RHSA-2023:2458 Red Hat Security Advisory: kernel security, bug fix, and enhancement update
hw: cpu: AMD CPUs may transiently execute beyond unconditional direct branch kernel: ext4: kernel bug in ext4_write_inline_data_end() kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory kernel: hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs kernel: mlxsw: thermal: Fix out-of-bounds memory accesses kernel: mlxsw: spectrum: Protect driver from buggy firmware kernel: net: stmmac: fix tc flower deletion for VLAN priority Rx steering kernel: can: etas_es58x: es58x_rx_err_msg(): fix memory leak in error path kernel: possible race condition in drivers/tty/tty_buffers.c kernel: KVM: NULL pointer dereference in kvm_mmu_invpcid_gva kernel: use-after-free in free_pipe_info() could lead to privilege escalation kernel: KVM: nVMX: missing IBPB when exiting from nested guest can lead to Spectre v2 attacks kernel: netfilter: nf_conntrack_irc message handling issue kernel: race condition in xfrm_probe_algs can lead to OOB read/write kernel: out-of-bounds read in fib_nh_match of the file net/ipv4/fib_semantics.c kernel: race condition in hugetlb_no_page() in mm/hugetlb.c kernel: memory leak in ipv6_renew_options() kernel: data races around icsk->icsk_af_ops in do_ipv6_setsockopt kernel: data races around sk->sk_prot kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c kernel: denial of service in follow_page_pte in mm/gup.c due to poisoned pte entry kernel: use-after-free after failed devlink reload in devlink_param_get kernel: USB-accessible buffer overflow in brcmfmac kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed kernel: mptcp: NULL pointer dereference in subflow traversal at disconnect time kernel: l2tp: missing lock when clearing sk_user_data can lead to NULL pointer dereference kernel: Recursive locking violation in usb-storage that can cause the kernel to deadlock kernel: igmp: use-after-free in ip_check_mc_rcu when opening and closing inet sockets kernel: lockdown bypass using IMA kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: network backend may cause Linux netfront to use freed SKBs (XSA-405) kernel: vmwgfx: out-of-bounds write in vmw_kms_cursor_snoop kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry kernel: TLB flush operations are mishandled in certain KVM_VCPU_PREEMPTED leading to guest malfunctioning kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans() kernel: use-after-free related to leaf anon_vma double reuse kernel: use-after-free in bss_ref_get in net/wireless/scan.c kernel: BSS list corruption in cfg80211_add_nontrans_list in net/wireless/scan.c kernel: Denial of service in beacon protection for P2P-device kernel: use-after-free in l2cap_connect and l2cap_le_connect_req in net/bluetooth/l2cap_core.c kernel: memory corruption in usbmon driver kernel: NULL pointer dereference in traffic control subsystem kernel: scsi: mpt3sas: Fix use-after-free warning kernel: regmap: spi: Reserve space for register address/padding kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug kernel: net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent kernel: net/mlx5: Fix command stats access after free kernel: ice: Fix potential memory leak in ice_gnss_tty_write() kernel: thermal: core: Fix TZ_GET_TRIP NULL pointer dereference kernel: nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() kernel: bpf: Add schedule points in batch ops kernel: hwmon: Handle failure to register sensor with thermal zone correctly kernel: netfilter: conntrack: fix using __this_cpu_add in preemptible kernel: netfilter: flowtable_offload: fix using __this_cpu_add in preemptible kernel: HID: core: fix shift-out-of-bounds in hid_report_raw_event kernel: ASoC: soc-pcm: Add NULL check in BE reparenting