Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
l.sgl by _aead_recvmsg() calling aead_request_set_crypt(). The problem comes if an empty ciphertext is passed: the loop in af_alg_get_rsgl() just passes straight out and doesn't set areq->first_rsgl up. This isn't a problem on x86_64 using gcmaes_crypt_by_sg() because, as far as I can tell, that ignores req->dst and only uses req->src[*]. [*] Is this a bug in aesni-intel_glue.c? The s390x oops looks something like: Unable to handle kernel pointer dereference in virtual kernel address space Failing address: 0000000a00000000 TEID: 0000000a00000803 Fault in home space mode while using kernel ASCE. AS:00000000a43a0007 R3:0000000000000024 Oops: 003b ilc:2 [#1] SMP ... Call Trace: [<000003ff7fc3d4
le using kernel ASCE. AS:00000000a43a0007 R3:0000000000000024 Oops: 003b ilc:2 [#1] SMP ... Call Trace: [<000003ff7fc3d47e>] gcm_walk_start+0x16/0x28 [aes_s390] [<00000000a2a342f2>] crypto_aead_decrypt+0x9a/0xb8 [<00000000a2a60888>] aead_recvmsg+0x478/0x698 [<00000000a2e519a0>] sock_recvmsg+0x70/0xb0 [<00000000a2e51a56>] sock_read_iter+0x76/0xa0 [<00000000a273e066>] vfs_read+0x26e/0x2a8 [<00000000a273e8c4>] ksys_read+0xbc/0x100 [<00000000a311d808>] __do_syscall+0x1d0/0x1f8 [<00000000a312ff30>] system_call+0x70/0x98 Last Breaking-Event-Address: [<000003ff7fc3e6b4>] gcm_aes_crypt+0x104/0xa68 [aes_s390] References: - https://git.kernel.org/stable/c/2c9d205040d7c0eaccc473917f9b0bb0a923e440 - htt
rypt+0x104/0xa68 [aes_s390] References: - https://git.kernel.org/stable/c/2c9d205040d7c0eaccc473917f9b0bb0a923e440 - https://git.kernel.org/stable/c/6a4b8aa0a916b39a39175584c07222434fa6c6ef
CVE ID: CVE-2023-53600 State: PUBLISHED Published: 2025-10-04T15:44:11.775Z Last Updated: 2025-10-04T15:44:11.775Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in ip_compute_csum+0x134/0x220 Read of size 4 at addr ffff88811c50db00 by task iperf3/1691 CPU: 2 PID: 1691 Comm: iperf3 Not tainted 6.5.0-rc3+ #309 [..] kasan_report+0x105/0x140 ip_compute_csum+0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_
0x134/0x220 iptunnel_pmtud_build_icmp+0x554/0x1020 skb_tunnel_check_pmtu+0x513/0xb80 vxlan_xmit_one+0x139e/0x2ef0 vxlan_xmit+0x1867/0x2760 dev_hard_start_xmit+0x1ee/0x4f0 br_dev_queue_push_xmit+0x4d1/0x660 [..] ip_compute_csum() cannot deal with nonlinear skbs, so avoid it. After this change, splat is gone and iperf3 is no longer stuck. References: - https://git.kernel.org/stable/c/5850c391fd7e25662334cb3cbf29a62bcbff1084 - https://git.kernel.org/stable/c/e95808121953410db8c59f0abfde70ac0d34222c - https://git.kernel.org/stable/c/da5f42a6e7485fbb7a6dbd6a2b3045e19e4df5cc - https://git.kernel.org/stable/c/fe6a9f7516735be9fdabab00e47ef7a3403a174d - https://git.kernel.org/stable/c/6a7ac3d20593865
tps://git.kernel.org/stable/c/fe6a9f7516735be9fdabab00e47ef7a3403a174d - https://git.kernel.org/stable/c/6a7ac3d20593865209dceb554d8b3f094c6bd940
CVE ID: CVE-2023-53601 State: PUBLISHED Published: 2025-10-04T15:44:12.477Z Last Updated: 2025-10-04T15:44:12.477Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bonding: do not assume skb mac_header is set Drivers must not assume in their ndo_start_xmit() that skbs have their mac_header set. skb->data is all what is needed. bonding seems to be one of the last offender as caught by syzbot: WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 skb_mac_offset include/linux/skbuff.h:2913 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] WARNING: CPU:
