Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a [ 231.730203] x20: ffff0000c3a0b600 x19: ffff0000c0102400 x18: 0000000000000000 [ 231.732329] x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe7aa8510 [ 231.734212] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000002 [ 231.736291] x11: ffff8000826998a8 x10: ffff800082b9baf0 x9 : ffff800081137558 [ 231.738195] x8 : fffffc00030e82c8 x7 : 0000000000000000 x6 : 0000000000000001 [ 231.740192] x5 : ffff0000ffbafe00 x4 : 0000000000000000 x3 : 0000000000000000 [ 231.742118] x2 : 00000000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208 [ 231.744196] Call trace: [ 231.744892] rb_update_pages+0x378/
00000000006aa x1 : 0000000000000001 x0 : ffff0000c0007208 [ 231.744196] Call trace: [ 231.744892] rb_update_pages+0x378/0x3f8 [ 231.745893] update_pages_handler+0x1c/0x38 [ 231.746893] process_one_work+0x1f0/0x468 [ 231.747852] worker_thread+0x54/0x410 [ 231.748737] kthread+0x124/0x138 [ 231.749549] ret_from_fork+0x10/0x20 [ 231.750434] ---[ end trace 0000000000000000 ]--- [ 233.720486] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000 [ 233.721696] Mem abort info: [ 233.721935] ESR = 0x0000000096000004 [ 233.722283] EC = 0x25: DABT (current EL), IL = 32 bits [ 233.722596] SET = 0, FnV = 0 [ 233.722805] EA = 0, S1PTW = 0 [ 233.723026] FSC = 0x04: level 0 tr
nt EL), IL = 32 bits [ 233.722596] SET = 0, FnV = 0 [ 233.722805] EA = 0, S1PTW = 0 [ 233.723026] FSC = 0x04: level 0 translation fault [ 233.723458] Data abort info: [ 233.723734] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 [ 233.724176] CM = 0, WnR = 0, TnD = 0, TagAccess = 0 [ 233.724589] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 [ 233.725075] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000104943000 [ 233.725592] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000 [ 233.726231] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP [ 233.726720] Modules linked in: [ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 233.727777] Hardw
ked in: [ 233.727007] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 233.727777] Hardware name: linux,dummy-virt (DT) [ 233.728225] Workqueue: events update_pages_handler [ 233.728655] pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 233.729054] pc : rb_update_pages+0x1a8/0x3f8 [ 233.729334] lr : rb_update_pages+0x154/0x3f8 [ 233.729592] sp : ffff800082b9bd50 [ 233.729792] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 00000000 ---truncated--- References: - https://git.kernel.org/stable/c/66a3b2a121386702663065d5c9e5a33c03d3f4a2 - https://git.kernel.org/stable/c/49b830d75f03d5dd41146d10e4d3e2a8211c4b94 - https://git.kernel.org/stable/c/128
3d3f4a2 - https://git.kernel.org/stable/c/49b830d75f03d5dd41146d10e4d3e2a8211c4b94 - https://git.kernel.org/stable/c/128c06a34cfe55212632533a706b050d54552741 - https://git.kernel.org/stable/c/02e52d7daaa3f0f48819f198092cf4871065bbf7 - https://git.kernel.org/stable/c/8a96c0288d0737ad77882024974c075345c72011
CVE ID: CVE-2023-53719 State: PUBLISHED Published: 2025-10-22T13:23:51.441Z Last Updated: 2025-10-22T13:23:51.441Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: serial: arc_uart: fix of_iomap leak in `arc_serial_probe` Smatch reports: drivers/tty/serial/arc_uart.c:631 arc_serial_probe() warn: 'port->membase' from of_iomap() not released on lines: 631. In arc_serial_probe(), if uart_add_one_port() fails, port->membase is not released, which would cause a resource leak. To fix this, I replace of_iomap with devm_platform_ioremap_resource. References: - https://git.kernel.org/stable/c/3f00df24a5021a6f02c1830a290acd4bceb22a2d - htt
