bf , < 640a604585aa30f93e39b17d4d6ba69fcb1e66c9 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/bpf/cpumap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b44d28b98f185d2f2348aa3c3636838c316f889e",
"status": "affected",
"version": "6710e1126934d8b4372b4d2f9ae1646cd3f151bf",
"versionType": "git"
},
{
"lessThan": "7a1178a3671b40746830d355836b72e47ceb2490",
"status": "affected",
"version": "6710e1126934d8b4372b4d2f9ae1646cd3f151bf",
"versionType": "git"
},
{
"lessThan": "ecb45b852af5e88257020b88bea5ff0798d72aca",
"status": "affected",
"version": "6710e1126934d8b4372b4d2f9ae1646cd3f151bf",
"versionType": "git"
},
{
"lessThan": "640a604585aa30f93e39b17d4d6ba69fcb1e66c9",
"status": "affected",
"version": "6710e1126934d8b4372b4d2f9ae1646cd3f151bf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/bpf/cpumap.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.126",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.126",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.45",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.10",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, cpumap: Make sure kthread is running before map update returns\n\nThe following warning was reported when running stress-mode enabled\nxdp_redirect_cpu with some RT threads:\n\n ------------[ cut here ]------------\n WARNING: CPU: 4 PID: 65 at kernel/bpf/cpumap.c:135\n CPU: 4 PID: 65 Comm: kworker/4:1 Not tainted 6.5.0-rc2+ #1\n Hardware name: QEMU Standard PC (i440FX + PIIX, 1996)\n Workqueue: events cpu_map_kthread_stop\n RIP: 0010:put_cpu_map_entry+0xda/0x220\n ......\n Call Trace:\n \u003cTASK\u003e\n ? show_regs+0x65/0x70\n ? __warn+0xa5/0x240\n ......\n ? put_cpu_map_entry+0xda/0x220\n cpu_map_kthread_stop+0x41/0x60\n process_one_work+0x6b0/0xb80\n worker_thread+0x96/0x720\n kthread+0x1a5/0x1f0\n ret_from_fork+0x3a/0x70\n ret_from_fork_asm+0x1b/0x30\n \u003c/TASK\u003e\n\nThe root cause is the same as commit 436901649731 (\"bpf: cpumap: Fix memory\nleak in cpu_map_update_elem\"). The kthread is stopped prematurely by\nkthread_stop() in cpu_map_kthread_stop(), and kthread() doesn\u0027t call\ncpu_map_kthread_run() at all but XDP program has already queued some\nframes or skbs into ptr_ring. So when __cpu_map_ring_cleanup() checks\nthe ptr_ring, it will find it was not emptied and report a warning.\n\nAn alternative fix is to use __cpu_map_ring_cleanup() to drop these\npending frames or skbs when kthread_stop() returns -EINTR, but it may\nconfuse the user, because these frames or skbs have been handled\ncorrectly by XDP program. So instead of dropping these frames or skbs,\njust make sure the per-cpu kthread is running before\n__cpu_map_entry_alloc() returns.\n\nAfter apply the fix, the error handle for kthread_stop() will be\nunnecessary because it will always return 0, so just remove it."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:16.632Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b44d28b98f185d2f2348aa3c3636838c316f889e"
},
{
"url": "https://git.kernel.org/stable/c/7a1178a3671b40746830d355836b72e47ceb2490"
},
{
"url": "https://git.kernel.org/stable/c/ecb45b852af5e88257020b88bea5ff0798d72aca"
},
{
"url": "https://git.kernel.org/stable/c/640a604585aa30f93e39b17d4d6ba69fcb1e66c9"
}
],
"title": "bpf, cpumap: Make sure kthread is running before map update returns",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53577",
"datePublished": "2025-10-04T15:17:16.632Z",
"dateReserved": "2025-10-04T15:14:15.926Z",
"dateUpdated": "2025-10-04T15:17:16.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50488 (GCVE-0-2022-50488)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
block, bfq: fix possible uaf for 'bfqq->bic'
Summary
In the Linux kernel, the following vulnerability has been resolved:
block, bfq: fix possible uaf for 'bfqq->bic'
Our test report a uaf for 'bfqq->bic' in 5.10:
==================================================================
BUG: KASAN: use-after-free in bfq_select_queue+0x378/0xa30
CPU: 6 PID: 2318352 Comm: fsstress Kdump: loaded Not tainted 5.10.0-60.18.0.50.h602.kasan.eulerosv2r11.x86_64 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-20220320_160524-szxrtosci10000 04/01/2014
Call Trace:
bfq_select_queue+0x378/0xa30
bfq_dispatch_request+0xe8/0x130
blk_mq_do_dispatch_sched+0x62/0xb0
__blk_mq_sched_dispatch_requests+0x215/0x2a0
blk_mq_sched_dispatch_requests+0x8f/0xd0
__blk_mq_run_hw_queue+0x98/0x180
__blk_mq_delay_run_hw_queue+0x22b/0x240
blk_mq_run_hw_queue+0xe3/0x190
blk_mq_sched_insert_requests+0x107/0x200
blk_mq_flush_plug_list+0x26e/0x3c0
blk_finish_plug+0x63/0x90
__iomap_dio_rw+0x7b5/0x910
iomap_dio_rw+0x36/0x80
ext4_dio_read_iter+0x146/0x190 [ext4]
ext4_file_read_iter+0x1e2/0x230 [ext4]
new_sync_read+0x29f/0x400
vfs_read+0x24e/0x2d0
ksys_read+0xd5/0x1b0
do_syscall_64+0x33/0x40
entry_SYSCALL_64_after_hwframe+0x61/0xc6
Commit 3bc5e683c67d ("bfq: Split shared queues on move between cgroups")
changes that move process to a new cgroup will allocate a new bfqq to
use, however, the old bfqq and new bfqq can point to the same bic:
1) Initial state, two process with io in the same cgroup.
Process 1 Process 2
(BIC1) (BIC2)
| Λ | Λ
| | | |
V | V |
bfqq1 bfqq2
2) bfqq1 is merged to bfqq2.
Process 1 Process 2
(BIC1) (BIC2)
| |
\-------------\|
V
bfqq1 bfqq2(coop)
3) Process 1 exit, then issue new io(denoce IOA) from Process 2.
(BIC2)
| Λ
| |
V |
bfqq2(coop)
4) Before IOA is completed, move Process 2 to another cgroup and issue io.
Process 2
(BIC2)
Λ
|\--------------\
| V
bfqq2 bfqq3
Now that BIC2 points to bfqq3, while bfqq2 and bfqq3 both point to BIC2.
If all the requests are completed, and Process 2 exit, BIC2 will be
freed while there is no guarantee that bfqq2 will be freed before BIC2.
Fix the problem by clearing bfqq->bic while bfqq is detached from bic.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4dfc12f8c94c8052e975060f595938f75e8b7165 , < 5533742c7cb1bc9b1f0bf401cc397d44a3a9e07a
(git)
Affected: 81b7d0c717a487ec50e2924a773ff501ee40f0d5 , < 094f3d9314d67691cb21ba091c1b528f6e3c4893 (git) Affected: 3bc5e683c67d94bd839a1da2e796c15847b51b69 , < b22fd72bfebda3956efc4431b60ddfc0a51e03e0 (git) Affected: 3bc5e683c67d94bd839a1da2e796c15847b51b69 , < 761564d93c8265f65543acf0a576b32d66bfa26a (git) Affected: 3bc5e683c67d94bd839a1da2e796c15847b51b69 , < 64dc8c732f5c2b406cc752e6aaa1bd5471159cab (git) Affected: 31326bf551269fb9bafa84ca99172b8340e5d8f8 (git) Affected: 43c51b86dbe551cff5d39b88aa2f41d29479f9c4 (git) Affected: 8615f6c0c9e7cf0ca90b6b5408784d797cbe5621 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/bfq-iosched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5533742c7cb1bc9b1f0bf401cc397d44a3a9e07a",
"status": "affected",
"version": "4dfc12f8c94c8052e975060f595938f75e8b7165",
"versionType": "git"
},
{
"lessThan": "094f3d9314d67691cb21ba091c1b528f6e3c4893",
"status": "affected",
"version": "81b7d0c717a487ec50e2924a773ff501ee40f0d5",
"versionType": "git"
},
{
"lessThan": "b22fd72bfebda3956efc4431b60ddfc0a51e03e0",
"status": "affected",
"version": "3bc5e683c67d94bd839a1da2e796c15847b51b69",
"versionType": "git"
},
{
"lessThan": "761564d93c8265f65543acf0a576b32d66bfa26a",
"status": "affected",
"version": "3bc5e683c67d94bd839a1da2e796c15847b51b69",
"versionType": "git"
},
{
"lessThan": "64dc8c732f5c2b406cc752e6aaa1bd5471159cab",
"status": "affected",
"version": "3bc5e683c67d94bd839a1da2e796c15847b51b69",
"versionType": "git"
},
{
"status": "affected",
"version": "31326bf551269fb9bafa84ca99172b8340e5d8f8",
"versionType": "git"
},
{
"status": "affected",
"version": "43c51b86dbe551cff5d39b88aa2f41d29479f9c4",
"versionType": "git"
},
{
"status": "affected",
"version": "8615f6c0c9e7cf0ca90b6b5408784d797cbe5621",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/bfq-iosched.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.19"
},
{
"lessThan": "5.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.175",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.175",
"versionStartIncluding": "5.10.121",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "5.15.46",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.198",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.17.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.18.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblock, bfq: fix possible uaf for \u0027bfqq-\u003ebic\u0027\n\nOur test report a uaf for \u0027bfqq-\u003ebic\u0027 in 5.10:\n\n==================================================================\nBUG: KASAN: use-after-free in bfq_select_queue+0x378/0xa30\n\nCPU: 6 PID: 2318352 Comm: fsstress Kdump: loaded Not tainted 5.10.0-60.18.0.50.h602.kasan.eulerosv2r11.x86_64 #1\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-20220320_160524-szxrtosci10000 04/01/2014\nCall Trace:\n bfq_select_queue+0x378/0xa30\n bfq_dispatch_request+0xe8/0x130\n blk_mq_do_dispatch_sched+0x62/0xb0\n __blk_mq_sched_dispatch_requests+0x215/0x2a0\n blk_mq_sched_dispatch_requests+0x8f/0xd0\n __blk_mq_run_hw_queue+0x98/0x180\n __blk_mq_delay_run_hw_queue+0x22b/0x240\n blk_mq_run_hw_queue+0xe3/0x190\n blk_mq_sched_insert_requests+0x107/0x200\n blk_mq_flush_plug_list+0x26e/0x3c0\n blk_finish_plug+0x63/0x90\n __iomap_dio_rw+0x7b5/0x910\n iomap_dio_rw+0x36/0x80\n ext4_dio_read_iter+0x146/0x190 [ext4]\n ext4_file_read_iter+0x1e2/0x230 [ext4]\n new_sync_read+0x29f/0x400\n vfs_read+0x24e/0x2d0\n ksys_read+0xd5/0x1b0\n do_syscall_64+0x33/0x40\n entry_SYSCALL_64_after_hwframe+0x61/0xc6\n\nCommit 3bc5e683c67d (\"bfq: Split shared queues on move between cgroups\")\nchanges that move process to a new cgroup will allocate a new bfqq to\nuse, however, the old bfqq and new bfqq can point to the same bic:\n\n1) Initial state, two process with io in the same cgroup.\n\nProcess 1 Process 2\n (BIC1) (BIC2)\n | \u039b | \u039b\n | | | |\n V | V |\n bfqq1 bfqq2\n\n2) bfqq1 is merged to bfqq2.\n\nProcess 1 Process 2\n (BIC1) (BIC2)\n | |\n \\-------------\\|\n V\n bfqq1 bfqq2(coop)\n\n3) Process 1 exit, then issue new io(denoce IOA) from Process 2.\n\n (BIC2)\n | \u039b\n | |\n V |\n bfqq2(coop)\n\n4) Before IOA is completed, move Process 2 to another cgroup and issue io.\n\nProcess 2\n (BIC2)\n \u039b\n |\\--------------\\\n | V\n bfqq2 bfqq3\n\nNow that BIC2 points to bfqq3, while bfqq2 and bfqq3 both point to BIC2.\nIf all the requests are completed, and Process 2 exit, BIC2 will be\nfreed while there is no guarantee that bfqq2 will be freed before BIC2.\n\nFix the problem by clearing bfqq-\u003ebic while bfqq is detached from bic."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:42.352Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5533742c7cb1bc9b1f0bf401cc397d44a3a9e07a"
},
{
"url": "https://git.kernel.org/stable/c/094f3d9314d67691cb21ba091c1b528f6e3c4893"
},
{
"url": "https://git.kernel.org/stable/c/b22fd72bfebda3956efc4431b60ddfc0a51e03e0"
},
{
"url": "https://git.kernel.org/stable/c/761564d93c8265f65543acf0a576b32d66bfa26a"
},
{
"url": "https://git.kernel.org/stable/c/64dc8c732f5c2b406cc752e6aaa1bd5471159cab"
}
],
"title": "block, bfq: fix possible uaf for \u0027bfqq-\u003ebic\u0027",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50488",
"datePublished": "2025-10-04T15:43:42.352Z",
"dateReserved": "2025-10-04T15:13:33.468Z",
"dateUpdated": "2025-10-04T15:43:42.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53569 (GCVE-0-2023-53569)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
ext2: Check block size validity during mount
Summary
In the Linux kernel, the following vulnerability has been resolved:
ext2: Check block size validity during mount
Check that log of block size stored in the superblock has sensible
value. Otherwise the shift computing the block size can overflow leading
to undefined behavior.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 0ebfaf14150f55550cffb1148ed3920143c7a69c
(git)
Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 451b98155be5dfee05bc6e7c8b30c0be4add3f71 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c4813f858e5c3e4c4659ce95385c1c400c593e1e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 22ab5fed07ad4b206ea910fd0132d1a0d4831584 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 99f8a15af6c9f0653193104a9e70891f950c6001 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < e6f4fb28890c1361e0db9eb1adee3fc04e7fe7f5 (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < c2e7776843a953fd7e48895c3880c277f996193e (git) Affected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 , < 62aeb94433fcec80241754b70d0d1836d5926b0a (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ext2/ext2.h",
"fs/ext2/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0ebfaf14150f55550cffb1148ed3920143c7a69c",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "451b98155be5dfee05bc6e7c8b30c0be4add3f71",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c4813f858e5c3e4c4659ce95385c1c400c593e1e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "22ab5fed07ad4b206ea910fd0132d1a0d4831584",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "99f8a15af6c9f0653193104a9e70891f950c6001",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "e6f4fb28890c1361e0db9eb1adee3fc04e7fe7f5",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "c2e7776843a953fd7e48895c3880c277f996193e",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
},
{
"lessThan": "62aeb94433fcec80241754b70d0d1836d5926b0a",
"status": "affected",
"version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ext2/ext2.h",
"fs/ext2/super.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.12"
},
{
"lessThan": "2.6.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.316",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.284",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.244",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.181",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.316",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.284",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.244",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.181",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.113",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.30",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "2.6.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\next2: Check block size validity during mount\n\nCheck that log of block size stored in the superblock has sensible\nvalue. Otherwise the shift computing the block size can overflow leading\nto undefined behavior."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:21.379Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0ebfaf14150f55550cffb1148ed3920143c7a69c"
},
{
"url": "https://git.kernel.org/stable/c/451b98155be5dfee05bc6e7c8b30c0be4add3f71"
},
{
"url": "https://git.kernel.org/stable/c/c4813f858e5c3e4c4659ce95385c1c400c593e1e"
},
{
"url": "https://git.kernel.org/stable/c/22ab5fed07ad4b206ea910fd0132d1a0d4831584"
},
{
"url": "https://git.kernel.org/stable/c/99f8a15af6c9f0653193104a9e70891f950c6001"
},
{
"url": "https://git.kernel.org/stable/c/e6f4fb28890c1361e0db9eb1adee3fc04e7fe7f5"
},
{
"url": "https://git.kernel.org/stable/c/c2e7776843a953fd7e48895c3880c277f996193e"
},
{
"url": "https://git.kernel.org/stable/c/62aeb94433fcec80241754b70d0d1836d5926b0a"
}
],
"title": "ext2: Check block size validity during mount",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53569",
"datePublished": "2025-10-04T15:17:10.734Z",
"dateReserved": "2025-10-04T15:14:15.924Z",
"dateUpdated": "2026-01-05T10:21:21.379Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53564 (GCVE-0-2023-53564)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
ocfs2: fix defrag path triggering jbd2 ASSERT
Summary
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix defrag path triggering jbd2 ASSERT
code path:
ocfs2_ioctl_move_extents
ocfs2_move_extents
ocfs2_defrag_extent
__ocfs2_move_extent
+ ocfs2_journal_access_di
+ ocfs2_split_extent //sub-paths call jbd2_journal_restart
+ ocfs2_journal_dirty //crash by jbs2 ASSERT
crash stacks:
PID: 11297 TASK: ffff974a676dcd00 CPU: 67 COMMAND: "defragfs.ocfs2"
#0 [ffffb25d8dad3900] machine_kexec at ffffffff8386fe01
#1 [ffffb25d8dad3958] __crash_kexec at ffffffff8395959d
#2 [ffffb25d8dad3a20] crash_kexec at ffffffff8395a45d
#3 [ffffb25d8dad3a38] oops_end at ffffffff83836d3f
#4 [ffffb25d8dad3a58] do_trap at ffffffff83833205
#5 [ffffb25d8dad3aa0] do_invalid_op at ffffffff83833aa6
#6 [ffffb25d8dad3ac0] invalid_op at ffffffff84200d18
[exception RIP: jbd2_journal_dirty_metadata+0x2ba]
RIP: ffffffffc09ca54a RSP: ffffb25d8dad3b70 RFLAGS: 00010207
RAX: 0000000000000000 RBX: ffff9706eedc5248 RCX: 0000000000000000
RDX: 0000000000000001 RSI: ffff97337029ea28 RDI: ffff9706eedc5250
RBP: ffff9703c3520200 R8: 000000000f46b0b2 R9: 0000000000000000
R10: 0000000000000001 R11: 00000001000000fe R12: ffff97337029ea28
R13: 0000000000000000 R14: ffff9703de59bf60 R15: ffff9706eedc5250
ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018
#7 [ffffb25d8dad3ba8] ocfs2_journal_dirty at ffffffffc137fb95 [ocfs2]
#8 [ffffb25d8dad3be8] __ocfs2_move_extent at ffffffffc139a950 [ocfs2]
#9 [ffffb25d8dad3c80] ocfs2_defrag_extent at ffffffffc139b2d2 [ocfs2]
Analysis
This bug has the same root cause of 'commit 7f27ec978b0e ("ocfs2: call
ocfs2_journal_access_di() before ocfs2_journal_dirty() in
ocfs2_write_end_nolock()")'. For this bug, jbd2_journal_restart() is
called by ocfs2_split_extent() during defragmenting.
How to fix
For ocfs2_split_extent() can handle journal operations totally by itself.
Caller doesn't need to call journal access/dirty pair, and caller only
needs to call journal start/stop pair. The fix method is to remove
journal access/dirty from __ocfs2_move_extent().
The discussion for this patch:
https://oss.oracle.com/pipermail/ocfs2-devel/2023-February/000647.html
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
8f603e567aa7a243e68ca48b4f105b990851360f , < 5f43d34a51ed30e6a60f7e59d224a63014fe2cd5
(git)
Affected: 8f603e567aa7a243e68ca48b4f105b990851360f , < 7f3b1c28e2908755fb248d3ee8ff56826f2387db (git) Affected: 8f603e567aa7a243e68ca48b4f105b990851360f , < 669134a66d37258e1c4a5cfbd5b82f547ae30fca (git) Affected: 8f603e567aa7a243e68ca48b4f105b990851360f , < 2c559b3ba8e0b9e3c4bb08159a28ccadc698410f (git) Affected: 8f603e567aa7a243e68ca48b4f105b990851360f , < 33665d1042666f2e5c736a3df1f453e31f030663 (git) Affected: 8f603e567aa7a243e68ca48b4f105b990851360f , < 8163ea90d89b7012dd1fa4b28edf5db0c641eca7 (git) Affected: 8f603e567aa7a243e68ca48b4f105b990851360f , < 590507ebabd33cd93324c04f9a5538309a5ba934 (git) Affected: 8f603e567aa7a243e68ca48b4f105b990851360f , < 60eed1e3d45045623e46944ebc7c42c30a4350f0 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/move_extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5f43d34a51ed30e6a60f7e59d224a63014fe2cd5",
"status": "affected",
"version": "8f603e567aa7a243e68ca48b4f105b990851360f",
"versionType": "git"
},
{
"lessThan": "7f3b1c28e2908755fb248d3ee8ff56826f2387db",
"status": "affected",
"version": "8f603e567aa7a243e68ca48b4f105b990851360f",
"versionType": "git"
},
{
"lessThan": "669134a66d37258e1c4a5cfbd5b82f547ae30fca",
"status": "affected",
"version": "8f603e567aa7a243e68ca48b4f105b990851360f",
"versionType": "git"
},
{
"lessThan": "2c559b3ba8e0b9e3c4bb08159a28ccadc698410f",
"status": "affected",
"version": "8f603e567aa7a243e68ca48b4f105b990851360f",
"versionType": "git"
},
{
"lessThan": "33665d1042666f2e5c736a3df1f453e31f030663",
"status": "affected",
"version": "8f603e567aa7a243e68ca48b4f105b990851360f",
"versionType": "git"
},
{
"lessThan": "8163ea90d89b7012dd1fa4b28edf5db0c641eca7",
"status": "affected",
"version": "8f603e567aa7a243e68ca48b4f105b990851360f",
"versionType": "git"
},
{
"lessThan": "590507ebabd33cd93324c04f9a5538309a5ba934",
"status": "affected",
"version": "8f603e567aa7a243e68ca48b4f105b990851360f",
"versionType": "git"
},
{
"lessThan": "60eed1e3d45045623e46944ebc7c42c30a4350f0",
"status": "affected",
"version": "8f603e567aa7a243e68ca48b4f105b990851360f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/ocfs2/move_extents.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.0"
},
{
"lessThan": "3.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.308",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.276",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.308",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.276",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.235",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "3.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "3.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix defrag path triggering jbd2 ASSERT\n\ncode path:\n\nocfs2_ioctl_move_extents\n ocfs2_move_extents\n ocfs2_defrag_extent\n __ocfs2_move_extent\n + ocfs2_journal_access_di\n + ocfs2_split_extent //sub-paths call jbd2_journal_restart\n + ocfs2_journal_dirty //crash by jbs2 ASSERT\n\ncrash stacks:\n\nPID: 11297 TASK: ffff974a676dcd00 CPU: 67 COMMAND: \"defragfs.ocfs2\"\n #0 [ffffb25d8dad3900] machine_kexec at ffffffff8386fe01\n #1 [ffffb25d8dad3958] __crash_kexec at ffffffff8395959d\n #2 [ffffb25d8dad3a20] crash_kexec at ffffffff8395a45d\n #3 [ffffb25d8dad3a38] oops_end at ffffffff83836d3f\n #4 [ffffb25d8dad3a58] do_trap at ffffffff83833205\n #5 [ffffb25d8dad3aa0] do_invalid_op at ffffffff83833aa6\n #6 [ffffb25d8dad3ac0] invalid_op at ffffffff84200d18\n [exception RIP: jbd2_journal_dirty_metadata+0x2ba]\n RIP: ffffffffc09ca54a RSP: ffffb25d8dad3b70 RFLAGS: 00010207\n RAX: 0000000000000000 RBX: ffff9706eedc5248 RCX: 0000000000000000\n RDX: 0000000000000001 RSI: ffff97337029ea28 RDI: ffff9706eedc5250\n RBP: ffff9703c3520200 R8: 000000000f46b0b2 R9: 0000000000000000\n R10: 0000000000000001 R11: 00000001000000fe R12: ffff97337029ea28\n R13: 0000000000000000 R14: ffff9703de59bf60 R15: ffff9706eedc5250\n ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n #7 [ffffb25d8dad3ba8] ocfs2_journal_dirty at ffffffffc137fb95 [ocfs2]\n #8 [ffffb25d8dad3be8] __ocfs2_move_extent at ffffffffc139a950 [ocfs2]\n #9 [ffffb25d8dad3c80] ocfs2_defrag_extent at ffffffffc139b2d2 [ocfs2]\n\nAnalysis\n\nThis bug has the same root cause of \u0027commit 7f27ec978b0e (\"ocfs2: call\nocfs2_journal_access_di() before ocfs2_journal_dirty() in\nocfs2_write_end_nolock()\")\u0027. For this bug, jbd2_journal_restart() is\ncalled by ocfs2_split_extent() during defragmenting.\n\nHow to fix\n\nFor ocfs2_split_extent() can handle journal operations totally by itself. \nCaller doesn\u0027t need to call journal access/dirty pair, and caller only\nneeds to call journal start/stop pair. The fix method is to remove\njournal access/dirty from __ocfs2_move_extent().\n\nThe discussion for this patch:\nhttps://oss.oracle.com/pipermail/ocfs2-devel/2023-February/000647.html"
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:19.933Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5f43d34a51ed30e6a60f7e59d224a63014fe2cd5"
},
{
"url": "https://git.kernel.org/stable/c/7f3b1c28e2908755fb248d3ee8ff56826f2387db"
},
{
"url": "https://git.kernel.org/stable/c/669134a66d37258e1c4a5cfbd5b82f547ae30fca"
},
{
"url": "https://git.kernel.org/stable/c/2c559b3ba8e0b9e3c4bb08159a28ccadc698410f"
},
{
"url": "https://git.kernel.org/stable/c/33665d1042666f2e5c736a3df1f453e31f030663"
},
{
"url": "https://git.kernel.org/stable/c/8163ea90d89b7012dd1fa4b28edf5db0c641eca7"
},
{
"url": "https://git.kernel.org/stable/c/590507ebabd33cd93324c04f9a5538309a5ba934"
},
{
"url": "https://git.kernel.org/stable/c/60eed1e3d45045623e46944ebc7c42c30a4350f0"
}
],
"title": "ocfs2: fix defrag path triggering jbd2 ASSERT",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53564",
"datePublished": "2025-10-04T15:17:07.114Z",
"dateReserved": "2025-10-04T15:14:15.923Z",
"dateUpdated": "2026-01-05T10:21:19.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53612 (GCVE-0-2023-53612)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
hwmon: (coretemp) Simplify platform device handling
Summary
In the Linux kernel, the following vulnerability has been resolved:
hwmon: (coretemp) Simplify platform device handling
Coretemp's platform driver is unconventional. All the real work is done
globally by the initcall and CPU hotplug notifiers, while the "driver"
effectively just wraps an allocation and the registration of the hwmon
interface in a long-winded round-trip through the driver core. The whole
logic of dynamically creating and destroying platform devices to bring
the interfaces up and down is error prone, since it assumes
platform_device_add() will synchronously bind the driver and set drvdata
before it returns, thus results in a NULL dereference if drivers_autoprobe
is turned off for the platform bus. Furthermore, the unusual approach of
doing that from within a CPU hotplug notifier, already commented in the
code that it deadlocks suspend, also causes lockdep issues for other
drivers or subsystems which may want to legitimately register a CPU
hotplug notifier from a platform bus notifier.
All of these issues can be solved by ripping this unusual behaviour out
completely, simply tying the platform devices to the lifetime of the
module itself, and directly managing the hwmon interfaces from the
hotplug notifiers. There is a slight user-visible change in that
/sys/bus/platform/drivers/coretemp will no longer appear, and
/sys/devices/platform/coretemp.n will remain present if package n is
hotplugged off, but hwmon users should really only be looking for the
presence of the hwmon interfaces, whose behaviour remains unchanged.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
e1b370b64031a01bb0c4158ce250073a88921fe1 , < 4000384684f612b3645a944f6acde0e65ac370b8
(git)
Affected: e1b370b64031a01bb0c4158ce250073a88921fe1 , < 5735878a7b7db7e9ce731cb36cec298a9de67549 (git) Affected: e1b370b64031a01bb0c4158ce250073a88921fe1 , < 52ea47a0ddfbc5fe05e873d3f5a59db4ba3e03fe (git) Affected: e1b370b64031a01bb0c4158ce250073a88921fe1 , < 8fcdbc4bc01365f4b10fed7db544a3149e3054fd (git) Affected: e1b370b64031a01bb0c4158ce250073a88921fe1 , < c57a8d14d7880521150ee801d53a0a64fdffd9c8 (git) Affected: e1b370b64031a01bb0c4158ce250073a88921fe1 , < 6d03bbff456befeccdd4d663177c4d6c75d0c4ff (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/coretemp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4000384684f612b3645a944f6acde0e65ac370b8",
"status": "affected",
"version": "e1b370b64031a01bb0c4158ce250073a88921fe1",
"versionType": "git"
},
{
"lessThan": "5735878a7b7db7e9ce731cb36cec298a9de67549",
"status": "affected",
"version": "e1b370b64031a01bb0c4158ce250073a88921fe1",
"versionType": "git"
},
{
"lessThan": "52ea47a0ddfbc5fe05e873d3f5a59db4ba3e03fe",
"status": "affected",
"version": "e1b370b64031a01bb0c4158ce250073a88921fe1",
"versionType": "git"
},
{
"lessThan": "8fcdbc4bc01365f4b10fed7db544a3149e3054fd",
"status": "affected",
"version": "e1b370b64031a01bb0c4158ce250073a88921fe1",
"versionType": "git"
},
{
"lessThan": "c57a8d14d7880521150ee801d53a0a64fdffd9c8",
"status": "affected",
"version": "e1b370b64031a01bb0c4158ce250073a88921fe1",
"versionType": "git"
},
{
"lessThan": "6d03bbff456befeccdd4d663177c4d6c75d0c4ff",
"status": "affected",
"version": "e1b370b64031a01bb0c4158ce250073a88921fe1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwmon/coretemp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.10"
},
{
"lessThan": "4.10",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.235",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.235",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "4.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "4.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nhwmon: (coretemp) Simplify platform device handling\n\nCoretemp\u0027s platform driver is unconventional. All the real work is done\nglobally by the initcall and CPU hotplug notifiers, while the \"driver\"\neffectively just wraps an allocation and the registration of the hwmon\ninterface in a long-winded round-trip through the driver core. The whole\nlogic of dynamically creating and destroying platform devices to bring\nthe interfaces up and down is error prone, since it assumes\nplatform_device_add() will synchronously bind the driver and set drvdata\nbefore it returns, thus results in a NULL dereference if drivers_autoprobe\nis turned off for the platform bus. Furthermore, the unusual approach of\ndoing that from within a CPU hotplug notifier, already commented in the\ncode that it deadlocks suspend, also causes lockdep issues for other\ndrivers or subsystems which may want to legitimately register a CPU\nhotplug notifier from a platform bus notifier.\n\nAll of these issues can be solved by ripping this unusual behaviour out\ncompletely, simply tying the platform devices to the lifetime of the\nmodule itself, and directly managing the hwmon interfaces from the\nhotplug notifiers. There is a slight user-visible change in that\n/sys/bus/platform/drivers/coretemp will no longer appear, and\n/sys/devices/platform/coretemp.n will remain present if package n is\nhotplugged off, but hwmon users should really only be looking for the\npresence of the hwmon interfaces, whose behaviour remains unchanged."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:31.384Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4000384684f612b3645a944f6acde0e65ac370b8"
},
{
"url": "https://git.kernel.org/stable/c/5735878a7b7db7e9ce731cb36cec298a9de67549"
},
{
"url": "https://git.kernel.org/stable/c/52ea47a0ddfbc5fe05e873d3f5a59db4ba3e03fe"
},
{
"url": "https://git.kernel.org/stable/c/8fcdbc4bc01365f4b10fed7db544a3149e3054fd"
},
{
"url": "https://git.kernel.org/stable/c/c57a8d14d7880521150ee801d53a0a64fdffd9c8"
},
{
"url": "https://git.kernel.org/stable/c/6d03bbff456befeccdd4d663177c4d6c75d0c4ff"
}
],
"title": "hwmon: (coretemp) Simplify platform device handling",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53612",
"datePublished": "2025-10-04T15:44:20.297Z",
"dateReserved": "2025-10-04T15:40:38.480Z",
"dateUpdated": "2026-01-05T10:21:31.384Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53557 (GCVE-0-2023-53557)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
fprobe: Release rethook after the ftrace_ops is unregistered
Summary
In the Linux kernel, the following vulnerability has been resolved:
fprobe: Release rethook after the ftrace_ops is unregistered
While running bpf selftests it's possible to get following fault:
general protection fault, probably for non-canonical address \
0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI
...
Call Trace:
<TASK>
fprobe_handler+0xc1/0x270
? __pfx_bpf_testmod_init+0x10/0x10
? __pfx_bpf_testmod_init+0x10/0x10
? bpf_fentry_test1+0x5/0x10
? bpf_fentry_test1+0x5/0x10
? bpf_testmod_init+0x22/0x80
? do_one_initcall+0x63/0x2e0
? rcu_is_watching+0xd/0x40
? kmalloc_trace+0xaf/0xc0
? do_init_module+0x60/0x250
? __do_sys_finit_module+0xac/0x120
? do_syscall_64+0x37/0x90
? entry_SYSCALL_64_after_hwframe+0x72/0xdc
</TASK>
In unregister_fprobe function we can't release fp->rethook while it's
possible there are some of its users still running on another cpu.
Moving rethook_free call after fp->ops is unregistered with
unregister_ftrace_function call.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
5b0ab78998e32564a011b14c4c7f9c81e2d42b9d , < ce3ec57faff559ccae1e0150c1f077eb2df648a4
(git)
Affected: 5b0ab78998e32564a011b14c4c7f9c81e2d42b9d , < 03d63255a5783243c110aec5e6ae2f1475c3be76 (git) Affected: 5b0ab78998e32564a011b14c4c7f9c81e2d42b9d , < 5f81018753dfd4989e33ece1f0cb6b8aae498b82 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/fprobe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ce3ec57faff559ccae1e0150c1f077eb2df648a4",
"status": "affected",
"version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
"versionType": "git"
},
{
"lessThan": "03d63255a5783243c110aec5e6ae2f1475c3be76",
"status": "affected",
"version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
"versionType": "git"
},
{
"lessThan": "5f81018753dfd4989e33ece1f0cb6b8aae498b82",
"status": "affected",
"version": "5b0ab78998e32564a011b14c4c7f9c81e2d42b9d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/fprobe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.40",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.5",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfprobe: Release rethook after the ftrace_ops is unregistered\n\nWhile running bpf selftests it\u0027s possible to get following fault:\n\n general protection fault, probably for non-canonical address \\\n 0x6b6b6b6b6b6b6b6b: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI\n ...\n Call Trace:\n \u003cTASK\u003e\n fprobe_handler+0xc1/0x270\n ? __pfx_bpf_testmod_init+0x10/0x10\n ? __pfx_bpf_testmod_init+0x10/0x10\n ? bpf_fentry_test1+0x5/0x10\n ? bpf_fentry_test1+0x5/0x10\n ? bpf_testmod_init+0x22/0x80\n ? do_one_initcall+0x63/0x2e0\n ? rcu_is_watching+0xd/0x40\n ? kmalloc_trace+0xaf/0xc0\n ? do_init_module+0x60/0x250\n ? __do_sys_finit_module+0xac/0x120\n ? do_syscall_64+0x37/0x90\n ? entry_SYSCALL_64_after_hwframe+0x72/0xdc\n \u003c/TASK\u003e\n\nIn unregister_fprobe function we can\u0027t release fp-\u003erethook while it\u0027s\npossible there are some of its users still running on another cpu.\n\nMoving rethook_free call after fp-\u003eops is unregistered with\nunregister_ftrace_function call."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:02.077Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ce3ec57faff559ccae1e0150c1f077eb2df648a4"
},
{
"url": "https://git.kernel.org/stable/c/03d63255a5783243c110aec5e6ae2f1475c3be76"
},
{
"url": "https://git.kernel.org/stable/c/5f81018753dfd4989e33ece1f0cb6b8aae498b82"
}
],
"title": "fprobe: Release rethook after the ftrace_ops is unregistered",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53557",
"datePublished": "2025-10-04T15:17:02.077Z",
"dateReserved": "2025-10-04T15:14:15.923Z",
"dateUpdated": "2025-10-04T15:17:02.077Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39940 (GCVE-0-2025-39940)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2026-01-02 15:32
VLAI?
EPSS
Title
dm-stripe: fix a possible integer overflow
Summary
In the Linux kernel, the following vulnerability has been resolved:
dm-stripe: fix a possible integer overflow
There's a possible integer overflow in stripe_io_hints if we have too
large chunk size. Test if the overflow happened, and if it did, don't set
limits->io_min and limits->io_opt;
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
40bea431274c247425e7f5970d796ff7b37a2b22 , < f8f64254bca5ae58f3b679441962bda4c409f659
(git)
Affected: 40bea431274c247425e7f5970d796ff7b37a2b22 , < ee27658c239b27721397f3e4eb16370b5cce596e (git) Affected: 40bea431274c247425e7f5970d796ff7b37a2b22 , < 1071d560afb4c245c2076494226df47db5a35708 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-stripe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f8f64254bca5ae58f3b679441962bda4c409f659",
"status": "affected",
"version": "40bea431274c247425e7f5970d796ff7b37a2b22",
"versionType": "git"
},
{
"lessThan": "ee27658c239b27721397f3e4eb16370b5cce596e",
"status": "affected",
"version": "40bea431274c247425e7f5970d796ff7b37a2b22",
"versionType": "git"
},
{
"lessThan": "1071d560afb4c245c2076494226df47db5a35708",
"status": "affected",
"version": "40bea431274c247425e7f5970d796ff7b37a2b22",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/md/dm-stripe.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"lessThan": "2.6.31",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "2.6.31",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "2.6.31",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndm-stripe: fix a possible integer overflow\n\nThere\u0027s a possible integer overflow in stripe_io_hints if we have too\nlarge chunk size. Test if the overflow happened, and if it did, don\u0027t set\nlimits-\u003eio_min and limits-\u003eio_opt;"
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T15:32:41.795Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f8f64254bca5ae58f3b679441962bda4c409f659"
},
{
"url": "https://git.kernel.org/stable/c/ee27658c239b27721397f3e4eb16370b5cce596e"
},
{
"url": "https://git.kernel.org/stable/c/1071d560afb4c245c2076494226df47db5a35708"
}
],
"title": "dm-stripe: fix a possible integer overflow",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39940",
"datePublished": "2025-10-04T07:31:03.309Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2026-01-02T15:32:41.795Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-50501 (GCVE-0-2022-50501)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
media: coda: Add check for dcoda_iram_alloc
Summary
In the Linux kernel, the following vulnerability has been resolved:
media: coda: Add check for dcoda_iram_alloc
As the coda_iram_alloc may return NULL pointer,
it should be better to check the return value
in order to avoid NULL poineter dereference,
same as the others.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
b313bcc9a46795c0233a765411cef9a15caaa7fb , < 5688d33aa293dfa122d66bef9c0258ddf7ef11e7
(git)
Affected: b313bcc9a46795c0233a765411cef9a15caaa7fb , < 2c6887d5a29024bada6928d1d0959c9990401384 (git) Affected: b313bcc9a46795c0233a765411cef9a15caaa7fb , < 45f57abaee136a1e39d2b04443a1bd5311ba7d94 (git) Affected: b313bcc9a46795c0233a765411cef9a15caaa7fb , < 2b436f1410245412ea5e4c356a175a928d73eed3 (git) Affected: b313bcc9a46795c0233a765411cef9a15caaa7fb , < 35ddd00b36589cf948875b825eedaab1aefd5ad5 (git) Affected: b313bcc9a46795c0233a765411cef9a15caaa7fb , < b99872178e7473f21904fdeea38109275aad8ae8 (git) Affected: b313bcc9a46795c0233a765411cef9a15caaa7fb , < 532417dc98cb9c1185ada4ea4e7ccf965c06bcb5 (git) Affected: b313bcc9a46795c0233a765411cef9a15caaa7fb , < 05f165ded4a7baec31b65aba88e2cd1fb9b91db2 (git) Affected: b313bcc9a46795c0233a765411cef9a15caaa7fb , < 6b8082238fb8bb20f67e46388123e67a5bbc558d (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/coda-bit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5688d33aa293dfa122d66bef9c0258ddf7ef11e7",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
},
{
"lessThan": "2c6887d5a29024bada6928d1d0959c9990401384",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
},
{
"lessThan": "45f57abaee136a1e39d2b04443a1bd5311ba7d94",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
},
{
"lessThan": "2b436f1410245412ea5e4c356a175a928d73eed3",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
},
{
"lessThan": "35ddd00b36589cf948875b825eedaab1aefd5ad5",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
},
{
"lessThan": "b99872178e7473f21904fdeea38109275aad8ae8",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
},
{
"lessThan": "532417dc98cb9c1185ada4ea4e7ccf965c06bcb5",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
},
{
"lessThan": "05f165ded4a7baec31b65aba88e2cd1fb9b91db2",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
},
{
"lessThan": "6b8082238fb8bb20f67e46388123e67a5bbc558d",
"status": "affected",
"version": "b313bcc9a46795c0233a765411cef9a15caaa7fb",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/media/platform/chips-media/coda-bit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.17"
},
{
"lessThan": "3.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "3.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "3.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: coda: Add check for dcoda_iram_alloc\n\nAs the coda_iram_alloc may return NULL pointer,\nit should be better to check the return value\nin order to avoid NULL poineter dereference,\nsame as the others."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:51.498Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5688d33aa293dfa122d66bef9c0258ddf7ef11e7"
},
{
"url": "https://git.kernel.org/stable/c/2c6887d5a29024bada6928d1d0959c9990401384"
},
{
"url": "https://git.kernel.org/stable/c/45f57abaee136a1e39d2b04443a1bd5311ba7d94"
},
{
"url": "https://git.kernel.org/stable/c/2b436f1410245412ea5e4c356a175a928d73eed3"
},
{
"url": "https://git.kernel.org/stable/c/35ddd00b36589cf948875b825eedaab1aefd5ad5"
},
{
"url": "https://git.kernel.org/stable/c/b99872178e7473f21904fdeea38109275aad8ae8"
},
{
"url": "https://git.kernel.org/stable/c/532417dc98cb9c1185ada4ea4e7ccf965c06bcb5"
},
{
"url": "https://git.kernel.org/stable/c/05f165ded4a7baec31b65aba88e2cd1fb9b91db2"
},
{
"url": "https://git.kernel.org/stable/c/6b8082238fb8bb20f67e46388123e67a5bbc558d"
}
],
"title": "media: coda: Add check for dcoda_iram_alloc",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50501",
"datePublished": "2025-10-04T15:43:51.498Z",
"dateReserved": "2025-10-04T15:39:19.465Z",
"dateUpdated": "2025-10-04T15:43:51.498Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39943 (GCVE-0-2025-39943)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:37
VLAI?