: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 __bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] WARNING: CPU: 1 PID: 12155 at include/linux/skbuff.h:2907 bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 Modules linked in: CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0 Ha
et/bonding/bond_main.c:5470 Modules linked in: CPU: 1 PID: 12155 Comm: syz-executor.3 Not tainted 6.1.30-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 RIP: 0010:skb_mac_header include/linux/skbuff.h:2907 [inline] RIP: 0010:skb_mac_offset include/linux/skbuff.h:2913 [inline] RIP: 0010:bond_xmit_hash drivers/net/bonding/bond_main.c:4170 [inline] RIP: 0010:bond_xmit_3ad_xor_slave_get drivers/net/bonding/bond_main.c:5149 [inline] RIP: 0010:bond_3ad_xor_xmit drivers/net/bonding/bond_main.c:5186 [inline] RIP: 0010:__bond_start_xmit drivers/net/bonding/bond_main.c:5442 [inline] RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_
art_xmit drivers/net/bonding/bond_main.c:5442 [inline] RIP: 0010:bond_start_xmit+0x14ab/0x19d0 drivers/net/bonding/bond_main.c:5470 Code: 8b 7c 24 30 e8 76 dd 1a 01 48 85 c0 74 0d 48 89 c3 e8 29 67 2e fe e9 15 ef ff ff e8 1f 67 2e fe e9 10 ef ff ff e8 15 67 2e fe <0f> 0b e9 45 f8 ff ff e8 09 67 2e fe e9 dc fa ff ff e8 ff 66 2e fe RSP: 0018:ffffc90002fff6e0 EFLAGS: 00010283 RAX: ffffffff835874db RBX: 000000000000ffff RCX: 0000000000040000 RDX: ffffc90004dcf000 RSI: 00000000000000b5 RDI: 00000000000000b6 RBP: ffffc90002fff8b8 R08: ffffffff83586d16 R09: ffffffff83586584 R10: 0000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236
000000000000007 R11: ffff8881599fc780 R12: ffff88811b6a7b7e R13: 1ffff110236d4f6f R14: ffff88811b6a7ac0 R15: 1ffff110236d4f76 FS: 00007f2e9eb47700(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2e421000 CR3: 000000010e6d4000 CR4: 00000000003526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> [<ffffffff8471a49f>] netdev_start_xmit include/linux/netdevice.h:4925 [inline] [<ffffffff8471a49f>] __dev_direct_xmit+0x4ef/0x850 net/core/dev.c:4380 [<ffffffff851d845b>] dev_direct_xmit include/linux/netdevice.h:3043 [inline] [<fff
_xmit+0x4ef/0x850 net/core/dev.c:4380 [<ffffffff851d845b>] dev_direct_xmit include/linux/netdevice.h:3043 [inline] [<ffffffff851d845b>] packet_direct_xmit+0x18b/0x300 net/packet/af_packet.c:284 [<ffffffff851c7472>] packet_snd net/packet/af_packet.c:3112 [inline] [<ffffffff851c7472>] packet_sendmsg+0x4a22/0x64d0 net/packet/af_packet.c:3143 [<ffffffff8467a4b2>] sock_sendmsg_nosec net/socket.c:716 [inline] [<ffffffff8467a4b2>] sock_sendmsg net/socket.c:736 [inline] [<ffffffff8467a4b2>] __sys_sendto+0x472/0x5f0 net/socket.c:2139 [<ffffffff8467a715>] __do_sys_sendto net/socket.c:2151 [inline] [<ffffffff8467a715>] __se_sys_sendto net/socket.c:2147 [inline] [<ffffffff8467a715>] __x64_sys_sendto+0xe
:2151 [inline] [<ffffffff8467a715>] __se_sys_sendto net/socket.c:2147 [inline] [<ffffffff8467a715>] __x64_sys_sendto+0xe5/0x100 net/socket.c:2147 [<ffffffff8553071f>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<ffffffff8553071f>] do_syscall_64+0x2f/0x50 arch/x86/entry/common.c:80 [<ffffffff85600087>] entry_SYSCALL_64_after_hwframe+0x63/0xcd References: - https://git.kernel.org/stable/c/029d892b05fc5e42a1b1c0665f62cb3e4b23e6dc - https://git.kernel.org/stable/c/37b6143376a578265add04f35161b257eeb84a5e - https://git.kernel.org/stable/c/c96cc3d9acaca53d9a81c884c23f1224b61c829b - https://git.kernel.org/stable/c/bc16fc63592c419357dd4c4d82d50762102a60ef - https://git.kernel.org/stable/c/6a