_platform_ioremap_resource. References: - https://git.kernel.org/stable/c/3f00df24a5021a6f02c1830a290acd4bceb22a2d - https://git.kernel.org/stable/c/7525aa211758cc023a371e010d16ceaae1057807 - https://git.kernel.org/stable/c/153017561d2804cfae87cc9aa377aa84dd906ae1 - https://git.kernel.org/stable/c/f76a18e53a66c0ef2938276110717b3805720cd9 - https://git.kernel.org/stable/c/081790eee6b47389a0d895262086d64c6a38d6e5 - https://git.kernel.org/stable/c/40a462313ba4f337a2b419e7fb4a670f3dd95e14 - https://git.kernel.org/stable/c/8ab5fc55d7f65d58a3c3aeadf11bdf60267cd2bd
CVE ID: CVE-2023-53720 State: PUBLISHED Published: 2025-10-22T13:23:52.123Z Last Updated: 2025-10-22T13:23:52.123Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Release the label when replacing existing ct entry Cited commit doesn't release the label mapping when replacing existing ct entry which leads to following memleak report: unreferenced object 0xffff8881854cf280 (size 96): comm "kworker/u48:74", pid 23093, jiffies 4296664564 (age 175.944s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00
0 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002722d368>] __kmalloc+0x4b/0x1c0 [<00000000cc44e18f>] mapping_add+0x6e8/0xc90 [mlx5_core] [<000000003ad942a7>] mlx5_get_label_mapping+0x66/0xe0 [mlx5_core] [<00000000266308ac>] mlx5_tc_ct_entry_create_mod_hdr+0x1c4/0xf50 [mlx5_core] [<000000009a768b4f>] mlx5_tc_ct_entry_add_rule+0x16f/0xaf0 [mlx5_core] [<00000000a178f3e5>] mlx5_tc_ct_block_flow_offload_add+0x10cb/0x1f90 [mlx5_core] [<000000007b46c496>] mlx5_tc_ct_block_flow_offload+0x14a/0x630 [mlx5_core] [<00000000a9a18ac5>] nf_flow_offload_tuple+0x1a3/0x390 [nf_flow_table] [<00000000d0881951>] flow_offload_work_handl
ore] [<00000000a9a18ac5>] nf_flow_offload_tuple+0x1a3/0x390 [nf_flow_table] [<00000000d0881951>] flow_offload_work_handler+0x257/0xd30 [nf_flow_table] [<000000009e4935a4>] process_one_work+0x7c2/0x13e0 [<00000000f5cd36a7>] worker_thread+0x59d/0xec0 [<00000000baed1daf>] kthread+0x28f/0x330 [<0000000063d282a4>] ret_from_fork+0x1f/0x30 Fix the issue by correctly releasing the label mapping. References: - https://git.kernel.org/stable/c/3db903a71f1f4bbf30baae166a4a49f2e8aceb61 - https://git.kernel.org/stable/c/8ac04a28144cfa89b61be518268233742c23d88d
CVE ID: CVE-2023-53721 State: PUBLISHED Published: 2025-10-22T13:23:52.699Z Last Updated: 2025-10-30T19:33:08.319Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix a NULL pointer dereference in ath12k_mac_op_hw_scan() In ath12k_mac_op_hw_scan(), the return value of kzalloc() is directly used in memcpy(), which may lead to a NULL pointer dereference on failure of kzalloc(). Fix this bug by adding a check of arg.extraie.ptr. Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.0-03427-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.15378.4 References: - https://git.kernel.org/stable/c/5a263df398b581189fe632b4ab8440f3dd76c251 - https://git.ker
ICONZ-1.15378.4 References: - https://git.kernel.org/stable/c/5a263df398b581189fe632b4ab8440f3dd76c251 - https://git.kernel.org/stable/c/8ad314da54c6dd223a6b6cc85019160aa842f659
CVE ID: CVE-2023-53722 State: PUBLISHED Published: 2025-10-22T13:23:53.329Z Last Updated: 2025-10-22T13:23:53.329Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: md: raid1: fix potential OOB in raid1_remove_disk() If rddev->raid_disk is greater than mddev->raid_disks, there will be an out-of-bounds in raid1_remove_disk(). We have already found similar reports as follows: 1) commit d17f744e883b ("md-raid10: fix KASAN warning") 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk") Fix this bug by checking whether the "number" variable is valid. References: - https://git.kernel.org/stable/c/beedf40f73939f248c8
