RHSA-2025:6966 Red Hat Security Advisory: kernel security update
kernel: xen-netfront: Fix NULL sring after live migration kernel: fscache: Fix oops due to race with cookie_lru and use_cookie kernel: tracing: Free buffers when a used dynamic event is removed kernel: net: tun: Fix use-after-free in tun_detach() kernel: hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails kernel: erofs/zmap.c: Fix incorrect offset calculation kernel: arm64/mm: fix incorrect file_map_count for non-leaf pmd/pud kernel: s390: avoid using global register for current_stack_pointer kernel: erofs: fix missing xas_retry() in fscache mode kernel: rpmsg: qcom_smd: Fix refcount leak in qcom_smd_parse_edge kernel: remoteproc: k3-r5: Fix refcount leak in k3_r5_cluster_of_init kernel: of: check previous kernel's ima-kexec-buffer against memory bounds kernel: coresight: Clear the connection field properly kernel: Linux kernel: Denial of Service in coresight: trbe kernel: rpmsg: char: Avoid double destroy of default endpoint kernel: coresight: cti: Fix hang in cti_disable_hw() kernel: lib/fonts: fix undefined behavior in bit shift for get_default_font kernel: Kernel: Denial of Service in pci_endpoint_test due to zero-length DMA mapping kernel: Linux kernel: Denial of Service in erofs due to memory leak kernel: erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails kernel: pipe: wakeup wr_wait after setting max_usage kernel: ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir() kernel: qed/qed_sriov: guard against NULL derefs from qed_iov_get_vf_info kernel: fs: prevent out-of-bounds array speculation when closing a file descriptor kernel: usb: dwc3: qcom: Fix potential memory leak kernel: ovl: fix null pointer dereference in ovl_permission() kernel: coresight: Fix memory leak in acpi_buffer->pointer kernel: Linux kernel: Denial of Service in the cdns3 USB driver due to improper spin lock handling kernel: scsi: ufs: core: Fix handling of lrbp->cmd kernel: media: v4l2-mem2mem: add lock to protect parameter num_rdy kernel: mm/damon/core: initialize damo_filter->list from damos_new_filter() kernel: s390/zcrypt: don't leak memory if dev_set_name() fails kernel: octeontx2-pf: mcs: Fix NULL pointer dereferences kernel: octeontx2-af: Add validation before accessing cgx and lmac kernel: s390/idle: mark arch_cpu_idle() noinstr kernel: arm64: mm: fix VA-range sanity check kernel: virtio_pmem: add the missing REQ_OP_WRITE for flush bio kernel: s390/dcssblk: fix kernel crash with list_add corruption kernel: amba: bus: fix refcount leak kernel: s390/vmem: split pages when debug pagealloc is enabled kernel: Linux kernel OverlayFS: Kernel crash via null pointer dereference in ovl_get_acl_rcu() kernel: arm64: set __exception_irq_entry with __irq_entry as a default kernel: drm: nv04: Fix out of bounds access kernel: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout kernel: net: phy: micrel: Fix potential null pointer dereference kernel: Bluetooth: btintel: Fix null ptr deref in btintel_read_version kernel: net/smc: reduce rtnl pressure in smc_pnet_create_pnetids_list() kernel: Bluetooth: hci_sock: Fix not validating setsockopt user input kernel: Bluetooth: ISO: Fix not validating setsockopt user input kernel: Bluetooth: L2CAP: Fix not validating setsockopt user input kernel: Bluetooth: RFCOMM: Fix not validating setsockopt user input kernel: Bluetooth: SCO: Fix not validating setsockopt user input kernel: Bluetooth: Fix memory leak in hci_req_sync_complete() kernel: Bluetooth: HCI: Fix potential null-ptr-deref kernel: Bluetooth: msft: fix slab-use-after-free in msft_do_close() kernel: Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() kernel: Bluetooth: qca: add missing firmware sanity checks kernel: Bluetooth: L2CAP: Fix div-by-zero in l2cap_le_flowctl_init() kernel: of: module: add buffer overflow check in of_modalias() kernel: sock_map: avoid race between sock_map_close and sk_psock_put kernel: dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list kernel: bpf: Fix too early release of tcx_entry kernel: bluetooth/l2cap: sync sock recv cb and release kernel: net/iucv: Avoid explicit cpumask var allocation on stack kernel: Bluetooth: Ignore too large handle values in BIG kernel: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race kernel: protect