kernel: hwmon: (coretemp) Check for null before removing sysfs attrs kernel: wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration kernel: mm/secretmem: fix panic when growing a memfd_secret kernel: cifs: potential buffer overflow in handling symlinks kernel: fbdev: Fix unregistering of framebuffers without device kernel: gpio: Restrict usage of GPIO chip irq members before initialization kernel: mm/mempolicy: fix mpol_new leak in shared_policy_replace kernel: highmem: fix checks in __kmap_local_sched_{in,out} kernel: rxrpc: fix a race in rxrpc_exit_net() kernel: NFS: Avoid writeback threads getting stuck in mempool_alloc() kernel: Bluetooth: Fix use after free in hci_send_acl kernel: scsi: libfc: Fix use after free in fc_exch_abts_resp() kernel: Bluetooth: use memset avoid memory leaks kernel: Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set kernel: bpf, sockmap: Fix more uncharged while msg has more_data kernel: bpf, sockmap: Fix double uncharge the mem of sk_msg kernel: bpf, sockmap: Fix memleak in sk_psock_queue_msg kernel: powerpc/64s: Don't use DSISR for SLB faults kernel: cxl/port: Hold port reference until decoder release kernel: bpf: Fix UAF due to race between btf_try_get_module and load_module kernel: can: m_can: m_can_tx_handler(): fix use after free of skb kernel: firmware: sysfb: fix platform-device leak in error path kernel: drm/amd/display: Check if modulo is 0 before dividing. kernel: iommu/arm-smmu-v3: check return value after calling platform_get_resource() kernel: iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() kernel: mt76: fix use-after-free by removing a non-RCU wcid pointer kernel: net/mlx5: E-Switch, pair only capable devices kernel: net: xfrm: unexport __init-annotated xfrm4_protocol_init() kernel: SUNRPC: Trap RDMA segment overflows kernel: NFSD: Fix potential use-after-free in nfsd_file_put() kernel: drm/amdgpu: Off by one in dm_dmub_outbox1_low_irq() kernel: driver core: fix deadlock in __device_attach kernel: tcp: tcp_rtx_synack() can be called from process context kernel: scsi: sd: Fix potential NULL pointer dereference kernel: driver core: Fix wait_for_device_probe() &#38; deferred_probe_timeout interaction kernel: mm/page_owner: use strscpy() instead of strlcpy() kernel: wifi: mac80211: fix use-after-free in chanctx code kernel: RDMA/hfi1: Prevent panic when SDMA is disabled kernel: PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() kernel: drivers/base/node.c: fix compaction sysfs file leak kernel: firmware: arm_scmi: Fix list protocols enumeration in the base protocol kernel: rtw89: cfo: check mac_id to avoid out-of-bounds kernel: nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags kernel: fbdev: defio: fix the pagelist corruption kernel: cpufreq: governor: Use kobject release() method to free dbs_data kernel: Linux kernel (ath10k): Double free vulnerability during suspend/resume kernel: arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall kernel: rtw89: ser: fix CAM leaks occurring in L2 reset kernel: cifs: fix potential double free during failed mount kernel: bpf: Fix potential array overflow in bpf_trampoline_get_progs() kernel: bpf: Fix combination of jit blinding and pointers to bpf subprogs. kernel: KVM: x86: Use __try_cmpxchg_user() to update guest PTE A/D bits kernel: perf/x86/intel/lbr: Fix unchecked MSR access error on HSW kernel: tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. kernel: tcp: Fix a data-race around sysctl_tcp_early_retrans. kernel: tcp: Fix data-races around sysctl_tcp_recovery. kernel: tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. kernel: udp: Fix a data-race around sysctl_udp_l3mdev_accept. kernel: ip: Fix data-races around sysctl_ip_prot_sock. kernel: ipv4: Fix data-races around