ug by checking whether the "number" variable is valid. References: - https://git.kernel.org/stable/c/beedf40f73939f248c81802eda08a2a8148ea13e - https://git.kernel.org/stable/c/91fbd4e75cb573f44d2619a9dc2f9ba927040760 - https://git.kernel.org/stable/c/25a68f2286be56fb3a6f9fa0e269c04b5e6c6e24 - https://git.kernel.org/stable/c/7993cfc041481a3a9cd4a3858088fc846b8ccaf7 - https://git.kernel.org/stable/c/4f96c0665f9f4cf70130c9757750dc43dc679c82 - https://git.kernel.org/stable/c/4f7d853b4590fc20e90dd50e346c02811a8c5b08 - https://git.kernel.org/stable/c/4bdb92eaf645e312975357adc3c4e9523b6e67f1 - https://git.kernel.org/stable/c/8b0472b50bcf0f19a5119b00a53b63579c8e1e4d
CVE ID: CVE-2023-53723 State: PUBLISHED Published: 2025-10-22T13:23:53.900Z Last Updated: 2025-10-22T13:23:53.900Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: disable sdma ecc irq only when sdma RAS is enabled in suspend sdma_v4_0_ip is shared on a few asics, but in sdma_v4_0_hw_fini, driver unconditionally disables ecc_irq which is only enabled on those asics enabling sdma ecc. This will introduce a warning in suspend cycle on those chips with sdma ip v4.0, while without sdma ecc. So this patch correct this. [ 7283.166354] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu] [ 7283.167001] RSP: 0018:ffff9a5fc3967d08 EFLA
correct this. [ 7283.166354] RIP: 0010:amdgpu_irq_put+0x45/0x70 [amdgpu] [ 7283.167001] RSP: 0018:ffff9a5fc3967d08 EFLAGS: 00010246 [ 7283.167019] RAX: ffff98d88afd3770 RBX: 0000000000000001 RCX: 0000000000000000 [ 7283.167023] RDX: 0000000000000000 RSI: ffff98d89da30390 RDI: ffff98d89da20000 [ 7283.167025] RBP: ffff98d89da20000 R08: 0000000000036838 R09: 0000000000000006 [ 7283.167028] R10: ffffd5764243c008 R11: 0000000000000000 R12: ffff98d89da30390 [ 7283.167030] R13: ffff98d89da38978 R14: ffffffff999ae15a R15: ffff98d880130105 [ 7283.167032] FS: 0000000000000000(0000) GS:ffff98d996f00000(0000) knlGS:0000000000000000 [ 7283.167036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7283.
GS:ffff98d996f00000(0000) knlGS:0000000000000000 [ 7283.167036] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 7283.167039] CR2: 00000000f7a9d178 CR3: 00000001c42ea000 CR4: 00000000003506e0 [ 7283.167041] Call Trace: [ 7283.167046] <TASK> [ 7283.167048] sdma_v4_0_hw_fini+0x38/0xa0 [amdgpu] [ 7283.167704] amdgpu_device_ip_suspend_phase2+0x101/0x1a0 [amdgpu] [ 7283.168296] amdgpu_device_suspend+0x103/0x180 [amdgpu] [ 7283.168875] amdgpu_pmops_freeze+0x21/0x60 [amdgpu] [ 7283.169464] pci_pm_freeze+0x54/0xc0 References: - https://git.kernel.org/stable/c/3decf3a750a924362bf4e2680dd3b07242fe56e8 - https://git.kernel.org/stable/c/c1420276be7a98df0074584bb9c1709cbc1a9df5 - https://git.kernel.org
e2680dd3b07242fe56e8 - https://git.kernel.org/stable/c/c1420276be7a98df0074584bb9c1709cbc1a9df5 - https://git.kernel.org/stable/c/823787470e320f90372c3ef506769520026c571f - https://git.kernel.org/stable/c/2a179117a3b29e7136e4045c57090a05bb97f373 - https://git.kernel.org/stable/c/71e1f44077db83e205db70a684c1f2c5d2247174 - https://git.kernel.org/stable/c/c5123c193696bf97fdf259c825ebfac517b54e44 - https://git.kernel.org/stable/c/8b229ada2669b74fdae06c83fbfda5a5a99fc253
CVE ID: CVE-2023-53724 State: PUBLISHED Published: 2025-10-22T13:23:54.542Z Last Updated: 2025-10-22T13:23:54.542Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: mfd: pcf50633-adc: Fix potential memleak in pcf50633_adc_async_read() `req` is allocated in pcf50633_adc_async_read(), but adc_enqueue_request() could fail to insert the `req` into queue. We need to check the return value and free it in the case of failure. References: - https://git.kernel.org/stable/c/66616eed76dfa6f3e442907760325a023c6da7e2 - https://git.kernel.org/stable/c/41cdf082ae006ea002135dfaf43b2897de3bded8 - https://git.kernel.org/stable/c/588edb4fb1f1e6487a0