the fetch of -&gt;fd[fd] in do_dup2() from mispredictions kernel: ASoC: TAS2781: Fix tasdev_load_calibrated_data() kernel: ice: Add a per-VF limit on number of FDIR filters kernel: block: fix deadlock between sd_remove & sd_release kernel: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal kernel: ext4: make sure the first directory block is not a hole kernel: ext4: check dot and dotdot of dx_root before making dir indexed kernel: sysctl: always initialize i_uid/i_gid kernel: exfat: fix potential deadlock on __exfat_get_dentry_set kernel: mm/mglru: fix div-by-zero in vmpressure_calc_level() kernel: net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE kernel: dm-raid: Fix WARN_ON_ONCE check for sync_thread in raid_resume kernel: scsi: lpfc: Fix a possible null pointer dereference kernel: PCI: keystone: Fix NULL pointer dereference in case of DT error in ks_pcie_setup_rc_app_regs() kernel: ext4: fix infinite loop when replaying fast_commit kernel: xdp: fix invalid wait context of page_pool_destroy() kernel: lib: objagg: Fix general protection fault kernel: cgroup/cpuset: Prevent UAF in proc_cpuset_show() kernel: devres: Fix memory leakage caused by driver API devm_free_percpu() kernel: vhost/vsock: always initialize seqpacket_allow kernel: exec: Fix ToCToU between perm check and set-uid/gid usage kernel: Bluetooth: MGMT: Add error handling to pair_device() kernel: padata: Fix possible divide-by-0 panic in padata_mt_helper() kernel: ext4: sanity check for NULL pointer after ext4_force_shutdown kernel: bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses kernel: md/raid5: avoid BUG_ON() while continue reshape after reassembling kernel: gpio: prevent potential speculation leaks in gpio_device_get_desc() kernel: idpf: fix UAFs when destroying the queues kernel: net: bridge: mcast: wait for previous gc cycles when removing port kernel: driver core: Fix uevent_show() vs driver detach race kernel: sched/smt: Fix unbalance sched_smt_present dec/inc kernel: idpf: fix memory leaks and crashes while performing a soft reset kernel: cgroup/cpuset: fix panic caused by partcmd_update kernel: ipv6: prevent UAF in ip6_send_skb() kernel: bonding: fix xfrm real_dev null pointer dereference kernel: fs/netfs/fscache_cookie: add missing "n_accesses" check kernel: mptcp: pm: only decrement add_addr_accepted for MPJ req kernel: mptcp: pm: only mark 'subflow' endp as available kernel: netem: fix return value if duplicate enqueue fails kernel: mm/vmalloc: fix page mapping if vm_area_alloc_pages() with high order fallback to order 0 kernel: scsi: aacraid: Fix double-free on probe failure kernel: usb: dwc3: core: Prevent USB core invalid event buffer address access kernel: mptcp: pm: fix ID 0 endp usage after multiple re-creations kernel: drm/amdgpu: fix mc_data out-of-bounds read warning kernel: drm/amdgpu: fix ucode out-of-bounds read warning kernel: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number kernel: drm/amdgpu: Fix out-of-bounds write warning kernel: of/irq: Prevent device address out-of-bounds read in interrupt map walk kernel: Input: uinput - reject requests with unreasonable number of slots kernel: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup kernel: PCI: Add missing bridge lock to pci_bus_lock() kernel: bpf: Remove tst_run from lwt_seg6local_prog_ops. kernel: hwmon: (w83627ehf) Fix underflows seen when writing limit attributes kernel: hwmon: (lm95234) Fix underflows seen when writing limit attributes kernel: hwmon: (adc128d818) Fix underflows seen when writing limit attributes kernel: pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv kernel: tcp_bpf: fix return value of tcp_bpf_sendmsg() kernel: fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF kernel: userfaultfd: fix checks for huge PMDs kernel: sch/netem: fix use after free in netem_dequeue kernel: drm/amdgpu: fix the waring dereferencing hive kernel: drm/amdgpu: Fix the warning division or modulo by zero kernel: drm/amd/amdgpu: Check tbo resource pointer kernel: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 kernel: drm/amdgpu/vcn: remove irq disabling in vcn 5 suspend kernel: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry kernel: sched: sch_cake: fix bulk flow accounting logic for host fairness kernel: drm/amdgpu: Fix smatch