sysctl_fib_multipath_hash_policy. kernel: ipv4: Fix a data-race around sysctl_fib_multipath_use_neigh. kernel: iavf: Fix handling of dummy receive descriptors kernel: tcp: Fix data-races around sysctl_tcp_fastopen_blackhole_timeout. kernel: tcp: Fix data-races around sysctl_tcp_fastopen. kernel: tcp: Fix a data-race around sysctl_tcp_notsent_lowat. kernel: tcp: Fix data-races around sysctl_tcp_migrate_req. kernel: igmp: Fix data-races around sysctl_igmp_qrv. kernel: igmp: Fix data-races around sysctl_igmp_llm_reports. kernel: net: stmmac: fix dma queue left shift overflow issue kernel: tcp: Fix a data-race around sysctl_tcp_probe_interval. kernel: tcp: Fix a data-race around sysctl_tcp_mtu_probe_floor. kernel: tcp: Fix a data-race around sysctl_tcp_probe_threshold. kernel: tcp: Fix data-races around sysctl_tcp_min_snd_mss. kernel: tcp: Fix data-races around sysctl_tcp_mtu_probing. kernel: tcp: Fix data-races around sysctl_tcp_l3mdev_accept. kernel: ip: Fix a data-race around sysctl_ip_autobind_reuse. kernel: tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. kernel: ip: Fix a data-race around sysctl_fwmark_reflect. kernel: ip: Fix data-races around sysctl_ip_fwd_update_priority. kernel: ip: Fix data-races around sysctl_ip_fwd_use_pmtu. kernel: power: supply: core: Fix boundary conditions in interpolation kernel: nexthop: Fix data-races around nexthop_compat_mode. kernel: tcp: Fix a data-race around sysctl_tcp_ecn_fallback. kernel: raw: Fix a data-race around sysctl_raw_l3mdev_accept. kernel: icmp: Fix a data-race around sysctl_icmp_errors_use_inbound_ifaddr. kernel: sysctl: Fix data-races in proc_dou8vec_minmax(). kernel: vlan: fix memory leak in vlan_newlink() kernel: ipv4: Fix a data-race around sysctl_fib_sync_mem. kernel: icmp: Fix data-races around sysctl. kernel: cipso: Fix data-races around sysctl. kernel: sysctl: Fix data races in proc_douintvec(). kernel: net: stmmac: dwc-qos: Disable split header for Tegra194 kernel: drm/i915: fix a possible refcount leak in intel_dp_add_mst_connector() kernel: wifi: mac80211: fix queue selection for mesh/OCB interfaces kernel: cgroup: Use separate src/dst nodes when preloading css_sets for migration kernel: srcu: Tighten cleanup_srcu_struct() GP checks kernel: fscache: Fix invalidation/lookup race kernel: can: m_can: m_can_{read_fifo,echo_tx_event}(): shift timestamp to full 32 bits kernel: powerpc/memhotplug: Add add_pages override for PPC kernel: afs: Fix dynamic root getattr kernel: mm/slub: add missing TID updates on slab deactivation kernel: drm/i915/reset: Fix error_state_read ptr + offset use kernel: clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() kernel: gfs2: Always check inode size of inline inodes kernel: dmaengine: Fix double increment of client_count in dma_chan_get() kernel: phy: qcom-qmp-combo: fix NULL-deref on runtime resume kernel: net: macvlan: fix memory leaks of macvlan_common_newlink kernel: tipc: fix the msg->req tlv len check in tipc_nl_compat_name_table_dump_header kernel: net: gso: fix panic on frag_list with mixed head alloc types kernel: block: Fix possible memory leak for rq_wb on add_disk failure kernel: ipv6: fix WARNING in ip6_route_net_exit_late() kernel: Bluetooth: L2CAP: Fix memory leak in vhci_write kernel: netfilter: ipset: enforce documented limit to prevent allocating huge memory kernel: netfilter: nf_tables: netlink notifier might race to release objects kernel: RDMA/core: Fix null-ptr-deref in ib_core_cleanup() kernel: wifi: mac80211: Fix UAF in ieee80211_scan_rx() kernel: dma-buf/dma-resv: check if the new fence is really later kernel: USB: core: Prevent nested device-reset calls kernel: wifi: mac80211: Don't finalize CSA in IBSS mode if state is disconnected kernel: USB: gadget: Fix obscure lockdep