EPSS
Title
ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer
If data_offset and data_length of smb_direct_data_transfer struct are
invalid, out of bounds issue could happen.
This patch validate data_offset and data_length field in recv_done.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < 773fddf976d282ef059c36c575ddb81567acd6bc
(git)
Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < bdaab5c6538e250a9654127e688ecbbeb6f771d5 (git) Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < eb0378dde086363046ed3d7db7f126fc3f76fd70 (git) Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < 8be498fcbd5b07272f560b45981d4b9e5a2ad885 (git) Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < 529b121b00a6ee3c88fb3c01b443b2b81f686d48 (git) Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < 5282491fc49d5614ac6ddcd012e5743eecb6a67c (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/transport_rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "773fddf976d282ef059c36c575ddb81567acd6bc",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "bdaab5c6538e250a9654127e688ecbbeb6f771d5",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "eb0378dde086363046ed3d7db7f126fc3f76fd70",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "8be498fcbd5b07272f560b45981d4b9e5a2ad885",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "529b121b00a6ee3c88fb3c01b443b2b81f686d48",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "5282491fc49d5614ac6ddcd012e5743eecb6a67c",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/transport_rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.194",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer\n\nIf data_offset and data_length of smb_direct_data_transfer struct are\ninvalid, out of bounds issue could happen.\nThis patch validate data_offset and data_length field in recv_done."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:37:03.203Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/773fddf976d282ef059c36c575ddb81567acd6bc"
},
{
"url": "https://git.kernel.org/stable/c/bdaab5c6538e250a9654127e688ecbbeb6f771d5"
},
{
"url": "https://git.kernel.org/stable/c/eb0378dde086363046ed3d7db7f126fc3f76fd70"
},
{
"url": "https://git.kernel.org/stable/c/8be498fcbd5b07272f560b45981d4b9e5a2ad885"
},
{
"url": "https://git.kernel.org/stable/c/529b121b00a6ee3c88fb3c01b443b2b81f686d48"
},
{
"url": "https://git.kernel.org/stable/c/5282491fc49d5614ac6ddcd012e5743eecb6a67c"
}
],
"title": "ksmbd: smbdirect: validate data_offset and data_length field of smb_direct_data_transfer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39943",
"datePublished": "2025-10-04T07:31:05.581Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:37:03.203Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53600 (GCVE-0-2023-53600)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
tunnels: fix kasan splat when generating ipv4 pmtu error
Summary
In the Linux kernel, the following vulnerability has been resolved:
tunnels: fix kasan splat when generating ipv4 pmtu error
If we try to emit an icmp error in response to a nonliner skb, we get
BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220
Read of size 4 at addr ffff88811c50db00 by task iperf3/1691
CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309
[..]
kasan_report+0x105/0x140
ip_compute_csum+0x134/0x220
iptunnel_pmtud_build_icmp+0x554/0x1020
skb_tunnel_check_pmtu+0x513/0xb80
vxlan_xmit_one+0x139e/0x2ef0
vxlan_xmit+0x1867/0x2760
dev_hard_start_xmit+0x1ee/0x4f0
br_dev_queue_push_xmit+0x4d1/0x660
[..]
ip_compute_csum() cannot deal with nonlinear skbs, so avoid it.
After this change, splat is gone and iperf3 is no longer stuck.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < 5850c391fd7e25662334cb3cbf29a62bcbff1084
(git)
Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < e95808121953410db8c59f0abfde70ac0d34222c (git) Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc (git) Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < fe6a9f7516735be9fdabab00e47ef7a3403a174d (git) Affected: 4cb47a8644cc9eb8ec81190a50e79e6530d0297f , < 6a7ac3d20593865209dceb554d8b3f094c6bd940 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_tunnel_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "5850c391fd7e25662334cb3cbf29a62bcbff1084",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "e95808121953410db8c59f0abfde70ac0d34222c",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "fe6a9f7516735be9fdabab00e47ef7a3403a174d",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
},
{
"lessThan": "6a7ac3d20593865209dceb554d8b3f094c6bd940",
"status": "affected",
"version": "4cb47a8644cc9eb8ec81190a50e79e6530d0297f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_tunnel_core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.127",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.191",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.127",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.46",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.11",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntunnels: fix kasan splat when generating ipv4 pmtu error\n\nIf we try to emit an icmp error in response to a nonliner skb, we get\n\nBUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220\nRead of size 4 at addr ffff88811c50db00 by task iperf3/1691\nCPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309\n[..]\n kasan_report+0x105/0x140\n ip_compute_csum+0x134/0x220\n iptunnel_pmtud_build_icmp+0x554/0x1020\n skb_tunnel_check_pmtu+0x513/0xb80\n vxlan_xmit_one+0x139e/0x2ef0\n vxlan_xmit+0x1867/0x2760\n dev_hard_start_xmit+0x1ee/0x4f0\n br_dev_queue_push_xmit+0x4d1/0x660\n [..]\n\nip_compute_csum() cannot deal with nonlinear skbs, so avoid it.\nAfter this change, splat is gone and iperf3 is no longer stuck."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:11.775Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/5850c391fd7e25662334cb3cbf29a62bcbff1084"
},
{
"url": "https://git.kernel.org/stable/c/e95808121953410db8c59f0abfde70ac0d34222c"
},
{
"url": "https://git.kernel.org/stable/c/da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc"
},
{
"url": "https://git.kernel.org/stable/c/fe6a9f7516735be9fdabab00e47ef7a3403a174d"
},
{
"url": "https://git.kernel.org/stable/c/6a7ac3d20593865209dceb554d8b3f094c6bd940"
}
],
"title": "tunnels: fix kasan splat when generating ipv4 pmtu error",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53600",
"datePublished": "2025-10-04T15:44:11.775Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-04T15:44:11.775Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53556 (GCVE-0-2023-53556)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
iavf: Fix use-after-free in free_netdev
Summary
In the Linux kernel, the following vulnerability has been resolved:
iavf: Fix use-after-free in free_netdev
We do netif_napi_add() for all allocated q_vectors[], but potentially
do netif_napi_del() for part of them, then kfree q_vectors and leave
invalid pointers at dev->napi_list.
Reproducer:
[root@host ~]# cat repro.sh
#!/bin/bash
pf_dbsf="0000:41:00.0"
vf0_dbsf="0000:41:02.0"
g_pids=()
function do_set_numvf()
{
echo 2 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs
sleep $((RANDOM%3+1))
echo 0 >/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs
sleep $((RANDOM%3+1))
}
function do_set_channel()
{
local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/)
[ -z "$nic" ] && { sleep $((RANDOM%3)) ; return 1; }
ifconfig $nic 192.168.18.5 netmask 255.255.255.0
ifconfig $nic up
ethtool -L $nic combined 1
ethtool -L $nic combined 4
sleep $((RANDOM%3))
}
function on_exit()
{
local pid
for pid in "${g_pids[@]}"; do
kill -0 "$pid" &>/dev/null && kill "$pid" &>/dev/null
done
g_pids=()
}
trap "on_exit; exit" EXIT
while :; do do_set_numvf ; done &
g_pids+=($!)
while :; do do_set_channel ; done &
g_pids+=($!)
wait
Result:
[ 4093.900222] ==================================================================
[ 4093.900230] BUG: KASAN: use-after-free in free_netdev+0x308/0x390
[ 4093.900232] Read of size 8 at addr ffff88b4dc145640 by task repro.sh/6699
[ 4093.900233]
[ 4093.900236] CPU: 10 PID: 6699 Comm: repro.sh Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1
[ 4093.900238] Hardware name: Powerleader PR2008AL/H12DSi-N6, BIOS 2.0 04/09/2021
[ 4093.900239] Call Trace:
[ 4093.900244] dump_stack+0x71/0xab
[ 4093.900249] print_address_description+0x6b/0x290
[ 4093.900251] ? free_netdev+0x308/0x390
[ 4093.900252] kasan_report+0x14a/0x2b0
[ 4093.900254] free_netdev+0x308/0x390
[ 4093.900261] iavf_remove+0x825/0xd20 [iavf]
[ 4093.900265] pci_device_remove+0xa8/0x1f0
[ 4093.900268] device_release_driver_internal+0x1c6/0x460
[ 4093.900271] pci_stop_bus_device+0x101/0x150
[ 4093.900273] pci_stop_and_remove_bus_device+0xe/0x20
[ 4093.900275] pci_iov_remove_virtfn+0x187/0x420
[ 4093.900277] ? pci_iov_add_virtfn+0xe10/0xe10
[ 4093.900278] ? pci_get_subsys+0x90/0x90
[ 4093.900280] sriov_disable+0xed/0x3e0
[ 4093.900282] ? bus_find_device+0x12d/0x1a0
[ 4093.900290] i40e_free_vfs+0x754/0x1210 [i40e]
[ 4093.900298] ? i40e_reset_all_vfs+0x880/0x880 [i40e]
[ 4093.900299] ? pci_get_device+0x7c/0x90
[ 4093.900300] ? pci_get_subsys+0x90/0x90
[ 4093.900306] ? pci_vfs_assigned.part.7+0x144/0x210
[ 4093.900309] ? __mutex_lock_slowpath+0x10/0x10
[ 4093.900315] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e]
[ 4093.900318] sriov_numvfs_store+0x214/0x290
[ 4093.900320] ? sriov_totalvfs_show+0x30/0x30
[ 4093.900321] ? __mutex_lock_slowpath+0x10/0x10
[ 4093.900323] ? __check_object_size+0x15a/0x350
[ 4093.900326] kernfs_fop_write+0x280/0x3f0
[ 4093.900329] vfs_write+0x145/0x440
[ 4093.900330] ksys_write+0xab/0x160
[ 4093.900332] ? __ia32_sys_read+0xb0/0xb0
[ 4093.900334] ? fput_many+0x1a/0x120
[ 4093.900335] ? filp_close+0xf0/0x130
[ 4093.900338] do_syscall_64+0xa0/0x370
[ 4093.900339] ? page_fault+0x8/0x30
[ 4093.900341] entry_SYSCALL_64_after_hwframe+0x65/0xca
[ 4093.900357] RIP: 0033:0x7f16ad4d22c0
[ 4093.900359] Code: 73 01 c3 48 8b 0d d8 cb 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 24 2d 00 00 75 10 b8 01 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe dd 01 00 48 89 04 24
[ 4093.900360] RSP: 002b:00007ffd6491b7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[ 4093.900362] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f16ad4d22c0
[ 4093.900363] RDX: 0000000000000002 RSI: 0000000001a41408 RDI: 0000000000000001
[ 4093.900364] RBP: 0000000001a41408 R08: 00007f16ad7a1780 R09: 00007f16ae1f2700
[ 4093.9003
---truncated---
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
5eae00c57f5e42bf201023471917da213c4946d6 , < 17046107ca15d7571551539d94e76aba2bf71fd3
(git)
Affected: 5eae00c57f5e42bf201023471917da213c4946d6 , < a4635f190f332304db4a49e827ece790b804b5db (git) Affected: 5eae00c57f5e42bf201023471917da213c4946d6 , < 345c44e18cc10cded85cb9134830e1684495c866 (git) Affected: 5eae00c57f5e42bf201023471917da213c4946d6 , < ca12b98e04b5d1902ac08fe826d3500cb4b6e891 (git) Affected: 5eae00c57f5e42bf201023471917da213c4946d6 , < 8d781a9c53034813c3194b7d94409c7d24ac73eb (git) Affected: 5eae00c57f5e42bf201023471917da213c4946d6 , < 5f4fa1672d98fe99d2297b03add35346f1685d6b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/iavf/iavf_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "17046107ca15d7571551539d94e76aba2bf71fd3",
"status": "affected",
"version": "5eae00c57f5e42bf201023471917da213c4946d6",
"versionType": "git"
},
{
"lessThan": "a4635f190f332304db4a49e827ece790b804b5db",
"status": "affected",
"version": "5eae00c57f5e42bf201023471917da213c4946d6",
"versionType": "git"
},
{
"lessThan": "345c44e18cc10cded85cb9134830e1684495c866",
"status": "affected",
"version": "5eae00c57f5e42bf201023471917da213c4946d6",
"versionType": "git"
},
{
"lessThan": "ca12b98e04b5d1902ac08fe826d3500cb4b6e891",
"status": "affected",
"version": "5eae00c57f5e42bf201023471917da213c4946d6",
"versionType": "git"
},
{
"lessThan": "8d781a9c53034813c3194b7d94409c7d24ac73eb",
"status": "affected",
"version": "5eae00c57f5e42bf201023471917da213c4946d6",
"versionType": "git"
},
{
"lessThan": "5f4fa1672d98fe99d2297b03add35346f1685d6b",
"status": "affected",
"version": "5eae00c57f5e42bf201023471917da213c4946d6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/intel/iavf/iavf_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.14"
},
{
"lessThan": "3.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.251",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.123",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.251",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.188",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.123",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.42",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.7",
"versionStartIncluding": "3.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "3.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niavf: Fix use-after-free in free_netdev\n\nWe do netif_napi_add() for all allocated q_vectors[], but potentially\ndo netif_napi_del() for part of them, then kfree q_vectors and leave\ninvalid pointers at dev-\u003enapi_list.\n\nReproducer:\n\n [root@host ~]# cat repro.sh\n #!/bin/bash\n\n pf_dbsf=\"0000:41:00.0\"\n vf0_dbsf=\"0000:41:02.0\"\n g_pids=()\n\n function do_set_numvf()\n {\n echo 2 \u003e/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs\n sleep $((RANDOM%3+1))\n echo 0 \u003e/sys/bus/pci/devices/${pf_dbsf}/sriov_numvfs\n sleep $((RANDOM%3+1))\n }\n\n function do_set_channel()\n {\n local nic=$(ls -1 --indicator-style=none /sys/bus/pci/devices/${vf0_dbsf}/net/)\n [ -z \"$nic\" ] \u0026\u0026 { sleep $((RANDOM%3)) ; return 1; }\n ifconfig $nic 192.168.18.5 netmask 255.255.255.0\n ifconfig $nic up\n ethtool -L $nic combined 1\n ethtool -L $nic combined 4\n sleep $((RANDOM%3))\n }\n\n function on_exit()\n {\n local pid\n for pid in \"${g_pids[@]}\"; do\n kill -0 \"$pid\" \u0026\u003e/dev/null \u0026\u0026 kill \"$pid\" \u0026\u003e/dev/null\n done\n g_pids=()\n }\n\n trap \"on_exit; exit\" EXIT\n\n while :; do do_set_numvf ; done \u0026\n g_pids+=($!)\n while :; do do_set_channel ; done \u0026\n g_pids+=($!)\n\n wait\n\nResult:\n\n[ 4093.900222] ==================================================================\n[ 4093.900230] BUG: KASAN: use-after-free in free_netdev+0x308/0x390\n[ 4093.900232] Read of size 8 at addr ffff88b4dc145640 by task repro.sh/6699\n[ 4093.900233]\n[ 4093.900236] CPU: 10 PID: 6699 Comm: repro.sh Kdump: loaded Tainted: G O --------- -t - 4.18.0 #1\n[ 4093.900238] Hardware name: Powerleader PR2008AL/H12DSi-N6, BIOS 2.0 04/09/2021\n[ 4093.900239] Call Trace:\n[ 4093.900244] dump_stack+0x71/0xab\n[ 4093.900249] print_address_description+0x6b/0x290\n[ 4093.900251] ? free_netdev+0x308/0x390\n[ 4093.900252] kasan_report+0x14a/0x2b0\n[ 4093.900254] free_netdev+0x308/0x390\n[ 4093.900261] iavf_remove+0x825/0xd20 [iavf]\n[ 4093.900265] pci_device_remove+0xa8/0x1f0\n[ 4093.900268] device_release_driver_internal+0x1c6/0x460\n[ 4093.900271] pci_stop_bus_device+0x101/0x150\n[ 4093.900273] pci_stop_and_remove_bus_device+0xe/0x20\n[ 4093.900275] pci_iov_remove_virtfn+0x187/0x420\n[ 4093.900277] ? pci_iov_add_virtfn+0xe10/0xe10\n[ 4093.900278] ? pci_get_subsys+0x90/0x90\n[ 4093.900280] sriov_disable+0xed/0x3e0\n[ 4093.900282] ? bus_find_device+0x12d/0x1a0\n[ 4093.900290] i40e_free_vfs+0x754/0x1210 [i40e]\n[ 4093.900298] ? i40e_reset_all_vfs+0x880/0x880 [i40e]\n[ 4093.900299] ? pci_get_device+0x7c/0x90\n[ 4093.900300] ? pci_get_subsys+0x90/0x90\n[ 4093.900306] ? pci_vfs_assigned.part.7+0x144/0x210\n[ 4093.900309] ? __mutex_lock_slowpath+0x10/0x10\n[ 4093.900315] i40e_pci_sriov_configure+0x1fa/0x2e0 [i40e]\n[ 4093.900318] sriov_numvfs_store+0x214/0x290\n[ 4093.900320] ? sriov_totalvfs_show+0x30/0x30\n[ 4093.900321] ? __mutex_lock_slowpath+0x10/0x10\n[ 4093.900323] ? __check_object_size+0x15a/0x350\n[ 4093.900326] kernfs_fop_write+0x280/0x3f0\n[ 4093.900329] vfs_write+0x145/0x440\n[ 4093.900330] ksys_write+0xab/0x160\n[ 4093.900332] ? __ia32_sys_read+0xb0/0xb0\n[ 4093.900334] ? fput_many+0x1a/0x120\n[ 4093.900335] ? filp_close+0xf0/0x130\n[ 4093.900338] do_syscall_64+0xa0/0x370\n[ 4093.900339] ? page_fault+0x8/0x30\n[ 4093.900341] entry_SYSCALL_64_after_hwframe+0x65/0xca\n[ 4093.900357] RIP: 0033:0x7f16ad4d22c0\n[ 4093.900359] Code: 73 01 c3 48 8b 0d d8 cb 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 83 3d 89 24 2d 00 00 75 10 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 fe dd 01 00 48 89 04 24\n[ 4093.900360] RSP: 002b:00007ffd6491b7f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\n[ 4093.900362] RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007f16ad4d22c0\n[ 4093.900363] RDX: 0000000000000002 RSI: 0000000001a41408 RDI: 0000000000000001\n[ 4093.900364] RBP: 0000000001a41408 R08: 00007f16ad7a1780 R09: 00007f16ae1f2700\n[ 4093.9003\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:01.238Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/17046107ca15d7571551539d94e76aba2bf71fd3"
},
{
"url": "https://git.kernel.org/stable/c/a4635f190f332304db4a49e827ece790b804b5db"
},
{
"url": "https://git.kernel.org/stable/c/345c44e18cc10cded85cb9134830e1684495c866"
},
{
"url": "https://git.kernel.org/stable/c/ca12b98e04b5d1902ac08fe826d3500cb4b6e891"
},
{
"url": "https://git.kernel.org/stable/c/8d781a9c53034813c3194b7d94409c7d24ac73eb"
},
{
"url": "https://git.kernel.org/stable/c/5f4fa1672d98fe99d2297b03add35346f1685d6b"
}
],
"title": "iavf: Fix use-after-free in free_netdev",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53556",
"datePublished": "2025-10-04T15:17:01.238Z",
"dateReserved": "2025-10-04T15:14:15.922Z",
"dateUpdated": "2025-10-04T15:17:01.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53551 (GCVE-0-2023-53551)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
usb: gadget: u_serial: Add null pointer check in gserial_resume
Summary
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: u_serial: Add null pointer check in gserial_resume
Consider a case where gserial_disconnect has already cleared
gser->ioport. And if a wakeup interrupt triggers afterwards,
gserial_resume gets called, which will lead to accessing of
gser->ioport and thus causing null pointer dereference.Add
a null pointer check to prevent this.
Added a static spinlock to prevent gser->ioport from becoming
null after the newly added check.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
aba3a8d01d623a5efef48ab8e78752d58d4c90c3 , < c5360eec648bd506afa304ae4a71f82e13d41897
(git)
Affected: aba3a8d01d623a5efef48ab8e78752d58d4c90c3 , < 3b24c980dc07be4550a9d1450ed7057f882530e5 (git) Affected: aba3a8d01d623a5efef48ab8e78752d58d4c90c3 , < ec357cd3e8af614855d286dd378725cdc7264df6 (git) Affected: aba3a8d01d623a5efef48ab8e78752d58d4c90c3 , < 44e004f757a7ae13dfebaadbcfdb1a6f98c10377 (git) Affected: aba3a8d01d623a5efef48ab8e78752d58d4c90c3 , < 5ec63fdbca604568890c577753c6f66c5b3ef0b5 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/u_serial.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "c5360eec648bd506afa304ae4a71f82e13d41897",
"status": "affected",
"version": "aba3a8d01d623a5efef48ab8e78752d58d4c90c3",
"versionType": "git"
},
{
"lessThan": "3b24c980dc07be4550a9d1450ed7057f882530e5",
"status": "affected",
"version": "aba3a8d01d623a5efef48ab8e78752d58d4c90c3",
"versionType": "git"
},
{
"lessThan": "ec357cd3e8af614855d286dd378725cdc7264df6",
"status": "affected",
"version": "aba3a8d01d623a5efef48ab8e78752d58d4c90c3",
"versionType": "git"
},
{
"lessThan": "44e004f757a7ae13dfebaadbcfdb1a6f98c10377",
"status": "affected",
"version": "aba3a8d01d623a5efef48ab8e78752d58d4c90c3",
"versionType": "git"
},
{
"lessThan": "5ec63fdbca604568890c577753c6f66c5b3ef0b5",
"status": "affected",
"version": "aba3a8d01d623a5efef48ab8e78752d58d4c90c3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/function/u_serial.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.171",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.97",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.171",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.97",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.15",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.2",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nusb: gadget: u_serial: Add null pointer check in gserial_resume\n\nConsider a case where gserial_disconnect has already cleared\ngser-\u003eioport. And if a wakeup interrupt triggers afterwards,\ngserial_resume gets called, which will lead to accessing of\ngser-\u003eioport and thus causing null pointer dereference.Add\na null pointer check to prevent this.\n\nAdded a static spinlock to prevent gser-\u003eioport from becoming\nnull after the newly added check."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:57.736Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/c5360eec648bd506afa304ae4a71f82e13d41897"
},
{
"url": "https://git.kernel.org/stable/c/3b24c980dc07be4550a9d1450ed7057f882530e5"
},
{
"url": "https://git.kernel.org/stable/c/ec357cd3e8af614855d286dd378725cdc7264df6"
},
{
"url": "https://git.kernel.org/stable/c/44e004f757a7ae13dfebaadbcfdb1a6f98c10377"
},
{
"url": "https://git.kernel.org/stable/c/5ec63fdbca604568890c577753c6f66c5b3ef0b5"
}
],
"title": "usb: gadget: u_serial: Add null pointer check in gserial_resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53551",
"datePublished": "2025-10-04T15:16:57.736Z",
"dateReserved": "2025-10-04T15:14:15.922Z",
"dateUpdated": "2025-10-04T15:16:57.736Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50483 (GCVE-0-2022-50483)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
net: enetc: avoid buffer leaks on xdp_do_redirect() failure
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: enetc: avoid buffer leaks on xdp_do_redirect() failure
Before enetc_clean_rx_ring_xdp() calls xdp_do_redirect(), each software
BD in the RX ring between index orig_i and i can have one of 2 refcount
values on its page.
We are the owner of the current buffer that is being processed, so the
refcount will be at least 1.
If the current owner of the buffer at the diametrically opposed index
in the RX ring (i.o.w, the other half of this page) has not yet called
kfree(), this page's refcount could even be 2.
enetc_page_reusable() in enetc_flip_rx_buff() tests for the page
refcount against 1, and [ if it's 2 ] does not attempt to reuse it.
But if enetc_flip_rx_buff() is put after the xdp_do_redirect() call,
the page refcount can have one of 3 values. It can also be 0, if there
is no owner of the other page half, and xdp_do_redirect() for this
buffer ran so far that it triggered a flush of the devmap/cpumap bulk
queue, and the consumers of those bulk queues also freed the buffer,
all by the time xdp_do_redirect() returns the execution back to enetc.
This is the reason why enetc_flip_rx_buff() is called before
xdp_do_redirect(), but there is a big flaw with that reasoning:
enetc_flip_rx_buff() will set rx_swbd->page = NULL on both sides of the
enetc_page_reusable() branch, and if xdp_do_redirect() returns an error,
we call enetc_xdp_free(), which does not deal gracefully with that.
In fact, what happens is quite special. The page refcounts start as 1.
enetc_flip_rx_buff() figures they're reusable, transfers these
rx_swbd->page pointers to a different rx_swbd in enetc_reuse_page(), and
bumps the refcount to 2. When xdp_do_redirect() later returns an error,
we call the no-op enetc_xdp_free(), but we still haven't lost the
reference to that page. A copy of it is still at rx_ring->next_to_alloc,
but that has refcount 2 (and there are no concurrent owners of it in
flight, to drop the refcount). What really kills the system is when
we'll flip the rx_swbd->page the second time around. With an updated
refcount of 2, the page will not be reusable and we'll really leak it.
Then enetc_new_page() will have to allocate more pages, which will then
eventually leak again on further errors from xdp_do_redirect().
The problem, summarized, is that we zeroize rx_swbd->page before we're
completely done with it, and this makes it impossible for the error path
to do something with it.
Since the packet is potentially multi-buffer and therefore the
rx_swbd->page is potentially an array, manual passing of the old
pointers between enetc_flip_rx_buff() and enetc_xdp_free() is a bit
difficult.
For the sake of going with a simple solution, we accept the possibility
of racing with xdp_do_redirect(), and we move the flip procedure to
execute only on the redirect success path. By racing, I mean that the
page may be deemed as not reusable by enetc (having a refcount of 0),
but there will be no leak in that case, either.
Once we accept that, we have something better to do with buffers on
XDP_REDIRECT failure. Since we haven't performed half-page flipping yet,
we won't, either (and this way, we can avoid enetc_xdp_free()
completely, which gives the entire page to the slab allocator).
Instead, we'll call enetc_xdp_drop(), which will recycle this half of
the buffer back to the RX ring.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
9d2b68cc108db2fdb35022ed2d88cfb305c441a6 , < bcf2c1dc5358dcf7e34a68cdb6b0bbf967801efa
(git)
Affected: 9d2b68cc108db2fdb35022ed2d88cfb305c441a6 , < 7fba523b51ccce5f7981f8a43ad84d664da68131 (git) Affected: 9d2b68cc108db2fdb35022ed2d88cfb305c441a6 , < 306526331e7a37e714e11ab7c6d73eb004745224 (git) Affected: 9d2b68cc108db2fdb35022ed2d88cfb305c441a6 , < 628050ec952d2e2e46ec9fb6aa07e41139e030c8 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/enetc/enetc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bcf2c1dc5358dcf7e34a68cdb6b0bbf967801efa",
"status": "affected",
"version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
"versionType": "git"
},
{
"lessThan": "7fba523b51ccce5f7981f8a43ad84d664da68131",
"status": "affected",
"version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
"versionType": "git"
},
{
"lessThan": "306526331e7a37e714e11ab7c6d73eb004745224",
"status": "affected",
"version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
"versionType": "git"
},
{
"lessThan": "628050ec952d2e2e46ec9fb6aa07e41139e030c8",
"status": "affected",
"version": "9d2b68cc108db2fdb35022ed2d88cfb305c441a6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/freescale/enetc/enetc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.13"
},
{
"lessThan": "5.13",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "5.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.13",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: avoid buffer leaks on xdp_do_redirect() failure\n\nBefore enetc_clean_rx_ring_xdp() calls xdp_do_redirect(), each software\nBD in the RX ring between index orig_i and i can have one of 2 refcount\nvalues on its page.\n\nWe are the owner of the current buffer that is being processed, so the\nrefcount will be at least 1.\n\nIf the current owner of the buffer at the diametrically opposed index\nin the RX ring (i.o.w, the other half of this page) has not yet called\nkfree(), this page\u0027s refcount could even be 2.\n\nenetc_page_reusable() in enetc_flip_rx_buff() tests for the page\nrefcount against 1, and [ if it\u0027s 2 ] does not attempt to reuse it.\n\nBut if enetc_flip_rx_buff() is put after the xdp_do_redirect() call,\nthe page refcount can have one of 3 values. It can also be 0, if there\nis no owner of the other page half, and xdp_do_redirect() for this\nbuffer ran so far that it triggered a flush of the devmap/cpumap bulk\nqueue, and the consumers of those bulk queues also freed the buffer,\nall by the time xdp_do_redirect() returns the execution back to enetc.\n\nThis is the reason why enetc_flip_rx_buff() is called before\nxdp_do_redirect(), but there is a big flaw with that reasoning:\nenetc_flip_rx_buff() will set rx_swbd-\u003epage = NULL on both sides of the\nenetc_page_reusable() branch, and if xdp_do_redirect() returns an error,\nwe call enetc_xdp_free(), which does not deal gracefully with that.\n\nIn fact, what happens is quite special. The page refcounts start as 1.\nenetc_flip_rx_buff() figures they\u0027re reusable, transfers these\nrx_swbd-\u003epage pointers to a different rx_swbd in enetc_reuse_page(), and\nbumps the refcount to 2. When xdp_do_redirect() later returns an error,\nwe call the no-op enetc_xdp_free(), but we still haven\u0027t lost the\nreference to that page. A copy of it is still at rx_ring-\u003enext_to_alloc,\nbut that has refcount 2 (and there are no concurrent owners of it in\nflight, to drop the refcount). What really kills the system is when\nwe\u0027ll flip the rx_swbd-\u003epage the second time around. With an updated\nrefcount of 2, the page will not be reusable and we\u0027ll really leak it.\nThen enetc_new_page() will have to allocate more pages, which will then\neventually leak again on further errors from xdp_do_redirect().\n\nThe problem, summarized, is that we zeroize rx_swbd-\u003epage before we\u0027re\ncompletely done with it, and this makes it impossible for the error path\nto do something with it.\n\nSince the packet is potentially multi-buffer and therefore the\nrx_swbd-\u003epage is potentially an array, manual passing of the old\npointers between enetc_flip_rx_buff() and enetc_xdp_free() is a bit\ndifficult.\n\nFor the sake of going with a simple solution, we accept the possibility\nof racing with xdp_do_redirect(), and we move the flip procedure to\nexecute only on the redirect success path. By racing, I mean that the\npage may be deemed as not reusable by enetc (having a refcount of 0),\nbut there will be no leak in that case, either.\n\nOnce we accept that, we have something better to do with buffers on\nXDP_REDIRECT failure. Since we haven\u0027t performed half-page flipping yet,\nwe won\u0027t, either (and this way, we can avoid enetc_xdp_free()\ncompletely, which gives the entire page to the slab allocator).\nInstead, we\u0027ll call enetc_xdp_drop(), which will recycle this half of\nthe buffer back to the RX ring."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:41.703Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bcf2c1dc5358dcf7e34a68cdb6b0bbf967801efa"
},
{
"url": "https://git.kernel.org/stable/c/7fba523b51ccce5f7981f8a43ad84d664da68131"
},
{
"url": "https://git.kernel.org/stable/c/306526331e7a37e714e11ab7c6d73eb004745224"
},
{
"url": "https://git.kernel.org/stable/c/628050ec952d2e2e46ec9fb6aa07e41139e030c8"
}
],
"title": "net: enetc: avoid buffer leaks on xdp_do_redirect() failure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50483",
"datePublished": "2025-10-04T15:16:41.703Z",
"dateReserved": "2025-10-04T15:13:33.468Z",
"dateUpdated": "2025-10-04T15:16:41.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39937 (GCVE-0-2025-39937)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:37
VLAI?
EPSS
Title
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer
Since commit 7d5e9737efda ("net: rfkill: gpio: get the name and type from
device property") rfkill_find_type() gets called with the possibly
uninitialized "const char *type_name;" local variable.
On x86 systems when rfkill-gpio binds to a "BCM4752" or "LNV4752"
acpi_device, the rfkill->type is set based on the ACPI acpi_device_id:
rfkill->type = (unsigned)id->driver_data;
and there is no "type" property so device_property_read_string() will fail
and leave type_name uninitialized, leading to a potential crash.
rfkill_find_type() does accept a NULL pointer, fix the potential crash
by initializing type_name to NULL.
Note likely sofar this has not been caught because:
1. Not many x86 machines actually have a "BCM4752"/"LNV4752" acpi_device
2. The stack happened to contain NULL where type_name is stored
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
7d5e9737efda16535e5b54bd627ef4881d11d31f , < 184f608a68f96794e8fe58cd5535014d53622cde
(git)
Affected: 7d5e9737efda16535e5b54bd627ef4881d11d31f , < 8793e7a8e1b60131a825457174ed6398111daeb7 (git) Affected: 7d5e9737efda16535e5b54bd627ef4881d11d31f , < ada2282259243387e6b6e89239aeb4897e62f051 (git) Affected: 7d5e9737efda16535e5b54bd627ef4881d11d31f , < 47ade5f9d70b23a119ec20b1c6504864b2543a79 (git) Affected: 7d5e9737efda16535e5b54bd627ef4881d11d31f , < 689aee35ce671aab752f159e5c8e66d7685e6887 (git) Affected: 7d5e9737efda16535e5b54bd627ef4881d11d31f , < 21ba85d9d508422ca9e6698463ff9357c928c22d (git) Affected: 7d5e9737efda16535e5b54bd627ef4881d11d31f , < 21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d (git) Affected: 7d5e9737efda16535e5b54bd627ef4881d11d31f , < b6f56a44e4c1014b08859dcf04ed246500e310e5 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/rfkill/rfkill-gpio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "184f608a68f96794e8fe58cd5535014d53622cde",
"status": "affected",
"version": "7d5e9737efda16535e5b54bd627ef4881d11d31f",
"versionType": "git"
},
{
"lessThan": "8793e7a8e1b60131a825457174ed6398111daeb7",
"status": "affected",
"version": "7d5e9737efda16535e5b54bd627ef4881d11d31f",
"versionType": "git"
},
{
"lessThan": "ada2282259243387e6b6e89239aeb4897e62f051",
"status": "affected",
"version": "7d5e9737efda16535e5b54bd627ef4881d11d31f",
"versionType": "git"
},
{
"lessThan": "47ade5f9d70b23a119ec20b1c6504864b2543a79",
"status": "affected",
"version": "7d5e9737efda16535e5b54bd627ef4881d11d31f",
"versionType": "git"
},
{
"lessThan": "689aee35ce671aab752f159e5c8e66d7685e6887",
"status": "affected",
"version": "7d5e9737efda16535e5b54bd627ef4881d11d31f",
"versionType": "git"
},
{
"lessThan": "21ba85d9d508422ca9e6698463ff9357c928c22d",
"status": "affected",
"version": "7d5e9737efda16535e5b54bd627ef4881d11d31f",
"versionType": "git"
},
{
"lessThan": "21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d",
"status": "affected",
"version": "7d5e9737efda16535e5b54bd627ef4881d11d31f",
"versionType": "git"
},
{
"lessThan": "b6f56a44e4c1014b08859dcf04ed246500e310e5",
"status": "affected",
"version": "7d5e9737efda16535e5b54bd627ef4881d11d31f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/rfkill/rfkill-gpio.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.300",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.245",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.300",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.245",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.194",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer\n\nSince commit 7d5e9737efda (\"net: rfkill: gpio: get the name and type from\ndevice property\") rfkill_find_type() gets called with the possibly\nuninitialized \"const char *type_name;\" local variable.\n\nOn x86 systems when rfkill-gpio binds to a \"BCM4752\" or \"LNV4752\"\nacpi_device, the rfkill-\u003etype is set based on the ACPI acpi_device_id:\n\n rfkill-\u003etype = (unsigned)id-\u003edriver_data;\n\nand there is no \"type\" property so device_property_read_string() will fail\nand leave type_name uninitialized, leading to a potential crash.\n\nrfkill_find_type() does accept a NULL pointer, fix the potential crash\nby initializing type_name to NULL.\n\nNote likely sofar this has not been caught because:\n\n1. Not many x86 machines actually have a \"BCM4752\"/\"LNV4752\" acpi_device\n2. The stack happened to contain NULL where type_name is stored"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:37:01.924Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/184f608a68f96794e8fe58cd5535014d53622cde"
},
{
"url": "https://git.kernel.org/stable/c/8793e7a8e1b60131a825457174ed6398111daeb7"
},
{
"url": "https://git.kernel.org/stable/c/ada2282259243387e6b6e89239aeb4897e62f051"
},
{
"url": "https://git.kernel.org/stable/c/47ade5f9d70b23a119ec20b1c6504864b2543a79"
},
{
"url": "https://git.kernel.org/stable/c/689aee35ce671aab752f159e5c8e66d7685e6887"
},
{
"url": "https://git.kernel.org/stable/c/21ba85d9d508422ca9e6698463ff9357c928c22d"
},
{
"url": "https://git.kernel.org/stable/c/21a39b958b4bcf44f7674bfbbe1bbb8cad0d842d"
},
{
"url": "https://git.kernel.org/stable/c/b6f56a44e4c1014b08859dcf04ed246500e310e5"
}
],
"title": "net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39937",
"datePublished": "2025-10-04T07:31:00.879Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:37:01.924Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53585 (GCVE-0-2023-53585)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
bpf: reject unhashed sockets in bpf_sk_assign
Summary
In the Linux kernel, the following vulnerability has been resolved:
bpf: reject unhashed sockets in bpf_sk_assign
The semantics for bpf_sk_assign are as follows:
sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)
That is, the sk is not consumed by bpf_sk_assign. The function
therefore needs to make sure that sk lives long enough to be
consumed from __inet_lookup_skb. The path through the stack for a
TCPv4 packet is roughly:
netif_receive_skb_core: takes RCU read lock
__netif_receive_skb_core:
sch_handle_ingress:
tcf_classify:
bpf_sk_assign()
deliver_ptype_list_skb:
deliver_skb:
ip_packet_type->func == ip_rcv:
ip_rcv_core:
ip_rcv_finish_core:
dst_input:
ip_local_deliver:
ip_local_deliver_finish:
ip_protocol_deliver_rcu:
tcp_v4_rcv:
__inet_lookup_skb:
skb_steal_sock
The existing helper takes advantage of the fact that everything
happens in the same RCU critical section: for sockets with
SOCK_RCU_FREE set bpf_sk_assign never takes a reference.
skb_steal_sock then checks SOCK_RCU_FREE again and does sock_put
if necessary.
This approach assumes that SOCK_RCU_FREE is never set on a sk
between bpf_sk_assign and skb_steal_sock, but this invariant is
violated by unhashed UDP sockets. A new UDP socket is created
in TCP_CLOSE state but without SOCK_RCU_FREE set. That flag is only
added in udp_lib_get_port() which happens when a socket is bound.
When bpf_sk_assign was added it wasn't possible to access unhashed
UDP sockets from BPF, so this wasn't a problem. This changed
in commit 0c48eefae712 ("sock_map: Lift socket state restriction
for datagram sockets"), but the helper wasn't adjusted accordingly.
The following sequence of events will therefore lead to a refcount
leak:
1. Add socket(AF_INET, SOCK_DGRAM) to a sockmap.
2. Pull socket out of sockmap and bpf_sk_assign it. Since
SOCK_RCU_FREE is not set we increment the refcount.
3. bind() or connect() the socket, setting SOCK_RCU_FREE.
4. skb_steal_sock will now set refcounted = false due to
SOCK_RCU_FREE.
5. tcp_v4_rcv() skips sock_put().
Fix the problem by rejecting unhashed sockets in bpf_sk_assign().
This matches the behaviour of __inet_lookup_skb which is ultimately
the goal of bpf_sk_assign().