static checker warning kernel: workqueue: Improve scalability of workqueue watchdog touch kernel: spi: nxp-fspi: fix the KASAN report out-of-bounds bug kernel: x86/hyperv: fix kexec crash due to VP assist page corruption kernel: drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX kernel: pinmux: Use sequential access to access desc->pinmux data kernel: fsnotify: clear PARENT_WATCHED flags lazily kernel: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() kernel: icmp: change the order of rate limits kernel: netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() kernel: vdpa/mlx5: Fix invalid mr resource destroy kernel: nfsd: return -EINVAL when namelen is 0 kernel: ext4: check stripe size compatibility on remount as well kernel: bpf, lsm: Add check for BPF LSM return value kernel: block: fix potential invalid pointer dereference in blk_add_partition kernel: block, bfq: fix possible UAF for bfqq->bic with merge chain kernel: sock_map: Add a cond_resched() in sock_hash_free() kernel: wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() kernel: wifi: mt76: mt7915: fix oops on non-dbdc mt7986 kernel: wifi: rtw88: always wait for both firmware loading attempts kernel: iommufd: Protect against overflow of ALIGN() during iova allocation kernel: nfsd: call cache_put if xdr_reserve_space returns NULL kernel: wifi: mac80211: don&#39;t use rate mask for offchannel TX either kernel: padata: use integer wrap around to prevent deadlock on seq_nr overflow kernel: mm: call the security_mmap_file() LSM hook in remap_file_pages() kernel: vhost_vdpa: assign irq bypass producer token correctly kernel: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR kernel: nvme-rdma: unquiesce admin_q before destroy it kernel: tpm: Clean up TPM space after command failure kernel: x86/sgx: Fix deadlock in SGX NUMA node search kernel: ACPI: sysfs: validate return type of _STR method kernel: bpf: Fix helper writes to read-only maps kernel: powercap: intel_rapl: Fix off by one in get_rpi() kernel: cachefiles: fix dentry leak in cachefiles_open_file() kernel: nfsd: map the EBADMSG to nfserr_io to avoid warning kernel: resource: fix region_intersects() vs add_memory_driver_managed() kernel: ext4: update orig_path in ext4_find_extent() kernel: ext4: fix double brelse() the buffer of the extents path kernel: ext4: aovid use-after-free in ext4_ext_insert_extent() kernel: ext4: fix slab-use-after-free in ext4_split_extent_at() kernel: mm, slub: avoid zeroing kmalloc redzone kernel: platform/x86: ISST: Fix the KASAN report slab-out-of-bounds bug kernel: ext4: avoid use-after-free in ext4_ext_show_leaf() kernel: drm/amdgpu: add list empty check to avoid null pointer issue kernel: x86/ioapic: Handle allocation failures gracefully kernel: wifi: rtw89: avoid reading out of bounds when loading TX power FW elements kernel: wifi: iwlwifi: mvm: avoid NULL pointer dereference kernel: wifi: ath11k: fix array out-of-bound access in SoC stats kernel: blk_iocost: fix more out of bound shifts kernel: fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name kernel: ACPI: PAD: fix crash in exit_round_robin() kernel: wifi: cfg80211: Set correct chandef when starting CAC kernel: wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit kernel: wifi: rtw89: avoid to add interface to list twice when SER kernel: ppp: do not assume bh is held in ppp_channel_bridge_input() kernel: net: add more sanity checks to qdisc_pkt_len_init() kernel: Bluetooth: L2CAP: Fix uaf in l2cap_connect kernel: Bluetooth: MGMT: Fix possible crash on mgmt_index_removed kernel: static_call: Replace pointless WARN_ON() in static_call_module_notify() kernel: jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error kernel: ext4: fix timer use-after-free on failed mount kernel: ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() kernel: ext4: no need to continue when the number of entries is 1 kernel: ext4: filesystems without casefold feature cannot be mounted with siphash kernel: drm/amd/display: Increase array size of dummy_boolean kernel: r8169: add tally counter fields added with RTL8125 kernel: NFSD: Limit the number of concurrent async COPY operations kernel: uprobes: fix kernel info leak via "[uprobes]" vma kernel: net: stmmac: Fix zero-division error when disabling tc cbs kernel: ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free kernel: drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer kernel: iommu/vt-d: Fix potential lockup if qi_submit_sync called with 0 count kernel: block: fix integer overflow in BLKSECDISCARD kernel: tipc: guard against string buffer overrun kernel: afs: Fix the setting of the server responding flag kernel: static_call: Handle module init failure correctly in static_call_del_module() kernel: ext4: fix i_data_sem unlock order in ext4_ind_migrate() kernel: wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() kernel: cpufreq: amd-pstate: add check for cpufreq_cpu_get&#39;s return value kernel: exfat: fix memory leak in exfat_load_bitmap() kernel: ext4: fix access to uninitialised lock in fc replay path kernel: ext4: dax: fix overflowing extents beyond inode size when partially writing kernel: net: napi: Prevent overflow of napi_defer_hard_irqs kernel: kthread: unpark only parked kthread kernel: device-dax: correct pgoff align in dax_set_mapping() kernel: net: phy: Remove LED entry from LEDs list on unregister kernel: net: Fix an unsafe loop on the list kernel: thermal: core: Free tzp copy along with the thermal zone kernel: thermal: core: Reference count the zone in thermal_zone_get_by_id() kernel: Bluetooth: hci_conn: Fix UAF in hci_enhanced_setup_sync kernel: slip: make slhc_remember() more robust against malicious packets kernel: ppp: fix ppp_async_encode() illegal access kernel: netfilter: xtables: avoid NFPROTO_UNSPEC where needed kernel: net/sched: accept TCA_STAB only for root qdisc kernel: Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change kernel: NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() kernel: smb: client: fix UAF in async decryption kernel: driver core: bus: Fix double free in driver API bus_register() kernel: usb: typec: tipd: Free IRQ only if it was requested before kernel: serial: protect uart_port_dtr_rts() in uart_shutdown() too kernel: zram: free secondary algorithms names kernel: uprobe: avoid out-of-bounds memory access of fetching args kernel: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux kernel: parport: Proper fix for array out-of-bounds access kernel: xhci: tegra: fix checked USB2 port number kernel: Bluetooth: ISO: Fix multiple init when debugfs is disabled kernel: Bluetooth: Call iso_exit() on module unload kernel: blk-mq: setup queue -&gt;tag_set before initializing hctx kernel: blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race kernel: thermal: intel: int340x: processor: Fix warning during module unload kernel: iommu/vt-d: Fix incorrect pci_for_each_dma_alias() for non-PCI devices kernel: x86: fix user address masking non-canonical speculation issue kernel: nfsd: fix race between laundromat and free_stateid kernel: platform/x86/intel/pmc: Fix pmc_core_iounmap to call iounmap for valid addresses kernel: md/raid10: fix null ptr dereference in raid10_size() kernel: drm/amd: Guard against bad data for ATIF ACPI method kernel: smb: client: Handle kstrdup failures for passwords kernel: nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net kernel: net: sched: use RCU read-side critical section in taprio_dump() kernel: net: sched: fix use-after-free in taprio_change() kernel: net: wwan: fix global oob in wwan_rtnl_policy kernel: netfilter: bpf: must hold reference on net namespace kernel: ACPI: PRM: Find EFI_MEMORY_RUNTIME block for PRM handler and context kernel: udf: fix uninit-value use in udf_get_fileshortad kernel: usb: typec: altmode should keep reference to parent kernel: smb: client: fix OOBs when building SMB2_IOCTL request kernel: smb: client: fix possible double free in smb2_set_ea() kernel: scsi: target: core: Fix null-ptr-deref in target_alloc_device() kernel: bpf: devmap: provide rxq after redirect kernel: bpf: Make sure internal and UAPI bpf_redirect flags don't overlap kernel: vsock: Update rx_bytes on read_skb() kernel: secretmem: disable memfd_secret() if arch cannot set direct map kernel: net: explicitly clear the sk pointer, when pf-&gt;create fails kernel: HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() kernel: ext4: don&#39;t set SB_RDONLY after filesystem errors kernel: pinctrl: intel: platform: fix error path in device_for_each_child_node() kernel: mm/swapfile: skip