//git.kernel.org/stable/c/41cdf082ae006ea002135dfaf43b2897de3bded8 - https://git.kernel.org/stable/c/588edb4fb1f1e6487a0f60a5f7b9a24d2d0c9f8e - https://git.kernel.org/stable/c/3ee13bdf0d25ae8752ae6185b6d13bbb0d5a8e30 - https://git.kernel.org/stable/c/6a8a02dcfae13ab07dc7bed2b409cec7f3d32e92 - https://git.kernel.org/stable/c/9cca3a4933ca365cc664d5eefb0f942374ea8b41 - https://git.kernel.org/stable/c/a62a5e79202967176a9c1a04e477860779accd6c - https://git.kernel.org/stable/c/8b450dcff23aa254844492831a8e2b508a9d522d
CVE ID: CVE-2023-53725 State: PUBLISHED Published: 2025-10-22T13:23:55.200Z Last Updated: 2025-10-22T13:23:55.200Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe Smatch reports: drivers/clocksource/timer-cadence-ttc.c:529 ttc_timer_probe() warn: 'timer_baseaddr' from of_iomap() not released on lines: 498,508,516. timer_baseaddr may have the problem of not being released after use, I replaced it with the devm_of_iomap() function and added the clk_put() function to cleanup the "clk_ce" and "clk_cs". References: - https://git.kernel.org/stable/c/e0a9cc90ea44a50d76
lk_put() function to cleanup the "clk_ce" and "clk_cs". References: - https://git.kernel.org/stable/c/e0a9cc90ea44a50d76a84f9f9bf1703d31fe45e9 - https://git.kernel.org/stable/c/54cc10a0f4b01b522e9519014200f1b33bf7e4aa - https://git.kernel.org/stable/c/ebdff0986513a29be242aace0ef89b6c105b0bf0 - https://git.kernel.org/stable/c/289e2054eeb63c9e133960731c342eeffad218d3 - https://git.kernel.org/stable/c/919dd531ebb7514f205ae7aab87994337ebce1f6 - https://git.kernel.org/stable/c/67d7eebbc424935dec61fb352d1ccae5d16cf429 - https://git.kernel.org/stable/c/99744200f28b2cf5f50767447e51b4b4a977d145 - https://git.kernel.org/stable/c/8b5bf64c89c7100c921bd807ba39b2eb003061ab
CVE ID: CVE-2023-53726 State: PUBLISHED Published: 2025-10-22T13:23:55.896Z Last Updated: 2025-10-22T13:23:55.896Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: csum: Fix OoB access in IP checksum code for negative lengths Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length calls") added an early return for zero-length input, syzkaller has popped up with an example of a _negative_ length which causes an undefined shift and an out-of-bounds read: | BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39 | Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5
do_csum+0x44/0x254 arch/arm64/lib/csum.c:39 | Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5975 | | CPU: 0 PID: 5975 Comm: syz-executor412 Not tainted 6.4.0-rc4-syzkaller-g908f31f2a05b #0 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 | Call trace: | dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233 | show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240 | __dump_stack lib/dump_stack.c:88 [inline] | dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 | print_address_description mm/kasan/report.c:351 [inline] | print_report+0x174/0x514 mm/kasan/report.c:462 | kasan_report+0xd4/0x130 mm/kasan/report.c:572 | kasan
.c:351 [inline] | print_report+0x174/0x514 mm/kasan/report.c:462 | kasan_report+0xd4/0x130 mm/kasan/report.c:572 | kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187 | __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31 | do_csum+0x44/0x254 arch/arm64/lib/csum.c:39 | csum_partial+0x30/0x58 lib/checksum.c:128 | gso_make_checksum include/linux/skbuff.h:4928 [inline] | __udp_gso_segment+0xaf4/0x1bc4 net/ipv4/udp_offload.c:332 | udp6_ufo_fragment+0x540/0xca0 net/ipv6/udp_offload.c:47 | ipv6_gso_segment+0x5cc/0x1760 net/ipv6/ip6_offload.c:119 | skb_mac_gso_segment+0x2b4/0x5b0 net/core/gro.c:141 | __skb_gso_segment+0x250/0x3d0 net/core/dev.c:3401 | skb_gso_segment include/linux/netdevice.h:4859 [i