b61c829b - https://git.kernel.org/stable/c/bc16fc63592c419357dd4c4d82d50762102a60ef - https://git.kernel.org/stable/c/6a940abdef3162e5723f1495b8a49859d1708f79
CVE ID: CVE-2023-53602 State: PUBLISHED Published: 2025-10-04T15:44:13.155Z Last Updated: 2025-10-06T09:07:20.856Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix memory leak in WMI firmware stats Memory allocated for firmware pdev, vdev and beacon statistics are not released during rmmod. Fix it by calling ath11k_fw_stats_free() function before hardware unregister. While at it, avoid calling ath11k_fw_stats_free() while processing the firmware stats received in the WMI event because the local list is getting spliced and reinitialised and hence there are no elements in the list after splicing. Tested-on: QCN907
list is getting spliced and reinitialised and hence there are no elements in the list after splicing. Tested-on: QCN9074 hw1.0 PCI WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 References: - https://git.kernel.org/stable/c/86f9330a49d1464849482298dd34d361859183eb - https://git.kernel.org/stable/c/55248d36beb79d3a61c9fb3122dc377fff523c89 - https://git.kernel.org/stable/c/6aafa1c2d3e3fea2ebe84c018003f2a91722e607
CVE ID: CVE-2023-53603 State: PUBLISHED Published: 2025-10-04T15:44:13.820Z Last Updated: 2025-10-29T10:50:33.875Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Avoid fcport pointer dereference Klocwork reported warning of NULL pointer may be dereferenced. The routine exits when sa_ctl is NULL and fcport is allocated after the exit call thus causing NULL fcport pointer to dereference at the time of exit. To avoid fcport pointer dereference, exit the routine when sa_ctl is NULL. References: - https://git.kernel.org/stable/c/4406fe8a96a946c7ea5724ee59625755a1d9c59d - https://git.kernel.org/stable/c/477bc74ad1add64
tps://git.kernel.org/stable/c/4406fe8a96a946c7ea5724ee59625755a1d9c59d - https://git.kernel.org/stable/c/477bc74ad1add644b606bff6ba1284943c42818a - https://git.kernel.org/stable/c/7bbeff613ec0560fb2f6f8b405288f3f043adf64 - https://git.kernel.org/stable/c/6b504d06976fe4a61cc05dedc68b84fadb397f77
CVE ID: CVE-2023-53604 State: PUBLISHED Published: 2025-10-04T15:44:14.568Z Last Updated: 2025-10-29T10:50:36.153Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path Otherwise the journal_io_cache will leak if dm_register_target() fails. References: - https://git.kernel.org/stable/c/ff4d6b5b38429a7731e5593680d2138bf74dd546 - https://git.kernel.org/stable/c/ca8b634fdf07dee3f6dfde57079c4511480b525e - https://git.kernel.org/stable/c/6d126899b0747305c9d39a0bcf87e0df9c3f555b - https://git.kernel.org/stable/c/44f29e93a55b544dc961b6f8b4e93abaeaafb9ee - https://git.k
47305c9d39a0bcf87e0df9c3f555b - https://git.kernel.org/stable/c/44f29e93a55b544dc961b6f8b4e93abaeaafb9ee - https://git.kernel.org/stable/c/a5d8c6bf58e5b2e70fbc15f3b08dfc1ba6f269ac - https://git.kernel.org/stable/c/3877b5c1509b16eeb1f275228fd91789cd88cf17 - https://git.kernel.org/stable/c/c8c9c50268729bf35f6c9bb1205f490db920454e - https://git.kernel.org/stable/c/e09a592fdd6c716506774bdbebb5f6c537b47767 - https://git.kernel.org/stable/c/6b79a428c02769f2a11f8ae76bf866226d134887