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < 791a12102e5191dcb6ce0b3a99d71b5a2802d12a
(git)
Affected: cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < 7dcbc0bb0e5cc1823923744befce59ac353135e6 (git) Affected: cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < c0ce0fb76610d5fad31f56f2ca8241a2a6717a1b (git) Affected: cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < 8aa43cfbb68b25119d2ced14ec717173e2901fa2 (git) Affected: cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < 3d4522f59fb748a54446846522941a4f09da63e9 (git) Affected: cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449 , < 67312adc96b5a585970d03b62412847afe2c6b01 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "791a12102e5191dcb6ce0b3a99d71b5a2802d12a",
"status": "affected",
"version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
"versionType": "git"
},
{
"lessThan": "7dcbc0bb0e5cc1823923744befce59ac353135e6",
"status": "affected",
"version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
"versionType": "git"
},
{
"lessThan": "c0ce0fb76610d5fad31f56f2ca8241a2a6717a1b",
"status": "affected",
"version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
"versionType": "git"
},
{
"lessThan": "8aa43cfbb68b25119d2ced14ec717173e2901fa2",
"status": "affected",
"version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
"versionType": "git"
},
{
"lessThan": "3d4522f59fb748a54446846522941a4f09da63e9",
"status": "affected",
"version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
"versionType": "git"
},
{
"lessThan": "67312adc96b5a585970d03b62412847afe2c6b01",
"status": "affected",
"version": "cf7fbe660f2dbd738ab58aea8e9b0ca6ad232449",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/core/filter.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.195",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.132",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.195",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.132",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.53",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.16",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.3",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: reject unhashed sockets in bpf_sk_assign\n\nThe semantics for bpf_sk_assign are as follows:\n\n sk = some_lookup_func()\n bpf_sk_assign(skb, sk)\n bpf_sk_release(sk)\n\nThat is, the sk is not consumed by bpf_sk_assign. The function\ntherefore needs to make sure that sk lives long enough to be\nconsumed from __inet_lookup_skb. The path through the stack for a\nTCPv4 packet is roughly:\n\n netif_receive_skb_core: takes RCU read lock\n __netif_receive_skb_core:\n sch_handle_ingress:\n tcf_classify:\n bpf_sk_assign()\n deliver_ptype_list_skb:\n deliver_skb:\n ip_packet_type-\u003efunc == ip_rcv:\n ip_rcv_core:\n ip_rcv_finish_core:\n dst_input:\n ip_local_deliver:\n ip_local_deliver_finish:\n ip_protocol_deliver_rcu:\n tcp_v4_rcv:\n __inet_lookup_skb:\n skb_steal_sock\n\nThe existing helper takes advantage of the fact that everything\nhappens in the same RCU critical section: for sockets with\nSOCK_RCU_FREE set bpf_sk_assign never takes a reference.\nskb_steal_sock then checks SOCK_RCU_FREE again and does sock_put\nif necessary.\n\nThis approach assumes that SOCK_RCU_FREE is never set on a sk\nbetween bpf_sk_assign and skb_steal_sock, but this invariant is\nviolated by unhashed UDP sockets. A new UDP socket is created\nin TCP_CLOSE state but without SOCK_RCU_FREE set. That flag is only\nadded in udp_lib_get_port() which happens when a socket is bound.\n\nWhen bpf_sk_assign was added it wasn\u0027t possible to access unhashed\nUDP sockets from BPF, so this wasn\u0027t a problem. This changed\nin commit 0c48eefae712 (\"sock_map: Lift socket state restriction\nfor datagram sockets\"), but the helper wasn\u0027t adjusted accordingly.\nThe following sequence of events will therefore lead to a refcount\nleak:\n\n1. Add socket(AF_INET, SOCK_DGRAM) to a sockmap.\n2. Pull socket out of sockmap and bpf_sk_assign it. Since\n SOCK_RCU_FREE is not set we increment the refcount.\n3. bind() or connect() the socket, setting SOCK_RCU_FREE.\n4. skb_steal_sock will now set refcounted = false due to\n SOCK_RCU_FREE.\n5. tcp_v4_rcv() skips sock_put().\n\nFix the problem by rejecting unhashed sockets in bpf_sk_assign().\nThis matches the behaviour of __inet_lookup_skb which is ultimately\nthe goal of bpf_sk_assign()."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:01.022Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/791a12102e5191dcb6ce0b3a99d71b5a2802d12a"
},
{
"url": "https://git.kernel.org/stable/c/7dcbc0bb0e5cc1823923744befce59ac353135e6"
},
{
"url": "https://git.kernel.org/stable/c/c0ce0fb76610d5fad31f56f2ca8241a2a6717a1b"
},
{
"url": "https://git.kernel.org/stable/c/8aa43cfbb68b25119d2ced14ec717173e2901fa2"
},
{
"url": "https://git.kernel.org/stable/c/3d4522f59fb748a54446846522941a4f09da63e9"
},
{
"url": "https://git.kernel.org/stable/c/67312adc96b5a585970d03b62412847afe2c6b01"
}
],
"title": "bpf: reject unhashed sockets in bpf_sk_assign",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53585",
"datePublished": "2025-10-04T15:44:01.022Z",
"dateReserved": "2025-10-04T15:40:38.477Z",
"dateUpdated": "2025-10-04T15:44:01.022Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53572 (GCVE-0-2023-53572)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
clk: imx: scu: use _safe list iterator to avoid a use after free
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: imx: scu: use _safe list iterator to avoid a use after free
This loop is freeing "clk" so it needs to use list_for_each_entry_safe().
Otherwise it dereferences a freed variable to get the next item on the
loop.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < f95ff838ac39f861d1f95a0f3bbb1e01c2517d79
(git)
Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba (git) Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 3d90921f91fc6a8c801d527bb5848c99e335c1cf (git) Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 0a719f0e4b6f233979e219baff73923e76a96e09 (git) Affected: 77d8f3068c63ee0983f0b5ba3207d3f7cce11be4 , < 632c60ecd25dbacee54d5581fe3aeb834b57010a (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/imx/clk-scu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f95ff838ac39f861d1f95a0f3bbb1e01c2517d79",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
},
{
"lessThan": "08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
},
{
"lessThan": "3d90921f91fc6a8c801d527bb5848c99e335c1cf",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
},
{
"lessThan": "0a719f0e4b6f233979e219baff73923e76a96e09",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
},
{
"lessThan": "632c60ecd25dbacee54d5581fe3aeb834b57010a",
"status": "affected",
"version": "77d8f3068c63ee0983f0b5ba3207d3f7cce11be4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/imx/clk-scu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.121",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.39",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.13",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.4",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: imx: scu: use _safe list iterator to avoid a use after free\n\nThis loop is freeing \"clk\" so it needs to use list_for_each_entry_safe().\nOtherwise it dereferences a freed variable to get the next item on the\nloop."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:13.089Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f95ff838ac39f861d1f95a0f3bbb1e01c2517d79"
},
{
"url": "https://git.kernel.org/stable/c/08cc7cd2c2a29a2abf5bceb8f048c0734d3694ba"
},
{
"url": "https://git.kernel.org/stable/c/3d90921f91fc6a8c801d527bb5848c99e335c1cf"
},
{
"url": "https://git.kernel.org/stable/c/0a719f0e4b6f233979e219baff73923e76a96e09"
},
{
"url": "https://git.kernel.org/stable/c/632c60ecd25dbacee54d5581fe3aeb834b57010a"
}
],
"title": "clk: imx: scu: use _safe list iterator to avoid a use after free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53572",
"datePublished": "2025-10-04T15:17:13.089Z",
"dateReserved": "2025-10-04T15:14:15.925Z",
"dateUpdated": "2025-10-04T15:17:13.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50477 (GCVE-0-2022-50477)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
rtc: class: Fix potential memleak in devm_rtc_allocate_device()
Summary
In the Linux kernel, the following vulnerability has been resolved:
rtc: class: Fix potential memleak in devm_rtc_allocate_device()
devm_rtc_allocate_device() will alloc a rtc_device first, and then run
dev_set_name(). If dev_set_name() failed, the rtc_device will memleak.
Move devm_add_action_or_reset() in front of dev_set_name() to prevent
memleak.
unreferenced object 0xffff888110a53000 (size 2048):
comm "python3", pid 470, jiffies 4296078308 (age 58.882s)
hex dump (first 32 bytes):
00 00 00 00 00 00 00 00 08 30 a5 10 81 88 ff ff .........0......
08 30 a5 10 81 88 ff ff 00 00 00 00 00 00 00 00 .0..............
backtrace:
[<000000004aac0364>] kmalloc_trace+0x21/0x110
[<000000000ff02202>] devm_rtc_allocate_device+0xd4/0x400
[<000000001bdf5639>] devm_rtc_device_register+0x1a/0x80
[<00000000351bf81c>] rx4581_probe+0xdd/0x110 [rtc_rx4581]
[<00000000f0eba0ae>] spi_probe+0xde/0x130
[<00000000bff89ee8>] really_probe+0x175/0x3f0
[<00000000128e8d84>] __driver_probe_device+0xe6/0x170
[<00000000ee5bf913>] device_driver_attach+0x32/0x80
[<00000000f3f28f92>] bind_store+0x10b/0x1a0
[<000000009ff812d8>] drv_attr_store+0x49/0x70
[<000000008139c323>] sysfs_kf_write+0x8d/0xb0
[<00000000b6146e01>] kernfs_fop_write_iter+0x214/0x2d0
[<00000000ecbe3895>] vfs_write+0x61a/0x7d0
[<00000000aa2196ea>] ksys_write+0xc8/0x190
[<0000000046a600f5>] do_syscall_64+0x37/0x90
[<00000000541a336f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
24d23181e43d72ca692a479e70dfe5b0b5dd33f1 , < 0bcfc8fd3e596994f527b46730579428b3a4fa5f
(git)
Affected: 24d23181e43d72ca692a479e70dfe5b0b5dd33f1 , < 59457a0f079eae19aaf322b3cc1c8ba66f55c5f3 (git) Affected: 24d23181e43d72ca692a479e70dfe5b0b5dd33f1 , < 60da73808298ff2cfa9f165d55eb3d7aa7078601 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/rtc/class.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0bcfc8fd3e596994f527b46730579428b3a4fa5f",
"status": "affected",
"version": "24d23181e43d72ca692a479e70dfe5b0b5dd33f1",
"versionType": "git"
},
{
"lessThan": "59457a0f079eae19aaf322b3cc1c8ba66f55c5f3",
"status": "affected",
"version": "24d23181e43d72ca692a479e70dfe5b0b5dd33f1",
"versionType": "git"
},
{
"lessThan": "60da73808298ff2cfa9f165d55eb3d7aa7078601",
"status": "affected",
"version": "24d23181e43d72ca692a479e70dfe5b0b5dd33f1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/rtc/class.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "5.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtc: class: Fix potential memleak in devm_rtc_allocate_device()\n\ndevm_rtc_allocate_device() will alloc a rtc_device first, and then run\ndev_set_name(). If dev_set_name() failed, the rtc_device will memleak.\nMove devm_add_action_or_reset() in front of dev_set_name() to prevent\nmemleak.\n\nunreferenced object 0xffff888110a53000 (size 2048):\n comm \"python3\", pid 470, jiffies 4296078308 (age 58.882s)\n hex dump (first 32 bytes):\n 00 00 00 00 00 00 00 00 08 30 a5 10 81 88 ff ff .........0......\n 08 30 a5 10 81 88 ff ff 00 00 00 00 00 00 00 00 .0..............\n backtrace:\n [\u003c000000004aac0364\u003e] kmalloc_trace+0x21/0x110\n [\u003c000000000ff02202\u003e] devm_rtc_allocate_device+0xd4/0x400\n [\u003c000000001bdf5639\u003e] devm_rtc_device_register+0x1a/0x80\n [\u003c00000000351bf81c\u003e] rx4581_probe+0xdd/0x110 [rtc_rx4581]\n [\u003c00000000f0eba0ae\u003e] spi_probe+0xde/0x130\n [\u003c00000000bff89ee8\u003e] really_probe+0x175/0x3f0\n [\u003c00000000128e8d84\u003e] __driver_probe_device+0xe6/0x170\n [\u003c00000000ee5bf913\u003e] device_driver_attach+0x32/0x80\n [\u003c00000000f3f28f92\u003e] bind_store+0x10b/0x1a0\n [\u003c000000009ff812d8\u003e] drv_attr_store+0x49/0x70\n [\u003c000000008139c323\u003e] sysfs_kf_write+0x8d/0xb0\n [\u003c00000000b6146e01\u003e] kernfs_fop_write_iter+0x214/0x2d0\n [\u003c00000000ecbe3895\u003e] vfs_write+0x61a/0x7d0\n [\u003c00000000aa2196ea\u003e] ksys_write+0xc8/0x190\n [\u003c0000000046a600f5\u003e] do_syscall_64+0x37/0x90\n [\u003c00000000541a336f\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:37.654Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0bcfc8fd3e596994f527b46730579428b3a4fa5f"
},
{
"url": "https://git.kernel.org/stable/c/59457a0f079eae19aaf322b3cc1c8ba66f55c5f3"
},
{
"url": "https://git.kernel.org/stable/c/60da73808298ff2cfa9f165d55eb3d7aa7078601"
}
],
"title": "rtc: class: Fix potential memleak in devm_rtc_allocate_device()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50477",
"datePublished": "2025-10-04T15:16:37.654Z",
"dateReserved": "2025-10-04T15:13:33.467Z",
"dateUpdated": "2025-10-04T15:16:37.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53601 (GCVE-0-2023-53601)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
bonding: do not assume skb mac_header is set
Summary
In the Linux kernel, the following vulnerability has been resolved:
bonding: do not assume skb mac_header is set
Drivers must not assume in their ndo_start_xmit() that
skbs have their mac_header set. skb->data is all what is needed.
bonding seems to be one of the last offender as caught by syzbot:
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline]
WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470
Modules linked in:
CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
RIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline]
RIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline]
RIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline]
RIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline]
RIP: 0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline]
RIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline]
RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470
Code: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe <0f> 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe
RSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283
RAX: ffffffff835874db RBX: 000000000000ffff RCX: 0000000000040000
RDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6
RBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584
R10: 0000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e
R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76
FS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
[<ffffffff8471a49f>] netdev_start_xmit include/linux/netdevice.h:4925 [inline]
[<ffffffff8471a49f>] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380
[<ffffffff851d845b>] dev_direct_xmit include/linux/netdevice.h:3043 [inline]
[<ffffffff851d845b>] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284
[<ffffffff851c7472>] packet_snd net/packet/af_packet.c:3112 [inline]
[<ffffffff851c7472>] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143
[<ffffffff8467a4b2>] sock_sendmsg_nosec net/socket.c:716 [inline]
[<ffffffff8467a4b2>] sock_sendmsg net/socket.c:736 [inline]
[<ffffffff8467a4b2>] __sys_sendto+0x472/0x5f0 net/socket.c:2139
[<ffffffff8467a715>] __do_sys_sendto net/socket.c:2151 [inline]
[<ffffffff8467a715>] __se_sys_sendto net/socket.c:2147 [inline]
[<ffffffff8467a715>] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147
[<ffffffff8553071f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff8553071f>] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80
[<ffffffff85600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
7b8fc0103bb51d1d3e1fb5fd67958612e709f883 , < 029d892b05fc5e42a1b1c0665f62cb3e4b23e6dc
(git)
Affected: 7b8fc0103bb51d1d3e1fb5fd67958612e709f883 , < 37b6143376a578265add04f35161b257eeb84a5e (git) Affected: 7b8fc0103bb51d1d3e1fb5fd67958612e709f883 , < c96cc3d9acaca53d9a81c884c23f1224b61c829b (git) Affected: 7b8fc0103bb51d1d3e1fb5fd67958612e709f883 , < bc16fc63592c419357dd4c4d82d50762102a60ef (git) Affected: 7b8fc0103bb51d1d3e1fb5fd67958612e709f883 , < 6a940abdef3162e5723f1495b8a49859d1708f79 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "029d892b05fc5e42a1b1c0665f62cb3e4b23e6dc",
"status": "affected",
"version": "7b8fc0103bb51d1d3e1fb5fd67958612e709f883",
"versionType": "git"
},
{
"lessThan": "37b6143376a578265add04f35161b257eeb84a5e",
"status": "affected",
"version": "7b8fc0103bb51d1d3e1fb5fd67958612e709f883",
"versionType": "git"
},
{
"lessThan": "c96cc3d9acaca53d9a81c884c23f1224b61c829b",
"status": "affected",
"version": "7b8fc0103bb51d1d3e1fb5fd67958612e709f883",
"versionType": "git"
},
{
"lessThan": "bc16fc63592c419357dd4c4d82d50762102a60ef",
"status": "affected",
"version": "7b8fc0103bb51d1d3e1fb5fd67958612e709f883",
"versionType": "git"
},
{
"lessThan": "6a940abdef3162e5723f1495b8a49859d1708f79",
"status": "affected",
"version": "7b8fc0103bb51d1d3e1fb5fd67958612e709f883",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/bonding/bond_main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.12"
},
{
"lessThan": "5.12",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.39",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.13",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.121",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.39",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.13",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.4",
"versionStartIncluding": "5.12",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.12",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbonding: do not assume skb mac_header is set\n\nDrivers must not assume in their ndo_start_xmit() that\nskbs have their mac_header set. skb-\u003edata is all what is needed.\n\nbonding seems to be one of the last offender as caught by syzbot:\n\nWARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline]\nWARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline]\nWARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline]\nWARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline]\nWARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline]\nWARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470\nModules linked in:\nCPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023\nRIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline]\nRIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline]\nRIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline]\nRIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline]\nRIP: 0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline]\nRIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline]\nRIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470\nCode: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe \u003c0f\u003e 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe\nRSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283\nRAX: ffffffff835874db RBX: 000000000000ffff RCX: 0000000000040000\nRDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6\nRBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584\nR10: 0000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e\nR13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76\nFS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n\u003cTASK\u003e\n[\u003cffffffff8471a49f\u003e] netdev_start_xmit include/linux/netdevice.h:4925 [inline]\n[\u003cffffffff8471a49f\u003e] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380\n[\u003cffffffff851d845b\u003e] dev_direct_xmit include/linux/netdevice.h:3043 [inline]\n[\u003cffffffff851d845b\u003e] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284\n[\u003cffffffff851c7472\u003e] packet_snd net/packet/af_packet.c:3112 [inline]\n[\u003cffffffff851c7472\u003e] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143\n[\u003cffffffff8467a4b2\u003e] sock_sendmsg_nosec net/socket.c:716 [inline]\n[\u003cffffffff8467a4b2\u003e] sock_sendmsg net/socket.c:736 [inline]\n[\u003cffffffff8467a4b2\u003e] __sys_sendto+0x472/0x5f0 net/socket.c:2139\n[\u003cffffffff8467a715\u003e] __do_sys_sendto net/socket.c:2151 [inline]\n[\u003cffffffff8467a715\u003e] __se_sys_sendto net/socket.c:2147 [inline]\n[\u003cffffffff8467a715\u003e] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147\n[\u003cffffffff8553071f\u003e] do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n[\u003cffffffff8553071f\u003e] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80\n[\u003cffffffff85600087\u003e] entry_SYSCALL_64_after_hwframe+0x63/0xcd"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:12.477Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/029d892b05fc5e42a1b1c0665f62cb3e4b23e6dc"
},
{
"url": "https://git.kernel.org/stable/c/37b6143376a578265add04f35161b257eeb84a5e"
},
{
"url": "https://git.kernel.org/stable/c/c96cc3d9acaca53d9a81c884c23f1224b61c829b"
},
{
"url": "https://git.kernel.org/stable/c/bc16fc63592c419357dd4c4d82d50762102a60ef"
},
{
"url": "https://git.kernel.org/stable/c/6a940abdef3162e5723f1495b8a49859d1708f79"
}
],
"title": "bonding: do not assume skb mac_header is set",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53601",
"datePublished": "2025-10-04T15:44:12.477Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-04T15:44:12.477Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53541 (GCVE-0-2023-53541)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
Summary
In the Linux kernel, the following vulnerability has been resolved:
mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
When the oob buffer length is not in multiple of words, the oob write
function does out-of-bounds read on the oob source buffer at the last
iteration. Fix that by always checking length limit on the oob buffer
read and fill with 0xff when reaching the end of the buffer to the oob
registers.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 , < 2bc3d6ac704ea7263175ea3da663fdbbb7f3dd8b
(git)
Affected: 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 , < 14b1d00520b4d6a4818364334ce472b79cfc8976 (git) Affected: 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 , < aae45746f4aee9818296e0500e0703e9d8caa5b8 (git) Affected: 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 , < d00b031266514a9395124704630b056a5185ec17 (git) Affected: 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 , < 2353b7bb61e45e7cfd21505d0c6747ac8c9496a1 (git) Affected: 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 , < 45fe4ad7f439799ee1b7b5f80bf82e8b34a98d25 (git) Affected: 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 , < 648d1150a688698e37f7aaf302860180901cb30e (git) Affected: 27c5b17cd1b10564fa36f8f51e4b4b41436ecc32 , < 5d53244186c9ac58cb88d76a0958ca55b83a15cd (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mtd/nand/raw/brcmnand/brcmnand.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2bc3d6ac704ea7263175ea3da663fdbbb7f3dd8b",
"status": "affected",
"version": "27c5b17cd1b10564fa36f8f51e4b4b41436ecc32",
"versionType": "git"
},
{
"lessThan": "14b1d00520b4d6a4818364334ce472b79cfc8976",
"status": "affected",
"version": "27c5b17cd1b10564fa36f8f51e4b4b41436ecc32",
"versionType": "git"
},
{
"lessThan": "aae45746f4aee9818296e0500e0703e9d8caa5b8",
"status": "affected",
"version": "27c5b17cd1b10564fa36f8f51e4b4b41436ecc32",
"versionType": "git"
},
{
"lessThan": "d00b031266514a9395124704630b056a5185ec17",
"status": "affected",
"version": "27c5b17cd1b10564fa36f8f51e4b4b41436ecc32",
"versionType": "git"
},
{
"lessThan": "2353b7bb61e45e7cfd21505d0c6747ac8c9496a1",
"status": "affected",
"version": "27c5b17cd1b10564fa36f8f51e4b4b41436ecc32",
"versionType": "git"
},
{
"lessThan": "45fe4ad7f439799ee1b7b5f80bf82e8b34a98d25",
"status": "affected",
"version": "27c5b17cd1b10564fa36f8f51e4b4b41436ecc32",
"versionType": "git"
},
{
"lessThan": "648d1150a688698e37f7aaf302860180901cb30e",
"status": "affected",
"version": "27c5b17cd1b10564fa36f8f51e4b4b41436ecc32",
"versionType": "git"
},
{
"lessThan": "5d53244186c9ac58cb88d76a0958ca55b83a15cd",
"status": "affected",
"version": "27c5b17cd1b10564fa36f8f51e4b4b41436ecc32",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mtd/nand/raw/brcmnand/brcmnand.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.326",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.295",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.257",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.195",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.132",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.326",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.295",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.257",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.195",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.132",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.54",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.4",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write\n\nWhen the oob buffer length is not in multiple of words, the oob write\nfunction does out-of-bounds read on the oob source buffer at the last\niteration. Fix that by always checking length limit on the oob buffer\nread and fill with 0xff when reaching the end of the buffer to the oob\nregisters."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:50.765Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2bc3d6ac704ea7263175ea3da663fdbbb7f3dd8b"
},
{
"url": "https://git.kernel.org/stable/c/14b1d00520b4d6a4818364334ce472b79cfc8976"
},
{
"url": "https://git.kernel.org/stable/c/aae45746f4aee9818296e0500e0703e9d8caa5b8"
},
{
"url": "https://git.kernel.org/stable/c/d00b031266514a9395124704630b056a5185ec17"
},
{
"url": "https://git.kernel.org/stable/c/2353b7bb61e45e7cfd21505d0c6747ac8c9496a1"
},
{
"url": "https://git.kernel.org/stable/c/45fe4ad7f439799ee1b7b5f80bf82e8b34a98d25"
},
{
"url": "https://git.kernel.org/stable/c/648d1150a688698e37f7aaf302860180901cb30e"
},
{
"url": "https://git.kernel.org/stable/c/5d53244186c9ac58cb88d76a0958ca55b83a15cd"
}
],
"title": "mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53541",
"datePublished": "2025-10-04T15:16:50.765Z",
"dateReserved": "2025-10-04T15:14:15.920Z",
"dateUpdated": "2025-10-04T15:16:50.765Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53562 (GCVE-0-2023-53562)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
drm/msm: fix vram leak on bind errors
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/msm: fix vram leak on bind errors
Make sure to release the VRAM buffer also in a case a subcomponent fails
to bind.
Patchwork: https://patchwork.freedesktop.org/patch/525094/
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
d863f0c7b536288e2bd40cbc01c10465dd226b11 , < 544711591a67a6da4d9f0f70ba3c805eb2548729
(git)
Affected: d863f0c7b536288e2bd40cbc01c10465dd226b11 , < c02e8c1c5b3eb0b6193946194ac280f58f48b3b5 (git) Affected: d863f0c7b536288e2bd40cbc01c10465dd226b11 , < e3401e07ba98a94b978164b7e873c25e5fc82b4b (git) Affected: d863f0c7b536288e2bd40cbc01c10465dd226b11 , < 60d476af96015891c7959f30838ae7a9749932bf (git) Affected: 0680689c609c7b2a15e52a9b9ca58fc2a04b2eee (git) Affected: ba74e0f222c7394eae16cbe91233aa34ba5122ea (git) Affected: d565c626b4e14864be4f6886d73e86f3338f7bac (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "544711591a67a6da4d9f0f70ba3c805eb2548729",
"status": "affected",
"version": "d863f0c7b536288e2bd40cbc01c10465dd226b11",
"versionType": "git"
},
{
"lessThan": "c02e8c1c5b3eb0b6193946194ac280f58f48b3b5",
"status": "affected",
"version": "d863f0c7b536288e2bd40cbc01c10465dd226b11",
"versionType": "git"
},
{
"lessThan": "e3401e07ba98a94b978164b7e873c25e5fc82b4b",
"status": "affected",
"version": "d863f0c7b536288e2bd40cbc01c10465dd226b11",
"versionType": "git"
},
{
"lessThan": "60d476af96015891c7959f30838ae7a9749932bf",
"status": "affected",
"version": "d863f0c7b536288e2bd40cbc01c10465dd226b11",
"versionType": "git"
},
{
"status": "affected",
"version": "0680689c609c7b2a15e52a9b9ca58fc2a04b2eee",
"versionType": "git"
},
{
"status": "affected",
"version": "ba74e0f222c7394eae16cbe91233aa34ba5122ea",
"versionType": "git"
},
{
"status": "affected",
"version": "d565c626b4e14864be4f6886d73e86f3338f7bac",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/msm/msm_drv.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.11"
},
{
"lessThan": "5.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.29",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.29",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.16",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.3",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.19.169",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.4.91",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.10.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/msm: fix vram leak on bind errors\n\nMake sure to release the VRAM buffer also in a case a subcomponent fails\nto bind.\n\nPatchwork: https://patchwork.freedesktop.org/patch/525094/"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:05.652Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/544711591a67a6da4d9f0f70ba3c805eb2548729"
},
{
"url": "https://git.kernel.org/stable/c/c02e8c1c5b3eb0b6193946194ac280f58f48b3b5"
},
{
"url": "https://git.kernel.org/stable/c/e3401e07ba98a94b978164b7e873c25e5fc82b4b"
},
{
"url": "https://git.kernel.org/stable/c/60d476af96015891c7959f30838ae7a9749932bf"
}
],
"title": "drm/msm: fix vram leak on bind errors",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53562",
"datePublished": "2025-10-04T15:17:05.652Z",
"dateReserved": "2025-10-04T15:14:15.923Z",
"dateUpdated": "2025-10-04T15:17:05.652Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53550 (GCVE-0-2023-53550)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
cpufreq: amd-pstate: fix global sysfs attribute type
Summary
In the Linux kernel, the following vulnerability has been resolved:
cpufreq: amd-pstate: fix global sysfs attribute type
In commit 3666062b87ec ("cpufreq: amd-pstate: move to use bus_get_dev_root()")
the "amd_pstate" attributes where moved from a dedicated kobject to the
cpu root kobject.
While the dedicated kobject expects to contain kobj_attributes the root
kobject needs device_attributes.
As the changed arguments are not used by the callbacks it works most of
the time.
However CFI will detect this issue:
[ 4947.849350] CFI failure at dev_attr_show+0x24/0x60 (target: show_status+0x0/0x70; expected type: 0x8651b1de)
...
[ 4947.849409] Call Trace:
[ 4947.849410] <TASK>
[ 4947.849411] ? __warn+0xcf/0x1c0
[ 4947.849414] ? dev_attr_show+0x24/0x60
[ 4947.849415] ? report_cfi_failure+0x4e/0x60
[ 4947.849417] ? handle_cfi_failure+0x14c/0x1d0
[ 4947.849419] ? __cfi_show_status+0x10/0x10
[ 4947.849420] ? handle_bug+0x4f/0x90
[ 4947.849421] ? exc_invalid_op+0x1a/0x60
[ 4947.849422] ? asm_exc_invalid_op+0x1a/0x20
[ 4947.849424] ? __cfi_show_status+0x10/0x10
[ 4947.849425] ? dev_attr_show+0x24/0x60
[ 4947.849426] sysfs_kf_seq_show+0xa6/0x110
[ 4947.849433] seq_read_iter+0x16c/0x4b0
[ 4947.849436] vfs_read+0x272/0x2d0
[ 4947.849438] ksys_read+0x72/0xe0
[ 4947.849439] do_syscall_64+0x76/0xb0
[ 4947.849440] ? do_user_addr_fault+0x252/0x650
[ 4947.849442] ? exc_page_fault+0x7a/0x1b0
[ 4947.849443] entry_SYSCALL_64_after_hwframe+0x72/0xdc
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/amd-pstate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ddcfc33a20380508f7fea18e1c330abe17ed4fc0",
"status": "affected",
"version": "3666062b87ec8be4b85dc475dfb54bb17e10a7f6",
"versionType": "git"
},
{
"lessThan": "5e720f8c8c9d959283c3908bbf32a91a01a86547",
"status": "affected",
"version": "3666062b87ec8be4b85dc475dfb54bb17e10a7f6",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/cpufreq/amd-pstate.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: amd-pstate: fix global sysfs attribute type\n\nIn commit 3666062b87ec (\"cpufreq: amd-pstate: move to use bus_get_dev_root()\")\nthe \"amd_pstate\" attributes where moved from a dedicated kobject to the\ncpu root kobject.\n\nWhile the dedicated kobject expects to contain kobj_attributes the root\nkobject needs device_attributes.\n\nAs the changed arguments are not used by the callbacks it works most of\nthe time.\nHowever CFI will detect this issue:\n\n[ 4947.849350] CFI failure at dev_attr_show+0x24/0x60 (target: show_status+0x0/0x70; expected type: 0x8651b1de)\n...\n[ 4947.849409] Call Trace:\n[ 4947.849410] \u003cTASK\u003e\n[ 4947.849411] ? __warn+0xcf/0x1c0\n[ 4947.849414] ? dev_attr_show+0x24/0x60\n[ 4947.849415] ? report_cfi_failure+0x4e/0x60\n[ 4947.849417] ? handle_cfi_failure+0x14c/0x1d0\n[ 4947.849419] ? __cfi_show_status+0x10/0x10\n[ 4947.849420] ? handle_bug+0x4f/0x90\n[ 4947.849421] ? exc_invalid_op+0x1a/0x60\n[ 4947.849422] ? asm_exc_invalid_op+0x1a/0x20\n[ 4947.849424] ? __cfi_show_status+0x10/0x10\n[ 4947.849425] ? dev_attr_show+0x24/0x60\n[ 4947.849426] sysfs_kf_seq_show+0xa6/0x110\n[ 4947.849433] seq_read_iter+0x16c/0x4b0\n[ 4947.849436] vfs_read+0x272/0x2d0\n[ 4947.849438] ksys_read+0x72/0xe0\n[ 4947.849439] do_syscall_64+0x76/0xb0\n[ 4947.849440] ? do_user_addr_fault+0x252/0x650\n[ 4947.849442] ? exc_page_fault+0x7a/0x1b0\n[ 4947.849443] entry_SYSCALL_64_after_hwframe+0x72/0xdc"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:57.061Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ddcfc33a20380508f7fea18e1c330abe17ed4fc0"
},
{
"url": "https://git.kernel.org/stable/c/5e720f8c8c9d959283c3908bbf32a91a01a86547"
}
],
"title": "cpufreq: amd-pstate: fix global sysfs attribute type",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53550",
"datePublished": "2025-10-04T15:16:57.061Z",
"dateReserved": "2025-10-04T15:14:15.922Z",
"dateUpdated": "2025-10-04T15:16:57.061Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53583 (GCVE-0-2023-53583)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start()
Summary
In the Linux kernel, the following vulnerability has been resolved:
perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start()
Since commit 096b52fd2bb4 ("perf: RISC-V: throttle perf events") the
perf_sample_event_took() function was added to report time spent in
overflow interrupts. If the interrupt takes too long, the perf framework
will lower the sysctl_perf_event_sample_rate and max_samples_per_tick.
When hwc->interrupts is larger than max_samples_per_tick, the
hwc->interrupts will be set to MAX_INTERRUPTS, and events will be
throttled within the __perf_event_account_interrupt() function.
However, the RISC-V PMU driver doesn't call riscv_pmu_stop() to update the
PERF_HES_STOPPED flag after perf_event_overflow() in pmu_sbi_ovf_handler()
function to avoid throttling. When the perf framework unthrottled the event
in the timer interrupt handler, it triggers riscv_pmu_start() function
and causes a WARN_ON_ONCE() warning, as shown below:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 240 at drivers/perf/riscv_pmu.c:184 riscv_pmu_start+0x7c/0x8e
Modules linked in:
CPU: 0 PID: 240 Comm: ls Not tainted 6.4-rc4-g19d0788e9ef2 #1
Hardware name: SiFive (DT)
epc : riscv_pmu_start+0x7c/0x8e
ra : riscv_pmu_start+0x28/0x8e
epc : ffffffff80aef864 ra : ffffffff80aef810 sp : ffff8f80004db6f0
gp : ffffffff81c83750 tp : ffffaf80069f9bc0 t0 : ffff8f80004db6c0
t1 : 0000000000000000 t2 : 000000000000001f s0 : ffff8f80004db720
s1 : ffffaf8008ca1068 a0 : 0000ffffffffffff a1 : 0000000000000000
a2 : 0000000000000001 a3 : 0000000000000870 a4 : 0000000000000000
a5 : 0000000000000000 a6 : 0000000000000840 a7 : 0000000000000030
s2 : 0000000000000000 s3 : ffffaf8005165800 s4 : ffffaf800424da00
s5 : ffffffffffffffff s6 : ffffffff81cc7590 s7 : 0000000000000000
s8 : 0000000000000006 s9 : 0000000000000001 s10: ffffaf807efbc340
s11: ffffaf807efbbf00 t3 : ffffaf8006a16028 t4 : 00000000dbfbb796
t5 : 0000000700000000 t6 : ffffaf8005269870
status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003
[<ffffffff80aef864>] riscv_pmu_start+0x7c/0x8e
[<ffffffff80185b56>] perf_adjust_freq_unthr_context+0x15e/0x174
[<ffffffff80188642>] perf_event_task_tick+0x88/0x9c
[<ffffffff800626a8>] scheduler_tick+0xfe/0x27c
[<ffffffff800b5640>] update_process_times+0x9a/0xba
[<ffffffff800c5bd4>] tick_sched_handle+0x32/0x66
[<ffffffff800c5e0c>] tick_sched_timer+0x64/0xb0
[<ffffffff800b5e50>] __hrtimer_run_queues+0x156/0x2f4
[<ffffffff800b6bdc>] hrtimer_interrupt+0xe2/0x1fe
[<ffffffff80acc9e8>] riscv_timer_interrupt+0x38/0x42
[<ffffffff80090a16>] handle_percpu_devid_irq+0x90/0x1d2
[<ffffffff8008a9f4>] generic_handle_domain_irq+0x28/0x36
After referring other PMU drivers like Arm, Loongarch, Csky, and Mips,
they don't call *_pmu_stop() to update with PERF_HES_STOPPED flag
after perf_event_overflow() function nor do they add PERF_HES_STOPPED
flag checking in *_pmu_start() which don't cause this warning.
Thus, it's recommended to remove this unnecessary check in
riscv_pmu_start() function to prevent this warning.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
096b52fd2bb4996fd68d22b3b7ad21a1296db9d3 , < aeb62beaf9cbd0a72e7f97c9af6d3e7f76ce2946
(git)
Affected: 096b52fd2bb4996fd68d22b3b7ad21a1296db9d3 , < 8270d539a943d00cf6a094da0073e2b5972b641d (git) Affected: 096b52fd2bb4996fd68d22b3b7ad21a1296db9d3 , < 66843b14fb71825fdd73ab12f6594f2243b402be (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/perf/riscv_pmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "aeb62beaf9cbd0a72e7f97c9af6d3e7f76ce2946",
"status": "affected",
"version": "096b52fd2bb4996fd68d22b3b7ad21a1296db9d3",
"versionType": "git"
},
{
"lessThan": "8270d539a943d00cf6a094da0073e2b5972b641d",
"status": "affected",
"version": "096b52fd2bb4996fd68d22b3b7ad21a1296db9d3",
"versionType": "git"
},
{
"lessThan": "66843b14fb71825fdd73ab12f6594f2243b402be",
"status": "affected",
"version": "096b52fd2bb4996fd68d22b3b7ad21a1296db9d3",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/perf/riscv_pmu.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.40",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.5",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nperf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start()\n\nSince commit 096b52fd2bb4 (\"perf: RISC-V: throttle perf events\") the\nperf_sample_event_took() function was added to report time spent in\noverflow interrupts. If the interrupt takes too long, the perf framework\nwill lower the sysctl_perf_event_sample_rate and max_samples_per_tick.\nWhen hwc-\u003einterrupts is larger than max_samples_per_tick, the\nhwc-\u003einterrupts will be set to MAX_INTERRUPTS, and events will be\nthrottled within the __perf_event_account_interrupt() function.\n\nHowever, the RISC-V PMU driver doesn\u0027t call riscv_pmu_stop() to update the\nPERF_HES_STOPPED flag after perf_event_overflow() in pmu_sbi_ovf_handler()\nfunction to avoid throttling. When the perf framework unthrottled the event\nin the timer interrupt handler, it triggers riscv_pmu_start() function\nand causes a WARN_ON_ONCE() warning, as shown below:\n\n ------------[ cut here ]------------\n WARNING: CPU: 0 PID: 240 at drivers/perf/riscv_pmu.c:184 riscv_pmu_start+0x7c/0x8e\n Modules linked in:\n CPU: 0 PID: 240 Comm: ls Not tainted 6.4-rc4-g19d0788e9ef2 #1\n Hardware name: SiFive (DT)\n epc : riscv_pmu_start+0x7c/0x8e\n ra : riscv_pmu_start+0x28/0x8e\n epc : ffffffff80aef864 ra : ffffffff80aef810 sp : ffff8f80004db6f0\n gp : ffffffff81c83750 tp : ffffaf80069f9bc0 t0 : ffff8f80004db6c0\n t1 : 0000000000000000 t2 : 000000000000001f s0 : ffff8f80004db720\n s1 : ffffaf8008ca1068 a0 : 0000ffffffffffff a1 : 0000000000000000\n a2 : 0000000000000001 a3 : 0000000000000870 a4 : 0000000000000000\n a5 : 0000000000000000 a6 : 0000000000000840 a7 : 0000000000000030\n s2 : 0000000000000000 s3 : ffffaf8005165800 s4 : ffffaf800424da00\n s5 : ffffffffffffffff s6 : ffffffff81cc7590 s7 : 0000000000000000\n s8 : 0000000000000006 s9 : 0000000000000001 s10: ffffaf807efbc340\n s11: ffffaf807efbbf00 t3 : ffffaf8006a16028 t4 : 00000000dbfbb796\n t5 : 0000000700000000 t6 : ffffaf8005269870\n status: 0000000200000100 badaddr: 0000000000000000 cause: 0000000000000003\n [\u003cffffffff80aef864\u003e] riscv_pmu_start+0x7c/0x8e\n [\u003cffffffff80185b56\u003e] perf_adjust_freq_unthr_context+0x15e/0x174\n [\u003cffffffff80188642\u003e] perf_event_task_tick+0x88/0x9c\n [\u003cffffffff800626a8\u003e] scheduler_tick+0xfe/0x27c\n [\u003cffffffff800b5640\u003e] update_process_times+0x9a/0xba\n [\u003cffffffff800c5bd4\u003e] tick_sched_handle+0x32/0x66\n [\u003cffffffff800c5e0c\u003e] tick_sched_timer+0x64/0xb0\n [\u003cffffffff800b5e50\u003e] __hrtimer_run_queues+0x156/0x2f4\n [\u003cffffffff800b6bdc\u003e] hrtimer_interrupt+0xe2/0x1fe\n [\u003cffffffff80acc9e8\u003e] riscv_timer_interrupt+0x38/0x42\n [\u003cffffffff80090a16\u003e] handle_percpu_devid_irq+0x90/0x1d2\n [\u003cffffffff8008a9f4\u003e] generic_handle_domain_irq+0x28/0x36\n\nAfter referring other PMU drivers like Arm, Loongarch, Csky, and Mips,\nthey don\u0027t call *_pmu_stop() to update with PERF_HES_STOPPED flag\nafter perf_event_overflow() function nor do they add PERF_HES_STOPPED\nflag checking in *_pmu_start() which don\u0027t cause this warning.\n\nThus, it\u0027s recommended to remove this unnecessary check in\nriscv_pmu_start() function to prevent this warning."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:59.154Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/aeb62beaf9cbd0a72e7f97c9af6d3e7f76ce2946"
},
{
"url": "https://git.kernel.org/stable/c/8270d539a943d00cf6a094da0073e2b5972b641d"
},
{
"url": "https://git.kernel.org/stable/c/66843b14fb71825fdd73ab12f6594f2243b402be"
}
],
"title": "perf: RISC-V: Remove PERF_HES_STOPPED flag checking in riscv_pmu_start()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53583",
"datePublished": "2025-10-04T15:43:59.154Z",
"dateReserved": "2025-10-04T15:40:38.477Z",
"dateUpdated": "2025-10-04T15:43:59.154Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50484 (GCVE-0-2022-50484)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-12-23 13:29
VLAI?
EPSS
Title
ALSA: usb-audio: Fix potential memory leaks
Summary
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Fix potential memory leaks
When the driver hits -ENOMEM at allocating a URB or a buffer, it
aborts and goes to the error path that releases the all previously
allocated resources. However, when -ENOMEM hits at the middle of the
sync EP URB allocation loop, the partially allocated URBs might be
left without released, because ep->nurbs is still zero at that point.
Fix it by setting ep->nurbs at first, so that the error handler loops
over the full URB list.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
8fdff6a319e7dac757c558bd283dc4577e68cde7 , < 0604e5e5537af099ea2f6dfd892afe5c92db8a80
(git)
Affected: 8fdff6a319e7dac757c558bd283dc4577e68cde7 , < 28d8d267af5d73f91d7640cbdb4024703256e36c (git) Affected: 8fdff6a319e7dac757c558bd283dc4577e68cde7 , < 46f0aed47673e275d682af60ed26dcc28add8eae (git) Affected: 8fdff6a319e7dac757c558bd283dc4577e68cde7 , < 988ec0cd0a2643c25c1658f7c33de2e15a5a2e31 (git) Affected: 8fdff6a319e7dac757c558bd283dc4577e68cde7 , < bc1d16d282bca421c6fc31de4b8fd412010f01bd (git) Affected: 8fdff6a319e7dac757c558bd283dc4577e68cde7 , < 0672215994e2347a9b4f145e2bc1709b1e01cee3 (git) Affected: 8fdff6a319e7dac757c558bd283dc4577e68cde7 , < faa8c1ed77d0169955b9b3516b714cc5fb512f27 (git) Affected: 8fdff6a319e7dac757c558bd283dc4577e68cde7 , < e4442410f76d66b9f7e854010bce04853f665324 (git) Affected: 8fdff6a319e7dac757c558bd283dc4577e68cde7 , < 6382da0828995af87aa8b8bef28cc61aceb4aff3 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"sound/usb/endpoint.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "0604e5e5537af099ea2f6dfd892afe5c92db8a80",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
},
{
"lessThan": "28d8d267af5d73f91d7640cbdb4024703256e36c",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
},
{
"lessThan": "46f0aed47673e275d682af60ed26dcc28add8eae",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
},
{
"lessThan": "988ec0cd0a2643c25c1658f7c33de2e15a5a2e31",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
},
{
"lessThan": "bc1d16d282bca421c6fc31de4b8fd412010f01bd",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
},
{
"lessThan": "0672215994e2347a9b4f145e2bc1709b1e01cee3",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
},
{
"lessThan": "faa8c1ed77d0169955b9b3516b714cc5fb512f27",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
},
{
"lessThan": "e4442410f76d66b9f7e854010bce04853f665324",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
},
{
"lessThan": "6382da0828995af87aa8b8bef28cc61aceb4aff3",
"status": "affected",
"version": "8fdff6a319e7dac757c558bd283dc4577e68cde7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"sound/usb/endpoint.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.5"
},
{
"lessThan": "3.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.331",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.296",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.262",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.331",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.296",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.262",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.220",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.150",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.75",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.17",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "3.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "3.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: usb-audio: Fix potential memory leaks\n\nWhen the driver hits -ENOMEM at allocating a URB or a buffer, it\naborts and goes to the error path that releases the all previously\nallocated resources. However, when -ENOMEM hits at the middle of the\nsync EP URB allocation loop, the partially allocated URBs might be\nleft without released, because ep-\u003enurbs is still zero at that point.\n\nFix it by setting ep-\u003enurbs at first, so that the error handler loops\nover the full URB list."