violation for udc_mutex kernel: Revert "usb: typec: ucsi: add a common function ucsi_unregister_connectors()" kernel: firmware_loader: Fix use-after-free during unregister kernel: net/sched: fix netdevice reference leaks in attach_default_qdiscs() kernel: openvswitch: fix memory leak at failed datapath creation kernel: drm/i915: fix null pointer dereference kernel: bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO kernel: xhci: Fix null pointer dereference in remove if xHC has only one roothub kernel: arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level kernel: drm/amd/pm: add missing ->fini_xxxx interfaces for some SMU13 asics kernel: drm/amd/pm: add missing ->fini_microcode interface for Sienna Cichlid kernel: bpf: Fix a data-race around bpf_jit_limit. kernel: drm/amd/display: clear optc underflow before turn off odm clock kernel: bpf, cgroup: Fix kernel BUG in purge_effective_progs kernel: drm/amd/pm: Fix a potential gpu_metrics_table memory leak kernel: skmsg: Fix wrong last sg check in sk_msg_recvmsg() kernel: HID: nintendo: fix rumble worker null pointer deref kernel: net: fix refcount bug in sk_psock_get (2) kernel: USB: gadget: Fix use-after-free Read in usb_udc_uevent() kernel: HID: hidraw: fix memory leak in hidraw_release() kernel: media: pvrusb2: fix memory leak in pvr_probe kernel: udmabuf: Set the DMA mask for the udmabuf device (v2) kernel: HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report kernel: bpf: Don't use tnum_range on array range checking for poke descriptors kernel: scsi: storvsc: Remove WQ_MEM_RECLAIM from storvsc_error_wq kernel: s390: fix double free of GS and RI CBs on fork() failure kernel: mm/hugetlb: avoid corrupting page->mapping in hugetlb_mcopy_atomic_pte kernel: mm/mprotect: only reference swap pfn page if type match kernel: loop: Check for overflow while configuring loop kernel: bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem kernel: writeback: avoid use-after-free after removing device kernel: rxrpc: Fix locking in rxrpc's sendmsg kernel: net/mlx5: LAG, fix logic over MLX5_LAG_FLAG_NDEVS_READY kernel: ice: xsk: prohibit usage of non-balanced queue id kernel: NFSv4.2 fix problems with __nfs42_ssc_open kernel: xfrm: fix refcount leak in __xfrm_policy_check() kernel: mm/gup: fix FOLL_FORCE COW security issue and remove FOLL_COW kernel: ASoC: SOF: Intel: hda-ipc: Do not process IPC reply before firmware boot kernel: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot kernel: ext4: avoid resizing to a partial cluster size kernel: ext4: block range must be validated before use in ext4_mb_clear_bb() kernel: drivers:md:fix a potential use-after-free bug kernel: gadgetfs: ep_io - wait until IRQ finishes kernel: clk: qcom: ipq8074: dont disable gcc_sleep_clk_src kernel: usb: renesas: Fix refcount leak bug kernel: usb: host: ohci-ppc-of: Fix refcount leak bug kernel: usb: cdns3 fix use-after-free at workaround 2 kernel: drm/amdgpu: Fix use-after-free on amdgpu_bo_list mutex kernel: drm/i915/ttm: don't leak the ccs state kernel: stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() kernel: ice: Fix call trace with null VSI during VF reset kernel: net: qrtr: start MHI channel after endpoit creation kernel: net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() kernel: ASoC: DPCM: Don't pick up BE without substream kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() kernel: ASoC: SOF: debug: Fix potential buffer overflow by snprintf() kernel: ASoC: Intel: avs: Fix potential buffer overflow by snprintf() kernel: iavf: Fix reset error handling kernel: iavf: Fix NULL pointer dereference in iavf_get_link_ksettings kernel: iavf: Fix adminq error handling kernel: vdpa_sim_blk: set number of address spaces and virtqueue groups kernel: drm/ttm: Fix dummy res NULL ptr deref bug kernel: BPF: Fix potential bad pointer dereference in bpf_sys_bpf() kernel: mptcp: do not queue data on closed subflows kernel: drm/amd/display: Check correct bounds for stream encoder instances for DCN303 kernel: KVM: Unconditionally get a ref to /dev/kvm module when creating a VM kernel: block: don't allow the same type rq_qos add more than once kernel: mm/damon/reclaim: fix potential memory leak in damon_reclaim_init() kernel: iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) kernel: sched/core: Do not requeue task on CPU excluded from cpus_mask kernel: ASoC: mt6359: Fix refcount leak bug kernel: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type() kernel: remoteproc: imx_rproc: Fix refcount leak in imx_rproc_addr_init kernel: ASoC: mediatek: mt8173-rt5650: Fix refcount leak in mt8173_rt5650_dev_probe kernel: ASoC: mediatek: mt8173: Fix refcount leak in mt8173_rt5650_rt5676_dev_probe kernel: ASoC: mt6797-mt6351: Fix refcount leak in mt6797_mt6351_dev_probe kernel: ASoC: cros_ec_codec: Fix refcount leak in cros_ec_codec_platform_probe kernel: jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted kernel: RDMA/srpt: Fix a use-after-free kernel: HID: mcp2221: prevent a buffer overflow in mcp_smbus_write() kernel: usb: cdns3: change place of 'priv_ep' assignment in cdns3_gadget_ep_dequeue(), cdns3_gadget_ep_enable() kernel: usb: xhci_plat_remove: avoid NULL dereference kernel: RDMA/siw: Fix duplicated reported IW_CM_EVENT_CONNECT_REPLY event kernel: RDMA/irdma: Fix a window for use-after-free kernel: RDMA/qedr: Fix potential memory leak in __qedr_alloc_mr() kernel: usb: aspeed-vhub: Fix refcount leak bug in ast_vhub_init_desc() kernel: PCI: dwc: Deallocate EPC memory on dw_pcie_ep_init() errors kernel: mm/mempolicy: fix get_nodes out of bound access kernel: kernfs: fix potential NULL dereference in __kernfs_remove kernel: driver core: fix potential deadlock in __driver_attach kernel: usb: cdns3: fix random warning message when driver load kernel: usb: ohci-nxp: Fix refcount leak in ohci_hcd_nxp_probe kernel: usb: host: Fix refcount leak in ehci_hcd_ppc_of_probe kernel: PCI: mediatek-gen3: Fix refcount leak in mtk_pcie_init_irq_domains() kernel: HID: cp2112: prevent a buffer overflow in cp2112_xfer() kernel: PCI: microchip: Fix refcount leak in mc_pcie_init_irq_domains() kernel: wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue kernel: Bluetooth: When HCI work queue is drained, only queue chained work kernel: bpf, x86: fix freeing of not-finalized bpf_prog_pack kernel: mt76: mt76x02u: fix possible memory leak in __mt76x02u_mcu_send_msg kernel: virtio-gpu: fix a missing check to avoid NULL dereference kernel: drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() kernel: tools/power turbostat: Fix file pointer leak kernel: spi: Fix simplification of devm_spi_register_controller kernel: soc: qcom: aoss: Fix refcount leak in qmp_cooling_devices_register kernel: soc: qcom: ocmem: Fix refcount leak in of_get_ocmem kernel: arm64: fix oops in concurrently setting insn_emulation sysctls kernel: md-raid10: fix KASAN warning kernel: scsi: sg: Allow waiting for commands to complete on removed device kernel: bpf: Fix KASAN use-after-free Read in compute_effective_progs kernel: drm/fb-helper: Fix out-of-bounds access kernel: Linux kernel KVM: Denial of Service via incorrect NX bit handling in NPT kernel: crypto: ccp - Use kzalloc for sev ioctl interfaces to prevent kernel memory leak kernel: KVM: x86/xen: Initialize Xen timer only once kernel: KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 kernel: ALSA: bcd2000: Fix a UAF bug on the error path of probing kernel: NFSD: Protect against send buffer overflow in NFSv2 READDIR kernel: NFSD: fix