CVE ID: CVE-2023-53605 State: PUBLISHED Published: 2025-10-04T15:44:15.231Z Last Updated: 2025-10-06T09:07:22.038Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm: amd: display: Fix memory leakage This commit fixes memory leakage in dc_construct_ctx() function. References: - https://git.kernel.org/stable/c/d473c55ce1975c9e601c25293328a5039225d2b2 - https://git.kernel.org/stable/c/9ae15ebaefc4878d614f10cc56ea672f88cea582 - https://git.kernel.org/stable/c/83ace0dd67ee386be1ddcf59dab49d6d9a54e62e - https://git.kernel.org/stable/c/1bdea8ee92a6abc650b2189fd5c53f36859baecb - https://git.kernel.org/stable/c/6b8701be1f66064ca72733c5
.kernel.org/stable/c/1bdea8ee92a6abc650b2189fd5c53f36859baecb - https://git.kernel.org/stable/c/6b8701be1f66064ca72733c5f6e13748cdbf8397
CVE ID: CVE-2023-53606 State: PUBLISHED Published: 2025-10-04T15:44:15.908Z Last Updated: 2025-10-04T15:44:15.908Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfsd: clean up potential nfsd_file refcount leaks in COPY codepath There are two different flavors of the nfsd4_copy struct. One is embedded in the compound and is used directly in synchronous copies. The other is dynamically allocated, refcounted and tracked in the client struture. For the embedded one, the cleanup just involves releasing any nfsd_files held on its behalf. For the async one, the cleanup is a bit more involved, and we need to dequeue it from lists, unh
les held on its behalf. For the async one, the cleanup is a bit more involved, and we need to dequeue it from lists, unhash it, etc. There is at least one potential refcount leak in this code now. If the kthread_create call fails, then both the src and dst nfsd_files in the original nfsd4_copy object are leaked. The cleanup in this codepath is also sort of weird. In the async copy case, we'll have up to four nfsd_file references (src and dst for both flavors of copy structure). They are both put at the end of nfsd4_do_async_copy, even though the ones held on behalf of the embedded one outlive that structure. Change it so that we always clean up the nfsd_file refs held by the embedded copy st
mbedded one outlive that structure. Change it so that we always clean up the nfsd_file refs held by the embedded copy structure before nfsd4_copy returns. Rework cleanup_async_copy to handle both inter and intra copies. Eliminate nfsd4_cleanup_intra_ssc since it now becomes a no-op. References: - https://git.kernel.org/stable/c/fd63299db8090307eae66f2aef17c8f00aafa0a9 - https://git.kernel.org/stable/c/b3169b6ffe036b549c296a9e71591d29a1fb3209 - https://git.kernel.org/stable/c/75b8c681c563ef7e85da6862354efc18d2a08b1b - https://git.kernel.org/stable/c/8f565846fbe8182961498d4cbe618b15076a683b - https://git.kernel.org/stable/c/6ba434cb1a8d403ea9aad1b667c3ea3ad8b3191f
CVE ID: CVE-2023-53607 State: PUBLISHED Published: 2025-10-04T15:44:16.598Z Last Updated: 2025-10-04T15:44:16.598Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ALSA: ymfpci: Fix BUG_ON in probe function The snd_dma_buffer.bytes field now contains the aligned size, which this snd_BUG_ON() did not account for, resulting in the following: [ 9.625915] ------------[ cut here ]------------ [ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci] [ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3
926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_r
jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy [ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da [ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014 [ 9.732204] Workqueue: events work_for_cpu_fn [ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci] [ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb [ 9.761358] RSP:
c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb [ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287 [ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8 [ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020 [ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00 [ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918 [ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200 [ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000 [ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [
0(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000 [ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0 [ 9.823301] Call Trace: [ 9.825747] <TASK> [ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615] [ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0 [ 9.841918] local_pci_probe+0x45/0x80 [ 9.845680] work_for_cpu_fn+0x1a/0x30 [ 9.849431] process_one_work+0x1c7/0x380 [ 9.853464] worker_thread+0x1af/0x390 [ 9.857225] ? rescuer_thread+0x3b0/0x3b0 [ 9.861254] kthread+0xde/0x110 [ 9.864414] ? kthread_complete_and_exit+0x20/0x20 [ 9.869210] ret_from_fork+0x22/0x
0x3b0 [ 9.861254] kthread+0xde/0x110 [ 9.864414] ? kthread_complete_and_exit+0x20/0x20 [ 9.869210] ret_from_fork+0x22/0x30 [ 9.872792] </TASK> [ 9.874985] ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/96e34c88000febc83e41aa7db0b0a41676314818 - https://git.kernel.org/stable/c/81d2a7e93c8322ca6b858f6736d7fc3d034e6c23 - https://git.kernel.org/stable/c/32b9bd7cfc2e2d92d595386add4e111b232b351f - https://git.kernel.org/stable/c/d0217b09910c081b6471181345ea5b24025edf51 - https://git.kernel.org/stable/c/6be2e7522eb529b41c16d459f33bbdbcddbf5c15
CVE ID: CVE-2023-53608 State: PUBLISHED Published: 2025-10-04T15:44:17.302Z Last Updated: 2025-10-04T15:44:17.302Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() The finalization of nilfs_segctor_thread() can race with nilfs_segctor_kill_thread() which terminates that thread, potentially causing a use-after-free BUG as KASAN detected. At the end of nilfs_segctor_thread(), it assigns NULL to "sc_task" member of "struct nilfs_sc_info" to indicate the thread has finished, and then notifies nilfs_segctor_kill_thread() of this using waitqueue "sc_wait_task"
indicate the thread has finished, and then notifies nilfs_segctor_kill_thread() of this using waitqueue "sc_wait_task" on the struct nilfs_sc_info. However, here, immediately after the NULL assignment to "sc_task", it is possible that nilfs_segctor_kill_thread() will detect it and return to continue the deallocation, freeing the nilfs_sc_info structure before the thread does the notification. This fixes the issue by protecting the NULL assignment to "sc_task" and its notification, with spinlock "sc_state_lock" of the struct nilfs_sc_info. Since nilfs_segctor_kill_thread() does a final check to see if "sc_task" is NULL with "sc_state_lock" locked, this can eliminate the race. References: - h