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T13:29:35.751Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/0604e5e5537af099ea2f6dfd892afe5c92db8a80"
},
{
"url": "https://git.kernel.org/stable/c/28d8d267af5d73f91d7640cbdb4024703256e36c"
},
{
"url": "https://git.kernel.org/stable/c/46f0aed47673e275d682af60ed26dcc28add8eae"
},
{
"url": "https://git.kernel.org/stable/c/988ec0cd0a2643c25c1658f7c33de2e15a5a2e31"
},
{
"url": "https://git.kernel.org/stable/c/bc1d16d282bca421c6fc31de4b8fd412010f01bd"
},
{
"url": "https://git.kernel.org/stable/c/0672215994e2347a9b4f145e2bc1709b1e01cee3"
},
{
"url": "https://git.kernel.org/stable/c/faa8c1ed77d0169955b9b3516b714cc5fb512f27"
},
{
"url": "https://git.kernel.org/stable/c/e4442410f76d66b9f7e854010bce04853f665324"
},
{
"url": "https://git.kernel.org/stable/c/6382da0828995af87aa8b8bef28cc61aceb4aff3"
}
],
"title": "ALSA: usb-audio: Fix potential memory leaks",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50484",
"datePublished": "2025-10-04T15:16:42.385Z",
"dateReserved": "2025-10-04T15:13:33.468Z",
"dateUpdated": "2025-12-23T13:29:35.751Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39944 (GCVE-0-2025-39944)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:31
VLAI?
EPSS
Title
octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
Summary
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()
The original code relies on cancel_delayed_work() in otx2_ptp_destroy(),
which does not ensure that the delayed work item synctstamp_work has fully
completed if it was already running. This leads to use-after-free scenarios
where otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work
remains active and attempts to dereference otx2_ptp in otx2_sync_tstamp().
Furthermore, the synctstamp_work is cyclic, the likelihood of triggering
the bug is nonnegligible.
A typical race condition is illustrated below:
CPU 0 (cleanup) | CPU 1 (delayed work callback)
otx2_remove() |
otx2_ptp_destroy() | otx2_sync_tstamp()
cancel_delayed_work() |
kfree(ptp) |
| ptp = container_of(...); //UAF
| ptp-> //UAF
This is confirmed by a KASAN report:
BUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0
Write of size 8 at addr ffff88800aa09a18 by task bash/136
...
Call Trace:
<IRQ>
dump_stack_lvl+0x55/0x70
print_report+0xcf/0x610
? __run_timer_base.part.0+0x7d7/0x8c0
kasan_report+0xb8/0xf0
? __run_timer_base.part.0+0x7d7/0x8c0
__run_timer_base.part.0+0x7d7/0x8c0
? __pfx___run_timer_base.part.0+0x10/0x10
? __pfx_read_tsc+0x10/0x10
? ktime_get+0x60/0x140
? lapic_next_event+0x11/0x20
? clockevents_program_event+0x1d4/0x2a0
run_timer_softirq+0xd1/0x190
handle_softirqs+0x16a/0x550
irq_exit_rcu+0xaf/0xe0
sysvec_apic_timer_interrupt+0x70/0x80
</IRQ>
...
Allocated by task 1:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0x7f/0x90
otx2_ptp_init+0xb1/0x860
otx2_probe+0x4eb/0xc30
local_pci_probe+0xdc/0x190
pci_device_probe+0x2fe/0x470
really_probe+0x1ca/0x5c0
__driver_probe_device+0x248/0x310
driver_probe_device+0x44/0x120
__driver_attach+0xd2/0x310
bus_for_each_dev+0xed/0x170
bus_add_driver+0x208/0x500
driver_register+0x132/0x460
do_one_initcall+0x89/0x300
kernel_init_freeable+0x40d/0x720
kernel_init+0x1a/0x150
ret_from_fork+0x10c/0x1a0
ret_from_fork_asm+0x1a/0x30
Freed by task 136:
kasan_save_stack+0x24/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3a/0x60
__kasan_slab_free+0x3f/0x50
kfree+0x137/0x370
otx2_ptp_destroy+0x38/0x80
otx2_remove+0x10d/0x4c0
pci_device_remove+0xa6/0x1d0
device_release_driver_internal+0xf8/0x210
pci_stop_bus_device+0x105/0x150
pci_stop_and_remove_bus_device_locked+0x15/0x30
remove_store+0xcc/0xe0
kernfs_fop_write_iter+0x2c3/0x440
vfs_write+0x871/0xd70
ksys_write+0xee/0x1c0
do_syscall_64+0xac/0x280
entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
Replace cancel_delayed_work() with cancel_delayed_work_sync() to ensure
that the delayed work item is properly canceled before the otx2_ptp is
deallocated.
This bug was initially identified through static analysis. To reproduce
and test it, I simulated the OcteonTX2 PCI device in QEMU and introduced
artificial delays within the otx2_sync_tstamp() function to increase the
likelihood of triggering the bug.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
2958d17a898416c6193431676f6130b68a2cb9fc , < 2786879aebf363806a13d41e8d5f99202ddd23d9
(git)
Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < d2cfefa14ce8137b17f99683f968bebf134b6a48 (git) Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < ff27e23b311fed4d25e3852e27ba693416d4c7b3 (git) Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < 5ca20bb7b4bde72110c3ae78423cbfdd0157aa36 (git) Affected: 2958d17a898416c6193431676f6130b68a2cb9fc , < f8b4687151021db61841af983f1cb7be6915d4ef (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "2786879aebf363806a13d41e8d5f99202ddd23d9",
"status": "affected",
"version": "2958d17a898416c6193431676f6130b68a2cb9fc",
"versionType": "git"
},
{
"lessThan": "d2cfefa14ce8137b17f99683f968bebf134b6a48",
"status": "affected",
"version": "2958d17a898416c6193431676f6130b68a2cb9fc",
"versionType": "git"
},
{
"lessThan": "ff27e23b311fed4d25e3852e27ba693416d4c7b3",
"status": "affected",
"version": "2958d17a898416c6193431676f6130b68a2cb9fc",
"versionType": "git"
},
{
"lessThan": "5ca20bb7b4bde72110c3ae78423cbfdd0157aa36",
"status": "affected",
"version": "2958d17a898416c6193431676f6130b68a2cb9fc",
"versionType": "git"
},
{
"lessThan": "f8b4687151021db61841af983f1cb7be6915d4ef",
"status": "affected",
"version": "2958d17a898416c6193431676f6130b68a2cb9fc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/nic/otx2_ptp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()\n\nThe original code relies on cancel_delayed_work() in otx2_ptp_destroy(),\nwhich does not ensure that the delayed work item synctstamp_work has fully\ncompleted if it was already running. This leads to use-after-free scenarios\nwhere otx2_ptp is deallocated by otx2_ptp_destroy(), while synctstamp_work\nremains active and attempts to dereference otx2_ptp in otx2_sync_tstamp().\nFurthermore, the synctstamp_work is cyclic, the likelihood of triggering\nthe bug is nonnegligible.\n\nA typical race condition is illustrated below:\n\nCPU 0 (cleanup) | CPU 1 (delayed work callback)\notx2_remove() |\n otx2_ptp_destroy() | otx2_sync_tstamp()\n cancel_delayed_work() |\n kfree(ptp) |\n | ptp = container_of(...); //UAF\n | ptp-\u003e //UAF\n\nThis is confirmed by a KASAN report:\n\nBUG: KASAN: slab-use-after-free in __run_timer_base.part.0+0x7d7/0x8c0\nWrite of size 8 at addr ffff88800aa09a18 by task bash/136\n...\nCall Trace:\n \u003cIRQ\u003e\n dump_stack_lvl+0x55/0x70\n print_report+0xcf/0x610\n ? __run_timer_base.part.0+0x7d7/0x8c0\n kasan_report+0xb8/0xf0\n ? __run_timer_base.part.0+0x7d7/0x8c0\n __run_timer_base.part.0+0x7d7/0x8c0\n ? __pfx___run_timer_base.part.0+0x10/0x10\n ? __pfx_read_tsc+0x10/0x10\n ? ktime_get+0x60/0x140\n ? lapic_next_event+0x11/0x20\n ? clockevents_program_event+0x1d4/0x2a0\n run_timer_softirq+0xd1/0x190\n handle_softirqs+0x16a/0x550\n irq_exit_rcu+0xaf/0xe0\n sysvec_apic_timer_interrupt+0x70/0x80\n \u003c/IRQ\u003e\n...\nAllocated by task 1:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n __kasan_kmalloc+0x7f/0x90\n otx2_ptp_init+0xb1/0x860\n otx2_probe+0x4eb/0xc30\n local_pci_probe+0xdc/0x190\n pci_device_probe+0x2fe/0x470\n really_probe+0x1ca/0x5c0\n __driver_probe_device+0x248/0x310\n driver_probe_device+0x44/0x120\n __driver_attach+0xd2/0x310\n bus_for_each_dev+0xed/0x170\n bus_add_driver+0x208/0x500\n driver_register+0x132/0x460\n do_one_initcall+0x89/0x300\n kernel_init_freeable+0x40d/0x720\n kernel_init+0x1a/0x150\n ret_from_fork+0x10c/0x1a0\n ret_from_fork_asm+0x1a/0x30\n\nFreed by task 136:\n kasan_save_stack+0x24/0x50\n kasan_save_track+0x14/0x30\n kasan_save_free_info+0x3a/0x60\n __kasan_slab_free+0x3f/0x50\n kfree+0x137/0x370\n otx2_ptp_destroy+0x38/0x80\n otx2_remove+0x10d/0x4c0\n pci_device_remove+0xa6/0x1d0\n device_release_driver_internal+0xf8/0x210\n pci_stop_bus_device+0x105/0x150\n pci_stop_and_remove_bus_device_locked+0x15/0x30\n remove_store+0xcc/0xe0\n kernfs_fop_write_iter+0x2c3/0x440\n vfs_write+0x871/0xd70\n ksys_write+0xee/0x1c0\n do_syscall_64+0xac/0x280\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n...\n\nReplace cancel_delayed_work() with cancel_delayed_work_sync() to ensure\nthat the delayed work item is properly canceled before the otx2_ptp is\ndeallocated.\n\nThis bug was initially identified through static analysis. To reproduce\nand test it, I simulated the OcteonTX2 PCI device in QEMU and introduced\nartificial delays within the otx2_sync_tstamp() function to increase the\nlikelihood of triggering the bug."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:31:06.339Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/2786879aebf363806a13d41e8d5f99202ddd23d9"
},
{
"url": "https://git.kernel.org/stable/c/d2cfefa14ce8137b17f99683f968bebf134b6a48"
},
{
"url": "https://git.kernel.org/stable/c/ff27e23b311fed4d25e3852e27ba693416d4c7b3"
},
{
"url": "https://git.kernel.org/stable/c/5ca20bb7b4bde72110c3ae78423cbfdd0157aa36"
},
{
"url": "https://git.kernel.org/stable/c/f8b4687151021db61841af983f1cb7be6915d4ef"
}
],
"title": "octeontx2-pf: Fix use-after-free bugs in otx2_sync_tstamp()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39944",
"datePublished": "2025-10-04T07:31:06.339Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:31:06.339Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53543 (GCVE-0-2023-53543)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-01-19 12:17
VLAI?
EPSS
Title
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
Summary
In the Linux kernel, the following vulnerability has been resolved:
vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check
The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.
That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.
This patch adds the missing nla_policy for vdpa max vqp attr to avoid
such bugs.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
ad69dd0bf26b88ec6ab26f8bbe5cd74fbed7672a , < ff71709445ac033e6e250d971683110e4781c068
(git)
Affected: ad69dd0bf26b88ec6ab26f8bbe5cd74fbed7672a , < ea65e8b5e6b1a34deda7564f09c90e9e80db436a (git) Affected: ad69dd0bf26b88ec6ab26f8bbe5cd74fbed7672a , < 5d6ba607d6cb5c58a4ddf33381e18c83dbb4098f (git) Affected: 447092100c7e71aa20469a270fcee441d807ed58 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ff71709445ac033e6e250d971683110e4781c068",
"status": "affected",
"version": "ad69dd0bf26b88ec6ab26f8bbe5cd74fbed7672a",
"versionType": "git"
},
{
"lessThan": "ea65e8b5e6b1a34deda7564f09c90e9e80db436a",
"status": "affected",
"version": "ad69dd0bf26b88ec6ab26f8bbe5cd74fbed7672a",
"versionType": "git"
},
{
"lessThan": "5d6ba607d6cb5c58a4ddf33381e18c83dbb4098f",
"status": "affected",
"version": "ad69dd0bf26b88ec6ab26f8bbe5cd74fbed7672a",
"versionType": "git"
},
{
"status": "affected",
"version": "447092100c7e71aa20469a270fcee441d807ed58",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/vdpa/vdpa.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.16"
},
{
"lessThan": "5.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.47",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.12",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "5.15.198",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check\n\nThe vdpa_nl_policy structure is used to validate the nlattr when parsing\nthe incoming nlmsg. It will ensure the attribute being described produces\na valid nlattr pointer in info-\u003eattrs before entering into each handler\nin vdpa_nl_ops.\n\nThat is to say, the missing part in vdpa_nl_policy may lead to illegal\nnlattr after parsing, which could lead to OOB read just like CVE-2023-3773.\n\nThis patch adds the missing nla_policy for vdpa max vqp attr to avoid\nsuch bugs."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-19T12:17:44.717Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ff71709445ac033e6e250d971683110e4781c068"
},
{
"url": "https://git.kernel.org/stable/c/ea65e8b5e6b1a34deda7564f09c90e9e80db436a"
},
{
"url": "https://git.kernel.org/stable/c/5d6ba607d6cb5c58a4ddf33381e18c83dbb4098f"
}
],
"title": "vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53543",
"datePublished": "2025-10-04T15:16:52.114Z",
"dateReserved": "2025-10-04T15:14:15.920Z",
"dateUpdated": "2026-01-19T12:17:44.717Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-50494 (GCVE-0-2022-50494)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-12-23 13:29
VLAI?
EPSS
Title
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
Summary
In the Linux kernel, the following vulnerability has been resolved:
thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash
When CPU 0 is offline and intel_powerclamp is used to inject
idle, it generates kernel BUG:
BUG: using smp_processor_id() in preemptible [00000000] code: bash/15687
caller is debug_smp_processor_id+0x17/0x20
CPU: 4 PID: 15687 Comm: bash Not tainted 5.19.0-rc7+ #57
Call Trace:
<TASK>
dump_stack_lvl+0x49/0x63
dump_stack+0x10/0x16
check_preemption_disabled+0xdd/0xe0
debug_smp_processor_id+0x17/0x20
powerclamp_set_cur_state+0x7f/0xf9 [intel_powerclamp]
...
...
Here CPU 0 is the control CPU by default and changed to the current CPU,
if CPU 0 offlined. This check has to be performed under cpus_read_lock(),
hence the above warning.
Use get_cpu() instead of smp_processor_id() to avoid this BUG.
[ rjw: Subject edits ]
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 3e799e815097febbcb81b472285be824f5d089f9
(git)
Affected: d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 0f91f66c568b316b19cb042cf50584467b3bdff4 (git) Affected: d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 6904727db0eb62fb0c2dce1cf331c341d97ee4b7 (git) Affected: d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 5a646c38f648185ee2c62f2a19da3c6f04e27612 (git) Affected: d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 513943bf879d45005213e6f5cfb7d9e9943f589f (git) Affected: d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 5614908434451aafbf9b24cb5247cf1d21269f76 (git) Affected: d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 6e2a347b304224b2aeb1c0ea000d1cf8a02cc592 (git) Affected: d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 418fae0700e85a498062424f8656435c32cdb200 (git) Affected: d6d71ee4a14ae602db343ec48c491851d7ec5267 , < 68b99e94a4a2db6ba9b31fe0485e057b9354a640 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/thermal/intel/intel_powerclamp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3e799e815097febbcb81b472285be824f5d089f9",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
},
{
"lessThan": "0f91f66c568b316b19cb042cf50584467b3bdff4",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
},
{
"lessThan": "6904727db0eb62fb0c2dce1cf331c341d97ee4b7",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
},
{
"lessThan": "5a646c38f648185ee2c62f2a19da3c6f04e27612",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
},
{
"lessThan": "513943bf879d45005213e6f5cfb7d9e9943f589f",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
},
{
"lessThan": "5614908434451aafbf9b24cb5247cf1d21269f76",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
},
{
"lessThan": "6e2a347b304224b2aeb1c0ea000d1cf8a02cc592",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
},
{
"lessThan": "418fae0700e85a498062424f8656435c32cdb200",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
},
{
"lessThan": "68b99e94a4a2db6ba9b31fe0485e057b9354a640",
"status": "affected",
"version": "d6d71ee4a14ae602db343ec48c491851d7ec5267",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/thermal/intel/intel_powerclamp.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"lessThan": "3.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.331",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.296",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.262",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.331",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.296",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.262",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.220",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.150",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.75",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.17",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "3.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nthermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash\n\nWhen CPU 0 is offline and intel_powerclamp is used to inject\nidle, it generates kernel BUG:\n\nBUG: using smp_processor_id() in preemptible [00000000] code: bash/15687\ncaller is debug_smp_processor_id+0x17/0x20\nCPU: 4 PID: 15687 Comm: bash Not tainted 5.19.0-rc7+ #57\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x49/0x63\ndump_stack+0x10/0x16\ncheck_preemption_disabled+0xdd/0xe0\ndebug_smp_processor_id+0x17/0x20\npowerclamp_set_cur_state+0x7f/0xf9 [intel_powerclamp]\n...\n...\n\nHere CPU 0 is the control CPU by default and changed to the current CPU,\nif CPU 0 offlined. This check has to be performed under cpus_read_lock(),\nhence the above warning.\n\nUse get_cpu() instead of smp_processor_id() to avoid this BUG.\n\n[ rjw: Subject edits ]"
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T13:29:40.081Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3e799e815097febbcb81b472285be824f5d089f9"
},
{
"url": "https://git.kernel.org/stable/c/0f91f66c568b316b19cb042cf50584467b3bdff4"
},
{
"url": "https://git.kernel.org/stable/c/6904727db0eb62fb0c2dce1cf331c341d97ee4b7"
},
{
"url": "https://git.kernel.org/stable/c/5a646c38f648185ee2c62f2a19da3c6f04e27612"
},
{
"url": "https://git.kernel.org/stable/c/513943bf879d45005213e6f5cfb7d9e9943f589f"
},
{
"url": "https://git.kernel.org/stable/c/5614908434451aafbf9b24cb5247cf1d21269f76"
},
{
"url": "https://git.kernel.org/stable/c/6e2a347b304224b2aeb1c0ea000d1cf8a02cc592"
},
{
"url": "https://git.kernel.org/stable/c/418fae0700e85a498062424f8656435c32cdb200"
},
{
"url": "https://git.kernel.org/stable/c/68b99e94a4a2db6ba9b31fe0485e057b9354a640"
}
],
"title": "thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50494",
"datePublished": "2025-10-04T15:43:46.562Z",
"dateReserved": "2025-10-04T15:39:19.464Z",
"dateUpdated": "2025-12-23T13:29:40.081Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53558 (GCVE-0-2023-53558)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-29 10:50
VLAI?
EPSS
Title
rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()
Summary
In the Linux kernel, the following vulnerability has been resolved:
rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()
pr_info() is called with rtp->cbs_gbl_lock spin lock locked. Because
pr_info() calls printk() that might sleep, this will result in BUG
like below:
[ 0.206455] cblist_init_generic: Setting adjustable number of callback queues.
[ 0.206463]
[ 0.206464] =============================
[ 0.206464] [ BUG: Invalid wait context ]
[ 0.206465] 5.19.0-00428-g9de1f9c8ca51 #5 Not tainted
[ 0.206466] -----------------------------
[ 0.206466] swapper/0/1 is trying to lock:
[ 0.206467] ffffffffa0167a58 (&port_lock_key){....}-{3:3}, at: serial8250_console_write+0x327/0x4a0
[ 0.206473] other info that might help us debug this:
[ 0.206473] context-{5:5}
[ 0.206474] 3 locks held by swapper/0/1:
[ 0.206474] #0: ffffffff9eb597e0 (rcu_tasks.cbs_gbl_lock){....}-{2:2}, at: cblist_init_generic.constprop.0+0x14/0x1f0
[ 0.206478] #1: ffffffff9eb579c0 (console_lock){+.+.}-{0:0}, at: _printk+0x63/0x7e
[ 0.206482] #2: ffffffff9ea77780 (console_owner){....}-{0:0}, at: console_emit_next_record.constprop.0+0x111/0x330
[ 0.206485] stack backtrace:
[ 0.206486] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-00428-g9de1f9c8ca51 #5
[ 0.206488] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014
[ 0.206489] Call Trace:
[ 0.206490] <TASK>
[ 0.206491] dump_stack_lvl+0x6a/0x9f
[ 0.206493] __lock_acquire.cold+0x2d7/0x2fe
[ 0.206496] ? stack_trace_save+0x46/0x70
[ 0.206497] lock_acquire+0xd1/0x2f0
[ 0.206499] ? serial8250_console_write+0x327/0x4a0
[ 0.206500] ? __lock_acquire+0x5c7/0x2720
[ 0.206502] _raw_spin_lock_irqsave+0x3d/0x90
[ 0.206504] ? serial8250_console_write+0x327/0x4a0
[ 0.206506] serial8250_console_write+0x327/0x4a0
[ 0.206508] console_emit_next_record.constprop.0+0x180/0x330
[ 0.206511] console_unlock+0xf7/0x1f0
[ 0.206512] vprintk_emit+0xf7/0x330
[ 0.206514] _printk+0x63/0x7e
[ 0.206516] cblist_init_generic.constprop.0.cold+0x24/0x32
[ 0.206518] rcu_init_tasks_generic+0x5/0xd9
[ 0.206522] kernel_init_freeable+0x15b/0x2a2
[ 0.206523] ? rest_init+0x160/0x160
[ 0.206526] kernel_init+0x11/0x120
[ 0.206527] ret_from_fork+0x1f/0x30
[ 0.206530] </TASK>
[ 0.207018] cblist_init_generic: Setting shift to 1 and lim to 1.
This patch moves pr_info() so that it is called without
rtp->cbs_gbl_lock locked.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
ab97152f88a4d580b89f0b7cc3028ffac438216f , < 9027d69221ff96e1356f070f7feb2ff989ae7388
(git)
Affected: ab97152f88a4d580b89f0b7cc3028ffac438216f , < ea9b81c7d9104040b46a84d2303045de267f5557 (git) Affected: ab97152f88a4d580b89f0b7cc3028ffac438216f , < 5fc8cbe4cf0fd34ded8045c385790c3bf04f6785 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/rcu/tasks.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9027d69221ff96e1356f070f7feb2ff989ae7388",
"status": "affected",
"version": "ab97152f88a4d580b89f0b7cc3028ffac438216f",
"versionType": "git"
},
{
"lessThan": "ea9b81c7d9104040b46a84d2303045de267f5557",
"status": "affected",
"version": "ab97152f88a4d580b89f0b7cc3028ffac438216f",
"versionType": "git"
},
{
"lessThan": "5fc8cbe4cf0fd34ded8045c385790c3bf04f6785",
"status": "affected",
"version": "ab97152f88a4d580b89f0b7cc3028ffac438216f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/rcu/tasks.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.42",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.42",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.7",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()\n\npr_info() is called with rtp-\u003ecbs_gbl_lock spin lock locked. Because\npr_info() calls printk() that might sleep, this will result in BUG\nlike below:\n\n[ 0.206455] cblist_init_generic: Setting adjustable number of callback queues.\n[ 0.206463]\n[ 0.206464] =============================\n[ 0.206464] [ BUG: Invalid wait context ]\n[ 0.206465] 5.19.0-00428-g9de1f9c8ca51 #5 Not tainted\n[ 0.206466] -----------------------------\n[ 0.206466] swapper/0/1 is trying to lock:\n[ 0.206467] ffffffffa0167a58 (\u0026port_lock_key){....}-{3:3}, at: serial8250_console_write+0x327/0x4a0\n[ 0.206473] other info that might help us debug this:\n[ 0.206473] context-{5:5}\n[ 0.206474] 3 locks held by swapper/0/1:\n[ 0.206474] #0: ffffffff9eb597e0 (rcu_tasks.cbs_gbl_lock){....}-{2:2}, at: cblist_init_generic.constprop.0+0x14/0x1f0\n[ 0.206478] #1: ffffffff9eb579c0 (console_lock){+.+.}-{0:0}, at: _printk+0x63/0x7e\n[ 0.206482] #2: ffffffff9ea77780 (console_owner){....}-{0:0}, at: console_emit_next_record.constprop.0+0x111/0x330\n[ 0.206485] stack backtrace:\n[ 0.206486] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-00428-g9de1f9c8ca51 #5\n[ 0.206488] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-1.fc36 04/01/2014\n[ 0.206489] Call Trace:\n[ 0.206490] \u003cTASK\u003e\n[ 0.206491] dump_stack_lvl+0x6a/0x9f\n[ 0.206493] __lock_acquire.cold+0x2d7/0x2fe\n[ 0.206496] ? stack_trace_save+0x46/0x70\n[ 0.206497] lock_acquire+0xd1/0x2f0\n[ 0.206499] ? serial8250_console_write+0x327/0x4a0\n[ 0.206500] ? __lock_acquire+0x5c7/0x2720\n[ 0.206502] _raw_spin_lock_irqsave+0x3d/0x90\n[ 0.206504] ? serial8250_console_write+0x327/0x4a0\n[ 0.206506] serial8250_console_write+0x327/0x4a0\n[ 0.206508] console_emit_next_record.constprop.0+0x180/0x330\n[ 0.206511] console_unlock+0xf7/0x1f0\n[ 0.206512] vprintk_emit+0xf7/0x330\n[ 0.206514] _printk+0x63/0x7e\n[ 0.206516] cblist_init_generic.constprop.0.cold+0x24/0x32\n[ 0.206518] rcu_init_tasks_generic+0x5/0xd9\n[ 0.206522] kernel_init_freeable+0x15b/0x2a2\n[ 0.206523] ? rest_init+0x160/0x160\n[ 0.206526] kernel_init+0x11/0x120\n[ 0.206527] ret_from_fork+0x1f/0x30\n[ 0.206530] \u003c/TASK\u003e\n[ 0.207018] cblist_init_generic: Setting shift to 1 and lim to 1.\n\nThis patch moves pr_info() so that it is called without\nrtp-\u003ecbs_gbl_lock locked."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-29T10:50:31.749Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9027d69221ff96e1356f070f7feb2ff989ae7388"
},
{
"url": "https://git.kernel.org/stable/c/ea9b81c7d9104040b46a84d2303045de267f5557"
},
{
"url": "https://git.kernel.org/stable/c/5fc8cbe4cf0fd34ded8045c385790c3bf04f6785"
}
],
"title": "rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53558",
"datePublished": "2025-10-04T15:17:02.822Z",
"dateReserved": "2025-10-04T15:14:15.923Z",
"dateUpdated": "2025-10-29T10:50:31.749Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39949 (GCVE-0-2025-39949)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:37
VLAI?
EPSS
Title
qed: Don't collect too many protection override GRC elements
Summary
In the Linux kernel, the following vulnerability has been resolved:
qed: Don't collect too many protection override GRC elements
In the protection override dump path, the firmware can return far too
many GRC elements, resulting in attempting to write past the end of the
previously-kmalloc'ed dump buffer.
This will result in a kernel panic with reason:
BUG: unable to handle kernel paging request at ADDRESS
where "ADDRESS" is just past the end of the protection override dump
buffer. The start address of the buffer is:
p_hwfn->cdev->dbg_features[DBG_FEATURE_PROTECTION_OVERRIDE].dump_buf
and the size of the buffer is buf_size in the same data structure.
The panic can be arrived at from either the qede Ethernet driver path:
[exception RIP: qed_grc_dump_addr_range+0x108]
qed_protection_override_dump at ffffffffc02662ed [qed]
qed_dbg_protection_override_dump at ffffffffc0267792 [qed]
qed_dbg_feature at ffffffffc026aa8f [qed]
qed_dbg_all_data at ffffffffc026b211 [qed]
qed_fw_fatal_reporter_dump at ffffffffc027298a [qed]
devlink_health_do_dump at ffffffff82497f61
devlink_health_report at ffffffff8249cf29
qed_report_fatal_error at ffffffffc0272baf [qed]
qede_sp_task at ffffffffc045ed32 [qede]
process_one_work at ffffffff81d19783
or the qedf storage driver path:
[exception RIP: qed_grc_dump_addr_range+0x108]
qed_protection_override_dump at ffffffffc068b2ed [qed]
qed_dbg_protection_override_dump at ffffffffc068c792 [qed]
qed_dbg_feature at ffffffffc068fa8f [qed]
qed_dbg_all_data at ffffffffc0690211 [qed]
qed_fw_fatal_reporter_dump at ffffffffc069798a [qed]
devlink_health_do_dump at ffffffff8aa95e51
devlink_health_report at ffffffff8aa9ae19
qed_report_fatal_error at ffffffffc0697baf [qed]
qed_hw_err_notify at ffffffffc06d32d7 [qed]
qed_spq_post at ffffffffc06b1011 [qed]
qed_fcoe_destroy_conn at ffffffffc06b2e91 [qed]
qedf_cleanup_fcport at ffffffffc05e7597 [qedf]
qedf_rport_event_handler at ffffffffc05e7bf7 [qedf]
fc_rport_work at ffffffffc02da715 [libfc]
process_one_work at ffffffff8a319663
Resolve this by clamping the firmware's return value to the maximum
number of legal elements the firmware should return.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
d52c89f120de849575f6b2e5948038f2be12ce6f , < 25672c620421fa2105703a94a29a03487245e6d6
(git)
Affected: d52c89f120de849575f6b2e5948038f2be12ce6f , < e0e24571a7b2f8c8f06e25d3417253ebbdbc8d5c (git) Affected: d52c89f120de849575f6b2e5948038f2be12ce6f , < 8141910869596b7a3a5d9b46107da2191d523f82 (git) Affected: d52c89f120de849575f6b2e5948038f2be12ce6f , < ea53e6a47e148b490b1c652fc65d2de5a086df76 (git) Affected: d52c89f120de849575f6b2e5948038f2be12ce6f , < 660b2a8f5a306a28c7efc1b4990ecc4912a68f87 (git) Affected: d52c89f120de849575f6b2e5948038f2be12ce6f , < 70affe82e38fd3dc76b9c68b5a1989f11e7fa0f3 (git) Affected: d52c89f120de849575f6b2e5948038f2be12ce6f , < 56c0a2a9ddc2f5b5078c5fb0f81ab76bbc3d4c37 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qlogic/qed/qed_debug.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "25672c620421fa2105703a94a29a03487245e6d6",
"status": "affected",
"version": "d52c89f120de849575f6b2e5948038f2be12ce6f",
"versionType": "git"
},
{
"lessThan": "e0e24571a7b2f8c8f06e25d3417253ebbdbc8d5c",
"status": "affected",
"version": "d52c89f120de849575f6b2e5948038f2be12ce6f",
"versionType": "git"
},
{
"lessThan": "8141910869596b7a3a5d9b46107da2191d523f82",
"status": "affected",
"version": "d52c89f120de849575f6b2e5948038f2be12ce6f",
"versionType": "git"
},
{
"lessThan": "ea53e6a47e148b490b1c652fc65d2de5a086df76",
"status": "affected",
"version": "d52c89f120de849575f6b2e5948038f2be12ce6f",
"versionType": "git"
},
{
"lessThan": "660b2a8f5a306a28c7efc1b4990ecc4912a68f87",
"status": "affected",
"version": "d52c89f120de849575f6b2e5948038f2be12ce6f",
"versionType": "git"
},
{
"lessThan": "70affe82e38fd3dc76b9c68b5a1989f11e7fa0f3",
"status": "affected",
"version": "d52c89f120de849575f6b2e5948038f2be12ce6f",
"versionType": "git"
},
{
"lessThan": "56c0a2a9ddc2f5b5078c5fb0f81ab76bbc3d4c37",
"status": "affected",
"version": "d52c89f120de849575f6b2e5948038f2be12ce6f",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/qlogic/qed/qed_debug.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.245",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.245",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.194",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nqed: Don\u0027t collect too many protection override GRC elements\n\nIn the protection override dump path, the firmware can return far too\nmany GRC elements, resulting in attempting to write past the end of the\npreviously-kmalloc\u0027ed dump buffer.\n\nThis will result in a kernel panic with reason:\n\n BUG: unable to handle kernel paging request at ADDRESS\n\nwhere \"ADDRESS\" is just past the end of the protection override dump\nbuffer. The start address of the buffer is:\n p_hwfn-\u003ecdev-\u003edbg_features[DBG_FEATURE_PROTECTION_OVERRIDE].dump_buf\nand the size of the buffer is buf_size in the same data structure.\n\nThe panic can be arrived at from either the qede Ethernet driver path:\n\n [exception RIP: qed_grc_dump_addr_range+0x108]\n qed_protection_override_dump at ffffffffc02662ed [qed]\n qed_dbg_protection_override_dump at ffffffffc0267792 [qed]\n qed_dbg_feature at ffffffffc026aa8f [qed]\n qed_dbg_all_data at ffffffffc026b211 [qed]\n qed_fw_fatal_reporter_dump at ffffffffc027298a [qed]\n devlink_health_do_dump at ffffffff82497f61\n devlink_health_report at ffffffff8249cf29\n qed_report_fatal_error at ffffffffc0272baf [qed]\n qede_sp_task at ffffffffc045ed32 [qede]\n process_one_work at ffffffff81d19783\n\nor the qedf storage driver path:\n\n [exception RIP: qed_grc_dump_addr_range+0x108]\n qed_protection_override_dump at ffffffffc068b2ed [qed]\n qed_dbg_protection_override_dump at ffffffffc068c792 [qed]\n qed_dbg_feature at ffffffffc068fa8f [qed]\n qed_dbg_all_data at ffffffffc0690211 [qed]\n qed_fw_fatal_reporter_dump at ffffffffc069798a [qed]\n devlink_health_do_dump at ffffffff8aa95e51\n devlink_health_report at ffffffff8aa9ae19\n qed_report_fatal_error at ffffffffc0697baf [qed]\n qed_hw_err_notify at ffffffffc06d32d7 [qed]\n qed_spq_post at ffffffffc06b1011 [qed]\n qed_fcoe_destroy_conn at ffffffffc06b2e91 [qed]\n qedf_cleanup_fcport at ffffffffc05e7597 [qedf]\n qedf_rport_event_handler at ffffffffc05e7bf7 [qedf]\n fc_rport_work at ffffffffc02da715 [libfc]\n process_one_work at ffffffff8a319663\n\nResolve this by clamping the firmware\u0027s return value to the maximum\nnumber of legal elements the firmware should return."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:37:05.967Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/25672c620421fa2105703a94a29a03487245e6d6"
},
{
"url": "https://git.kernel.org/stable/c/e0e24571a7b2f8c8f06e25d3417253ebbdbc8d5c"
},
{
"url": "https://git.kernel.org/stable/c/8141910869596b7a3a5d9b46107da2191d523f82"
},
{
"url": "https://git.kernel.org/stable/c/ea53e6a47e148b490b1c652fc65d2de5a086df76"
},
{
"url": "https://git.kernel.org/stable/c/660b2a8f5a306a28c7efc1b4990ecc4912a68f87"
},
{
"url": "https://git.kernel.org/stable/c/70affe82e38fd3dc76b9c68b5a1989f11e7fa0f3"
},
{
"url": "https://git.kernel.org/stable/c/56c0a2a9ddc2f5b5078c5fb0f81ab76bbc3d4c37"
}
],
"title": "qed: Don\u0027t collect too many protection override GRC elements",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39949",
"datePublished": "2025-10-04T07:31:10.164Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:37:05.967Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53571 (GCVE-0-2023-53571)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
drm/i915: Make intel_get_crtc_new_encoder() less oopsy
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: Make intel_get_crtc_new_encoder() less oopsy
The point of the WARN was to print something, not oops
straight up. Currently that is precisely what happens
if we can't find the connector for the crtc in the atomic
state. Get the dev pointer from the atomic state instead
of the potentially NULL encoder to avoid that.
(cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c)
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
3a47ae201e074945bbde0b088e4c1215c07f4d75 , < 780f303233c35eeb5132e3ee1cbc8f4cebe86dd2
(git)
Affected: 3a47ae201e074945bbde0b088e4c1215c07f4d75 , < 54202488c835dab8c648acd107f0bb8eaa699894 (git) Affected: 3a47ae201e074945bbde0b088e4c1215c07f4d75 , < 0fe6ef82e4f4764e8f556632e4cd93d78d448e99 (git) Affected: 3a47ae201e074945bbde0b088e4c1215c07f4d75 , < 8cd725315c559a8a4d18ac1d7fce1d6b9a667529 (git) Affected: 3a47ae201e074945bbde0b088e4c1215c07f4d75 , < fd8b0abecdf66379e9d25d7448b942b5be379cb2 (git) Affected: 3a47ae201e074945bbde0b088e4c1215c07f4d75 , < 631420b06597a33c72b6dcef78d1c2dea17f452d (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_display.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "780f303233c35eeb5132e3ee1cbc8f4cebe86dd2",
"status": "affected",
"version": "3a47ae201e074945bbde0b088e4c1215c07f4d75",
"versionType": "git"
},
{
"lessThan": "54202488c835dab8c648acd107f0bb8eaa699894",
"status": "affected",
"version": "3a47ae201e074945bbde0b088e4c1215c07f4d75",
"versionType": "git"
},
{
"lessThan": "0fe6ef82e4f4764e8f556632e4cd93d78d448e99",
"status": "affected",
"version": "3a47ae201e074945bbde0b088e4c1215c07f4d75",
"versionType": "git"
},
{
"lessThan": "8cd725315c559a8a4d18ac1d7fce1d6b9a667529",
"status": "affected",
"version": "3a47ae201e074945bbde0b088e4c1215c07f4d75",
"versionType": "git"
},
{
"lessThan": "fd8b0abecdf66379e9d25d7448b942b5be379cb2",
"status": "affected",
"version": "3a47ae201e074945bbde0b088e4c1215c07f4d75",
"versionType": "git"
},
{
"lessThan": "631420b06597a33c72b6dcef78d1c2dea17f452d",
"status": "affected",
"version": "3a47ae201e074945bbde0b088e4c1215c07f4d75",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/display/intel_display.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: Make intel_get_crtc_new_encoder() less oopsy\n\nThe point of the WARN was to print something, not oops\nstraight up. Currently that is precisely what happens\nif we can\u0027t find the connector for the crtc in the atomic\nstate. Get the dev pointer from the atomic state instead\nof the potentially NULL encoder to avoid that.\n\n(cherry picked from commit 3b6692357f70498f617ea1b31a0378070a0acf1c)"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:12.304Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/780f303233c35eeb5132e3ee1cbc8f4cebe86dd2"
},
{
"url": "https://git.kernel.org/stable/c/54202488c835dab8c648acd107f0bb8eaa699894"
},
{
"url": "https://git.kernel.org/stable/c/0fe6ef82e4f4764e8f556632e4cd93d78d448e99"
},
{
"url": "https://git.kernel.org/stable/c/8cd725315c559a8a4d18ac1d7fce1d6b9a667529"
},
{
"url": "https://git.kernel.org/stable/c/fd8b0abecdf66379e9d25d7448b942b5be379cb2"
},
{
"url": "https://git.kernel.org/stable/c/631420b06597a33c72b6dcef78d1c2dea17f452d"
}
],
"title": "drm/i915: Make intel_get_crtc_new_encoder() less oopsy",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53571",
"datePublished": "2025-10-04T15:17:12.304Z",
"dateReserved": "2025-10-04T15:14:15.925Z",
"dateUpdated": "2025-10-04T15:17:12.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53573 (GCVE-0-2023-53573)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
clk: rs9: Fix suspend/resume
Summary
In the Linux kernel, the following vulnerability has been resolved:
clk: rs9: Fix suspend/resume
Disabling the cache in commit 2ff4ba9e3702 ("clk: rs9: Fix I2C accessors")
without removing cache synchronization in resume path results in a
kernel panic as map->cache_ops is unset, due to REGCACHE_NONE.
Enable flat cache again to support resume again. num_reg_defaults_raw
is necessary to read the cache defaults from hardware. Some registers
are strapped in hardware and cannot be provided in software.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
2ff4ba9e37024735f5cefc5ea2a73fc66addfe0e , < 74f4471ad64214dd5046213ebdd6e0930da7bd2c
(git)
Affected: 2ff4ba9e37024735f5cefc5ea2a73fc66addfe0e , < a983967602675880d6160a17ace2c0f48717ff33 (git) Affected: 2ff4ba9e37024735f5cefc5ea2a73fc66addfe0e , < 632e04739c8f45c2d9ca4d4c5bd18d80c2ac9296 (git) Affected: 94c9e0e11a53e18fcedbf4563ef04a07385b2c89 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-renesas-pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "74f4471ad64214dd5046213ebdd6e0930da7bd2c",
"status": "affected",
"version": "2ff4ba9e37024735f5cefc5ea2a73fc66addfe0e",
"versionType": "git"
},
{
"lessThan": "a983967602675880d6160a17ace2c0f48717ff33",
"status": "affected",
"version": "2ff4ba9e37024735f5cefc5ea2a73fc66addfe0e",
"versionType": "git"
},
{
"lessThan": "632e04739c8f45c2d9ca4d4c5bd18d80c2ac9296",
"status": "affected",
"version": "2ff4ba9e37024735f5cefc5ea2a73fc66addfe0e",
"versionType": "git"
},
{
"status": "affected",
"version": "94c9e0e11a53e18fcedbf4563ef04a07385b2c89",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/clk/clk-renesas-pcie.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.25",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.25",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.12",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nclk: rs9: Fix suspend/resume\n\nDisabling the cache in commit 2ff4ba9e3702 (\"clk: rs9: Fix I2C accessors\")\nwithout removing cache synchronization in resume path results in a\nkernel panic as map-\u003ecache_ops is unset, due to REGCACHE_NONE.\nEnable flat cache again to support resume again. num_reg_defaults_raw\nis necessary to read the cache defaults from hardware. Some registers\nare strapped in hardware and cannot be provided in software."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:13.872Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/74f4471ad64214dd5046213ebdd6e0930da7bd2c"
},
{
"url": "https://git.kernel.org/stable/c/a983967602675880d6160a17ace2c0f48717ff33"
},
{
"url": "https://git.kernel.org/stable/c/632e04739c8f45c2d9ca4d4c5bd18d80c2ac9296"
}
],
"title": "clk: rs9: Fix suspend/resume",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53573",
"datePublished": "2025-10-04T15:17:13.872Z",
"dateReserved": "2025-10-04T15:14:15.925Z",
"dateUpdated": "2025-10-04T15:17:13.872Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53575 (GCVE-0-2023-53575)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-06 09:07
VLAI?