use-after-free on source server when doing inter-server copy kernel: sctp: handle the error returned from sctp_auth_asoc_init_active_key kernel: vdpasim: fix memory leak when freeing IOTLBs kernel: Linux kernel: Denial of Service due to memory allocation failure in vhost/vsock kernel: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages kernel: md: Replace snprintf with scnprintf kernel: Linux kernel lockd: Denial of Service via uninitialized file lock field in NFSv3 kernel: kernel: ext4 out-of-bounds read via corrupt file system image kernel: ASoC: qcom: Add checks for devm_kcalloc kernel: perf/x86/intel/uncore: Fix reference count leak in hswep_has_limit_sbox() kernel: ASoC: Intel: avs: Fix potential RX buffer overflow kernel: media: airspy: fix memory leak in airspy probe kernel: ext4: fix null-ptr-deref in ext4_write_info kernel: nfsd: Fix a memory leak in an error handling path kernel: scsi: target: iscsi: Fix a race condition between login_work and the login thread kernel: skmsg: pass gfp argument to alloc_sk_msg() kernel: md: fix a crash in mempool_free kernel: NFS: Fix an Oops in nfs_d_automount() kernel: nvme: fix multipath crash caused by flush request when blktrace is enabled kernel: Linux kernel: Denial of Service in ASoC Mediatek due to refcount leak kernel: net: sched: fix memory leak in tcindex_set_parms kernel: drivers/md/md-bitmap: check the return value of md_bitmap_get_counter() kernel: ext4: fix undefined behavior in bit shift for ext4_check_flag_values kernel: net/tunnel: wait until all sk_user_data reader finish before releasing the sock kernel: wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() kernel: NFSD: Protect against send buffer overflow in NFSv2 READ kernel: wifi: ath11k: mhi: fix potential memory leak in ath11k_mhi_register() kernel: x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly kernel: ALSA: ac97: fix possible memory leak in snd_ac97_dev_register() kernel: ALSA: aoa: i2sbus: fix possible memory leak in i2sbus_add_dev() kernel: ext4: don't set up encryption key during jbd2 transaction kernel: ASoC: mediatek: mt8173: Enable IRQ when pdata is ready kernel: xfrm: Reinject transport-mode packets through workqueue kernel: net: sched: cake: fix null pointer access issue when cake_init() fails kernel: scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername() kernel: Linux kernel ext4: Information Disclosure via uninitialized memory leak in fast-commit journal kernel: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID kernel: ALSA: usb-audio: Fix potential memory leaks kernel: NFSD: Protect against send buffer overflow in NFSv3 READDIR kernel: dm cache: Fix UAF in destroy() kernel: drbd: only clone bio if we have a backing device kernel: ext4: fix potential memory leak in ext4_fc_record_regions() kernel: fs: dlm: fix invalid derefence of sb_lvbptr kernel: blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping() kernel: Linux kernel (TIPC): Information disclosure via uninitialized memory in tipc_topsrv_kern_subscr kernel: dm thin: Use last transaction's pmd->root when commit failed kernel: ext4: fix uninititialized value in 'ext4_evict_inode' kernel: dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata kernel: blk-mq: avoid double ->queue_rq() because of early timeout kernel: tipc: fix a null-ptr-deref in tipc_topsrv_accept kernel: dm thin: Fix UAF in run_timer_softirq() kernel: xfrm: Update ipcomp_scratches with NULL when freed kernel: blk-throttle: prevent overflow while calculating wait time kernel: md/raid0, raid10: Don't set discard sectors for request queue kernel: perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map() kernel: Linux kernel (ext4): Memory leak due to improper handling of krealloc failure kernel: powerpc/kprobes: Fix