HugeTLB pages for unuse_vma kernel: maple_tree: correct tree corruption on spanning store kernel: drm/radeon: Fix encoder->possible_clones kernel: nvmet-auth: assign dh_key to NULL after kfree_sensitive kernel: xfs: fix finding a last resort AG in xfs_filestream_pick_ag kernel: mm/page_alloc: let GFP_ATOMIC order-0 allocs access highatomic reserves kernel: mm: shmem: fix data-race in shmem_getattr() kernel: wifi: cfg80211: clear wdev->cqm_config pointer on free kernel: wifi: ath10k: Fix memory leak in management tx kernel: wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower kernel: netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() kernel: macsec: Fix use-after-free while sending the offloading packet kernel: signal: restore the override_rlimit logic kernel: filemap: Fix bounds checking in filemap_read() kernel: dm cache: fix potential out-of-bounds access on the first resume kernel: drm/amdgpu: add missing size check in amdgpu_debugfs_gprwave_read() kernel: sctp: properly validate chunk size in sctp_sf_ootb() kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() kernel: net/sched: sch_api: fix xa_insert() error path in tcf_block_get_ext() kernel: mptcp: init: protect sched with rcu_read_lock kernel: drm/i915/hdcp: Add encoder check in hdcp2_get_capability kernel: drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability kernel: wifi: iwlwifi: mvm: fix 6 GHz scan construction kernel: net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT kernel: wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() kernel: drm/amdgpu: prevent NULL pointer dereference if ATIF is not supported kernel: usb: dwc3: fix fault at system suspend if device was already runtime suspended kernel: platform/x86/amd/pmc: Detect when STB is not available kernel: wifi: iwlwifi: mvm: don't leak a link on AP removal kernel: virtio_net: Add hash_key_length check kernel: tpm: Lock TPM chip in tpm_pm_suspend() first kernel: bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx kernel: nvme-multipath: defer partition scanning kernel: smb: client: Fix use-after-free of network namespace. kernel: mm: resolve faulty mmap_region() error path behaviour kernel: mm: krealloc: Fix MTE false alarm in __do_krealloc kernel: hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer kernel: mm: page_alloc: move mlocked flag clearance into free_pages_prepare() kernel: vp_vdpa: fix id_table array not null terminated error kernel: virtio/vsock: Improve MSG_ZEROCOPY error handling kernel: vsock: Fix sk_error_queue memory leak kernel: net/mlx5e: CT: Fix null-ptr-deref in add rule err flow kernel: net/mlx5: fs, lock FTE when checking if active kernel: mptcp: error out earlier on disconnect kernel: net: fix data-races around sk->sk_forward_alloc kernel: pmdomain: imx93-blk-ctrl: correct remove path kernel: mm: revert "mm: shmem: fix data-race in shmem_getattr()" kernel: netfilter: ipset: add missing range check in bitmap_ip_uadt kernel: initramfs: avoid filename buffer overrun kernel: NFSD: Prevent a potential integer overflow kernel: PCI: tegra194: Move controller cleanups to pex_ep_event_pex_rst_deassert() kernel: wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() kernel: rcu/kvfree: Fix data-race in __mod_timer / kvfree_call_rcu kernel: EDAC/bluefield: Fix potential integer overflow kernel: net: sched: fix ordering of qlen adjustment kernel: block, bfq: fix bfqq uaf in bfq_limit_depth() kernel: NFSv4.0: Fix a use-after-free problem in the asynchronous open() kernel: SUNRPC: make sure cache entry active before cache_show kernel: smb: During unmount, ensure all cached dir instances drop their dentry kernel: wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures kernel: PCI: Fix use-after-free of slot->bus on hot remove kernel: usb: typec: fix potential array underflow in ucsi_ccg_sync_control() kernel: Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync kernel: net: usb: lan78xx: Fix double free issue with interrupt buffer allocation kernel: nfsd: release svc_expkey/svc_export with rcu_work kernel: zram: fix NULL pointer in comp_algorithm_show() kernel: RDMA/mlx5: Move events notifier registration to be after device registration kernel: iommu/s390: Implement blocking domain kernel: Bluetooth: fix use-after-free in device_for_each_child() kernel: nvmet: Don't overflow subsysnqn kernel: Bluetooth: iso: Fix circular lock in iso_listen_bis kernel: smb: client: fix TCP timers deadlock after rmmod kernel: wifi: rtw89: coex: check NULL return of kmalloc in btc_fw_set_monreg() kernel: udmabuf: change folios array from kmalloc to kvmalloc kernel: drm/amdgpu: fix usage slab after free kernel: nfsd: make sure exp active before svc_export_show kernel: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() kernel: mm/slub: Avoid list corruption when removing a slab from the full list kernel: ovl: Filter invalid inodes with missing lookup function kernel: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet kernel: Bluetooth: hci_conn: Use disable_delayed_work_sync kernel: net: inet6: do not leave a dangling sk pointer in inet6_create() kernel: net: inet: do not leave a dangling sk pointer in inet_create() kernel: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() kernel: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() kernel: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() kernel: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM kernel: xsk: fix OOB map writes when deleting elements kernel: drm/dp_mst: Fix MST sideband message body length check kernel: scsi: qla2xxx: Fix use after free on unload kernel: scsi: sg: Fix slab-use-after-free read in sg_release() kernel: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). kernel: net/ipv6: release expired exception dst cached in socket kernel: net: Fix icmp host relookup triggering ip_rt_bug kernel: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump kernel: Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating kernel: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one kernel: bpf, sockmap: Fix race between element replace and close() kernel: drm/i915: Fix NULL pointer dereference in capture_engine kernel: sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport kernel: brd: defer automatic disk creation until module initialization succeeds kernel: smb: Initialize cfid->tcon before performing network ops kernel: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect kernel: PCI/MSI: Handle lack of irqdomain gracefully kernel: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur kernel: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level kernel: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() kernel: PCI: imx6: Fix suspend/resume support on i.MX6QDL kernel: virtio-net: fix overflow inside virtnet_rq_alloc kernel: firmware: qcom: scm: smc: Handle missing SCM device kernel: Bluetooth: iso: Always release hdev at the end of iso_listen_bis kernel: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() kernel: mm/kmemleak: fix sleeping function called from invalid context at print message kernel: workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker kernel: RDMA/uverbs: Prevent integer overflow issue kernel: Bluetooth: hci_core: Fix sleeping function called from invalid context kernel: wifi: cfg80211: clear link ID from bitmap during link delete after clean up kernel: net: restrict SO_REUSEPORT to inet sockets kernel: dm array: fix releasing a faulty array block twice in dm_array_cursor_end kernel: selinux: ignore unknown extended permissions kernel: exfat: fix the infinite loop in exfat_readdir() kernel: Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc kernel: wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap() kernel: vmxnet3: Fix packet corruption in vmxnet3_xdp_xmit_frame kernel: Secure Boot does not automatically enable kernel lockdown kernel: afs: Fix the maximum cell name length kernel: net: stmmac: dwmac-tegra: Read iommu stream id from device tree kernel: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] kernel: pmdomain: imx8mp-blk-ctrl: add missing loop break condition kernel: vsock/virtio: discard packets if the transport changes kernel: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() kernel: fs/proc: fix softlockup in __read_vmcore (part 2) kernel: RDMA/mlx5: Fix a WARN during dereg_mr for DM type kernel: bpf: Fix array bounds error with may_goto kernel: Linux kernel (s390): Denial of service and data corruption due to improper page table updates kernel: cifs: Fix memory and information leak in smb3_reconfigure()
CVSS v3.1 score: 5.5