EPSS
Title
wifi: iwlwifi: mvm: fix potential array out of bounds access
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: mvm: fix potential array out of bounds access
Account for IWL_SEC_WEP_KEY_OFFSET when needed while verifying
key_len size in iwl_mvm_sec_key_add().
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "133b1cd4d98bb8b272335c8e6b0e0c399c0b2ffa",
"status": "affected",
"version": "5c75a208c2449c6ea24f07610cc052f6a352246c",
"versionType": "git"
},
{
"lessThan": "637452360ecde9ac972d19416e9606529576b302",
"status": "affected",
"version": "5c75a208c2449c6ea24f07610cc052f6a352246c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/intel/iwlwifi/mvm/mld-key.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.7",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: iwlwifi: mvm: fix potential array out of bounds access\n\nAccount for IWL_SEC_WEP_KEY_OFFSET when needed while verifying\nkey_len size in iwl_mvm_sec_key_add()."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T09:07:19.662Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/133b1cd4d98bb8b272335c8e6b0e0c399c0b2ffa"
},
{
"url": "https://git.kernel.org/stable/c/637452360ecde9ac972d19416e9606529576b302"
}
],
"title": "wifi: iwlwifi: mvm: fix potential array out of bounds access",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53575",
"datePublished": "2025-10-04T15:17:15.224Z",
"dateReserved": "2025-10-04T15:14:15.925Z",
"dateUpdated": "2025-10-06T09:07:19.662Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50474 (GCVE-0-2022-50474)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
macintosh: fix possible memory leak in macio_add_one_device()
Summary
In the Linux kernel, the following vulnerability has been resolved:
macintosh: fix possible memory leak in macio_add_one_device()
Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's
bus_id string array"), the name of device is allocated dynamically. It
needs to be freed when of_device_register() fails. Call put_device() to
give up the reference that's taken in device_initialize(), so that it
can be freed in kobject_cleanup() when the refcount hits 0.
macio device is freed in macio_release_dev(), so the kfree() can be
removed.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
1fa5ae857bb14f6046205171d98506d8112dd74e , < 3a866ff6fc2232c8e393cdb55ffb8ce947349e03
(git)
Affected: 1fa5ae857bb14f6046205171d98506d8112dd74e , < aa9054267366ff0a382d403d17728e21951ddbb9 (git) Affected: 1fa5ae857bb14f6046205171d98506d8112dd74e , < 35858b87a943917fa30172aa4bf01ce7adbcb42c (git) Affected: 1fa5ae857bb14f6046205171d98506d8112dd74e , < b29a2f1dd33ae9b94821ab2f4d398b9081786748 (git) Affected: 1fa5ae857bb14f6046205171d98506d8112dd74e , < 2ac0a7059b7bcbed35bfffa34a82c9a9e99638ef (git) Affected: 1fa5ae857bb14f6046205171d98506d8112dd74e , < 19ded60b40e86b0903c8d5bd0161437ed5107a8b (git) Affected: 1fa5ae857bb14f6046205171d98506d8112dd74e , < ca765257feb89dacf604ced9cd233db5f865dee0 (git) Affected: 1fa5ae857bb14f6046205171d98506d8112dd74e , < 76837e7f6b30da72ad59f56291e22804a219e015 (git) Affected: 1fa5ae857bb14f6046205171d98506d8112dd74e , < 5ca86eae55a2f006e6c1edd2029b2cacb6979515 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/macintosh/macio_asic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3a866ff6fc2232c8e393cdb55ffb8ce947349e03",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
},
{
"lessThan": "aa9054267366ff0a382d403d17728e21951ddbb9",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
},
{
"lessThan": "35858b87a943917fa30172aa4bf01ce7adbcb42c",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
},
{
"lessThan": "b29a2f1dd33ae9b94821ab2f4d398b9081786748",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
},
{
"lessThan": "2ac0a7059b7bcbed35bfffa34a82c9a9e99638ef",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
},
{
"lessThan": "19ded60b40e86b0903c8d5bd0161437ed5107a8b",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
},
{
"lessThan": "ca765257feb89dacf604ced9cd233db5f865dee0",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
},
{
"lessThan": "76837e7f6b30da72ad59f56291e22804a219e015",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
},
{
"lessThan": "5ca86eae55a2f006e6c1edd2029b2cacb6979515",
"status": "affected",
"version": "1fa5ae857bb14f6046205171d98506d8112dd74e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/macintosh/macio_asic.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmacintosh: fix possible memory leak in macio_add_one_device()\n\nAfer commit 1fa5ae857bb1 (\"driver core: get rid of struct device\u0027s\nbus_id string array\"), the name of device is allocated dynamically. It\nneeds to be freed when of_device_register() fails. Call put_device() to\ngive up the reference that\u0027s taken in device_initialize(), so that it\ncan be freed in kobject_cleanup() when the refcount hits 0.\n\nmacio device is freed in macio_release_dev(), so the kfree() can be\nremoved."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:35.537Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3a866ff6fc2232c8e393cdb55ffb8ce947349e03"
},
{
"url": "https://git.kernel.org/stable/c/aa9054267366ff0a382d403d17728e21951ddbb9"
},
{
"url": "https://git.kernel.org/stable/c/35858b87a943917fa30172aa4bf01ce7adbcb42c"
},
{
"url": "https://git.kernel.org/stable/c/b29a2f1dd33ae9b94821ab2f4d398b9081786748"
},
{
"url": "https://git.kernel.org/stable/c/2ac0a7059b7bcbed35bfffa34a82c9a9e99638ef"
},
{
"url": "https://git.kernel.org/stable/c/19ded60b40e86b0903c8d5bd0161437ed5107a8b"
},
{
"url": "https://git.kernel.org/stable/c/ca765257feb89dacf604ced9cd233db5f865dee0"
},
{
"url": "https://git.kernel.org/stable/c/76837e7f6b30da72ad59f56291e22804a219e015"
},
{
"url": "https://git.kernel.org/stable/c/5ca86eae55a2f006e6c1edd2029b2cacb6979515"
}
],
"title": "macintosh: fix possible memory leak in macio_add_one_device()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50474",
"datePublished": "2025-10-04T15:16:35.537Z",
"dateReserved": "2025-10-04T15:13:33.467Z",
"dateUpdated": "2025-10-04T15:16:35.537Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53576 (GCVE-0-2023-53576)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
null_blk: Always check queue mode setting from configfs
Summary
In the Linux kernel, the following vulnerability has been resolved:
null_blk: Always check queue mode setting from configfs
Make sure to check device queue mode in the null_validate_conf() and
return error for NULL_Q_RQ as we don't allow legacy I/O path, without
this patch we get OOPs when queue mode is set to 1 from configfs,
following are repro steps :-
modprobe null_blk nr_devices=0
mkdir config/nullb/nullb0
echo 1 > config/nullb/nullb0/memory_backed
echo 4096 > config/nullb/nullb0/blocksize
echo 20480 > config/nullb/nullb0/size
echo 1 > config/nullb/nullb0/queue_mode
echo 1 > config/nullb/nullb0/power
Entering kdb (current=0xffff88810acdd080, pid 2372) on processor 42 Oops: (null)
due to oops @ 0xffffffffc041c329
CPU: 42 PID: 2372 Comm: sh Tainted: G O N 6.3.0-rc5lblk+ #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:null_add_dev.part.0+0xd9/0x720 [null_blk]
Code: 01 00 00 85 d2 0f 85 a1 03 00 00 48 83 bb 08 01 00 00 00 0f 85 f7 03 00 00 80 bb 62 01 00 00 00 48 8b 75 20 0f 85 6d 02 00 00 <48> 89 6e 60 48 8b 75 20 bf 06 00 00 00 e8 f5 37 2c c1 48 8b 75 20
RSP: 0018:ffffc900052cbde0 EFLAGS: 00010246
RAX: 0000000000000001 RBX: ffff88811084d800 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888100042e00
RBP: ffff8881053d8200 R08: ffffc900052cbd68 R09: ffff888105db2000
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002
R13: ffff888104765200 R14: ffff88810eec1748 R15: ffff88810eec1740
FS: 00007fd445fd1740(0000) GS:ffff8897dfc80000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000060 CR3: 0000000166a00000 CR4: 0000000000350ee0
DR0: ffffffff8437a488 DR1: ffffffff8437a489 DR2: ffffffff8437a48a
DR3: ffffffff8437a48b DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
nullb_device_power_store+0xd1/0x120 [null_blk]
configfs_write_iter+0xb4/0x120
vfs_write+0x2ba/0x3c0
ksys_write+0x5f/0xe0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
RIP: 0033:0x7fd4460c57a7
Code: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24
RSP: 002b:00007ffd3792a4a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd4460c57a7
RDX: 0000000000000002 RSI: 000055b43c02e4c0 RDI: 0000000000000001
RBP: 000055b43c02e4c0 R08: 000000000000000a R09: 00007fd44615b4e0
R10: 00007fd44615b3e0 R11: 0000000000000246 R12: 0000000000000002
R13: 00007fd446198520 R14: 0000000000000002 R15: 00007fd446198700
</TASK>
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
e50b1e327aeb4b224364aa6f85c1713ff8b3654b , < e732a266b973cd4e115e2cc2ea5007119e8a7fbc
(git)
Affected: e50b1e327aeb4b224364aa6f85c1713ff8b3654b , < 35e304dbcefa95237a3d6f94c007bfb10f012b17 (git) Affected: e50b1e327aeb4b224364aa6f85c1713ff8b3654b , < fd35b7bb6d5a329c427924886949ab51f210200a (git) Affected: e50b1e327aeb4b224364aa6f85c1713ff8b3654b , < 651260e563d9f50827dac496dc8a0b9b23d5db1a (git) Affected: e50b1e327aeb4b224364aa6f85c1713ff8b3654b , < 63f8793ee60513a09f110ea460a6ff2c33811cdb (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/block/null_blk/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e732a266b973cd4e115e2cc2ea5007119e8a7fbc",
"status": "affected",
"version": "e50b1e327aeb4b224364aa6f85c1713ff8b3654b",
"versionType": "git"
},
{
"lessThan": "35e304dbcefa95237a3d6f94c007bfb10f012b17",
"status": "affected",
"version": "e50b1e327aeb4b224364aa6f85c1713ff8b3654b",
"versionType": "git"
},
{
"lessThan": "fd35b7bb6d5a329c427924886949ab51f210200a",
"status": "affected",
"version": "e50b1e327aeb4b224364aa6f85c1713ff8b3654b",
"versionType": "git"
},
{
"lessThan": "651260e563d9f50827dac496dc8a0b9b23d5db1a",
"status": "affected",
"version": "e50b1e327aeb4b224364aa6f85c1713ff8b3654b",
"versionType": "git"
},
{
"lessThan": "63f8793ee60513a09f110ea460a6ff2c33811cdb",
"status": "affected",
"version": "e50b1e327aeb4b224364aa6f85c1713ff8b3654b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/block/null_blk/main.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.181",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.113",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.181",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.113",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.30",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnull_blk: Always check queue mode setting from configfs\n\nMake sure to check device queue mode in the null_validate_conf() and\nreturn error for NULL_Q_RQ as we don\u0027t allow legacy I/O path, without\nthis patch we get OOPs when queue mode is set to 1 from configfs,\nfollowing are repro steps :-\n\nmodprobe null_blk nr_devices=0\nmkdir config/nullb/nullb0\necho 1 \u003e config/nullb/nullb0/memory_backed\necho 4096 \u003e config/nullb/nullb0/blocksize\necho 20480 \u003e config/nullb/nullb0/size\necho 1 \u003e config/nullb/nullb0/queue_mode\necho 1 \u003e config/nullb/nullb0/power\n\nEntering kdb (current=0xffff88810acdd080, pid 2372) on processor 42 Oops: (null)\ndue to oops @ 0xffffffffc041c329\nCPU: 42 PID: 2372 Comm: sh Tainted: G O N 6.3.0-rc5lblk+ #5\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\nRIP: 0010:null_add_dev.part.0+0xd9/0x720 [null_blk]\nCode: 01 00 00 85 d2 0f 85 a1 03 00 00 48 83 bb 08 01 00 00 00 0f 85 f7 03 00 00 80 bb 62 01 00 00 00 48 8b 75 20 0f 85 6d 02 00 00 \u003c48\u003e 89 6e 60 48 8b 75 20 bf 06 00 00 00 e8 f5 37 2c c1 48 8b 75 20\nRSP: 0018:ffffc900052cbde0 EFLAGS: 00010246\nRAX: 0000000000000001 RBX: ffff88811084d800 RCX: 0000000000000001\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888100042e00\nRBP: ffff8881053d8200 R08: ffffc900052cbd68 R09: ffff888105db2000\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000002\nR13: ffff888104765200 R14: ffff88810eec1748 R15: ffff88810eec1740\nFS: 00007fd445fd1740(0000) GS:ffff8897dfc80000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000000000000060 CR3: 0000000166a00000 CR4: 0000000000350ee0\nDR0: ffffffff8437a488 DR1: ffffffff8437a489 DR2: ffffffff8437a48a\nDR3: ffffffff8437a48b DR6: 00000000ffff0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n nullb_device_power_store+0xd1/0x120 [null_blk]\n configfs_write_iter+0xb4/0x120\n vfs_write+0x2ba/0x3c0\n ksys_write+0x5f/0xe0\n do_syscall_64+0x3b/0x90\n entry_SYSCALL_64_after_hwframe+0x72/0xdc\nRIP: 0033:0x7fd4460c57a7\nCode: 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 01 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 48 89 54 24 18 48 89 74 24\nRSP: 002b:00007ffd3792a4a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000000000000002 RCX: 00007fd4460c57a7\nRDX: 0000000000000002 RSI: 000055b43c02e4c0 RDI: 0000000000000001\nRBP: 000055b43c02e4c0 R08: 000000000000000a R09: 00007fd44615b4e0\nR10: 00007fd44615b3e0 R11: 0000000000000246 R12: 0000000000000002\nR13: 00007fd446198520 R14: 0000000000000002 R15: 00007fd446198700\n \u003c/TASK\u003e"
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:22.694Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e732a266b973cd4e115e2cc2ea5007119e8a7fbc"
},
{
"url": "https://git.kernel.org/stable/c/35e304dbcefa95237a3d6f94c007bfb10f012b17"
},
{
"url": "https://git.kernel.org/stable/c/fd35b7bb6d5a329c427924886949ab51f210200a"
},
{
"url": "https://git.kernel.org/stable/c/651260e563d9f50827dac496dc8a0b9b23d5db1a"
},
{
"url": "https://git.kernel.org/stable/c/63f8793ee60513a09f110ea460a6ff2c33811cdb"
}
],
"title": "null_blk: Always check queue mode setting from configfs",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53576",
"datePublished": "2025-10-04T15:17:15.931Z",
"dateReserved": "2025-10-04T15:14:15.925Z",
"dateUpdated": "2026-01-05T10:21:22.694Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-39929 (GCVE-0-2025-39929)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2025-10-04 07:30
VLAI?
EPSS
Title
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path
During tests of another unrelated patch I was able to trigger this
error: Objects remaining on __kmem_cache_shutdown()
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
f198186aa9bbd60fae7a2061f4feec614d880299 , < 3d7c075c878ac844e33c43e506c2fa27ac7e9689
(git)
Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < e7b7a93879558e77d950f1ff9a6f3daa385b33df (git) Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < 922338efaad63cfe30d459dfc59f9d69ff93ded4 (git) Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < 0991418bf98f191d0c320bd25245fcffa1998c7e (git) Affected: f198186aa9bbd60fae7a2061f4feec614d880299 , < daac51c7032036a0ca5f1aa419ad1b0471d1c6e0 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smbdirect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3d7c075c878ac844e33c43e506c2fa27ac7e9689",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "e7b7a93879558e77d950f1ff9a6f3daa385b33df",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "922338efaad63cfe30d459dfc59f9d69ff93ded4",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "0991418bf98f191d0c320bd25245fcffa1998c7e",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "daac51c7032036a0ca5f1aa419ad1b0471d1c6e0",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smbdirect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path\n\nDuring tests of another unrelated patch I was able to trigger this\nerror: Objects remaining on __kmem_cache_shutdown()"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:30:55.153Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3d7c075c878ac844e33c43e506c2fa27ac7e9689"
},
{
"url": "https://git.kernel.org/stable/c/e7b7a93879558e77d950f1ff9a6f3daa385b33df"
},
{
"url": "https://git.kernel.org/stable/c/922338efaad63cfe30d459dfc59f9d69ff93ded4"
},
{
"url": "https://git.kernel.org/stable/c/0991418bf98f191d0c320bd25245fcffa1998c7e"
},
{
"url": "https://git.kernel.org/stable/c/daac51c7032036a0ca5f1aa419ad1b0471d1c6e0"
}
],
"title": "smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39929",
"datePublished": "2025-10-04T07:30:55.153Z",
"dateReserved": "2025-04-16T07:20:57.147Z",
"dateUpdated": "2025-10-04T07:30:55.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53608 (GCVE-0-2023-53608)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
Summary
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()
The finalization of nilfs_segctor_thread() can race with
nilfs_segctor_kill_thread() which terminates that thread, potentially
causing a use-after-free BUG as KASAN detected.
At the end of nilfs_segctor_thread(), it assigns NULL to "sc_task" member
of "struct nilfs_sc_info" to indicate the thread has finished, and then
notifies nilfs_segctor_kill_thread() of this using waitqueue
"sc_wait_task" on the struct nilfs_sc_info.
However, here, immediately after the NULL assignment to "sc_task", it is
possible that nilfs_segctor_kill_thread() will detect it and return to
continue the deallocation, freeing the nilfs_sc_info structure before the
thread does the notification.
This fixes the issue by protecting the NULL assignment to "sc_task" and
its notification, with spinlock "sc_state_lock" of the struct
nilfs_sc_info. Since nilfs_segctor_kill_thread() does a final check to
see if "sc_task" is NULL with "sc_state_lock" locked, this can eliminate
the race.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 , < 034cce77d52ba013ce62b4f5258c29907eb1ada5
(git)
Affected: 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 , < 0dbf0e64b91ee8fcb278aea93eb06fc7d56ecbcc (git) Affected: 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 , < 613bf23c070d11c525268f2945aa594704a9b764 (git) Affected: 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 , < f32297dba338dc06d62286dedb3cdbd5175b1719 (git) Affected: 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 , < 92684e02654c91a61a0b0561433b710bcece19fe (git) Affected: 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 , < bae009a2f1b7c2011d2e92d8c84868d315c0b97e (git) Affected: 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 , < b4d80bd6370b81a1725b6b8f7894802c23a14e9f (git) Affected: 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 , < 6be49d100c22ffea3287a4b19d7639d259888e33 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nilfs2/segment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "034cce77d52ba013ce62b4f5258c29907eb1ada5",
"status": "affected",
"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453",
"versionType": "git"
},
{
"lessThan": "0dbf0e64b91ee8fcb278aea93eb06fc7d56ecbcc",
"status": "affected",
"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453",
"versionType": "git"
},
{
"lessThan": "613bf23c070d11c525268f2945aa594704a9b764",
"status": "affected",
"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453",
"versionType": "git"
},
{
"lessThan": "f32297dba338dc06d62286dedb3cdbd5175b1719",
"status": "affected",
"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453",
"versionType": "git"
},
{
"lessThan": "92684e02654c91a61a0b0561433b710bcece19fe",
"status": "affected",
"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453",
"versionType": "git"
},
{
"lessThan": "bae009a2f1b7c2011d2e92d8c84868d315c0b97e",
"status": "affected",
"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453",
"versionType": "git"
},
{
"lessThan": "b4d80bd6370b81a1725b6b8f7894802c23a14e9f",
"status": "affected",
"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453",
"versionType": "git"
},
{
"lessThan": "6be49d100c22ffea3287a4b19d7639d259888e33",
"status": "affected",
"version": "9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nilfs2/segment.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.313",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.281",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.241",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.107",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.24",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.313",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.281",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.241",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.178",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.107",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.24",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.11",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()\n\nThe finalization of nilfs_segctor_thread() can race with\nnilfs_segctor_kill_thread() which terminates that thread, potentially\ncausing a use-after-free BUG as KASAN detected.\n\nAt the end of nilfs_segctor_thread(), it assigns NULL to \"sc_task\" member\nof \"struct nilfs_sc_info\" to indicate the thread has finished, and then\nnotifies nilfs_segctor_kill_thread() of this using waitqueue\n\"sc_wait_task\" on the struct nilfs_sc_info.\n\nHowever, here, immediately after the NULL assignment to \"sc_task\", it is\npossible that nilfs_segctor_kill_thread() will detect it and return to\ncontinue the deallocation, freeing the nilfs_sc_info structure before the\nthread does the notification.\n\nThis fixes the issue by protecting the NULL assignment to \"sc_task\" and\nits notification, with spinlock \"sc_state_lock\" of the struct\nnilfs_sc_info. Since nilfs_segctor_kill_thread() does a final check to\nsee if \"sc_task\" is NULL with \"sc_state_lock\" locked, this can eliminate\nthe race."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:29.974Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/034cce77d52ba013ce62b4f5258c29907eb1ada5"
},
{
"url": "https://git.kernel.org/stable/c/0dbf0e64b91ee8fcb278aea93eb06fc7d56ecbcc"
},
{
"url": "https://git.kernel.org/stable/c/613bf23c070d11c525268f2945aa594704a9b764"
},
{
"url": "https://git.kernel.org/stable/c/f32297dba338dc06d62286dedb3cdbd5175b1719"
},
{
"url": "https://git.kernel.org/stable/c/92684e02654c91a61a0b0561433b710bcece19fe"
},
{
"url": "https://git.kernel.org/stable/c/bae009a2f1b7c2011d2e92d8c84868d315c0b97e"
},
{
"url": "https://git.kernel.org/stable/c/b4d80bd6370b81a1725b6b8f7894802c23a14e9f"
},
{
"url": "https://git.kernel.org/stable/c/6be49d100c22ffea3287a4b19d7639d259888e33"
}
],
"title": "nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53608",
"datePublished": "2025-10-04T15:44:17.302Z",
"dateReserved": "2025-10-04T15:40:38.480Z",
"dateUpdated": "2026-01-05T10:21:29.974Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53565 (GCVE-0-2023-53565)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
wifi: brcmfmac: Check for probe() id argument being NULL
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: brcmfmac: Check for probe() id argument being NULL
The probe() id argument may be NULL in 2 scenarios:
1. brcmf_pcie_pm_leave_D3() calling brcmf_pcie_probe() to reprobe
the device.
2. If a user tries to manually bind the driver from sysfs then the sdio /
pcie / usb probe() function gets called with NULL as id argument.
1. Is being hit by users causing the following oops on resume and causing
wifi to stop working:
BUG: kernel NULL pointer dereference, address: 0000000000000018
<snip>
Hardware name: Dell Inc. XPS 13 9350/0PWNCR, BIDS 1.13.0 02/10/2020
Workgueue: events_unbound async_run_entry_fn
RIP: 0010:brcmf_pcie_probe+Ox16b/0x7a0 [brcmfmac]
<snip>
Call Trace:
<TASK>
brcmf_pcie_pm_leave_D3+0xc5/8x1a0 [brcmfmac be3b4cefca451e190fa35be8f00db1bbec293887]
? pci_pm_resume+0x5b/0xf0
? pci_legacy_resume+0x80/0x80
dpm_run_callback+0x47/0x150
device_resume+0xa2/0x1f0
async_resume+0x1d/0x30
<snip>
Fix this by checking for id being NULL.
In the PCI and USB cases try a manual lookup of the id so that manually
binding the driver through sysfs and more importantly brcmf_pcie_probe()
on resume will work.
For the SDIO case there is no helper to do a manual sdio_device_id lookup,
so just directly error out on a NULL id there.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "84766e77a5c35e2b60e34f570c62fc97adc05e09",
"status": "affected",
"version": "da6d9c8ecd00e20218461007948f2b0a8e7fa242",
"versionType": "git"
},
{
"lessThan": "60fc756fc8e6954a5618eecac73b255d651602e4",
"status": "affected",
"version": "da6d9c8ecd00e20218461007948f2b0a8e7fa242",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c",
"drivers/net/wireless/broadcom/brcm80211/brcmfmac/usb.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: brcmfmac: Check for probe() id argument being NULL\n\nThe probe() id argument may be NULL in 2 scenarios:\n\n1. brcmf_pcie_pm_leave_D3() calling brcmf_pcie_probe() to reprobe\n the device.\n\n2. If a user tries to manually bind the driver from sysfs then the sdio /\n pcie / usb probe() function gets called with NULL as id argument.\n\n1. Is being hit by users causing the following oops on resume and causing\nwifi to stop working:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000018\n\u003csnip\u003e\nHardware name: Dell Inc. XPS 13 9350/0PWNCR, BIDS 1.13.0 02/10/2020\nWorkgueue: events_unbound async_run_entry_fn\nRIP: 0010:brcmf_pcie_probe+Ox16b/0x7a0 [brcmfmac]\n\u003csnip\u003e\nCall Trace:\n \u003cTASK\u003e\n brcmf_pcie_pm_leave_D3+0xc5/8x1a0 [brcmfmac be3b4cefca451e190fa35be8f00db1bbec293887]\n ? pci_pm_resume+0x5b/0xf0\n ? pci_legacy_resume+0x80/0x80\n dpm_run_callback+0x47/0x150\n device_resume+0xa2/0x1f0\n async_resume+0x1d/0x30\n\u003csnip\u003e\n\nFix this by checking for id being NULL.\n\nIn the PCI and USB cases try a manual lookup of the id so that manually\nbinding the driver through sysfs and more importantly brcmf_pcie_probe()\non resume will work.\n\nFor the SDIO case there is no helper to do a manual sdio_device_id lookup,\nso just directly error out on a NULL id there."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:07.921Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/84766e77a5c35e2b60e34f570c62fc97adc05e09"
},
{
"url": "https://git.kernel.org/stable/c/60fc756fc8e6954a5618eecac73b255d651602e4"
}
],
"title": "wifi: brcmfmac: Check for probe() id argument being NULL",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53565",
"datePublished": "2025-10-04T15:17:07.921Z",
"dateReserved": "2025-10-04T15:14:15.924Z",
"dateUpdated": "2025-10-04T15:17:07.921Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50478 (GCVE-0-2022-50478)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-12-23 13:29
VLAI?
EPSS
Title
nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
Summary
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()
Patch series "nilfs2: fix UBSAN shift-out-of-bounds warnings on mount
time".
The first patch fixes a bug reported by syzbot, and the second one fixes
the remaining bug of the same kind. Although they are triggered by the
same super block data anomaly, I divided it into the above two because the
details of the issues and how to fix it are different.
Both are required to eliminate the shift-out-of-bounds issues at mount
time.
This patch (of 2):
If the block size exponent information written in an on-disk superblock is
corrupted, nilfs_sb2_bad_offset helper function can trigger
shift-out-of-bounds warning followed by a kernel panic (if panic_on_warn
is set):
shift exponent 38983 is too large for 64-bit type 'unsigned long long'
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106
ubsan_epilogue lib/ubsan.c:151 [inline]
__ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322
nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline]
nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523
init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577
nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047
nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317
...
In addition, since nilfs_sb2_bad_offset() performs multiplication without
considering the upper bound, the computation may overflow if the disk
layout parameters are not normal.
This fixes these issues by inserting preliminary sanity checks for those
parameters and by converting the comparison from one involving
multiplication and left bit-shifting to one using division and right
bit-shifting.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 6b0ea3df56cccd53398d0289f399f19d43136b2e
(git)
Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < a6f89b10042baca218c8598d6db5a44c7e32625f (git) Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 9b3ba54025357440d6c4414c670984f628c6f6bf (git) Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < d706485dffbbbf848e681edda29c7a46ac55698c (git) Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < d464b035c0613856d012cf1704879d3ff3f057fb (git) Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a (git) Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 1012ff77284e3bec0ec0a35a820b03ec43dec2cc (git) Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 62d11ec205ef14d8acf172cfc9904fdbf200025a (git) Affected: e339ad31f59925b48a92ee3947692fdf9758b8c7 , < 610a2a3d7d8be3537458a378ec69396a76c385b6 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/nilfs2/the_nilfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b0ea3df56cccd53398d0289f399f19d43136b2e",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
},
{
"lessThan": "a6f89b10042baca218c8598d6db5a44c7e32625f",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
},
{
"lessThan": "9b3ba54025357440d6c4414c670984f628c6f6bf",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
},
{
"lessThan": "d706485dffbbbf848e681edda29c7a46ac55698c",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
},
{
"lessThan": "d464b035c0613856d012cf1704879d3ff3f057fb",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
},
{
"lessThan": "b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
},
{
"lessThan": "1012ff77284e3bec0ec0a35a820b03ec43dec2cc",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
},
{
"lessThan": "62d11ec205ef14d8acf172cfc9904fdbf200025a",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
},
{
"lessThan": "610a2a3d7d8be3537458a378ec69396a76c385b6",
"status": "affected",
"version": "e339ad31f59925b48a92ee3947692fdf9758b8c7",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/nilfs2/the_nilfs.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.30"
},
{
"lessThan": "2.6.30",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "2.6.30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "2.6.30",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()\n\nPatch series \"nilfs2: fix UBSAN shift-out-of-bounds warnings on mount\ntime\".\n\nThe first patch fixes a bug reported by syzbot, and the second one fixes\nthe remaining bug of the same kind. Although they are triggered by the\nsame super block data anomaly, I divided it into the above two because the\ndetails of the issues and how to fix it are different.\n\nBoth are required to eliminate the shift-out-of-bounds issues at mount\ntime.\n\n\nThis patch (of 2):\n\nIf the block size exponent information written in an on-disk superblock is\ncorrupted, nilfs_sb2_bad_offset helper function can trigger\nshift-out-of-bounds warning followed by a kernel panic (if panic_on_warn\nis set):\n\n shift exponent 38983 is too large for 64-bit type \u0027unsigned long long\u0027\n Call Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:88 [inline]\n dump_stack_lvl+0x1b1/0x28e lib/dump_stack.c:106\n ubsan_epilogue lib/ubsan.c:151 [inline]\n __ubsan_handle_shift_out_of_bounds+0x33d/0x3b0 lib/ubsan.c:322\n nilfs_sb2_bad_offset fs/nilfs2/the_nilfs.c:449 [inline]\n nilfs_load_super_block+0xdf5/0xe00 fs/nilfs2/the_nilfs.c:523\n init_nilfs+0xb7/0x7d0 fs/nilfs2/the_nilfs.c:577\n nilfs_fill_super+0xb1/0x5d0 fs/nilfs2/super.c:1047\n nilfs_mount+0x613/0x9b0 fs/nilfs2/super.c:1317\n ...\n\nIn addition, since nilfs_sb2_bad_offset() performs multiplication without\nconsidering the upper bound, the computation may overflow if the disk\nlayout parameters are not normal.\n\nThis fixes these issues by inserting preliminary sanity checks for those\nparameters and by converting the comparison from one involving\nmultiplication and left bit-shifting to one using division and right\nbit-shifting."
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T13:29:34.027Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b0ea3df56cccd53398d0289f399f19d43136b2e"
},
{
"url": "https://git.kernel.org/stable/c/a6f89b10042baca218c8598d6db5a44c7e32625f"
},
{
"url": "https://git.kernel.org/stable/c/9b3ba54025357440d6c4414c670984f628c6f6bf"
},
{
"url": "https://git.kernel.org/stable/c/d706485dffbbbf848e681edda29c7a46ac55698c"
},
{
"url": "https://git.kernel.org/stable/c/d464b035c0613856d012cf1704879d3ff3f057fb"
},
{
"url": "https://git.kernel.org/stable/c/b47f5c579c8186f7f5ab5e4254e0734ea5b7bf7a"
},
{
"url": "https://git.kernel.org/stable/c/1012ff77284e3bec0ec0a35a820b03ec43dec2cc"
},
{
"url": "https://git.kernel.org/stable/c/62d11ec205ef14d8acf172cfc9904fdbf200025a"
},
{
"url": "https://git.kernel.org/stable/c/610a2a3d7d8be3537458a378ec69396a76c385b6"
}
],
"title": "nilfs2: fix shift-out-of-bounds/overflow in nilfs_sb2_bad_offset()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50478",
"datePublished": "2025-10-04T15:16:38.346Z",
"dateReserved": "2025-10-04T15:13:33.467Z",
"dateUpdated": "2025-12-23T13:29:34.027Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53605 (GCVE-0-2023-53605)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-06 09:07
VLAI?
EPSS
Title
drm: amd: display: Fix memory leakage
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm: amd: display: Fix memory leakage
This commit fixes memory leakage in dc_construct_ctx() function.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < d473c55ce1975c9e601c25293328a5039225d2b2
(git)
Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 9ae15ebaefc4878d614f10cc56ea672f88cea582 (git) Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 83ace0dd67ee386be1ddcf59dab49d6d9a54e62e (git) Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 1bdea8ee92a6abc650b2189fd5c53f36859baecb (git) Affected: 4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c , < 6b8701be1f66064ca72733c5f6e13748cdbf8397 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "d473c55ce1975c9e601c25293328a5039225d2b2",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "9ae15ebaefc4878d614f10cc56ea672f88cea582",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "83ace0dd67ee386be1ddcf59dab49d6d9a54e62e",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "1bdea8ee92a6abc650b2189fd5c53f36859baecb",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
},
{
"lessThan": "6b8701be1f66064ca72733c5f6e13748cdbf8397",
"status": "affected",
"version": "4562236b3bc0a28aeb6ee93b2d8a849a4c4e1c7c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/amd/display/dc/core/dc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.15"
},
{
"lessThan": "4.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "4.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "4.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm: amd: display: Fix memory leakage\n\nThis commit fixes memory leakage in dc_construct_ctx() function."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-06T09:07:22.038Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/d473c55ce1975c9e601c25293328a5039225d2b2"
},
{
"url": "https://git.kernel.org/stable/c/9ae15ebaefc4878d614f10cc56ea672f88cea582"
},
{
"url": "https://git.kernel.org/stable/c/83ace0dd67ee386be1ddcf59dab49d6d9a54e62e"
},
{
"url": "https://git.kernel.org/stable/c/1bdea8ee92a6abc650b2189fd5c53f36859baecb"
},
{
"url": "https://git.kernel.org/stable/c/6b8701be1f66064ca72733c5f6e13748cdbf8397"
}
],
"title": "drm: amd: display: Fix memory leakage",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53605",
"datePublished": "2025-10-04T15:44:15.231Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-06T09:07:22.038Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50491 (GCVE-0-2022-50491)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
coresight: cti: Fix hang in cti_disable_hw()
Summary
In the Linux kernel, the following vulnerability has been resolved:
coresight: cti: Fix hang in cti_disable_hw()
cti_enable_hw() and cti_disable_hw() are called from an atomic context
so shouldn't use runtime PM because it can result in a sleep when
communicating with firmware.
Since commit 3c6656337852 ("Revert "firmware: arm_scmi: Add clock
management to the SCMI power domain""), this causes a hang on Juno when
running the Perf Coresight tests or running this command:
perf record -e cs_etm//u -- ls
This was also missed until the revert commit because pm_runtime_put()
was called with the wrong device until commit 692c9a499b28 ("coresight:
cti: Correct the parameter for pm_runtime_put")
With lock and scheduler debugging enabled the following is output:
coresight cti_sys0: cti_enable_hw -- dev:cti_sys0 parent: 20020000.cti
BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1151
in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 330, name: perf-exec
preempt_count: 2, expected: 0
RCU nest depth: 0, expected: 0
INFO: lockdep is turned off.
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [<ffff80000822b394>] copy_process+0xa0c/0x1948
softirqs last enabled at (0): [<ffff80000822b394>] copy_process+0xa0c/0x1948
softirqs last disabled at (0): [<0000000000000000>] 0x0
CPU: 3 PID: 330 Comm: perf-exec Not tainted 6.0.0-00053-g042116d99298 #7
Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Sep 13 2022
Call trace:
dump_backtrace+0x134/0x140
show_stack+0x20/0x58
dump_stack_lvl+0x8c/0xb8
dump_stack+0x18/0x34
__might_resched+0x180/0x228
__might_sleep+0x50/0x88
__pm_runtime_resume+0xac/0xb0
cti_enable+0x44/0x120
coresight_control_assoc_ectdev+0xc0/0x150
coresight_enable_path+0xb4/0x288
etm_event_start+0x138/0x170
etm_event_add+0x48/0x70
event_sched_in.isra.122+0xb4/0x280
merge_sched_in+0x1fc/0x3d0
visit_groups_merge.constprop.137+0x16c/0x4b0
ctx_sched_in+0x114/0x1f0
perf_event_sched_in+0x60/0x90
ctx_resched+0x68/0xb0
perf_event_exec+0x138/0x508
begin_new_exec+0x52c/0xd40
load_elf_binary+0x6b8/0x17d0
bprm_execve+0x360/0x7f8
do_execveat_common.isra.47+0x218/0x238
__arm64_sys_execve+0x48/0x60
invoke_syscall+0x4c/0x110
el0_svc_common.constprop.4+0xfc/0x120
do_el0_svc+0x34/0xc0
el0_svc+0x40/0x98
el0t_64_sync_handler+0x98/0xc0
el0t_64_sync+0x170/0x174
Fix the issue by removing the runtime PM calls completely. They are not
needed here because it must have already been done when building the
path for a trace.