null pointer reference in arch_prepare_kprobe() kernel: ext4: fix deadlock due to mbcache entry corruption kernel: wifi: brcmfmac: fix invalid address access when enabling SCAN log level kernel: i40e: Fix DMA mappings leak kernel: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks() kernel: Linux kernel: Memory leak in vdpa_sim leading to denial of service kernel: Kernel: Denial of Service via refcount leak in qcom_smsm_probe() kernel: Linux kernel: Denial of Service in mt7921e driver during module unload kernel: md/raid1: stop mdx_raid1 thread when raid1 array run failed kernel: nvmet-tcp: add bounds check on Transfer Tag kernel: Kernel: Denial of Service via memory leak in bnxt_nvm_test() kernel: net/mlx5: Fix possible use-after-free in async command interface kernel: ext4: silence the warning when evicting inode with dioread_nolock kernel: Linux kernel: vhost-vdpa memory leak leading to Denial of Service kernel: Linux kernel: Hard lockup in lpfc driver leads to Denial of Service kernel: md/raid5: Remove unnecessary bio_put() in raid5_read_one_chunk() kernel: scsi: smartpqi: Correct device removal for multi-actuator devices kernel: Linux kernel ALSA mts64 module: Denial of Service via null pointer dereference kernel: fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL kernel: mptcp: use proper req destructor for IPv6 kernel: ipv6: ensure sane device mtu in tunnels kernel: Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works kernel: jbd2: add miss release buffer head in fc_do_one_pass() kernel: jbd2: fix potential buffer head reference count leak kernel: dm clone: Fix UAF in clone_dtr() kernel: bpf: prevent leak of lsm program after failed attach kernel: NFSD: Finish converting the NFSv2 GETACL result encoder kernel: Kernel: Denial of Service via memory leak in wifi power saving mode kernel: ASoC: pxa: fix null-pointer dereference in filter() kernel: dm integrity: Fix UAF in dm_integrity_dtr() kernel: NULL pointer dereference in rawv6_push_pending_frames kernel: net/ulp: use-after-free in listening ULP sockets kernel: use-after-free due to race condition in qdisc_graft() kernel: use-after-free caused by invalid pointer hostname in fs/cifs/connect.c kernel: denial of service in tipc_conn_close Kernel: NULL pointer dereference problem in sctp_sched_dequeue_common kernel: ext4: use-after-free in ext4_xattr_set_entry() kernel: drm/virtio: improper return value check in virtio_gpu_object_shmem_init() kernel: ICMPv6 “Packet Too Big” packets force a DoS of the Linux kernel by forcing 100% CPU kernel: octeontx2-pf: Fix resource leakage in VF driver unbind kernel: l2tp: close all race conditions in l2tp_tunnel_register() kernel: net/sched: sch_taprio: fix possible use-after-free kernel: octeontx2-pf: Fix the use of GFP_KERNEL in atomic context on rt kernel: octeontx2-pf: Avoid use of GFP_KERNEL in atomic context kernel: netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits kernel: iavf: fix hang on reboot with ice kernel: nfsd: don't replace page in rq_pages if it's a continuation of last page kernel: Drivers: vmbus: Check for channel allocation before looking up relids kernel: NFSD: fix leaked reference count of nfsd4_ssc_umount_item kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free kernel: nfsd: clean up potential nfsd_file refcount leaks in COPY codepath kernel: bpf, arm64: Fixed a BTI error on returning to patched function kernel: dm cache: free background tracker's queued work in btracker_destroy kernel: Kernel: Denial of Service via recursive deadlock in L2TP tunnel registration kernel: RDMA/irdma: Cap MSIX used to online CPUs + 1 kernel: bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() kernel: NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
CVSS v3.1 score: 4.7