does a final check to see if "sc_task" is NULL with "sc_state_lock" locked, this can eliminate the race. References: - https://git.kernel.org/stable/c/034cce77d52ba013ce62b4f5258c29907eb1ada5 - https://git.kernel.org/stable/c/0dbf0e64b91ee8fcb278aea93eb06fc7d56ecbcc - https://git.kernel.org/stable/c/613bf23c070d11c525268f2945aa594704a9b764 - https://git.kernel.org/stable/c/f32297dba338dc06d62286dedb3cdbd5175b1719 - https://git.kernel.org/stable/c/92684e02654c91a61a0b0561433b710bcece19fe - https://git.kernel.org/stable/c/bae009a2f1b7c2011d2e92d8c84868d315c0b97e - https://git.kernel.org/stable/c/b4d80bd6370b81a1725b6b8f7894802c23a14e9f - https://git.kernel.org/stable/c/6be49d100c22ffea3287a4b1
.kernel.org/stable/c/b4d80bd6370b81a1725b6b8f7894802c23a14e9f - https://git.kernel.org/stable/c/6be49d100c22ffea3287a4b19d7639d259888e33
CVE ID: CVE-2023-53609 State: PUBLISHED Published: 2025-10-04T15:44:18.151Z Last Updated: 2025-10-04T15:44:18.151Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: Revert "scsi: core: Do not increase scsi_device's iorequest_cnt if dispatch failed" The "atomic_inc(&cmd->device->iorequest_cnt)" in scsi_queue_rq() would cause kernel panic because cmd->device may be freed after returning from scsi_dispatch_cmd(). This reverts commit cfee29ffb45b1c9798011b19d454637d1b0fe87d. References: - https://git.kernel.org/stable/c/35fe6fa57b994e7da222893adf0bb748d6055e73 - https://git.kernel.org/stable/c/6ca9818d1624e136a76ae8faedb6b6c95ca
/stable/c/35fe6fa57b994e7da222893adf0bb748d6055e73 - https://git.kernel.org/stable/c/6ca9818d1624e136a76ae8faedb6b6c95ca66903
CVE ID: CVE-2023-53610 State: PUBLISHED Published: 2025-10-04T15:44:18.863Z Last Updated: 2025-10-04T15:44:18.863Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip: Fix refcount leak in platform_irqchip_probe of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/b00baffcc2561374f8fe8af873d00531f19864eb - https://git.kernel.org/stable/c/4401b485855700f296cae4d0db36a52948bff4fa - https://git.kernel.org/stable/c/ea54b608d85b7536f92238f3259730fa06cb5d21 - h
/4401b485855700f296cae4d0db36a52948bff4fa - https://git.kernel.org/stable/c/ea54b608d85b7536f92238f3259730fa06cb5d21 - https://git.kernel.org/stable/c/c32fb16331f612e66a7fa8930164e0dc15725b72 - https://git.kernel.org/stable/c/6caa5a2b78f5f53c433d3a3781e53325da22f0ac
CVE ID: CVE-2023-53611 State: PUBLISHED Published: 2025-10-04T15:44:19.593Z Last Updated: 2025-10-04T15:44:19.593Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ipmi_si: fix a memleak in try_smi_init() Kmemleak reported the following leak info in try_smi_init(): unreferenced object 0xffff00018ecf9400 (size 1024): comm "modprobe", pid 2707763, jiffies 4300851415 (age 773.308s) backtrace: [<000000004ca5b312>] __kmalloc+0x4b8/0x7b0 [<00000000953b1072>] try_smi_init+0x148/0x5dc [ipmi_si] [<000000006460d325>] 0xffff800081b10148 [<0000000039206ea5>] do_one_initcall+0x64/0x2a4 [<00000000601399ce>] do_init_module+0x50/0x300 [<00000000
ff800081b10148 [<0000000039206ea5>] do_one_initcall+0x64/0x2a4 [<00000000601399ce>] do_init_module+0x50/0x300 [<000000003c12ba3c>] load_module+0x7a8/0x9e0 [<00000000c246fffe>] __se_sys_init_module+0x104/0x180 [<00000000eea99093>] __arm64_sys_init_module+0x24/0x30 [<0000000021b1ef87>] el0_svc_common.constprop.0+0x94/0x250 [<0000000070f4f8b7>] do_el0_svc+0x48/0xe0 [<000000005a05337f>] el0_svc+0x24/0x3c [<000000005eb248d6>] el0_sync_handler+0x160/0x164 [<0000000030a59039>] el0_sync+0x160/0x180 The problem was that when an error occurred before handlers registration and after allocating `new_smi->si_sm`, the variable wouldn't be freed in the error handling afterwards since `shutdown_smi()` hadn'