[ Fix build warnings ]
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
835d722ba10ac924adba1e8a46f2d80955222b4b , < e33ce54cef5d429430e3b1ae5c8ee4f4103c4fdc
(git)
Affected: 835d722ba10ac924adba1e8a46f2d80955222b4b , < 4c365a0c21aaf2b8fcc88de8dc298803288f61ac (git) Affected: 835d722ba10ac924adba1e8a46f2d80955222b4b , < c51cfba50df8b9e16bfe0e6d4f2f252a4a10063d (git) Affected: 835d722ba10ac924adba1e8a46f2d80955222b4b , < 6746eae4bbaddcc16b40efb33dab79210828b3ce (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-cti-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "e33ce54cef5d429430e3b1ae5c8ee4f4103c4fdc",
"status": "affected",
"version": "835d722ba10ac924adba1e8a46f2d80955222b4b",
"versionType": "git"
},
{
"lessThan": "4c365a0c21aaf2b8fcc88de8dc298803288f61ac",
"status": "affected",
"version": "835d722ba10ac924adba1e8a46f2d80955222b4b",
"versionType": "git"
},
{
"lessThan": "c51cfba50df8b9e16bfe0e6d4f2f252a4a10063d",
"status": "affected",
"version": "835d722ba10ac924adba1e8a46f2d80955222b4b",
"versionType": "git"
},
{
"lessThan": "6746eae4bbaddcc16b40efb33dab79210828b3ce",
"status": "affected",
"version": "835d722ba10ac924adba1e8a46f2d80955222b4b",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/hwtracing/coresight/coresight-cti-core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.77",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.7",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.154",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.77",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.7",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: cti: Fix hang in cti_disable_hw()\n\ncti_enable_hw() and cti_disable_hw() are called from an atomic context\nso shouldn\u0027t use runtime PM because it can result in a sleep when\ncommunicating with firmware.\n\nSince commit 3c6656337852 (\"Revert \"firmware: arm_scmi: Add clock\nmanagement to the SCMI power domain\"\"), this causes a hang on Juno when\nrunning the Perf Coresight tests or running this command:\n\n perf record -e cs_etm//u -- ls\n\nThis was also missed until the revert commit because pm_runtime_put()\nwas called with the wrong device until commit 692c9a499b28 (\"coresight:\ncti: Correct the parameter for pm_runtime_put\")\n\nWith lock and scheduler debugging enabled the following is output:\n\n coresight cti_sys0: cti_enable_hw -- dev:cti_sys0 parent: 20020000.cti\n BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1151\n in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 330, name: perf-exec\n preempt_count: 2, expected: 0\n RCU nest depth: 0, expected: 0\n INFO: lockdep is turned off.\n irq event stamp: 0\n hardirqs last enabled at (0): [\u003c0000000000000000\u003e] 0x0\n hardirqs last disabled at (0): [\u003cffff80000822b394\u003e] copy_process+0xa0c/0x1948\n softirqs last enabled at (0): [\u003cffff80000822b394\u003e] copy_process+0xa0c/0x1948\n softirqs last disabled at (0): [\u003c0000000000000000\u003e] 0x0\n CPU: 3 PID: 330 Comm: perf-exec Not tainted 6.0.0-00053-g042116d99298 #7\n Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Sep 13 2022\n Call trace:\n dump_backtrace+0x134/0x140\n show_stack+0x20/0x58\n dump_stack_lvl+0x8c/0xb8\n dump_stack+0x18/0x34\n __might_resched+0x180/0x228\n __might_sleep+0x50/0x88\n __pm_runtime_resume+0xac/0xb0\n cti_enable+0x44/0x120\n coresight_control_assoc_ectdev+0xc0/0x150\n coresight_enable_path+0xb4/0x288\n etm_event_start+0x138/0x170\n etm_event_add+0x48/0x70\n event_sched_in.isra.122+0xb4/0x280\n merge_sched_in+0x1fc/0x3d0\n visit_groups_merge.constprop.137+0x16c/0x4b0\n ctx_sched_in+0x114/0x1f0\n perf_event_sched_in+0x60/0x90\n ctx_resched+0x68/0xb0\n perf_event_exec+0x138/0x508\n begin_new_exec+0x52c/0xd40\n load_elf_binary+0x6b8/0x17d0\n bprm_execve+0x360/0x7f8\n do_execveat_common.isra.47+0x218/0x238\n __arm64_sys_execve+0x48/0x60\n invoke_syscall+0x4c/0x110\n el0_svc_common.constprop.4+0xfc/0x120\n do_el0_svc+0x34/0xc0\n el0_svc+0x40/0x98\n el0t_64_sync_handler+0x98/0xc0\n el0t_64_sync+0x170/0x174\n\nFix the issue by removing the runtime PM calls completely. They are not\nneeded here because it must have already been done when building the\npath for a trace.\n\n[ Fix build warnings ]"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:44.470Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/e33ce54cef5d429430e3b1ae5c8ee4f4103c4fdc"
},
{
"url": "https://git.kernel.org/stable/c/4c365a0c21aaf2b8fcc88de8dc298803288f61ac"
},
{
"url": "https://git.kernel.org/stable/c/c51cfba50df8b9e16bfe0e6d4f2f252a4a10063d"
},
{
"url": "https://git.kernel.org/stable/c/6746eae4bbaddcc16b40efb33dab79210828b3ce"
}
],
"title": "coresight: cti: Fix hang in cti_disable_hw()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50491",
"datePublished": "2025-10-04T15:43:44.470Z",
"dateReserved": "2025-10-04T15:39:19.463Z",
"dateUpdated": "2025-10-04T15:43:44.470Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50503 (GCVE-0-2022-50503)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
mtd: lpddr2_nvm: Fix possible null-ptr-deref
Summary
In the Linux kernel, the following vulnerability has been resolved:
mtd: lpddr2_nvm: Fix possible null-ptr-deref
It will cause null-ptr-deref when resource_size(add_range) invoked,
if platform_get_resource() returns NULL.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < 4d10bd7416e8383340b5524b8d616b8ad01ef1e1
(git)
Affected: 96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < bb9ccb6121ec4140d366147aa866ceb5a21a8d3d (git) Affected: 96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < e6aafb57d90ff2c1e18554f3a3c36247a59825ce (git) Affected: 96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < 8eb64dc5a790a529ef49ec94b3337af09dac15d3 (git) Affected: 96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < 0919982a1744346269320615615c7deb14106661 (git) Affected: 96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < e0d3e46ac6669cdf1b99bc7b7d92f1221b9a1ff2 (git) Affected: 96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < f82f63b3911f1b2da68a14d9c4babf3b55feca55 (git) Affected: 96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < c4cc41e94d8357f5f02b8ef40257bb23931d8438 (git) Affected: 96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25 , < 6bdd45d795adf9e73b38ced5e7f750cd199499ff (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/mtd/lpddr/lpddr2_nvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4d10bd7416e8383340b5524b8d616b8ad01ef1e1",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
},
{
"lessThan": "bb9ccb6121ec4140d366147aa866ceb5a21a8d3d",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
},
{
"lessThan": "e6aafb57d90ff2c1e18554f3a3c36247a59825ce",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
},
{
"lessThan": "8eb64dc5a790a529ef49ec94b3337af09dac15d3",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
},
{
"lessThan": "0919982a1744346269320615615c7deb14106661",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
},
{
"lessThan": "e0d3e46ac6669cdf1b99bc7b7d92f1221b9a1ff2",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
},
{
"lessThan": "f82f63b3911f1b2da68a14d9c4babf3b55feca55",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
},
{
"lessThan": "c4cc41e94d8357f5f02b8ef40257bb23931d8438",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
},
{
"lessThan": "6bdd45d795adf9e73b38ced5e7f750cd199499ff",
"status": "affected",
"version": "96ba9dd65788a0bd2a7d1e57ec78b7642f0ccc25",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/mtd/lpddr/lpddr2_nvm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.16"
},
{
"lessThan": "3.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "3.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "3.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmtd: lpddr2_nvm: Fix possible null-ptr-deref\n\nIt will cause null-ptr-deref when resource_size(add_range) invoked,\nif platform_get_resource() returns NULL."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:52.845Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4d10bd7416e8383340b5524b8d616b8ad01ef1e1"
},
{
"url": "https://git.kernel.org/stable/c/bb9ccb6121ec4140d366147aa866ceb5a21a8d3d"
},
{
"url": "https://git.kernel.org/stable/c/e6aafb57d90ff2c1e18554f3a3c36247a59825ce"
},
{
"url": "https://git.kernel.org/stable/c/8eb64dc5a790a529ef49ec94b3337af09dac15d3"
},
{
"url": "https://git.kernel.org/stable/c/0919982a1744346269320615615c7deb14106661"
},
{
"url": "https://git.kernel.org/stable/c/e0d3e46ac6669cdf1b99bc7b7d92f1221b9a1ff2"
},
{
"url": "https://git.kernel.org/stable/c/f82f63b3911f1b2da68a14d9c4babf3b55feca55"
},
{
"url": "https://git.kernel.org/stable/c/c4cc41e94d8357f5f02b8ef40257bb23931d8438"
},
{
"url": "https://git.kernel.org/stable/c/6bdd45d795adf9e73b38ced5e7f750cd199499ff"
}
],
"title": "mtd: lpddr2_nvm: Fix possible null-ptr-deref",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50503",
"datePublished": "2025-10-04T15:43:52.845Z",
"dateReserved": "2025-10-04T15:39:19.465Z",
"dateUpdated": "2025-10-04T15:43:52.845Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39952 (GCVE-0-2025-39952)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2026-01-02 15:32
VLAI?
EPSS
Title
wifi: wilc1000: avoid buffer overflow in WID string configuration
Summary
In the Linux kernel, the following vulnerability has been resolved:
wifi: wilc1000: avoid buffer overflow in WID string configuration
Fix the following copy overflow warning identified by Smatch checker.
drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()
error: '__memcpy()' 'cfg->s[i]->str' copy overflow (512 vs 65537)
This patch introduces size check before accessing the memory buffer.
The checks are base on the WID type of received data from the firmware.
For WID string configuration, the size limit is determined by individual
element size in 'struct wilc_cfg_str_vals' that is maintained in 'len' field
of 'struct wilc_cfg_str'.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
c5c77ba18ea66aa05441c71e38473efb787705a4 , < 6085291a1a5865d4ad70f0e5812d524ebd5d1711
(git)
Affected: c5c77ba18ea66aa05441c71e38473efb787705a4 , < 2203ef417044b10a8563ade6a17c74183745d72e (git) Affected: c5c77ba18ea66aa05441c71e38473efb787705a4 , < ae50f8562306a7ea1cf3c9722f97ee244f974729 (git) Affected: c5c77ba18ea66aa05441c71e38473efb787705a4 , < fe9e4d0c39311d0f97b024147a0d155333f388b5 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/wlan_cfg.c",
"drivers/net/wireless/microchip/wilc1000/wlan_cfg.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6085291a1a5865d4ad70f0e5812d524ebd5d1711",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "2203ef417044b10a8563ade6a17c74183745d72e",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "ae50f8562306a7ea1cf3c9722f97ee244f974729",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
},
{
"lessThan": "fe9e4d0c39311d0f97b024147a0d155333f388b5",
"status": "affected",
"version": "c5c77ba18ea66aa05441c71e38473efb787705a4",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wireless/microchip/wilc1000/wlan_cfg.c",
"drivers/net/wireless/microchip/wilc1000/wlan_cfg.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.2"
},
{
"lessThan": "4.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "4.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwifi: wilc1000: avoid buffer overflow in WID string configuration\n\nFix the following copy overflow warning identified by Smatch checker.\n\n drivers/net/wireless/microchip/wilc1000/wlan_cfg.c:184 wilc_wlan_parse_response_frame()\n error: \u0027__memcpy()\u0027 \u0027cfg-\u003es[i]-\u003estr\u0027 copy overflow (512 vs 65537)\n\nThis patch introduces size check before accessing the memory buffer.\nThe checks are base on the WID type of received data from the firmware.\nFor WID string configuration, the size limit is determined by individual\nelement size in \u0027struct wilc_cfg_str_vals\u0027 that is maintained in \u0027len\u0027 field\nof \u0027struct wilc_cfg_str\u0027."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-02T15:32:43.137Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6085291a1a5865d4ad70f0e5812d524ebd5d1711"
},
{
"url": "https://git.kernel.org/stable/c/2203ef417044b10a8563ade6a17c74183745d72e"
},
{
"url": "https://git.kernel.org/stable/c/ae50f8562306a7ea1cf3c9722f97ee244f974729"
},
{
"url": "https://git.kernel.org/stable/c/fe9e4d0c39311d0f97b024147a0d155333f388b5"
}
],
"title": "wifi: wilc1000: avoid buffer overflow in WID string configuration",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39952",
"datePublished": "2025-10-04T07:31:12.445Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2026-01-02T15:32:43.137Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53593 (GCVE-0-2023-53593)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2026-01-05 10:21
VLAI?
EPSS
Title
cifs: Release folio lock on fscache read hit.
Summary
In the Linux kernel, the following vulnerability has been resolved:
cifs: Release folio lock on fscache read hit.
Under the current code, when cifs_readpage_worker is called, the call
contract is that the callee should unlock the page. This is documented
in the read_folio section of Documentation/filesystems/vfs.rst as:
> The filesystem should unlock the folio once the read has completed,
> whether it was successful or not.
Without this change, when fscache is in use and cache hit occurs during
a read, the page lock is leaked, producing the following stack on
subsequent reads (via mmap) to the page:
$ cat /proc/3890/task/12864/stack
[<0>] folio_wait_bit_common+0x124/0x350
[<0>] filemap_read_folio+0xad/0xf0
[<0>] filemap_fault+0x8b1/0xab0
[<0>] __do_fault+0x39/0x150
[<0>] do_fault+0x25c/0x3e0
[<0>] __handle_mm_fault+0x6ca/0xc70
[<0>] handle_mm_fault+0xe9/0x350
[<0>] do_user_addr_fault+0x225/0x6c0
[<0>] exc_page_fault+0x84/0x1b0
[<0>] asm_exc_page_fault+0x27/0x30
This requires a reboot to resolve; it is a deadlock.
Note however that the call to cifs_readpage_from_fscache does mark the
page clean, but does not free the folio lock. This happens in
__cifs_readpage_from_fscache on success. Releasing the lock at that
point however is not appropriate as cifs_readahead also calls
cifs_readpage_from_fscache and *does* unconditionally release the lock
after its return. This change therefore effectively makes
cifs_readpage_worker work like cifs_readahead.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
0174ee9947bd0f24fee2794b35258960d108b7aa , < 9e725386d4262ef23ae51993f04602bc535b5be2
(git)
Affected: 0174ee9947bd0f24fee2794b35258960d108b7aa , < 7a9fb689c1a1dc373887621a3bfa3810df0abde4 (git) Affected: 0174ee9947bd0f24fee2794b35258960d108b7aa , < 69513dd669e243928f7450893190915a88f84a2b (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "9e725386d4262ef23ae51993f04602bc535b5be2",
"status": "affected",
"version": "0174ee9947bd0f24fee2794b35258960d108b7aa",
"versionType": "git"
},
{
"lessThan": "7a9fb689c1a1dc373887621a3bfa3810df0abde4",
"status": "affected",
"version": "0174ee9947bd0f24fee2794b35258960d108b7aa",
"versionType": "git"
},
{
"lessThan": "69513dd669e243928f7450893190915a88f84a2b",
"status": "affected",
"version": "0174ee9947bd0f24fee2794b35258960d108b7aa",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/file.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"lessThan": "5.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.47",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.12",
"versionStartIncluding": "5.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "5.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncifs: Release folio lock on fscache read hit.\n\nUnder the current code, when cifs_readpage_worker is called, the call\ncontract is that the callee should unlock the page. This is documented\nin the read_folio section of Documentation/filesystems/vfs.rst as:\n\n\u003e The filesystem should unlock the folio once the read has completed,\n\u003e whether it was successful or not.\n\nWithout this change, when fscache is in use and cache hit occurs during\na read, the page lock is leaked, producing the following stack on\nsubsequent reads (via mmap) to the page:\n\n$ cat /proc/3890/task/12864/stack\n[\u003c0\u003e] folio_wait_bit_common+0x124/0x350\n[\u003c0\u003e] filemap_read_folio+0xad/0xf0\n[\u003c0\u003e] filemap_fault+0x8b1/0xab0\n[\u003c0\u003e] __do_fault+0x39/0x150\n[\u003c0\u003e] do_fault+0x25c/0x3e0\n[\u003c0\u003e] __handle_mm_fault+0x6ca/0xc70\n[\u003c0\u003e] handle_mm_fault+0xe9/0x350\n[\u003c0\u003e] do_user_addr_fault+0x225/0x6c0\n[\u003c0\u003e] exc_page_fault+0x84/0x1b0\n[\u003c0\u003e] asm_exc_page_fault+0x27/0x30\n\nThis requires a reboot to resolve; it is a deadlock.\n\nNote however that the call to cifs_readpage_from_fscache does mark the\npage clean, but does not free the folio lock. This happens in\n__cifs_readpage_from_fscache on success. Releasing the lock at that\npoint however is not appropriate as cifs_readahead also calls\ncifs_readpage_from_fscache and *does* unconditionally release the lock\nafter its return. This change therefore effectively makes\ncifs_readpage_worker work like cifs_readahead."
}
],
"providerMetadata": {
"dateUpdated": "2026-01-05T10:21:27.106Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/9e725386d4262ef23ae51993f04602bc535b5be2"
},
{
"url": "https://git.kernel.org/stable/c/7a9fb689c1a1dc373887621a3bfa3810df0abde4"
},
{
"url": "https://git.kernel.org/stable/c/69513dd669e243928f7450893190915a88f84a2b"
}
],
"title": "cifs: Release folio lock on fscache read hit.",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53593",
"datePublished": "2025-10-04T15:44:06.853Z",
"dateReserved": "2025-10-04T15:40:38.478Z",
"dateUpdated": "2026-01-05T10:21:27.106Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2022-50504 (GCVE-0-2022-50504)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-12-23 13:29
VLAI?
EPSS
Title
powerpc/rtas: avoid scheduling in rtas_os_term()
Summary
In the Linux kernel, the following vulnerability has been resolved:
powerpc/rtas: avoid scheduling in rtas_os_term()
It's unsafe to use rtas_busy_delay() to handle a busy status from
the ibm,os-term RTAS function in rtas_os_term():
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0
preempt_count: 2, expected: 0
CPU: 7 PID: 1 Comm: swapper/0 Tainted: G D 6.0.0-rc5-02182-gf8553a572277-dirty #9
Call Trace:
[c000000007b8f000] [c000000001337110] dump_stack_lvl+0xb4/0x110 (unreliable)
[c000000007b8f040] [c0000000002440e4] __might_resched+0x394/0x3c0
[c000000007b8f0e0] [c00000000004f680] rtas_busy_delay+0x120/0x1b0
[c000000007b8f100] [c000000000052d04] rtas_os_term+0xb8/0xf4
[c000000007b8f180] [c0000000001150fc] pseries_panic+0x50/0x68
[c000000007b8f1f0] [c000000000036354] ppc_panic_platform_handler+0x34/0x50
[c000000007b8f210] [c0000000002303c4] notifier_call_chain+0xd4/0x1c0
[c000000007b8f2b0] [c0000000002306cc] atomic_notifier_call_chain+0xac/0x1c0
[c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0
[c000000007b8f390] [c0000000001e573c] do_exit+0x140c/0x1420
[c000000007b8f480] [c0000000001e586c] make_task_dead+0xdc/0x200
Use rtas_busy_delay_time() instead, which signals without side effects
whether to attempt the ibm,os-term RTAS call again.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
507279db1819aacf4022e790b3fc8bc8cf56debf , < f413135b337c4e90c1e593c6613f8717e17bc724
(git)
Affected: 507279db1819aacf4022e790b3fc8bc8cf56debf , < 4768935b8cc2d2afeb7956292df0f6e2c49ca0a5 (git) Affected: 507279db1819aacf4022e790b3fc8bc8cf56debf , < ffa991a003abb4f8cb9e5004646bfe2d9a46912c (git) Affected: 507279db1819aacf4022e790b3fc8bc8cf56debf , < 515959eb49e6d218a46979d66f36fdef329ac7d2 (git) Affected: 507279db1819aacf4022e790b3fc8bc8cf56debf , < 6f7e2fcab73372a371ab4017cbedf7a71f4f9b40 (git) Affected: 507279db1819aacf4022e790b3fc8bc8cf56debf , < 7280fdb80bf0fe35d9b799fc7009f2cbe0a397d7 (git) Affected: 507279db1819aacf4022e790b3fc8bc8cf56debf , < bed48651c87bef59ea1a9d6dbc381bcbc452f4ff (git) Affected: 507279db1819aacf4022e790b3fc8bc8cf56debf , < 482d990a5dd1027ee0b70a8a570d56749cac8103 (git) Affected: 507279db1819aacf4022e790b3fc8bc8cf56debf , < 6c606e57eecc37d6b36d732b1ff7e55b7dc32dd4 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/powerpc/kernel/rtas.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f413135b337c4e90c1e593c6613f8717e17bc724",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
},
{
"lessThan": "4768935b8cc2d2afeb7956292df0f6e2c49ca0a5",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
},
{
"lessThan": "ffa991a003abb4f8cb9e5004646bfe2d9a46912c",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
},
{
"lessThan": "515959eb49e6d218a46979d66f36fdef329ac7d2",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
},
{
"lessThan": "6f7e2fcab73372a371ab4017cbedf7a71f4f9b40",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
},
{
"lessThan": "7280fdb80bf0fe35d9b799fc7009f2cbe0a397d7",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
},
{
"lessThan": "bed48651c87bef59ea1a9d6dbc381bcbc452f4ff",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
},
{
"lessThan": "482d990a5dd1027ee0b70a8a570d56749cac8103",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
},
{
"lessThan": "6c606e57eecc37d6b36d732b1ff7e55b7dc32dd4",
"status": "affected",
"version": "507279db1819aacf4022e790b3fc8bc8cf56debf",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/powerpc/kernel/rtas.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.18"
},
{
"lessThan": "2.6.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.87",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.87",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.17",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.3",
"versionStartIncluding": "2.6.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "2.6.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\npowerpc/rtas: avoid scheduling in rtas_os_term()\n\nIt\u0027s unsafe to use rtas_busy_delay() to handle a busy status from\nthe ibm,os-term RTAS function in rtas_os_term():\n\nKernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b\nBUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618\nin_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0\npreempt_count: 2, expected: 0\nCPU: 7 PID: 1 Comm: swapper/0 Tainted: G D 6.0.0-rc5-02182-gf8553a572277-dirty #9\nCall Trace:\n[c000000007b8f000] [c000000001337110] dump_stack_lvl+0xb4/0x110 (unreliable)\n[c000000007b8f040] [c0000000002440e4] __might_resched+0x394/0x3c0\n[c000000007b8f0e0] [c00000000004f680] rtas_busy_delay+0x120/0x1b0\n[c000000007b8f100] [c000000000052d04] rtas_os_term+0xb8/0xf4\n[c000000007b8f180] [c0000000001150fc] pseries_panic+0x50/0x68\n[c000000007b8f1f0] [c000000000036354] ppc_panic_platform_handler+0x34/0x50\n[c000000007b8f210] [c0000000002303c4] notifier_call_chain+0xd4/0x1c0\n[c000000007b8f2b0] [c0000000002306cc] atomic_notifier_call_chain+0xac/0x1c0\n[c000000007b8f2f0] [c0000000001d62b8] panic+0x228/0x4d0\n[c000000007b8f390] [c0000000001e573c] do_exit+0x140c/0x1420\n[c000000007b8f480] [c0000000001e586c] make_task_dead+0xdc/0x200\n\nUse rtas_busy_delay_time() instead, which signals without side effects\nwhether to attempt the ibm,os-term RTAS call again."
}
],
"providerMetadata": {
"dateUpdated": "2025-12-23T13:29:42.710Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f413135b337c4e90c1e593c6613f8717e17bc724"
},
{
"url": "https://git.kernel.org/stable/c/4768935b8cc2d2afeb7956292df0f6e2c49ca0a5"
},
{
"url": "https://git.kernel.org/stable/c/ffa991a003abb4f8cb9e5004646bfe2d9a46912c"
},
{
"url": "https://git.kernel.org/stable/c/515959eb49e6d218a46979d66f36fdef329ac7d2"
},
{
"url": "https://git.kernel.org/stable/c/6f7e2fcab73372a371ab4017cbedf7a71f4f9b40"
},
{
"url": "https://git.kernel.org/stable/c/7280fdb80bf0fe35d9b799fc7009f2cbe0a397d7"
},
{
"url": "https://git.kernel.org/stable/c/bed48651c87bef59ea1a9d6dbc381bcbc452f4ff"
},
{
"url": "https://git.kernel.org/stable/c/482d990a5dd1027ee0b70a8a570d56749cac8103"
},
{
"url": "https://git.kernel.org/stable/c/6c606e57eecc37d6b36d732b1ff7e55b7dc32dd4"
}
],
"title": "powerpc/rtas: avoid scheduling in rtas_os_term()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50504",
"datePublished": "2025-10-04T15:43:53.523Z",
"dateReserved": "2025-10-04T15:39:19.465Z",
"dateUpdated": "2025-12-23T13:29:42.710Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2023-53595 (GCVE-0-2023-53595)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
octeontx2-pf: mcs: Fix NULL pointer dereferences
Summary
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: mcs: Fix NULL pointer dereferences
When system is rebooted after creating macsec interface
below NULL pointer dereference crashes occurred. This
patch fixes those crashes by using correct order of teardown
[ 3324.406942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 3324.415726] Mem abort info:
[ 3324.418510] ESR = 0x96000006
[ 3324.421557] EC = 0x25: DABT (current EL), IL = 32 bits
[ 3324.426865] SET = 0, FnV = 0
[ 3324.429913] EA = 0, S1PTW = 0
[ 3324.433047] Data abort info:
[ 3324.435921] ISV = 0, ISS = 0x00000006
[ 3324.439748] CM = 0, WnR = 0
....
[ 3324.575915] Call trace:
[ 3324.578353] cn10k_mdo_del_secy+0x24/0x180
[ 3324.582440] macsec_common_dellink+0xec/0x120
[ 3324.586788] macsec_notify+0x17c/0x1c0
[ 3324.590529] raw_notifier_call_chain+0x50/0x70
[ 3324.594965] call_netdevice_notifiers_info+0x34/0x7c
[ 3324.599921] rollback_registered_many+0x354/0x5bc
[ 3324.604616] unregister_netdevice_queue+0x88/0x10c
[ 3324.609399] unregister_netdev+0x20/0x30
[ 3324.613313] otx2_remove+0x8c/0x310
[ 3324.616794] pci_device_shutdown+0x30/0x70
[ 3324.620882] device_shutdown+0x11c/0x204
[ 966.664930] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 966.673712] Mem abort info:
[ 966.676497] ESR = 0x96000006
[ 966.679543] EC = 0x25: DABT (current EL), IL = 32 bits
[ 966.684848] SET = 0, FnV = 0
[ 966.687895] EA = 0, S1PTW = 0
[ 966.691028] Data abort info:
[ 966.693900] ISV = 0, ISS = 0x00000006
[ 966.697729] CM = 0, WnR = 0
[ 966.833467] Call trace:
[ 966.835904] cn10k_mdo_stop+0x20/0xa0
[ 966.839557] macsec_dev_stop+0xe8/0x11c
[ 966.843384] __dev_close_many+0xbc/0x140
[ 966.847298] dev_close_many+0x84/0x120
[ 966.851039] rollback_registered_many+0x114/0x5bc
[ 966.855735] unregister_netdevice_many.part.0+0x14/0xa0
[ 966.860952] unregister_netdevice_many+0x18/0x24
[ 966.865560] macsec_notify+0x1ac/0x1c0
[ 966.869303] raw_notifier_call_chain+0x50/0x70
[ 966.873738] call_netdevice_notifiers_info+0x34/0x7c
[ 966.878694] rollback_registered_many+0x354/0x5bc
[ 966.883390] unregister_netdevice_queue+0x88/0x10c
[ 966.888173] unregister_netdev+0x20/0x30
[ 966.892090] otx2_remove+0x8c/0x310
[ 966.895571] pci_device_shutdown+0x30/0x70
[ 966.899660] device_shutdown+0x11c/0x204
[ 966.903574] __do_sys_reboot+0x208/0x290
[ 966.907487] __arm64_sys_reboot+0x20/0x30
[ 966.911489] el0_svc_handler+0x80/0x1c0
[ 966.915316] el0_svc+0x8/0x180
[ 966.918362] Code: f9400000 f9400a64 91220014 f94b3403 (f9400060)
[ 966.924448] ---[ end trace 341778e799c3d8d7 ]---
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
c54ffc73601c0a239e55911923a6e23a2a74f143 , < a3dcc45eca017fca82ac47dbde6f41af960657e5
(git)
Affected: c54ffc73601c0a239e55911923a6e23a2a74f143 , < 1152c0f947b76e7731e039185cbd00fdb4389f00 (git) Affected: c54ffc73601c0a239e55911923a6e23a2a74f143 , < 13ff119b17e5e2916435ce01a0156c8698ad9e16 (git) Affected: c54ffc73601c0a239e55911923a6e23a2a74f143 , < 699af748c61574125d269db260dabbe20436d74e (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a3dcc45eca017fca82ac47dbde6f41af960657e5",
"status": "affected",
"version": "c54ffc73601c0a239e55911923a6e23a2a74f143",
"versionType": "git"
},
{
"lessThan": "1152c0f947b76e7731e039185cbd00fdb4389f00",
"status": "affected",
"version": "c54ffc73601c0a239e55911923a6e23a2a74f143",
"versionType": "git"
},
{
"lessThan": "13ff119b17e5e2916435ce01a0156c8698ad9e16",
"status": "affected",
"version": "c54ffc73601c0a239e55911923a6e23a2a74f143",
"versionType": "git"
},
{
"lessThan": "699af748c61574125d269db260dabbe20436d74e",
"status": "affected",
"version": "c54ffc73601c0a239e55911923a6e23a2a74f143",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.29",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.29",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.16",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.3",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocteontx2-pf: mcs: Fix NULL pointer dereferences\n\nWhen system is rebooted after creating macsec interface\nbelow NULL pointer dereference crashes occurred. This\npatch fixes those crashes by using correct order of teardown\n\n[ 3324.406942] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[ 3324.415726] Mem abort info:\n[ 3324.418510] ESR = 0x96000006\n[ 3324.421557] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 3324.426865] SET = 0, FnV = 0\n[ 3324.429913] EA = 0, S1PTW = 0\n[ 3324.433047] Data abort info:\n[ 3324.435921] ISV = 0, ISS = 0x00000006\n[ 3324.439748] CM = 0, WnR = 0\n....\n[ 3324.575915] Call trace:\n[ 3324.578353] cn10k_mdo_del_secy+0x24/0x180\n[ 3324.582440] macsec_common_dellink+0xec/0x120\n[ 3324.586788] macsec_notify+0x17c/0x1c0\n[ 3324.590529] raw_notifier_call_chain+0x50/0x70\n[ 3324.594965] call_netdevice_notifiers_info+0x34/0x7c\n[ 3324.599921] rollback_registered_many+0x354/0x5bc\n[ 3324.604616] unregister_netdevice_queue+0x88/0x10c\n[ 3324.609399] unregister_netdev+0x20/0x30\n[ 3324.613313] otx2_remove+0x8c/0x310\n[ 3324.616794] pci_device_shutdown+0x30/0x70\n[ 3324.620882] device_shutdown+0x11c/0x204\n\n[ 966.664930] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000\n[ 966.673712] Mem abort info:\n[ 966.676497] ESR = 0x96000006\n[ 966.679543] EC = 0x25: DABT (current EL), IL = 32 bits\n[ 966.684848] SET = 0, FnV = 0\n[ 966.687895] EA = 0, S1PTW = 0\n[ 966.691028] Data abort info:\n[ 966.693900] ISV = 0, ISS = 0x00000006\n[ 966.697729] CM = 0, WnR = 0\n[ 966.833467] Call trace:\n[ 966.835904] cn10k_mdo_stop+0x20/0xa0\n[ 966.839557] macsec_dev_stop+0xe8/0x11c\n[ 966.843384] __dev_close_many+0xbc/0x140\n[ 966.847298] dev_close_many+0x84/0x120\n[ 966.851039] rollback_registered_many+0x114/0x5bc\n[ 966.855735] unregister_netdevice_many.part.0+0x14/0xa0\n[ 966.860952] unregister_netdevice_many+0x18/0x24\n[ 966.865560] macsec_notify+0x1ac/0x1c0\n[ 966.869303] raw_notifier_call_chain+0x50/0x70\n[ 966.873738] call_netdevice_notifiers_info+0x34/0x7c\n[ 966.878694] rollback_registered_many+0x354/0x5bc\n[ 966.883390] unregister_netdevice_queue+0x88/0x10c\n[ 966.888173] unregister_netdev+0x20/0x30\n[ 966.892090] otx2_remove+0x8c/0x310\n[ 966.895571] pci_device_shutdown+0x30/0x70\n[ 966.899660] device_shutdown+0x11c/0x204\n[ 966.903574] __do_sys_reboot+0x208/0x290\n[ 966.907487] __arm64_sys_reboot+0x20/0x30\n[ 966.911489] el0_svc_handler+0x80/0x1c0\n[ 966.915316] el0_svc+0x8/0x180\n[ 966.918362] Code: f9400000 f9400a64 91220014 f94b3403 (f9400060)\n[ 966.924448] ---[ end trace 341778e799c3d8d7 ]---"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:08.261Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a3dcc45eca017fca82ac47dbde6f41af960657e5"
},
{
"url": "https://git.kernel.org/stable/c/1152c0f947b76e7731e039185cbd00fdb4389f00"
},
{
"url": "https://git.kernel.org/stable/c/13ff119b17e5e2916435ce01a0156c8698ad9e16"
},
{
"url": "https://git.kernel.org/stable/c/699af748c61574125d269db260dabbe20436d74e"
}
],
"title": "octeontx2-pf: mcs: Fix NULL pointer dereferences",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53595",
"datePublished": "2025-10-04T15:44:08.261Z",
"dateReserved": "2025-10-04T15:40:38.478Z",
"dateUpdated": "2025-10-04T15:44:08.261Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53559 (GCVE-0-2023-53559)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
ip_vti: fix potential slab-use-after-free in decode_session6
Summary
In the Linux kernel, the following vulnerability has been resolved:
ip_vti: fix potential slab-use-after-free in decode_session6
When ip_vti device is set to the qdisc of the sfb type, the cb field
of the sent skb may be modified during enqueuing. Then,
slab-use-after-free may occur when ip_vti device sends IPv6 packets.
As commit f855691975bb ("xfrm6: Fix the nexthdr offset in
_decode_session6.") showed, xfrm_decode_session was originally intended
only for the receive path. IP6CB(skb)->nhoff is not set during
transmission. Therefore, set the cb field in the skb to 0 before
sending packets.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
f855691975bb06373a98711e4cfe2c224244b536 , < 82fb41c5de243e7dfa90f32ca58e35adaff56c1d
(git)
Affected: f855691975bb06373a98711e4cfe2c224244b536 , < 7dfe23659f3677c08a60a0056cda2d91a79c15ca (git) Affected: f855691975bb06373a98711e4cfe2c224244b536 , < d34c30442d5e53a33cde79ca163320dbe2432cbd (git) Affected: f855691975bb06373a98711e4cfe2c224244b536 , < 0b4d69539fdea138af2befe08893850c89248068 (git) Affected: f855691975bb06373a98711e4cfe2c224244b536 , < e1e04cc2ef2c0c0866c19f5627149a76c2baae32 (git) Affected: f855691975bb06373a98711e4cfe2c224244b536 , < 2b05bf5dc437f7891dd409a3eaf5058459391c7a (git) Affected: f855691975bb06373a98711e4cfe2c224244b536 , < 78e397a43e1c47321a4679cc49a6c4530bf820b9 (git) Affected: f855691975bb06373a98711e4cfe2c224244b536 , < 6018a266279b1a75143c7c0804dd08a5fc4c3e0b (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "82fb41c5de243e7dfa90f32ca58e35adaff56c1d",
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"versionType": "git"
},
{
"lessThan": "7dfe23659f3677c08a60a0056cda2d91a79c15ca",
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"versionType": "git"
},
{
"lessThan": "d34c30442d5e53a33cde79ca163320dbe2432cbd",
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"versionType": "git"
},
{
"lessThan": "0b4d69539fdea138af2befe08893850c89248068",
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"versionType": "git"
},
{
"lessThan": "e1e04cc2ef2c0c0866c19f5627149a76c2baae32",
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"versionType": "git"
},
{
"lessThan": "2b05bf5dc437f7891dd409a3eaf5058459391c7a",
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"versionType": "git"
},
{
"lessThan": "78e397a43e1c47321a4679cc49a6c4530bf820b9",
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"versionType": "git"
},
{
"lessThan": "6018a266279b1a75143c7c0804dd08a5fc4c3e0b",
"status": "affected",
"version": "f855691975bb06373a98711e4cfe2c224244b536",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/ipv4/ip_vti.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.19"
},
{
"lessThan": "3.19",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.324",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.293",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.255",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.192",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.128",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.47",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.324",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.293",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.255",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.192",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.128",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.47",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.12",
"versionStartIncluding": "3.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "3.19",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nip_vti: fix potential slab-use-after-free in decode_session6\n\nWhen ip_vti device is set to the qdisc of the sfb type, the cb field\nof the sent skb may be modified during enqueuing. Then,\nslab-use-after-free may occur when ip_vti device sends IPv6 packets.\nAs commit f855691975bb (\"xfrm6: Fix the nexthdr offset in\n_decode_session6.\") showed, xfrm_decode_session was originally intended\nonly for the receive path. IP6CB(skb)-\u003enhoff is not set during\ntransmission. Therefore, set the cb field in the skb to 0 before\nsending packets."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:03.497Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/82fb41c5de243e7dfa90f32ca58e35adaff56c1d"
},
{
"url": "https://git.kernel.org/stable/c/7dfe23659f3677c08a60a0056cda2d91a79c15ca"
},
{
"url": "https://git.kernel.org/stable/c/d34c30442d5e53a33cde79ca163320dbe2432cbd"
},
{
"url": "https://git.kernel.org/stable/c/0b4d69539fdea138af2befe08893850c89248068"
},
{
"url": "https://git.kernel.org/stable/c/e1e04cc2ef2c0c0866c19f5627149a76c2baae32"
},
{
"url": "https://git.kernel.org/stable/c/2b05bf5dc437f7891dd409a3eaf5058459391c7a"
},
{
"url": "https://git.kernel.org/stable/c/78e397a43e1c47321a4679cc49a6c4530bf820b9"
},
{
"url": "https://git.kernel.org/stable/c/6018a266279b1a75143c7c0804dd08a5fc4c3e0b"
}
],
"title": "ip_vti: fix potential slab-use-after-free in decode_session6",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53559",
"datePublished": "2025-10-04T15:17:03.497Z",
"dateReserved": "2025-10-04T15:14:15.923Z",
"dateUpdated": "2025-10-04T15:17:03.497Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39951 (GCVE-0-2025-39951)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:37
VLAI?
EPSS
Title
um: virtio_uml: Fix use-after-free after put_device in probe
Summary
In the Linux kernel, the following vulnerability has been resolved:
um: virtio_uml: Fix use-after-free after put_device in probe
When register_virtio_device() fails in virtio_uml_probe(),
the code sets vu_dev->registered = 1 even though
the device was not successfully registered.
This can lead to use-after-free or other issues.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
04e5b1fb01834a602acaae2276b67a783a8c6159 , < 14c231959a16ca41bfdcaede72483362a8c645d7
(git)
Affected: 04e5b1fb01834a602acaae2276b67a783a8c6159 , < 5e94e44c9cb30d7a383d8ac227f24a8c9326b770 (git) Affected: 04e5b1fb01834a602acaae2276b67a783a8c6159 , < aaf900a83508c8cd5cdf765e7749f9076196ec7f (git) Affected: 04e5b1fb01834a602acaae2276b67a783a8c6159 , < 4f364023ddcfe83f7073b973a9cb98584b7f2a46 (git) Affected: 04e5b1fb01834a602acaae2276b67a783a8c6159 , < 00e98b5a69034b251bb36dc6e7123d7648e218e4 (git) Affected: 04e5b1fb01834a602acaae2276b67a783a8c6159 , < c2ff91255e0157b356cff115d8dc3eeb5162edf2 (git) Affected: 04e5b1fb01834a602acaae2276b67a783a8c6159 , < 7ebf70cf181651fe3f2e44e95e7e5073d594c9c0 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"arch/um/drivers/virtio_uml.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "14c231959a16ca41bfdcaede72483362a8c645d7",
"status": "affected",
"version": "04e5b1fb01834a602acaae2276b67a783a8c6159",
"versionType": "git"
},
{
"lessThan": "5e94e44c9cb30d7a383d8ac227f24a8c9326b770",
"status": "affected",
"version": "04e5b1fb01834a602acaae2276b67a783a8c6159",
"versionType": "git"
},
{
"lessThan": "aaf900a83508c8cd5cdf765e7749f9076196ec7f",
"status": "affected",
"version": "04e5b1fb01834a602acaae2276b67a783a8c6159",
"versionType": "git"
},
{
"lessThan": "4f364023ddcfe83f7073b973a9cb98584b7f2a46",
"status": "affected",
"version": "04e5b1fb01834a602acaae2276b67a783a8c6159",
"versionType": "git"
},
{
"lessThan": "00e98b5a69034b251bb36dc6e7123d7648e218e4",
"status": "affected",
"version": "04e5b1fb01834a602acaae2276b67a783a8c6159",
"versionType": "git"
},
{
"lessThan": "c2ff91255e0157b356cff115d8dc3eeb5162edf2",
"status": "affected",
"version": "04e5b1fb01834a602acaae2276b67a783a8c6159",
"versionType": "git"
},
{
"lessThan": "7ebf70cf181651fe3f2e44e95e7e5073d594c9c0",
"status": "affected",
"version": "04e5b1fb01834a602acaae2276b67a783a8c6159",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"arch/um/drivers/virtio_uml.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.5"
},
{
"lessThan": "5.5",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.245",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.194",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.245",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.194",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "5.5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.5",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\num: virtio_uml: Fix use-after-free after put_device in probe\n\nWhen register_virtio_device() fails in virtio_uml_probe(),\nthe code sets vu_dev-\u003eregistered = 1 even though\nthe device was not successfully registered.\nThis can lead to use-after-free or other issues."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:37:07.273Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/14c231959a16ca41bfdcaede72483362a8c645d7"
},
{
"url": "https://git.kernel.org/stable/c/5e94e44c9cb30d7a383d8ac227f24a8c9326b770"
},
{
"url": "https://git.kernel.org/stable/c/aaf900a83508c8cd5cdf765e7749f9076196ec7f"
},
{
"url": "https://git.kernel.org/stable/c/4f364023ddcfe83f7073b973a9cb98584b7f2a46"
},
{
"url": "https://git.kernel.org/stable/c/00e98b5a69034b251bb36dc6e7123d7648e218e4"
},
{
"url": "https://git.kernel.org/stable/c/c2ff91255e0157b356cff115d8dc3eeb5162edf2"
},
{
"url": "https://git.kernel.org/stable/c/7ebf70cf181651fe3f2e44e95e7e5073d594c9c0"
}
],
"title": "um: virtio_uml: Fix use-after-free after put_device in probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39951",
"datePublished": "2025-10-04T07:31:11.684Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:37:07.273Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50480 (GCVE-0-2022-50480)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
Summary
In the Linux kernel, the following vulnerability has been resolved:
memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()
The break of for_each_available_child_of_node() needs a
corresponding of_node_put() when the reference 'child' is not
used anymore. Here we do not need to call of_node_put() in
fail path as '!match' means no break.
While the of_platform_device_create() will created a new
reference by 'child' but it has considered the refcounting.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
fee10bd2267868f2a3e7ba008ef7665aac5e4412 , < b37f4a711e5d4bf3608ccbc6de82b52e92b441a0
(git)
Affected: fee10bd2267868f2a3e7ba008ef7665aac5e4412 , < fde46754d5483bc398018bbec3c8ef5c55219e67 (git) Affected: fee10bd2267868f2a3e7ba008ef7665aac5e4412 , < 566b143aa5112a0c2784e20603778518bb799537 (git) Affected: fee10bd2267868f2a3e7ba008ef7665aac5e4412 , < 44db35ceb94756ba513dcf6b69bf9e949b28469c (git) Affected: fee10bd2267868f2a3e7ba008ef7665aac5e4412 , < 49605dc25e7fb33bf8b671279d4468531da90f89 (git) Affected: fee10bd2267868f2a3e7ba008ef7665aac5e4412 , < 61b3c876c1cbdb1efd1f52a1f348580e6e14efb6 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/memory/pl353-smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b37f4a711e5d4bf3608ccbc6de82b52e92b441a0",
"status": "affected",
"version": "fee10bd2267868f2a3e7ba008ef7665aac5e4412",
"versionType": "git"
},
{
"lessThan": "fde46754d5483bc398018bbec3c8ef5c55219e67",
"status": "affected",
"version": "fee10bd2267868f2a3e7ba008ef7665aac5e4412",
"versionType": "git"
},
{
"lessThan": "566b143aa5112a0c2784e20603778518bb799537",
"status": "affected",
"version": "fee10bd2267868f2a3e7ba008ef7665aac5e4412",
"versionType": "git"
},
{
"lessThan": "44db35ceb94756ba513dcf6b69bf9e949b28469c",
"status": "affected",
"version": "fee10bd2267868f2a3e7ba008ef7665aac5e4412",
"versionType": "git"
},
{
"lessThan": "49605dc25e7fb33bf8b671279d4468531da90f89",
"status": "affected",
"version": "fee10bd2267868f2a3e7ba008ef7665aac5e4412",
"versionType": "git"
},
{
"lessThan": "61b3c876c1cbdb1efd1f52a1f348580e6e14efb6",
"status": "affected",
"version": "fee10bd2267868f2a3e7ba008ef7665aac5e4412",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/memory/pl353-smc.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.0"
},
{
"lessThan": "5.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.220",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.150",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.75",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.19.*",
"status": "unaffected",
"version": "5.19.17",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.220",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.150",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.75",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.19.17",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.3",
"versionStartIncluding": "5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1",
"versionStartIncluding": "5.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmemory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()\n\nThe break of for_each_available_child_of_node() needs a\ncorresponding of_node_put() when the reference \u0027child\u0027 is not\nused anymore. Here we do not need to call of_node_put() in\nfail path as \u0027!match\u0027 means no break.\n\nWhile the of_platform_device_create() will created a new\nreference by \u0027child\u0027 but it has considered the refcounting."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:39.704Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b37f4a711e5d4bf3608ccbc6de82b52e92b441a0"
},
{
"url": "https://git.kernel.org/stable/c/fde46754d5483bc398018bbec3c8ef5c55219e67"
},
{
"url": "https://git.kernel.org/stable/c/566b143aa5112a0c2784e20603778518bb799537"
},
{
"url": "https://git.kernel.org/stable/c/44db35ceb94756ba513dcf6b69bf9e949b28469c"
},
{
"url": "https://git.kernel.org/stable/c/49605dc25e7fb33bf8b671279d4468531da90f89"
},
{
"url": "https://git.kernel.org/stable/c/61b3c876c1cbdb1efd1f52a1f348580e6e14efb6"
}
],
"title": "memory: pl353-smc: Fix refcount leak bug in pl353_smc_probe()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50480",
"datePublished": "2025-10-04T15:16:39.704Z",
"dateReserved": "2025-10-04T15:13:33.467Z",
"dateUpdated": "2025-10-04T15:16:39.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53596 (GCVE-0-2023-53596)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
drivers: base: Free devm resources when unregistering a device
Summary
In the Linux kernel, the following vulnerability has been resolved:
drivers: base: Free devm resources when unregistering a device
In the current code, devres_release_all() only gets called if the device
has a bus and has been probed.
This leads to issues when using bus-less or driver-less devices where
the device might never get freed if a managed resource holds a reference
to the device. This is happening in the DRM framework for example.
We should thus call devres_release_all() in the device_del() function to
make sure that the device-managed actions are properly executed when the
device is unregistered, even if it has neither a bus nor a driver.
This is effectively the same change than commit 2f8d16a996da ("devres:
release resources on device_del()") that got reverted by commit
a525a3ddeaca ("driver core: free devres in device_release") over
memory leaks concerns.
This patch effectively combines the two commits mentioned above to
release the resources both on device_del() and device_release() and get
the best of both worlds.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
a525a3ddeaca69f405d98442ab3c0746e53168dc , < 297992e5c63528e603666e36081836204fc36ec9
(git)
Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < 3bcc4c2a096e8342c8c719e595ce15de212694dd (git) Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < c8c426fae26086a0ca8ab6cc6da2de79810ec038 (git) Affected: a525a3ddeaca69f405d98442ab3c0746e53168dc , < 699fb50d99039a50e7494de644f96c889279aca3 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/base/core.c",
"drivers/base/test/platform-device-test.c",
"drivers/base/test/root-device-test.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "297992e5c63528e603666e36081836204fc36ec9",
"status": "affected",
"version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
"versionType": "git"
},
{
"lessThan": "3bcc4c2a096e8342c8c719e595ce15de212694dd",
"status": "affected",
"version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
"versionType": "git"
},
{
"lessThan": "c8c426fae26086a0ca8ab6cc6da2de79810ec038",
"status": "affected",
"version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
"versionType": "git"
},
{
"lessThan": "699fb50d99039a50e7494de644f96c889279aca3",
"status": "affected",
"version": "a525a3ddeaca69f405d98442ab3c0746e53168dc",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/base/core.c",
"drivers/base/test/platform-device-test.c",
"drivers/base/test/root-device-test.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "3.7"
},
{
"lessThan": "3.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.53",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.16",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.3",
"versionStartIncluding": "3.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "3.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrivers: base: Free devm resources when unregistering a device\n\nIn the current code, devres_release_all() only gets called if the device\nhas a bus and has been probed.\n\nThis leads to issues when using bus-less or driver-less devices where\nthe device might never get freed if a managed resource holds a reference\nto the device. This is happening in the DRM framework for example.\n\nWe should thus call devres_release_all() in the device_del() function to\nmake sure that the device-managed actions are properly executed when the\ndevice is unregistered, even if it has neither a bus nor a driver.\n\nThis is effectively the same change than commit 2f8d16a996da (\"devres:\nrelease resources on device_del()\") that got reverted by commit\na525a3ddeaca (\"driver core: free devres in device_release\") over\nmemory leaks concerns.\n\nThis patch effectively combines the two commits mentioned above to\nrelease the resources both on device_del() and device_release() and get\nthe best of both worlds."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:08.942Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/297992e5c63528e603666e36081836204fc36ec9"
},
{
"url": "https://git.kernel.org/stable/c/3bcc4c2a096e8342c8c719e595ce15de212694dd"
},
{
"url": "https://git.kernel.org/stable/c/c8c426fae26086a0ca8ab6cc6da2de79810ec038"
},
{
"url": "https://git.kernel.org/stable/c/699fb50d99039a50e7494de644f96c889279aca3"
}
],
"title": "drivers: base: Free devm resources when unregistering a device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53596",
"datePublished": "2025-10-04T15:44:08.942Z",
"dateReserved": "2025-10-04T15:40:38.478Z",
"dateUpdated": "2025-10-04T15:44:08.942Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53610 (GCVE-0-2023-53610)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
irqchip: Fix refcount leak in platform_irqchip_probe
Summary
In the Linux kernel, the following vulnerability has been resolved:
irqchip: Fix refcount leak in platform_irqchip_probe
of_irq_find_parent() returns a node pointer with refcount incremented,
We should use of_node_put() on it when not needed anymore.
Add missing of_node_put() to avoid refcount leak.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
f8410e626569324cfe831aaecc0504cafc12b471 , < b00baffcc2561374f8fe8af873d00531f19864eb
(git)
Affected: f8410e626569324cfe831aaecc0504cafc12b471 , < 4401b485855700f296cae4d0db36a52948bff4fa (git) Affected: f8410e626569324cfe831aaecc0504cafc12b471 , < ea54b608d85b7536f92238f3259730fa06cb5d21 (git) Affected: f8410e626569324cfe831aaecc0504cafc12b471 , < c32fb16331f612e66a7fa8930164e0dc15725b72 (git) Affected: f8410e626569324cfe831aaecc0504cafc12b471 , < 6caa5a2b78f5f53c433d3a3781e53325da22f0ac (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/irqchip/irqchip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b00baffcc2561374f8fe8af873d00531f19864eb",
"status": "affected",
"version": "f8410e626569324cfe831aaecc0504cafc12b471",
"versionType": "git"
},
{
"lessThan": "4401b485855700f296cae4d0db36a52948bff4fa",
"status": "affected",
"version": "f8410e626569324cfe831aaecc0504cafc12b471",
"versionType": "git"
},
{
"lessThan": "ea54b608d85b7536f92238f3259730fa06cb5d21",
"status": "affected",
"version": "f8410e626569324cfe831aaecc0504cafc12b471",
"versionType": "git"
},
{
"lessThan": "c32fb16331f612e66a7fa8930164e0dc15725b72",
"status": "affected",
"version": "f8410e626569324cfe831aaecc0504cafc12b471",
"versionType": "git"
},
{
"lessThan": "6caa5a2b78f5f53c433d3a3781e53325da22f0ac",
"status": "affected",
"version": "f8410e626569324cfe831aaecc0504cafc12b471",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/irqchip/irqchip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"lessThan": "5.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.173",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.173",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "5.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "5.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nirqchip: Fix refcount leak in platform_irqchip_probe\n\nof_irq_find_parent() returns a node pointer with refcount incremented,\nWe should use of_node_put() on it when not needed anymore.\nAdd missing of_node_put() to avoid refcount leak."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:18.863Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b00baffcc2561374f8fe8af873d00531f19864eb"
},
{
"url": "https://git.kernel.org/stable/c/4401b485855700f296cae4d0db36a52948bff4fa"
},
{
"url": "https://git.kernel.org/stable/c/ea54b608d85b7536f92238f3259730fa06cb5d21"
},
{
"url": "https://git.kernel.org/stable/c/c32fb16331f612e66a7fa8930164e0dc15725b72"
},
{
"url": "https://git.kernel.org/stable/c/6caa5a2b78f5f53c433d3a3781e53325da22f0ac"
}
],
"title": "irqchip: Fix refcount leak in platform_irqchip_probe",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53610",
"datePublished": "2025-10-04T15:44:18.863Z",
"dateReserved": "2025-10-04T15:40:38.480Z",
"dateUpdated": "2025-10-04T15:44:18.863Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53615 (GCVE-0-2023-53615)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
scsi: qla2xxx: Fix deletion race condition
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: qla2xxx: Fix deletion race condition
System crash when using debug kernel due to link list corruption. The cause
of the link list corruption is due to session deletion was allowed to queue
up twice. Here's the internal trace that show the same port was allowed to
double queue for deletion on different cpu.
20808683956 015 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1
20808683957 027 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1
Move the clearing/setting of deleted flag lock.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
726b85487067d7f5b23495bc33c484b8517c4074 , < a4628a5b98e4c6d905e1f7638242612d7db7d9c2
(git)
Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < 4d7da12483e98c451a51bd294a3d3494f0aee5eb (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < f1ea164be545629bf442c22f508ad9e7b94ac100 (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < cd06c45b326e44f0d21dc1b3fa23e71f46847e28 (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < b05017cb4ff75eea783583f3d400059507510ab1 (git) Affected: 726b85487067d7f5b23495bc33c484b8517c4074 , < 6dfe4344c168c6ca20fe7640649aacfcefcccb26 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_init.c",
"drivers/scsi/qla2xxx/qla_target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "a4628a5b98e4c6d905e1f7638242612d7db7d9c2",
"status": "affected",
"version": "726b85487067d7f5b23495bc33c484b8517c4074",
"versionType": "git"
},
{
"lessThan": "4d7da12483e98c451a51bd294a3d3494f0aee5eb",
"status": "affected",
"version": "726b85487067d7f5b23495bc33c484b8517c4074",
"versionType": "git"
},
{
"lessThan": "f1ea164be545629bf442c22f508ad9e7b94ac100",
"status": "affected",
"version": "726b85487067d7f5b23495bc33c484b8517c4074",
"versionType": "git"
},
{
"lessThan": "cd06c45b326e44f0d21dc1b3fa23e71f46847e28",
"status": "affected",
"version": "726b85487067d7f5b23495bc33c484b8517c4074",
"versionType": "git"
},
{
"lessThan": "b05017cb4ff75eea783583f3d400059507510ab1",
"status": "affected",
"version": "726b85487067d7f5b23495bc33c484b8517c4074",
"versionType": "git"
},
{
"lessThan": "6dfe4344c168c6ca20fe7640649aacfcefcccb26",
"status": "affected",
"version": "726b85487067d7f5b23495bc33c484b8517c4074",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/qla2xxx/qla_init.c",
"drivers/scsi/qla2xxx/qla_target.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.11"
},
{
"lessThan": "4.11",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.258",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.195",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.132",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.258",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.195",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.132",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.54",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.4",
"versionStartIncluding": "4.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "4.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: qla2xxx: Fix deletion race condition\n\nSystem crash when using debug kernel due to link list corruption. The cause\nof the link list corruption is due to session deletion was allowed to queue\nup twice. Here\u0027s the internal trace that show the same port was allowed to\ndouble queue for deletion on different cpu.\n\n20808683956 015 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1\n20808683957 027 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1\n\nMove the clearing/setting of deleted flag lock."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:22.376Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/a4628a5b98e4c6d905e1f7638242612d7db7d9c2"
},
{
"url": "https://git.kernel.org/stable/c/4d7da12483e98c451a51bd294a3d3494f0aee5eb"
},
{
"url": "https://git.kernel.org/stable/c/f1ea164be545629bf442c22f508ad9e7b94ac100"
},
{
"url": "https://git.kernel.org/stable/c/cd06c45b326e44f0d21dc1b3fa23e71f46847e28"
},
{
"url": "https://git.kernel.org/stable/c/b05017cb4ff75eea783583f3d400059507510ab1"
},
{
"url": "https://git.kernel.org/stable/c/6dfe4344c168c6ca20fe7640649aacfcefcccb26"
}
],
"title": "scsi: qla2xxx: Fix deletion race condition",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53615",
"datePublished": "2025-10-04T15:44:22.376Z",
"dateReserved": "2025-10-04T15:40:38.481Z",
"dateUpdated": "2025-10-04T15:44:22.376Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53611 (GCVE-0-2023-53611)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
ipmi_si: fix a memleak in try_smi_init()
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi_si: fix a memleak in try_smi_init()
Kmemleak reported the following leak info in try_smi_init():
unreferenced object 0xffff00018ecf9400 (size 1024):
comm "modprobe", pid 2707763, jiffies 4300851415 (age 773.308s)
backtrace:
[<000000004ca5b312>] __kmalloc+0x4b8/0x7b0
[<00000000953b1072>] try_smi_init+0x148/0x5dc [ipmi_si]
[<000000006460d325>] 0xffff800081b10148
[<0000000039206ea5>] do_one_initcall+0x64/0x2a4
[<00000000601399ce>] do_init_module+0x50/0x300
[<000000003c12ba3c>] load_module+0x7a8/0x9e0
[<00000000c246fffe>] __se_sys_init_module+0x104/0x180
[<00000000eea99093>] __arm64_sys_init_module+0x24/0x30
[<0000000021b1ef87>] el0_svc_common.constprop.0+0x94/0x250
[<0000000070f4f8b7>] do_el0_svc+0x48/0xe0
[<000000005a05337f>] el0_svc+0x24/0x3c
[<000000005eb248d6>] el0_sync_handler+0x160/0x164
[<0000000030a59039>] el0_sync+0x160/0x180
The problem was that when an error occurred before handlers registration
and after allocating `new_smi->si_sm`, the variable wouldn't be freed in
the error handling afterwards since `shutdown_smi()` hadn't been
registered yet. Fix it by adding a `kfree()` in the error handling path
in `try_smi_init()`.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
7960f18a56475bf2177c5ff56c72eb4c12c56440 , < b9bc8fbb2d416ce87f0342478dc9fcfd79f2c65f
(git)
Affected: 7960f18a56475bf2177c5ff56c72eb4c12c56440 , < f53ab5a2bf20fed59a2f7542d3453228b8056358 (git) Affected: 7960f18a56475bf2177c5ff56c72eb4c12c56440 , < 5c5f02e16b919c8cb6024dc3778c8d8f1fb1f26b (git) Affected: 7960f18a56475bf2177c5ff56c72eb4c12c56440 , < cbb7d8a4b4beb3061b3a1847a742983a01dca381 (git) Affected: 7960f18a56475bf2177c5ff56c72eb4c12c56440 , < 09cb2a71b2e982015fe0464f28da1ab42b8e6375 (git) Affected: 7960f18a56475bf2177c5ff56c72eb4c12c56440 , < 1bfcfea0fae0d0a6c6ff5543e6d704b3807b83ce (git) Affected: 7960f18a56475bf2177c5ff56c72eb4c12c56440 , < 7291af9a738d936c2d6869d030711dceb68404d0 (git) Affected: 7960f18a56475bf2177c5ff56c72eb4c12c56440 , < 6cf1a126de2992b4efe1c3c4d398f8de4aed6e3f (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "b9bc8fbb2d416ce87f0342478dc9fcfd79f2c65f",
"status": "affected",
"version": "7960f18a56475bf2177c5ff56c72eb4c12c56440",
"versionType": "git"
},
{
"lessThan": "f53ab5a2bf20fed59a2f7542d3453228b8056358",
"status": "affected",
"version": "7960f18a56475bf2177c5ff56c72eb4c12c56440",
"versionType": "git"
},
{
"lessThan": "5c5f02e16b919c8cb6024dc3778c8d8f1fb1f26b",
"status": "affected",
"version": "7960f18a56475bf2177c5ff56c72eb4c12c56440",
"versionType": "git"
},
{
"lessThan": "cbb7d8a4b4beb3061b3a1847a742983a01dca381",
"status": "affected",
"version": "7960f18a56475bf2177c5ff56c72eb4c12c56440",
"versionType": "git"
},
{
"lessThan": "09cb2a71b2e982015fe0464f28da1ab42b8e6375",
"status": "affected",
"version": "7960f18a56475bf2177c5ff56c72eb4c12c56440",
"versionType": "git"
},
{
"lessThan": "1bfcfea0fae0d0a6c6ff5543e6d704b3807b83ce",
"status": "affected",
"version": "7960f18a56475bf2177c5ff56c72eb4c12c56440",
"versionType": "git"
},
{
"lessThan": "7291af9a738d936c2d6869d030711dceb68404d0",
"status": "affected",
"version": "7960f18a56475bf2177c5ff56c72eb4c12c56440",
"versionType": "git"
},
{
"lessThan": "6cf1a126de2992b4efe1c3c4d398f8de4aed6e3f",
"status": "affected",
"version": "7960f18a56475bf2177c5ff56c72eb4c12c56440",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/char/ipmi/ipmi_si_intf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.295",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.257",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.195",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.132",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.53",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.295",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.257",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.195",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.132",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.53",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.16",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.3",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "4.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi_si: fix a memleak in try_smi_init()\n\nKmemleak reported the following leak info in try_smi_init():\n\nunreferenced object 0xffff00018ecf9400 (size 1024):\n comm \"modprobe\", pid 2707763, jiffies 4300851415 (age 773.308s)\n backtrace:\n [\u003c000000004ca5b312\u003e] __kmalloc+0x4b8/0x7b0\n [\u003c00000000953b1072\u003e] try_smi_init+0x148/0x5dc [ipmi_si]\n [\u003c000000006460d325\u003e] 0xffff800081b10148\n [\u003c0000000039206ea5\u003e] do_one_initcall+0x64/0x2a4\n [\u003c00000000601399ce\u003e] do_init_module+0x50/0x300\n [\u003c000000003c12ba3c\u003e] load_module+0x7a8/0x9e0\n [\u003c00000000c246fffe\u003e] __se_sys_init_module+0x104/0x180\n [\u003c00000000eea99093\u003e] __arm64_sys_init_module+0x24/0x30\n [\u003c0000000021b1ef87\u003e] el0_svc_common.constprop.0+0x94/0x250\n [\u003c0000000070f4f8b7\u003e] do_el0_svc+0x48/0xe0\n [\u003c000000005a05337f\u003e] el0_svc+0x24/0x3c\n [\u003c000000005eb248d6\u003e] el0_sync_handler+0x160/0x164\n [\u003c0000000030a59039\u003e] el0_sync+0x160/0x180\n\nThe problem was that when an error occurred before handlers registration\nand after allocating `new_smi-\u003esi_sm`, the variable wouldn\u0027t be freed in\nthe error handling afterwards since `shutdown_smi()` hadn\u0027t been\nregistered yet. Fix it by adding a `kfree()` in the error handling path\nin `try_smi_init()`."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:19.593Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/b9bc8fbb2d416ce87f0342478dc9fcfd79f2c65f"
},
{
"url": "https://git.kernel.org/stable/c/f53ab5a2bf20fed59a2f7542d3453228b8056358"
},
{
"url": "https://git.kernel.org/stable/c/5c5f02e16b919c8cb6024dc3778c8d8f1fb1f26b"
},
{
"url": "https://git.kernel.org/stable/c/cbb7d8a4b4beb3061b3a1847a742983a01dca381"
},
{
"url": "https://git.kernel.org/stable/c/09cb2a71b2e982015fe0464f28da1ab42b8e6375"
},
{
"url": "https://git.kernel.org/stable/c/1bfcfea0fae0d0a6c6ff5543e6d704b3807b83ce"
},
{
"url": "https://git.kernel.org/stable/c/7291af9a738d936c2d6869d030711dceb68404d0"
},
{
"url": "https://git.kernel.org/stable/c/6cf1a126de2992b4efe1c3c4d398f8de4aed6e3f"
}
],
"title": "ipmi_si: fix a memleak in try_smi_init()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53611",
"datePublished": "2025-10-04T15:44:19.593Z",
"dateReserved": "2025-10-04T15:40:38.480Z",
"dateUpdated": "2025-10-04T15:44:19.593Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53614 (GCVE-0-2023-53614)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
mm/ksm: fix race with VMA iteration and mm_struct teardown
Summary
In the Linux kernel, the following vulnerability has been resolved:
mm/ksm: fix race with VMA iteration and mm_struct teardown
exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held
in write mode. Ensure that the maple tree is still valid by checking
ksm_test_exit() after taking the mmap_lock in read mode, but before the
for_each_vma() iterator dereferences a destroyed maple tree.
Since the maple tree is destroyed, the flags telling lockdep to check an
external lock has been cleared. Skip the for_each_vma() iterator to avoid
dereferencing a maple tree without the external lock flag, which would
create a lockdep warning.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
a5f18ba0727656bd1fe3bcdb0d563f81790f9a04 , < 286b0cab31bac29960e5684f6fb331d42f03b363
(git)
Affected: a5f18ba0727656bd1fe3bcdb0d563f81790f9a04 , < b4f664ffd8f78c05a1fd542a28bc5a11e994c014 (git) Affected: a5f18ba0727656bd1fe3bcdb0d563f81790f9a04 , < 6db504ce55bdbc575723938fc480713c9183f6a2 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"mm/ksm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "286b0cab31bac29960e5684f6fb331d42f03b363",
"status": "affected",
"version": "a5f18ba0727656bd1fe3bcdb0d563f81790f9a04",
"versionType": "git"
},
{
"lessThan": "b4f664ffd8f78c05a1fd542a28bc5a11e994c014",
"status": "affected",
"version": "a5f18ba0727656bd1fe3bcdb0d563f81790f9a04",
"versionType": "git"
},
{
"lessThan": "6db504ce55bdbc575723938fc480713c9183f6a2",
"status": "affected",
"version": "a5f18ba0727656bd1fe3bcdb0d563f81790f9a04",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"mm/ksm.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.1"
},
{
"lessThan": "6.1",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.22",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.22",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.9",
"versionStartIncluding": "6.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "6.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm/ksm: fix race with VMA iteration and mm_struct teardown\n\nexit_mmap() will tear down the VMAs and maple tree with the mmap_lock held\nin write mode. Ensure that the maple tree is still valid by checking\nksm_test_exit() after taking the mmap_lock in read mode, but before the\nfor_each_vma() iterator dereferences a destroyed maple tree.\n\nSince the maple tree is destroyed, the flags telling lockdep to check an\nexternal lock has been cleared. Skip the for_each_vma() iterator to avoid\ndereferencing a maple tree without the external lock flag, which would\ncreate a lockdep warning."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:21.671Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/286b0cab31bac29960e5684f6fb331d42f03b363"
},
{
"url": "https://git.kernel.org/stable/c/b4f664ffd8f78c05a1fd542a28bc5a11e994c014"
},
{
"url": "https://git.kernel.org/stable/c/6db504ce55bdbc575723938fc480713c9183f6a2"
}
],
"title": "mm/ksm: fix race with VMA iteration and mm_struct teardown",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53614",
"datePublished": "2025-10-04T15:44:21.671Z",
"dateReserved": "2025-10-04T15:40:38.481Z",
"dateUpdated": "2025-10-04T15:44:21.671Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53568 (GCVE-0-2023-53568)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
s390/zcrypt: don't leak memory if dev_set_name() fails
Summary
In the Linux kernel, the following vulnerability has been resolved:
s390/zcrypt: don't leak memory if dev_set_name() fails
When dev_set_name() fails, zcdn_create() doesn't free the newly
allocated resources. Do it.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
00fab2350e6b91e57b3cdcd5d9f01056775a921d , < 6b0cb9c055843777b374309503d89eabeb769355
(git)
Affected: 00fab2350e6b91e57b3cdcd5d9f01056775a921d , < 0878052579cb2773caee64812a811edcab6b5a55 (git) Affected: 00fab2350e6b91e57b3cdcd5d9f01056775a921d , < 131cd74a8e38d75239f2c81dfee53d6554eb8bf8 (git) Affected: 00fab2350e6b91e57b3cdcd5d9f01056775a921d , < 147d8da33a2c2195ec63acd56cd7d80a3458c253 (git) Affected: 00fab2350e6b91e57b3cdcd5d9f01056775a921d , < 174f11ef1615ec3ab1e2189685864433c0d855a2 (git) Affected: 00fab2350e6b91e57b3cdcd5d9f01056775a921d , < 6252f47b78031979ad919f971dc8468b893488bd (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "6b0cb9c055843777b374309503d89eabeb769355",
"status": "affected",
"version": "00fab2350e6b91e57b3cdcd5d9f01056775a921d",
"versionType": "git"
},
{
"lessThan": "0878052579cb2773caee64812a811edcab6b5a55",
"status": "affected",
"version": "00fab2350e6b91e57b3cdcd5d9f01056775a921d",
"versionType": "git"
},
{
"lessThan": "131cd74a8e38d75239f2c81dfee53d6554eb8bf8",
"status": "affected",
"version": "00fab2350e6b91e57b3cdcd5d9f01056775a921d",
"versionType": "git"
},
{
"lessThan": "147d8da33a2c2195ec63acd56cd7d80a3458c253",
"status": "affected",
"version": "00fab2350e6b91e57b3cdcd5d9f01056775a921d",
"versionType": "git"
},
{
"lessThan": "174f11ef1615ec3ab1e2189685864433c0d855a2",
"status": "affected",
"version": "00fab2350e6b91e57b3cdcd5d9f01056775a921d",
"versionType": "git"
},
{
"lessThan": "6252f47b78031979ad919f971dc8468b893488bd",
"status": "affected",
"version": "00fab2350e6b91e57b3cdcd5d9f01056775a921d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/s390/crypto/zcrypt_api.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.20"
},
{
"lessThan": "4.20",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.257",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.195",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.132",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.257",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.195",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.132",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.54",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.4",
"versionStartIncluding": "4.20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "4.20",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/zcrypt: don\u0027t leak memory if dev_set_name() fails\n\nWhen dev_set_name() fails, zcdn_create() doesn\u0027t free the newly\nallocated resources. Do it."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:10.044Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/6b0cb9c055843777b374309503d89eabeb769355"
},
{
"url": "https://git.kernel.org/stable/c/0878052579cb2773caee64812a811edcab6b5a55"
},
{
"url": "https://git.kernel.org/stable/c/131cd74a8e38d75239f2c81dfee53d6554eb8bf8"
},
{
"url": "https://git.kernel.org/stable/c/147d8da33a2c2195ec63acd56cd7d80a3458c253"
},
{
"url": "https://git.kernel.org/stable/c/174f11ef1615ec3ab1e2189685864433c0d855a2"
},
{
"url": "https://git.kernel.org/stable/c/6252f47b78031979ad919f971dc8468b893488bd"
}
],
"title": "s390/zcrypt: don\u0027t leak memory if dev_set_name() fails",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53568",
"datePublished": "2025-10-04T15:17:10.044Z",
"dateReserved": "2025-10-04T15:14:15.924Z",
"dateUpdated": "2025-10-04T15:17:10.044Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39942 (GCVE-0-2025-39942)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:31 – Updated: 2025-10-04 07:31
VLAI?
EPSS
Title
ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
Summary
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
This is inspired by the check for data_offset + data_length.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < 196a3a7676d726ee67621ea2bf3b7815ac2685b4
(git)
Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < d3cb3f209d35c44b7ee74f77ed27ebb28995b9ce (git) Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < 9644798294c7287e65a7b26e35aa6d2ce3345bcc (git) Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < c64b915bb3d9339adcae5db4be2c35ffbef5e615 (git) Affected: 2ea086e35c3d726a3bacd0a971c1f02a50e98206 , < e1868ba37fd27c6a68e31565402b154beaa65df0 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/server/transport_rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "196a3a7676d726ee67621ea2bf3b7815ac2685b4",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "d3cb3f209d35c44b7ee74f77ed27ebb28995b9ce",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "9644798294c7287e65a7b26e35aa6d2ce3345bcc",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "c64b915bb3d9339adcae5db4be2c35ffbef5e615",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
},
{
"lessThan": "e1868ba37fd27c6a68e31565402b154beaa65df0",
"status": "affected",
"version": "2ea086e35c3d726a3bacd0a971c1f02a50e98206",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/server/transport_rdma.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"lessThan": "5.15",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.154",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.49",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.154",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.108",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.49",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "5.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "5.15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size\n\nThis is inspired by the check for data_offset + data_length."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:31:04.810Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/196a3a7676d726ee67621ea2bf3b7815ac2685b4"
},
{
"url": "https://git.kernel.org/stable/c/d3cb3f209d35c44b7ee74f77ed27ebb28995b9ce"
},
{
"url": "https://git.kernel.org/stable/c/9644798294c7287e65a7b26e35aa6d2ce3345bcc"
},
{
"url": "https://git.kernel.org/stable/c/c64b915bb3d9339adcae5db4be2c35ffbef5e615"
},
{
"url": "https://git.kernel.org/stable/c/e1868ba37fd27c6a68e31565402b154beaa65df0"
}
],
"title": "ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39942",
"datePublished": "2025-10-04T07:31:04.810Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:31:04.810Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50481 (GCVE-0-2022-50481)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
Summary
In the Linux kernel, the following vulnerability has been resolved:
cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()
If device_register() fails in cxl_register_afu|adapter(), the device
is not added, device_unregister() can not be called in the error path,
otherwise it will cause a null-ptr-deref because of removing not added
device.
As comment of device_register() says, it should use put_device() to give
up the reference in the error path. So split device_unregister() into
device_del() and put_device(), then goes to put dev when register fails.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
14baf4d9c739e6e69150512d2eb23c71fffcc192 , < 96fba6fb95bdede80583c262ac185da09661f264
(git)
Affected: 14baf4d9c739e6e69150512d2eb23c71fffcc192 , < 1ae581696b7a799afa39a664c4b721569643f58a (git) Affected: 14baf4d9c739e6e69150512d2eb23c71fffcc192 , < d775a1da5a52b4f4bb02f2707ba420d1bec48dbb (git) Affected: 14baf4d9c739e6e69150512d2eb23c71fffcc192 , < 60b2ed21a65f3f5318666ccd765c3507991370cf (git) Affected: 14baf4d9c739e6e69150512d2eb23c71fffcc192 , < 170e8c2d2b61e15e7f7cfeded81bc1e959a15ed8 (git) Affected: 14baf4d9c739e6e69150512d2eb23c71fffcc192 , < e5021bbf11b024cc65ea1e84c377df484183be4b (git) Affected: 14baf4d9c739e6e69150512d2eb23c71fffcc192 , < b32559ee4e6667c5c3daf4ec5454c277d1f255d2 (git) Affected: 14baf4d9c739e6e69150512d2eb23c71fffcc192 , < ab44c182353be101c3be9465e1d15d42130c53c4 (git) Affected: 14baf4d9c739e6e69150512d2eb23c71fffcc192 , < 61c80d1c3833e196256fb060382db94f24d3d9a7 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/misc/cxl/guest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "96fba6fb95bdede80583c262ac185da09661f264",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
},
{
"lessThan": "1ae581696b7a799afa39a664c4b721569643f58a",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
},
{
"lessThan": "d775a1da5a52b4f4bb02f2707ba420d1bec48dbb",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
},
{
"lessThan": "60b2ed21a65f3f5318666ccd765c3507991370cf",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
},
{
"lessThan": "170e8c2d2b61e15e7f7cfeded81bc1e959a15ed8",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
},
{
"lessThan": "e5021bbf11b024cc65ea1e84c377df484183be4b",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
},
{
"lessThan": "b32559ee4e6667c5c3daf4ec5454c277d1f255d2",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
},
{
"lessThan": "ab44c182353be101c3be9465e1d15d42130c53c4",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
},
{
"lessThan": "61c80d1c3833e196256fb060382db94f24d3d9a7",
"status": "affected",
"version": "14baf4d9c739e6e69150512d2eb23c71fffcc192",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/misc/cxl/guest.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.6"
},
{
"lessThan": "4.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.9.*",
"status": "unaffected",
"version": "4.9.337",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.14.*",
"status": "unaffected",
"version": "4.14.303",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.270",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.229",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.163",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.86",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.0.*",
"status": "unaffected",
"version": "6.0.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.9.337",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.14.303",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.270",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.229",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.163",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.86",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.0.16",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.2",
"versionStartIncluding": "4.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2",
"versionStartIncluding": "4.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()\n\nIf device_register() fails in cxl_register_afu|adapter(), the device\nis not added, device_unregister() can not be called in the error path,\notherwise it will cause a null-ptr-deref because of removing not added\ndevice.\n\nAs comment of device_register() says, it should use put_device() to give\nup the reference in the error path. So split device_unregister() into\ndevice_del() and put_device(), then goes to put dev when register fails."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:40.374Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96fba6fb95bdede80583c262ac185da09661f264"
},
{
"url": "https://git.kernel.org/stable/c/1ae581696b7a799afa39a664c4b721569643f58a"
},
{
"url": "https://git.kernel.org/stable/c/d775a1da5a52b4f4bb02f2707ba420d1bec48dbb"
},
{
"url": "https://git.kernel.org/stable/c/60b2ed21a65f3f5318666ccd765c3507991370cf"
},
{
"url": "https://git.kernel.org/stable/c/170e8c2d2b61e15e7f7cfeded81bc1e959a15ed8"
},
{
"url": "https://git.kernel.org/stable/c/e5021bbf11b024cc65ea1e84c377df484183be4b"
},
{
"url": "https://git.kernel.org/stable/c/b32559ee4e6667c5c3daf4ec5454c277d1f255d2"
},
{
"url": "https://git.kernel.org/stable/c/ab44c182353be101c3be9465e1d15d42130c53c4"
},
{
"url": "https://git.kernel.org/stable/c/61c80d1c3833e196256fb060382db94f24d3d9a7"
}
],
"title": "cxl: fix possible null-ptr-deref in cxl_guest_init_afu|adapter()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50481",
"datePublished": "2025-10-04T15:16:40.374Z",
"dateReserved": "2025-10-04T15:13:33.468Z",
"dateUpdated": "2025-10-04T15:16:40.374Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53580 (GCVE-0-2023-53580)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-04 15:43
VLAI?
EPSS
Title
USB: Gadget: core: Help prevent panic during UVC unconfigure
Summary
In the Linux kernel, the following vulnerability has been resolved:
USB: Gadget: core: Help prevent panic during UVC unconfigure
Avichal Rakesh reported a kernel panic that occurred when the UVC
gadget driver was removed from a gadget's configuration. The panic
involves a somewhat complicated interaction between the kernel driver
and a userspace component (as described in the Link tag below), but
the analysis did make one thing clear: The Gadget core should
accomodate gadget drivers calling usb_gadget_deactivate() as part of
their unbind procedure.
Currently this doesn't work. gadget_unbind_driver() calls
driver->unbind() while holding the udc->connect_lock mutex, and
usb_gadget_deactivate() attempts to acquire that mutex, which will
result in a deadlock.
The simple fix is for gadget_unbind_driver() to release the mutex when
invoking the ->unbind() callback. There is no particular reason for
it to be holding the mutex at that time, and the mutex isn't held
while the ->bind() callback is invoked. So we'll drop the mutex
before performing the unbind callback and reacquire it afterward.
We'll also add a couple of comments to usb_gadget_activate() and
usb_gadget_deactivate(). Because they run in process context they
must not be called from a gadget driver's ->disconnect() callback,
which (according to the kerneldoc for struct usb_gadget_driver in
include/linux/usb/gadget.h) may run in interrupt context. This may
help prevent similar bugs from arising in the future.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
d8195536ce2624e2947d9f56b1a61e7a27874bd3 , < bed19d95fcb9c98dfaa9585922b39a2dfba7898d
(git)
Affected: 286d9975a838d0a54da049765fa1d1fb96b89682 , < 8c1edc00db65f6d4408b3d1cd845e8da3b9e0ca4 (git) Affected: 286d9975a838d0a54da049765fa1d1fb96b89682 , < 65dadb2beeb7360232b09ebc4585b54475dfee06 (git) Affected: 85102a45c7390caf124a3a5796574446f1e037b9 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "bed19d95fcb9c98dfaa9585922b39a2dfba7898d",
"status": "affected",
"version": "d8195536ce2624e2947d9f56b1a61e7a27874bd3",
"versionType": "git"
},
{
"lessThan": "8c1edc00db65f6d4408b3d1cd845e8da3b9e0ca4",
"status": "affected",
"version": "286d9975a838d0a54da049765fa1d1fb96b89682",
"versionType": "git"
},
{
"lessThan": "65dadb2beeb7360232b09ebc4585b54475dfee06",
"status": "affected",
"version": "286d9975a838d0a54da049765fa1d1fb96b89682",
"versionType": "git"
},
{
"status": "affected",
"version": "85102a45c7390caf124a3a5796574446f1e037b9",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/usb/gadget/udc/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"lessThan": "6.4",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.46",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.11",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.46",
"versionStartIncluding": "6.1.35",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.11",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "6.4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.3.9",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nUSB: Gadget: core: Help prevent panic during UVC unconfigure\n\nAvichal Rakesh reported a kernel panic that occurred when the UVC\ngadget driver was removed from a gadget\u0027s configuration. The panic\ninvolves a somewhat complicated interaction between the kernel driver\nand a userspace component (as described in the Link tag below), but\nthe analysis did make one thing clear: The Gadget core should\naccomodate gadget drivers calling usb_gadget_deactivate() as part of\ntheir unbind procedure.\n\nCurrently this doesn\u0027t work. gadget_unbind_driver() calls\ndriver-\u003eunbind() while holding the udc-\u003econnect_lock mutex, and\nusb_gadget_deactivate() attempts to acquire that mutex, which will\nresult in a deadlock.\n\nThe simple fix is for gadget_unbind_driver() to release the mutex when\ninvoking the -\u003eunbind() callback. There is no particular reason for\nit to be holding the mutex at that time, and the mutex isn\u0027t held\nwhile the -\u003ebind() callback is invoked. So we\u0027ll drop the mutex\nbefore performing the unbind callback and reacquire it afterward.\n\nWe\u0027ll also add a couple of comments to usb_gadget_activate() and\nusb_gadget_deactivate(). Because they run in process context they\nmust not be called from a gadget driver\u0027s -\u003edisconnect() callback,\nwhich (according to the kerneldoc for struct usb_gadget_driver in\ninclude/linux/usb/gadget.h) may run in interrupt context. This may\nhelp prevent similar bugs from arising in the future."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:43:57.064Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/bed19d95fcb9c98dfaa9585922b39a2dfba7898d"
},
{
"url": "https://git.kernel.org/stable/c/8c1edc00db65f6d4408b3d1cd845e8da3b9e0ca4"
},
{
"url": "https://git.kernel.org/stable/c/65dadb2beeb7360232b09ebc4585b54475dfee06"
}
],
"title": "USB: Gadget: core: Help prevent panic during UVC unconfigure",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53580",
"datePublished": "2025-10-04T15:43:57.064Z",
"dateReserved": "2025-10-04T15:14:15.926Z",
"dateUpdated": "2025-10-04T15:43:57.064Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-39933 (GCVE-0-2025-39933)
Vulnerability from cvelistv5 – Published: 2025-10-04 07:30 – Updated: 2025-10-04 07:30
VLAI?
EPSS
Title
smb: client: let recv_done verify data_offset, data_length and remaining_data_length
Summary
In the Linux kernel, the following vulnerability has been resolved:
smb: client: let recv_done verify data_offset, data_length and remaining_data_length
This is inspired by the related server fixes.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smbdirect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "581fb78e0388b78911b0c920e4073737090c8b5f",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
},
{
"lessThan": "f57e53ea252363234f86674db475839e5b87102e",
"status": "affected",
"version": "f198186aa9bbd60fae7a2061f4feec614d880299",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/smb/client/smbdirect.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.16"
},
{
"lessThan": "4.16",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.16.*",
"status": "unaffected",
"version": "6.16.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.17",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.16.9",
"versionStartIncluding": "4.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.17",
"versionStartIncluding": "4.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: client: let recv_done verify data_offset, data_length and remaining_data_length\n\nThis is inspired by the related server fixes."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T07:30:57.496Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/581fb78e0388b78911b0c920e4073737090c8b5f"
},
{
"url": "https://git.kernel.org/stable/c/f57e53ea252363234f86674db475839e5b87102e"
}
],
"title": "smb: client: let recv_done verify data_offset, data_length and remaining_data_length",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2025-39933",
"datePublished": "2025-10-04T07:30:57.496Z",
"dateReserved": "2025-04-16T07:20:57.148Z",
"dateUpdated": "2025-10-04T07:30:57.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53536 (GCVE-0-2023-53536)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
blk-crypto: make blk_crypto_evict_key() more robust
Summary
In the Linux kernel, the following vulnerability has been resolved:
blk-crypto: make blk_crypto_evict_key() more robust
If blk_crypto_evict_key() sees that the key is still in-use (due to a
bug) or that ->keyslot_evict failed, it currently just returns while
leaving the key linked into the keyslot management structures.
However, blk_crypto_evict_key() is only called in contexts such as inode
eviction where failure is not an option. So actually the caller
proceeds with freeing the blk_crypto_key regardless of the return value
of blk_crypto_evict_key().
These two assumptions don't match, and the result is that there can be a
use-after-free in blk_crypto_reprogram_all_keys() after one of these
errors occurs. (Note, these errors *shouldn't* happen; we're just
talking about what happens if they do anyway.)
Fix this by making blk_crypto_evict_key() unlink the key from the
keyslot management structures even on failure.
Also improve some comments.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
1b2628397058ebce7277480960b29c788138de90 , < 701a8220762ff90615dc91d3543f789391b63298
(git)
Affected: 1b2628397058ebce7277480960b29c788138de90 , < 5bb4005fb667c6e2188fa87950f8d5faf2994410 (git) Affected: 1b2628397058ebce7277480960b29c788138de90 , < 64ef787bb1588475163069c2e62fdd8f6c27b1f6 (git) Affected: 1b2628397058ebce7277480960b29c788138de90 , < 809a5be62e92a444a3c3d7b9f438019d0b322f55 (git) Affected: 1b2628397058ebce7277480960b29c788138de90 , < 5c62852942667c613de0458fc797c5b8c36112b5 (git) Affected: 1b2628397058ebce7277480960b29c788138de90 , < 5c7cb94452901a93e90c2230632e2c12a681bc92 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"block/blk-crypto-profile.c",
"block/blk-crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "701a8220762ff90615dc91d3543f789391b63298",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "5bb4005fb667c6e2188fa87950f8d5faf2994410",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "64ef787bb1588475163069c2e62fdd8f6c27b1f6",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "809a5be62e92a444a3c3d7b9f438019d0b322f55",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "5c62852942667c613de0458fc797c5b8c36112b5",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
},
{
"lessThan": "5c7cb94452901a93e90c2230632e2c12a681bc92",
"status": "affected",
"version": "1b2628397058ebce7277480960b29c788138de90",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"block/blk-crypto-profile.c",
"block/blk-crypto.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.8"
},
{
"lessThan": "5.8",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.180",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.111",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.180",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.111",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "5.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-crypto: make blk_crypto_evict_key() more robust\n\nIf blk_crypto_evict_key() sees that the key is still in-use (due to a\nbug) or that -\u003ekeyslot_evict failed, it currently just returns while\nleaving the key linked into the keyslot management structures.\n\nHowever, blk_crypto_evict_key() is only called in contexts such as inode\neviction where failure is not an option. So actually the caller\nproceeds with freeing the blk_crypto_key regardless of the return value\nof blk_crypto_evict_key().\n\nThese two assumptions don\u0027t match, and the result is that there can be a\nuse-after-free in blk_crypto_reprogram_all_keys() after one of these\nerrors occurs. (Note, these errors *shouldn\u0027t* happen; we\u0027re just\ntalking about what happens if they do anyway.)\n\nFix this by making blk_crypto_evict_key() unlink the key from the\nkeyslot management structures even on failure.\n\nAlso improve some comments."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:47.304Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/701a8220762ff90615dc91d3543f789391b63298"
},
{
"url": "https://git.kernel.org/stable/c/5bb4005fb667c6e2188fa87950f8d5faf2994410"
},
{
"url": "https://git.kernel.org/stable/c/64ef787bb1588475163069c2e62fdd8f6c27b1f6"
},
{
"url": "https://git.kernel.org/stable/c/809a5be62e92a444a3c3d7b9f438019d0b322f55"
},
{
"url": "https://git.kernel.org/stable/c/5c62852942667c613de0458fc797c5b8c36112b5"
},
{
"url": "https://git.kernel.org/stable/c/5c7cb94452901a93e90c2230632e2c12a681bc92"
}
],
"title": "blk-crypto: make blk_crypto_evict_key() more robust",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53536",
"datePublished": "2025-10-04T15:16:47.304Z",
"dateReserved": "2025-10-04T15:14:15.919Z",
"dateUpdated": "2025-10-04T15:16:47.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-50495 (GCVE-0-2022-50495)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:43 – Updated: 2025-10-05 09:31
VLAI?
EPSS
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2025-10-05T09:31:38.372Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"rejectedReasons": [
{
"lang": "en",
"value": "This CVE ID has been rejected or withdrawn by its CVE Numbering Authority."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2022-50495",
"datePublished": "2025-10-04T15:43:47.266Z",
"dateRejected": "2025-10-05T09:31:38.372Z",
"dateReserved": "2025-10-04T15:39:19.464Z",
"dateUpdated": "2025-10-05T09:31:38.372Z",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53598 (GCVE-0-2023-53598)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
bus: mhi: host: Range check CHDBOFF and ERDBOFF
Summary
In the Linux kernel, the following vulnerability has been resolved:
bus: mhi: host: Range check CHDBOFF and ERDBOFF
If the value read from the CHDBOFF and ERDBOFF registers is outside the
range of the MHI register space then an invalid address might be computed
which later causes a kernel panic. Range check the read value to prevent
a crash due to bad data from the device.
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
6cd330ae76ffd5c8f6294c423cabde7eeef1b40c , < 372f1752b74572b0a9d2288841eab7db17daccae
(git)
Affected: 6cd330ae76ffd5c8f6294c423cabde7eeef1b40c , < 2343385fe6eed11d0432ab42a97b3ca4aef06a99 (git) Affected: 6cd330ae76ffd5c8f6294c423cabde7eeef1b40c , < a2cbb1a45a0c86ce77839c0875414efe1a89315e (git) Affected: 6cd330ae76ffd5c8f6294c423cabde7eeef1b40c , < 83bf6b87e2dd053d95d89eb2f01ae885f9e568db (git) Affected: 6cd330ae76ffd5c8f6294c423cabde7eeef1b40c , < 4e584127ec2bd42a37c88badb49df409f21fa40a (git) Affected: 6cd330ae76ffd5c8f6294c423cabde7eeef1b40c , < 6a0c637bfee69a74c104468544d9f2a6579626d0 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/bus/mhi/host/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "372f1752b74572b0a9d2288841eab7db17daccae",
"status": "affected",
"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c",
"versionType": "git"
},
{
"lessThan": "2343385fe6eed11d0432ab42a97b3ca4aef06a99",
"status": "affected",
"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c",
"versionType": "git"
},
{
"lessThan": "a2cbb1a45a0c86ce77839c0875414efe1a89315e",
"status": "affected",
"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c",
"versionType": "git"
},
{
"lessThan": "83bf6b87e2dd053d95d89eb2f01ae885f9e568db",
"status": "affected",
"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c",
"versionType": "git"
},
{
"lessThan": "4e584127ec2bd42a37c88badb49df409f21fa40a",
"status": "affected",
"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c",
"versionType": "git"
},
{
"lessThan": "6a0c637bfee69a74c104468544d9f2a6579626d0",
"status": "affected",
"version": "6cd330ae76ffd5c8f6294c423cabde7eeef1b40c",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/bus/mhi/host/init.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"lessThan": "5.7",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.192",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.112",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.28",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.15",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.192",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.112",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.28",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.15",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.2",
"versionStartIncluding": "5.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: mhi: host: Range check CHDBOFF and ERDBOFF\n\nIf the value read from the CHDBOFF and ERDBOFF registers is outside the\nrange of the MHI register space then an invalid address might be computed\nwhich later causes a kernel panic. Range check the read value to prevent\na crash due to bad data from the device."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:10.380Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/372f1752b74572b0a9d2288841eab7db17daccae"
},
{
"url": "https://git.kernel.org/stable/c/2343385fe6eed11d0432ab42a97b3ca4aef06a99"
},
{
"url": "https://git.kernel.org/stable/c/a2cbb1a45a0c86ce77839c0875414efe1a89315e"
},
{
"url": "https://git.kernel.org/stable/c/83bf6b87e2dd053d95d89eb2f01ae885f9e568db"
},
{
"url": "https://git.kernel.org/stable/c/4e584127ec2bd42a37c88badb49df409f21fa40a"
},
{
"url": "https://git.kernel.org/stable/c/6a0c637bfee69a74c104468544d9f2a6579626d0"
}
],
"title": "bus: mhi: host: Range check CHDBOFF and ERDBOFF",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53598",
"datePublished": "2025-10-04T15:44:10.380Z",
"dateReserved": "2025-10-04T15:40:38.479Z",
"dateUpdated": "2025-10-04T15:44:10.380Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53560 (GCVE-0-2023-53560)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
tracing/histograms: Add histograms to hist_vars if they have referenced variables
Summary
In the Linux kernel, the following vulnerability has been resolved:
tracing/histograms: Add histograms to hist_vars if they have referenced variables
Hist triggers can have referenced variables without having direct
variables fields. This can be the case if referenced variables are added
for trigger actions. In this case the newly added references will not
have field variables. Not taking such referenced variables into
consideration can result in a bug where it would be possible to remove
hist trigger with variables being refenced. This will result in a bug
that is easily reproducable like so
$ cd /sys/kernel/tracing
$ echo 'synthetic_sys_enter char[] comm; long id' >> synthetic_events
$ echo 'hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname' >> events/raw_syscalls/sys_enter/trigger
$ echo 'hist:keys=common_pid.execname,id.syscall:onmatch(raw_syscalls.sys_enter).synthetic_sys_enter($comm, id)' >> events/raw_syscalls/sys_enter/trigger
$ echo '!hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname' >> events/raw_syscalls/sys_enter/trigger
[ 100.263533] ==================================================================
[ 100.264634] BUG: KASAN: slab-use-after-free in resolve_var_refs+0xc7/0x180
[ 100.265520] Read of size 8 at addr ffff88810375d0f0 by task bash/439
[ 100.266320]
[ 100.266533] CPU: 2 PID: 439 Comm: bash Not tainted 6.5.0-rc1 #4
[ 100.267277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-20220807_005459-localhost 04/01/2014
[ 100.268561] Call Trace:
[ 100.268902] <TASK>
[ 100.269189] dump_stack_lvl+0x4c/0x70
[ 100.269680] print_report+0xc5/0x600
[ 100.270165] ? resolve_var_refs+0xc7/0x180
[ 100.270697] ? kasan_complete_mode_report_info+0x80/0x1f0
[ 100.271389] ? resolve_var_refs+0xc7/0x180
[ 100.271913] kasan_report+0xbd/0x100
[ 100.272380] ? resolve_var_refs+0xc7/0x180
[ 100.272920] __asan_load8+0x71/0xa0
[ 100.273377] resolve_var_refs+0xc7/0x180
[ 100.273888] event_hist_trigger+0x749/0x860
[ 100.274505] ? kasan_save_stack+0x2a/0x50
[ 100.275024] ? kasan_set_track+0x29/0x40
[ 100.275536] ? __pfx_event_hist_trigger+0x10/0x10
[ 100.276138] ? ksys_write+0xd1/0x170
[ 100.276607] ? do_syscall_64+0x3c/0x90
[ 100.277099] ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 100.277771] ? destroy_hist_data+0x446/0x470
[ 100.278324] ? event_hist_trigger_parse+0xa6c/0x3860
[ 100.278962] ? __pfx_event_hist_trigger_parse+0x10/0x10
[ 100.279627] ? __kasan_check_write+0x18/0x20
[ 100.280177] ? mutex_unlock+0x85/0xd0
[ 100.280660] ? __pfx_mutex_unlock+0x10/0x10
[ 100.281200] ? kfree+0x7b/0x120
[ 100.281619] ? ____kasan_slab_free+0x15d/0x1d0
[ 100.282197] ? event_trigger_write+0xac/0x100
[ 100.282764] ? __kasan_slab_free+0x16/0x20
[ 100.283293] ? __kmem_cache_free+0x153/0x2f0
[ 100.283844] ? sched_mm_cid_remote_clear+0xb1/0x250
[ 100.284550] ? __pfx_sched_mm_cid_remote_clear+0x10/0x10
[ 100.285221] ? event_trigger_write+0xbc/0x100
[ 100.285781] ? __kasan_check_read+0x15/0x20
[ 100.286321] ? __bitmap_weight+0x66/0xa0
[ 100.286833] ? _find_next_bit+0x46/0xe0
[ 100.287334] ? task_mm_cid_work+0x37f/0x450
[ 100.287872] event_triggers_call+0x84/0x150
[ 100.288408] trace_event_buffer_commit+0x339/0x430
[ 100.289073] ? ring_buffer_event_data+0x3f/0x60
[ 100.292189] trace_event_raw_event_sys_enter+0x8b/0xe0
[ 100.295434] syscall_trace_enter.constprop.0+0x18f/0x1b0
[ 100.298653] syscall_enter_from_user_mode+0x32/0x40
[ 100.301808] do_syscall_64+0x1a/0x90
[ 100.304748] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 100.307775] RIP: 0033:0x7f686c75c1cb
[ 100.310617] Code: 73 01 c3 48 8b 0d 65 3c 10 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 21 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 35 3c 10 00 f7 d8 64 89 01 48
[ 100.317847] RSP: 002b:00007ffc60137a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000021
[ 100.321200] RA
---truncated---
Severity ?
No CVSS data available.
Assigner
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 4ffad1528e81c91769d9da1f8436080861c8ec67
(git)
Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 4815359056083c555f97a5ee3af86519be5166de (git) Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 1576f0df7b4d1f82db588d6654b89d796fa06929 (git) Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 97f54b330c797ed27fba8791baeaa38ace886cbd (git) Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 5fd32eb6fa0ac795aa5a64bc004ab68d7b44196a (git) Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 4a540f63618e525e433b37d2b5522cda08e321d7 (git) Affected: 067fe038e70f6e64960d26a79c4df5f1413d0f13 , < 6018b585e8c6fa7d85d4b38d9ce49a5b67be7078 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "4ffad1528e81c91769d9da1f8436080861c8ec67",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "4815359056083c555f97a5ee3af86519be5166de",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "1576f0df7b4d1f82db588d6654b89d796fa06929",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "97f54b330c797ed27fba8791baeaa38ace886cbd",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "5fd32eb6fa0ac795aa5a64bc004ab68d7b44196a",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "4a540f63618e525e433b37d2b5522cda08e321d7",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
},
{
"lessThan": "6018b585e8c6fa7d85d4b38d9ce49a5b67be7078",
"status": "affected",
"version": "067fe038e70f6e64960d26a79c4df5f1413d0f13",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"kernel/trace/trace_events_hist.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.17"
},
{
"lessThan": "4.17",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "4.19.*",
"status": "unaffected",
"version": "4.19.291",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.4.*",
"status": "unaffected",
"version": "5.4.251",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.188",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.121",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.40",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.4.*",
"status": "unaffected",
"version": "6.4.5",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.5",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.19.291",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.4.251",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.188",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.121",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.40",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4.5",
"versionStartIncluding": "4.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5",
"versionStartIncluding": "4.17",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing/histograms: Add histograms to hist_vars if they have referenced variables\n\nHist triggers can have referenced variables without having direct\nvariables fields. This can be the case if referenced variables are added\nfor trigger actions. In this case the newly added references will not\nhave field variables. Not taking such referenced variables into\nconsideration can result in a bug where it would be possible to remove\nhist trigger with variables being refenced. This will result in a bug\nthat is easily reproducable like so\n\n$ cd /sys/kernel/tracing\n$ echo \u0027synthetic_sys_enter char[] comm; long id\u0027 \u003e\u003e synthetic_events\n$ echo \u0027hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname\u0027 \u003e\u003e events/raw_syscalls/sys_enter/trigger\n$ echo \u0027hist:keys=common_pid.execname,id.syscall:onmatch(raw_syscalls.sys_enter).synthetic_sys_enter($comm, id)\u0027 \u003e\u003e events/raw_syscalls/sys_enter/trigger\n$ echo \u0027!hist:keys=common_pid.execname,id.syscall:vals=hitcount:comm=common_pid.execname\u0027 \u003e\u003e events/raw_syscalls/sys_enter/trigger\n\n[ 100.263533] ==================================================================\n[ 100.264634] BUG: KASAN: slab-use-after-free in resolve_var_refs+0xc7/0x180\n[ 100.265520] Read of size 8 at addr ffff88810375d0f0 by task bash/439\n[ 100.266320]\n[ 100.266533] CPU: 2 PID: 439 Comm: bash Not tainted 6.5.0-rc1 #4\n[ 100.267277] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.0-20220807_005459-localhost 04/01/2014\n[ 100.268561] Call Trace:\n[ 100.268902] \u003cTASK\u003e\n[ 100.269189] dump_stack_lvl+0x4c/0x70\n[ 100.269680] print_report+0xc5/0x600\n[ 100.270165] ? resolve_var_refs+0xc7/0x180\n[ 100.270697] ? kasan_complete_mode_report_info+0x80/0x1f0\n[ 100.271389] ? resolve_var_refs+0xc7/0x180\n[ 100.271913] kasan_report+0xbd/0x100\n[ 100.272380] ? resolve_var_refs+0xc7/0x180\n[ 100.272920] __asan_load8+0x71/0xa0\n[ 100.273377] resolve_var_refs+0xc7/0x180\n[ 100.273888] event_hist_trigger+0x749/0x860\n[ 100.274505] ? kasan_save_stack+0x2a/0x50\n[ 100.275024] ? kasan_set_track+0x29/0x40\n[ 100.275536] ? __pfx_event_hist_trigger+0x10/0x10\n[ 100.276138] ? ksys_write+0xd1/0x170\n[ 100.276607] ? do_syscall_64+0x3c/0x90\n[ 100.277099] ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n[ 100.277771] ? destroy_hist_data+0x446/0x470\n[ 100.278324] ? event_hist_trigger_parse+0xa6c/0x3860\n[ 100.278962] ? __pfx_event_hist_trigger_parse+0x10/0x10\n[ 100.279627] ? __kasan_check_write+0x18/0x20\n[ 100.280177] ? mutex_unlock+0x85/0xd0\n[ 100.280660] ? __pfx_mutex_unlock+0x10/0x10\n[ 100.281200] ? kfree+0x7b/0x120\n[ 100.281619] ? ____kasan_slab_free+0x15d/0x1d0\n[ 100.282197] ? event_trigger_write+0xac/0x100\n[ 100.282764] ? __kasan_slab_free+0x16/0x20\n[ 100.283293] ? __kmem_cache_free+0x153/0x2f0\n[ 100.283844] ? sched_mm_cid_remote_clear+0xb1/0x250\n[ 100.284550] ? __pfx_sched_mm_cid_remote_clear+0x10/0x10\n[ 100.285221] ? event_trigger_write+0xbc/0x100\n[ 100.285781] ? __kasan_check_read+0x15/0x20\n[ 100.286321] ? __bitmap_weight+0x66/0xa0\n[ 100.286833] ? _find_next_bit+0x46/0xe0\n[ 100.287334] ? task_mm_cid_work+0x37f/0x450\n[ 100.287872] event_triggers_call+0x84/0x150\n[ 100.288408] trace_event_buffer_commit+0x339/0x430\n[ 100.289073] ? ring_buffer_event_data+0x3f/0x60\n[ 100.292189] trace_event_raw_event_sys_enter+0x8b/0xe0\n[ 100.295434] syscall_trace_enter.constprop.0+0x18f/0x1b0\n[ 100.298653] syscall_enter_from_user_mode+0x32/0x40\n[ 100.301808] do_syscall_64+0x1a/0x90\n[ 100.304748] entry_SYSCALL_64_after_hwframe+0x6e/0xd8\n[ 100.307775] RIP: 0033:0x7f686c75c1cb\n[ 100.310617] Code: 73 01 c3 48 8b 0d 65 3c 10 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 21 00 00 00 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 8b 0d 35 3c 10 00 f7 d8 64 89 01 48\n[ 100.317847] RSP: 002b:00007ffc60137a38 EFLAGS: 00000246 ORIG_RAX: 0000000000000021\n[ 100.321200] RA\n---truncated---"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:04.299Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/4ffad1528e81c91769d9da1f8436080861c8ec67"
},
{
"url": "https://git.kernel.org/stable/c/4815359056083c555f97a5ee3af86519be5166de"
},
{
"url": "https://git.kernel.org/stable/c/1576f0df7b4d1f82db588d6654b89d796fa06929"
},
{
"url": "https://git.kernel.org/stable/c/97f54b330c797ed27fba8791baeaa38ace886cbd"
},
{
"url": "https://git.kernel.org/stable/c/5fd32eb6fa0ac795aa5a64bc004ab68d7b44196a"
},
{
"url": "https://git.kernel.org/stable/c/4a540f63618e525e433b37d2b5522cda08e321d7"
},
{
"url": "https://git.kernel.org/stable/c/6018b585e8c6fa7d85d4b38d9ce49a5b67be7078"
}
],
"title": "tracing/histograms: Add histograms to hist_vars if they have referenced variables",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53560",
"datePublished": "2025-10-04T15:17:04.299Z",
"dateReserved": "2025-10-04T15:14:15.923Z",
"dateUpdated": "2025-10-04T15:17:04.299Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53578 (GCVE-0-2023-53578)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()
Syzbot reported a bug as following:
=====================================================
BUG: KMSAN: uninit-value in qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230
qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230
qrtr_endpoint_post+0xf85/0x11b0 net/qrtr/af_qrtr.c:519
qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108
call_write_iter include/linux/fs.h:2189 [inline]
aio_write+0x63a/0x950 fs/aio.c:1600
io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
__do_sys_io_submit fs/aio.c:2078 [inline]
__se_sys_io_submit+0x293/0x770 fs/aio.c:2048
__x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at:
slab_post_alloc_hook mm/slab.h:766 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
__kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491
__do_kmalloc_node mm/slab_common.c:967 [inline]
__kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988
kmalloc_reserve net/core/skbuff.c:492 [inline]
__alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565
__netdev_alloc_skb+0x120/0x7d0 net/core/skbuff.c:630
qrtr_endpoint_post+0xbd/0x11b0 net/qrtr/af_qrtr.c:446
qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108
call_write_iter include/linux/fs.h:2189 [inline]
aio_write+0x63a/0x950 fs/aio.c:1600
io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019
__do_sys_io_submit fs/aio.c:2078 [inline]
__se_sys_io_submit+0x293/0x770 fs/aio.c:2048
__x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
It is because that skb->len requires at least sizeof(struct qrtr_ctrl_pkt)
in qrtr_tx_resume(). And skb->len equals to size in qrtr_endpoint_post().
But size is less than sizeof(struct qrtr_ctrl_pkt) when qrtr_cb->type
equals to QRTR_TYPE_RESUME_TX in qrtr_endpoint_post() under the syzbot
scenario. This triggers the uninit variable access bug.
Add size check when qrtr_cb->type equals to QRTR_TYPE_RESUME_TX in
qrtr_endpoint_post() to fix the bug.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
5fdeb0d372ab33b4175043a2a4a1730239a217f1 , < 3814d211ff13ee35f2d9437439a6c7df58524137
(git)
Affected: 5fdeb0d372ab33b4175043a2a4a1730239a217f1 , < c6a796ee5a639ffb83c6e5469408cc2ec16cac6a (git) Affected: 5fdeb0d372ab33b4175043a2a4a1730239a217f1 , < bef57c227b52c2bde00fad33556175d36d12cfa0 (git) Affected: 5fdeb0d372ab33b4175043a2a4a1730239a217f1 , < 8c9ce34a6ff2c544f96ce0b088e8fd3c1b9698c4 (git) Affected: 5fdeb0d372ab33b4175043a2a4a1730239a217f1 , < 6417070918de3bcdbe0646e7256dae58fd8083ba (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/qrtr/af_qrtr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "3814d211ff13ee35f2d9437439a6c7df58524137",
"status": "affected",
"version": "5fdeb0d372ab33b4175043a2a4a1730239a217f1",
"versionType": "git"
},
{
"lessThan": "c6a796ee5a639ffb83c6e5469408cc2ec16cac6a",
"status": "affected",
"version": "5fdeb0d372ab33b4175043a2a4a1730239a217f1",
"versionType": "git"
},
{
"lessThan": "bef57c227b52c2bde00fad33556175d36d12cfa0",
"status": "affected",
"version": "5fdeb0d372ab33b4175043a2a4a1730239a217f1",
"versionType": "git"
},
{
"lessThan": "8c9ce34a6ff2c544f96ce0b088e8fd3c1b9698c4",
"status": "affected",
"version": "5fdeb0d372ab33b4175043a2a4a1730239a217f1",
"versionType": "git"
},
{
"lessThan": "6417070918de3bcdbe0646e7256dae58fd8083ba",
"status": "affected",
"version": "5fdeb0d372ab33b4175043a2a4a1730239a217f1",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/qrtr/af_qrtr.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.6"
},
{
"lessThan": "5.6",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.178",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.108",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.25",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.178",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.108",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.25",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.12",
"versionStartIncluding": "5.6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "5.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()\n\nSyzbot reported a bug as following:\n\n=====================================================\nBUG: KMSAN: uninit-value in qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230\n qrtr_tx_resume+0x185/0x1f0 net/qrtr/af_qrtr.c:230\n qrtr_endpoint_post+0xf85/0x11b0 net/qrtr/af_qrtr.c:519\n qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108\n call_write_iter include/linux/fs.h:2189 [inline]\n aio_write+0x63a/0x950 fs/aio.c:1600\n io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019\n __do_sys_io_submit fs/aio.c:2078 [inline]\n __se_sys_io_submit+0x293/0x770 fs/aio.c:2048\n __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nUninit was created at:\n slab_post_alloc_hook mm/slab.h:766 [inline]\n slab_alloc_node mm/slub.c:3452 [inline]\n __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491\n __do_kmalloc_node mm/slab_common.c:967 [inline]\n __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988\n kmalloc_reserve net/core/skbuff.c:492 [inline]\n __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565\n __netdev_alloc_skb+0x120/0x7d0 net/core/skbuff.c:630\n qrtr_endpoint_post+0xbd/0x11b0 net/qrtr/af_qrtr.c:446\n qrtr_tun_write_iter+0x270/0x400 net/qrtr/tun.c:108\n call_write_iter include/linux/fs.h:2189 [inline]\n aio_write+0x63a/0x950 fs/aio.c:1600\n io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019\n __do_sys_io_submit fs/aio.c:2078 [inline]\n __se_sys_io_submit+0x293/0x770 fs/aio.c:2048\n __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x63/0xcd\n\nIt is because that skb-\u003elen requires at least sizeof(struct qrtr_ctrl_pkt)\nin qrtr_tx_resume(). And skb-\u003elen equals to size in qrtr_endpoint_post().\nBut size is less than sizeof(struct qrtr_ctrl_pkt) when qrtr_cb-\u003etype\nequals to QRTR_TYPE_RESUME_TX in qrtr_endpoint_post() under the syzbot\nscenario. This triggers the uninit variable access bug.\n\nAdd size check when qrtr_cb-\u003etype equals to QRTR_TYPE_RESUME_TX in\nqrtr_endpoint_post() to fix the bug."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:17.350Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/3814d211ff13ee35f2d9437439a6c7df58524137"
},
{
"url": "https://git.kernel.org/stable/c/c6a796ee5a639ffb83c6e5469408cc2ec16cac6a"
},
{
"url": "https://git.kernel.org/stable/c/bef57c227b52c2bde00fad33556175d36d12cfa0"
},
{
"url": "https://git.kernel.org/stable/c/8c9ce34a6ff2c544f96ce0b088e8fd3c1b9698c4"
},
{
"url": "https://git.kernel.org/stable/c/6417070918de3bcdbe0646e7256dae58fd8083ba"
}
],
"title": "net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53578",
"datePublished": "2025-10-04T15:17:17.350Z",
"dateReserved": "2025-10-04T15:14:15.926Z",
"dateUpdated": "2025-10-04T15:17:17.350Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53552 (GCVE-0-2023-53552)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2025-10-04 15:16
VLAI?
EPSS
Title
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
Summary
In the Linux kernel, the following vulnerability has been resolved:
drm/i915: mark requests for GuC virtual engines to avoid use-after-free
References to i915_requests may be trapped by userspace inside a
sync_file or dmabuf (dma-resv) and held indefinitely across different
proceses. To counter-act the memory leaks, we try to not to keep
references from the request past their completion.
On the other side on fence release we need to know if rq->engine
is valid and points to hw engine (true for non-virtual requests).
To make it possible extra bit has been added to rq->execution_mask,
for marking virtual engines.
(cherry picked from commit 280410677af763f3871b93e794a199cfcf6fb580)
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
bcb9aa45d5a0e11ef91245330c53cde214d15e8d , < 8017a27cec32eac8c8f9430b0a3055840136b856
(git)
Affected: bcb9aa45d5a0e11ef91245330c53cde214d15e8d , < 7fb464d52fa41c31a6fd1ad82888e67c65935d94 (git) Affected: bcb9aa45d5a0e11ef91245330c53cde214d15e8d , < 5eefc5307c983b59344a4cb89009819f580c84fa (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_engine_types.h",
"drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c",
"drivers/gpu/drm/i915/i915_request.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8017a27cec32eac8c8f9430b0a3055840136b856",
"status": "affected",
"version": "bcb9aa45d5a0e11ef91245330c53cde214d15e8d",
"versionType": "git"
},
{
"lessThan": "7fb464d52fa41c31a6fd1ad82888e67c65935d94",
"status": "affected",
"version": "bcb9aa45d5a0e11ef91245330c53cde214d15e8d",
"versionType": "git"
},
{
"lessThan": "5eefc5307c983b59344a4cb89009819f580c84fa",
"status": "affected",
"version": "bcb9aa45d5a0e11ef91245330c53cde214d15e8d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/gpu/drm/i915/gt/intel_engine_types.h",
"drivers/gpu/drm/i915/gt/uc/intel_guc_submission.c",
"drivers/gpu/drm/i915/i915_request.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.0"
},
{
"lessThan": "6.0",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.54",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.5.*",
"status": "unaffected",
"version": "6.5.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.6",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.54",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.5.4",
"versionStartIncluding": "6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/i915: mark requests for GuC virtual engines to avoid use-after-free\n\nReferences to i915_requests may be trapped by userspace inside a\nsync_file or dmabuf (dma-resv) and held indefinitely across different\nproceses. To counter-act the memory leaks, we try to not to keep\nreferences from the request past their completion.\nOn the other side on fence release we need to know if rq-\u003eengine\nis valid and points to hw engine (true for non-virtual requests).\nTo make it possible extra bit has been added to rq-\u003eexecution_mask,\nfor marking virtual engines.\n\n(cherry picked from commit 280410677af763f3871b93e794a199cfcf6fb580)"
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:16:58.429Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8017a27cec32eac8c8f9430b0a3055840136b856"
},
{
"url": "https://git.kernel.org/stable/c/7fb464d52fa41c31a6fd1ad82888e67c65935d94"
},
{
"url": "https://git.kernel.org/stable/c/5eefc5307c983b59344a4cb89009819f580c84fa"
}
],
"title": "drm/i915: mark requests for GuC virtual engines to avoid use-after-free",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53552",
"datePublished": "2025-10-04T15:16:58.429Z",
"dateReserved": "2025-10-04T15:14:15.922Z",
"dateUpdated": "2025-10-04T15:16:58.429Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53561 (GCVE-0-2023-53561)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:17 – Updated: 2025-10-04 15:17
VLAI?
EPSS
Title
net: wwan: iosm: fix NULL pointer dereference when removing device
Summary
In the Linux kernel, the following vulnerability has been resolved:
net: wwan: iosm: fix NULL pointer dereference when removing device
In suspend and resume cycle, the removal and rescan of device ends
up in NULL pointer dereference.
During driver initialization, if the ipc_imem_wwan_channel_init()
fails to get the valid device capabilities it returns an error and
further no resource (wwan struct) will be allocated. Now in this
situation if driver removal procedure is initiated it would result
in NULL pointer exception since unallocated wwan struct is dereferenced
inside ipc_wwan_deinit().
ipc_imem_run_state_worker() to handle the called functions return value
and to release the resource in failure case. It also reports the link
down event in failure cases. The user space application can handle this
event to do a device reset for restoring the device communication.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
3670970dd8c661c10c10c300d726f59428eaad32 , < ee44bacf462db3ec6e4f0dcfa7931e768670d77c
(git)
Affected: 3670970dd8c661c10c10c300d726f59428eaad32 , < 862c6e3e26735247d8a4df41fa2421909c3f4d63 (git) Affected: 3670970dd8c661c10c10c300d726f59428eaad32 , < 60829145f1e2650b31ebe6a0ec70a9725b38fa2c (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/iosm/iosm_ipc_imem.c",
"drivers/net/wwan/iosm/iosm_ipc_imem_ops.c",
"drivers/net/wwan/iosm/iosm_ipc_imem_ops.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "ee44bacf462db3ec6e4f0dcfa7931e768670d77c",
"status": "affected",
"version": "3670970dd8c661c10c10c300d726f59428eaad32",
"versionType": "git"
},
{
"lessThan": "862c6e3e26735247d8a4df41fa2421909c3f4d63",
"status": "affected",
"version": "3670970dd8c661c10c10c300d726f59428eaad32",
"versionType": "git"
},
{
"lessThan": "60829145f1e2650b31ebe6a0ec70a9725b38fa2c",
"status": "affected",
"version": "3670970dd8c661c10c10c300d726f59428eaad32",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/net/wwan/iosm/iosm_ipc_imem.c",
"drivers/net/wwan/iosm/iosm_ipc_imem_ops.c",
"drivers/net/wwan/iosm/iosm_ipc_imem_ops.h"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.14"
},
{
"lessThan": "5.14",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.30",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.30",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "5.14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "5.14",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: wwan: iosm: fix NULL pointer dereference when removing device\n\nIn suspend and resume cycle, the removal and rescan of device ends\nup in NULL pointer dereference.\n\nDuring driver initialization, if the ipc_imem_wwan_channel_init()\nfails to get the valid device capabilities it returns an error and\nfurther no resource (wwan struct) will be allocated. Now in this\nsituation if driver removal procedure is initiated it would result\nin NULL pointer exception since unallocated wwan struct is dereferenced\ninside ipc_wwan_deinit().\n\nipc_imem_run_state_worker() to handle the called functions return value\nand to release the resource in failure case. It also reports the link\ndown event in failure cases. The user space application can handle this\nevent to do a device reset for restoring the device communication."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:17:05.000Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/ee44bacf462db3ec6e4f0dcfa7931e768670d77c"
},
{
"url": "https://git.kernel.org/stable/c/862c6e3e26735247d8a4df41fa2421909c3f4d63"
},
{
"url": "https://git.kernel.org/stable/c/60829145f1e2650b31ebe6a0ec70a9725b38fa2c"
}
],
"title": "net: wwan: iosm: fix NULL pointer dereference when removing device",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53561",
"datePublished": "2025-10-04T15:17:05.000Z",
"dateReserved": "2025-10-04T15:14:15.923Z",
"dateUpdated": "2025-10-04T15:17:05.000Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53594 (GCVE-0-2023-53594)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
driver core: fix resource leak in device_add()
Summary
In the Linux kernel, the following vulnerability has been resolved:
driver core: fix resource leak in device_add()
When calling kobject_add() failed in device_add(), it will call
cleanup_glue_dir() to free resource. But in kobject_add(),
dev->kobj.parent has been set to NULL. This will cause resource leak.
The process is as follows:
device_add()
get_device_parent()
class_dir_create_and_add()
kobject_add() //kobject_get()
...
dev->kobj.parent = kobj;
...
kobject_add() //failed, but set dev->kobj.parent = NULL
...
glue_dir = get_glue_dir(dev) //glue_dir = NULL, and goto
//"Error" label
...
cleanup_glue_dir() //becaues glue_dir is NULL, not call
//kobject_put()
The preceding problem may cause insmod mac80211_hwsim.ko to failed.
sysfs: cannot create duplicate filename '/devices/virtual/mac80211_hwsim'
Call Trace:
<TASK>
dump_stack_lvl+0x8e/0xd1
sysfs_warn_dup.cold+0x1c/0x29
sysfs_create_dir_ns+0x224/0x280
kobject_add_internal+0x2aa/0x880
kobject_add+0x135/0x1a0
get_device_parent+0x3d7/0x590
device_add+0x2aa/0x1cb0
device_create_groups_vargs+0x1eb/0x260
device_create+0xdc/0x110
mac80211_hwsim_new_radio+0x31e/0x4790 [mac80211_hwsim]
init_mac80211_hwsim+0x48d/0x1000 [mac80211_hwsim]
do_one_initcall+0x10f/0x630
do_init_module+0x19f/0x5e0
load_module+0x64b7/0x6eb0
__do_sys_finit_module+0x140/0x200
do_syscall_64+0x35/0x80
entry_SYSCALL_64_after_hwframe+0x46/0xb0
</TASK>
kobject_add_internal failed for mac80211_hwsim with -EEXIST, don't try to
register things with the same name in the same directory.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Linux | Linux |
Affected:
cebf8fd16900fdfd58c0028617944f808f97fe50 , < 8d389e363075c2e1deb84a560686ea92123e4b8b
(git)
Affected: cebf8fd16900fdfd58c0028617944f808f97fe50 , < d1dbff10c6cd3b43457f3efd3c9c4950009635bf (git) Affected: cebf8fd16900fdfd58c0028617944f808f97fe50 , < f39d21154db87545d8f0b25d13c326f37cc32239 (git) Affected: cebf8fd16900fdfd58c0028617944f808f97fe50 , < 6977b1a5d67097eaa4d02b0c126c04cc6e8917c0 (git) Affected: e7f6e3c9db4b6f259c89fd05728d024ab32acd71 (git) Affected: a93a63333dbdb182b87e8cc99df8b4474f867acb (git) Affected: 37de955c11b59050346e530143c20b10b4846527 (git) Affected: 645897231f960590220144b06d1f994b7eb88326 (git) |
||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/base/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8d389e363075c2e1deb84a560686ea92123e4b8b",
"status": "affected",
"version": "cebf8fd16900fdfd58c0028617944f808f97fe50",
"versionType": "git"
},
{
"lessThan": "d1dbff10c6cd3b43457f3efd3c9c4950009635bf",
"status": "affected",
"version": "cebf8fd16900fdfd58c0028617944f808f97fe50",
"versionType": "git"
},
{
"lessThan": "f39d21154db87545d8f0b25d13c326f37cc32239",
"status": "affected",
"version": "cebf8fd16900fdfd58c0028617944f808f97fe50",
"versionType": "git"
},
{
"lessThan": "6977b1a5d67097eaa4d02b0c126c04cc6e8917c0",
"status": "affected",
"version": "cebf8fd16900fdfd58c0028617944f808f97fe50",
"versionType": "git"
},
{
"status": "affected",
"version": "e7f6e3c9db4b6f259c89fd05728d024ab32acd71",
"versionType": "git"
},
{
"status": "affected",
"version": "a93a63333dbdb182b87e8cc99df8b4474f867acb",
"versionType": "git"
},
{
"status": "affected",
"version": "37de955c11b59050346e530143c20b10b4846527",
"versionType": "git"
},
{
"status": "affected",
"version": "645897231f960590220144b06d1f994b7eb88326",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/base/core.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.9"
},
{
"lessThan": "4.9",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.99",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.16",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.2.*",
"status": "unaffected",
"version": "6.2.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.3",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.99",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.16",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.2.3",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3",
"versionStartIncluding": "4.9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.10.105",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "3.12.70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.4.40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.8.16",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndriver core: fix resource leak in device_add()\n\nWhen calling kobject_add() failed in device_add(), it will call\ncleanup_glue_dir() to free resource. But in kobject_add(),\ndev-\u003ekobj.parent has been set to NULL. This will cause resource leak.\n\nThe process is as follows:\ndevice_add()\n\tget_device_parent()\n\t\tclass_dir_create_and_add()\n\t\t\tkobject_add()\t\t//kobject_get()\n\t...\n\tdev-\u003ekobj.parent = kobj;\n\t...\n\tkobject_add()\t\t//failed, but set dev-\u003ekobj.parent = NULL\n\t...\n\tglue_dir = get_glue_dir(dev)\t//glue_dir = NULL, and goto\n\t\t\t\t\t//\"Error\" label\n\t...\n\tcleanup_glue_dir()\t//becaues glue_dir is NULL, not call\n\t\t\t\t//kobject_put()\n\nThe preceding problem may cause insmod mac80211_hwsim.ko to failed.\nsysfs: cannot create duplicate filename \u0027/devices/virtual/mac80211_hwsim\u0027\nCall Trace:\n\u003cTASK\u003e\ndump_stack_lvl+0x8e/0xd1\nsysfs_warn_dup.cold+0x1c/0x29\nsysfs_create_dir_ns+0x224/0x280\nkobject_add_internal+0x2aa/0x880\nkobject_add+0x135/0x1a0\nget_device_parent+0x3d7/0x590\ndevice_add+0x2aa/0x1cb0\ndevice_create_groups_vargs+0x1eb/0x260\ndevice_create+0xdc/0x110\nmac80211_hwsim_new_radio+0x31e/0x4790 [mac80211_hwsim]\ninit_mac80211_hwsim+0x48d/0x1000 [mac80211_hwsim]\ndo_one_initcall+0x10f/0x630\ndo_init_module+0x19f/0x5e0\nload_module+0x64b7/0x6eb0\n__do_sys_finit_module+0x140/0x200\ndo_syscall_64+0x35/0x80\nentry_SYSCALL_64_after_hwframe+0x46/0xb0\n\u003c/TASK\u003e\nkobject_add_internal failed for mac80211_hwsim with -EEXIST, don\u0027t try to\nregister things with the same name in the same directory."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:07.533Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8d389e363075c2e1deb84a560686ea92123e4b8b"
},
{
"url": "https://git.kernel.org/stable/c/d1dbff10c6cd3b43457f3efd3c9c4950009635bf"
},
{
"url": "https://git.kernel.org/stable/c/f39d21154db87545d8f0b25d13c326f37cc32239"
},
{
"url": "https://git.kernel.org/stable/c/6977b1a5d67097eaa4d02b0c126c04cc6e8917c0"
}
],
"title": "driver core: fix resource leak in device_add()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53594",
"datePublished": "2025-10-04T15:44:07.533Z",
"dateReserved": "2025-10-04T15:40:38.478Z",
"dateUpdated": "2025-10-04T15:44:07.533Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-53609 (GCVE-0-2023-53609)
Vulnerability from cvelistv5 – Published: 2025-10-04 15:44 – Updated: 2025-10-04 15:44
VLAI?
EPSS
Title
scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed"
Summary
In the Linux kernel, the following vulnerability has been resolved:
scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed"
The "atomic_inc(&cmd->device->iorequest_cnt)" in scsi_queue_rq() would
cause kernel panic because cmd->device may be freed after returning from
scsi_dispatch_cmd().
This reverts commit cfee29ffb45b1c9798011b19d454637d1b0fe87d.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_lib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "35fe6fa57b994e7da222893adf0bb748d6055e73",
"status": "affected",
"version": "cfee29ffb45b1c9798011b19d454637d1b0fe87d",
"versionType": "git"
},
{
"lessThan": "6ca9818d1624e136a76ae8faedb6b6c95ca66903",
"status": "affected",
"version": "cfee29ffb45b1c9798011b19d454637d1b0fe87d",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"drivers/scsi/scsi_lib.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"lessThan": "6.2",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.3.*",
"status": "unaffected",
"version": "6.3.4",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "6.4",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.3.4",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.4",
"versionStartIncluding": "6.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: Revert \"scsi: core: Do not increase scsi_device\u0027s iorequest_cnt if dispatch failed\"\n\nThe \"atomic_inc(\u0026cmd-\u003edevice-\u003eiorequest_cnt)\" in scsi_queue_rq() would\ncause kernel panic because cmd-\u003edevice may be freed after returning from\nscsi_dispatch_cmd().\n\nThis reverts commit cfee29ffb45b1c9798011b19d454637d1b0fe87d."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-04T15:44:18.151Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/35fe6fa57b994e7da222893adf0bb748d6055e73"
},
{
"url": "https://git.kernel.org/stable/c/6ca9818d1624e136a76ae8faedb6b6c95ca66903"
}
],
"title": "scsi: Revert \"scsi: core: Do not increase scsi_device\u0027s iorequest_cnt if dispatch failed\"",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2023-53609",
"datePublished": "2025-10-04T15:44:18.151Z",
"dateReserved": "2025-10-04T15:40:38.480Z",
"dateUpdated": "2025-10-04T15:44:18.151Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Show additional events:
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…