t/core/gro.c:141 | __skb_gso_segment+0x250/0x3d0 net/core/dev.c:3401 | skb_gso_segment include/linux/netdevice.h:4859 [inline] | validate_xmit_skb+0x364/0xdbc net/core/dev.c:3659 | validate_xmit_skb_list+0x94/0x130 net/core/dev.c:3709 | sch_direct_xmit+0xe8/0x548 net/sched/sch_generic.c:327 | __dev_xmit_skb net/core/dev.c:3805 [inline] | __dev_queue_xmit+0x147c/0x3318 net/core/dev.c:4210 | dev_queue_xmit include/linux/netdevice.h:3085 [inline] | packet_xmit+0x6c/0x318 net/packet/af_packet.c:276 | packet_snd net/packet/af_packet.c:3081 [inline] | packet_sendmsg+0x376c/0x4c98 net/packet/af_packet.c:3113 | sock_sendmsg_nosec net/socket.c:724 [inline] | sock_sendmsg net/socket.c:747 [inline] | _
net/packet/af_packet.c:3113 | sock_sendmsg_nosec net/socket.c:724 [inline] | sock_sendmsg net/socket.c:747 [inline] | __sys_sendto+0x3b4/0x538 net/socket.c:2144 Extend the early return to reject negative lengths as well, aligning our implementation with the generic code in lib/checksum.c References: - https://git.kernel.org/stable/c/5a85727239a23de1cc8d93985f1056308128f3e2 - https://git.kernel.org/stable/c/9a43563cfd6b9200ff2f76b3f9fcdcb217ceb523 - https://git.kernel.org/stable/c/ba0b46166b8e547024d02345a68b747841931ad2 - https://git.kernel.org/stable/c/a5ad2f87d8e74e351d3f500ad9d5b3a5653e1c6f - https://git.kernel.org/stable/c/fcdf904e866de0e3715835e50409fda3b2590527 - https://git.kernel.or
f500ad9d5b3a5653e1c6f - https://git.kernel.org/stable/c/fcdf904e866de0e3715835e50409fda3b2590527 - https://git.kernel.org/stable/c/8bd795fedb8450ecbef18eeadbd23ed8fc7630f5
CVE ID: CVE-2023-53727 State: PUBLISHED Published: 2025-10-22T13:23:56.528Z Last Updated: 2025-10-22T13:23:56.528Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net/sched: fq_pie: avoid stalls in fq_pie_timer() When setting a high number of flows (limit being 65536), fq_pie_timer() is currently using too much time as syzbot reported. Add logic to yield the cpu every 2048 flows (less than 150 usec on debug kernels). It should also help by not blocking qdisc fast paths for too long. Worst case (65536 flows) would need 31 jiffies for a complete scan. Relevant extract from syzbot report: rcu: INFO: rcu_preempt detected expedited s
ld need 31 jiffies for a complete scan. Relevant extract from syzbot report: rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2663 jiffies s: 873 root: 0x1/. rcu: blocking rcu_node structures (internal RCU debug): Sending NMI from CPU 1 to CPUs 0: NMI backtrace for cpu 0 CPU: 0 PID: 5177 Comm: syz-executor273 Not tainted 6.5.0-syzkaller-00453-g727dbda16b83 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline] RIP: 0010:write_comp_data+0x21/0x90 kernel/kcov.c:236 Code: 2e 0f 1f 84 00 00 00 00 00 65 8b 05 01 b2 7d 7e 49 89 f1 89 c6 49 89 d2 81 e6 00 01 00 00 49 89 f8 65 48 8b 1
:236 Code: 2e 0f 1f 84 00 00 00 00 00 65 8b 05 01 b2 7d 7e 49 89 f1 89 c6 49 89 d2 81 e6 00 01 00 00 49 89 f8 65 48 8b 14 25 80 b9 03 00 <a9> 00 01 ff 00 74 0e 85 f6 74 59 8b 82 04 16 00 00 85 c0 74 4f 8b RSP: 0018:ffffc90000007bb8 EFLAGS: 00000206 RAX: 0000000000000101 RBX: ffffc9000dc0d140 RCX: ffffffff885893b0 RDX: ffff88807c075940 RSI: 0000000000000100 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000dc0d178 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000555555d54380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050
S: 0000555555d54380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f6b442f6130 CR3: 000000006fe1c000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <NMI> </NMI> <IRQ> pie_calculate_probability+0x480/0x850 net/sched/sch_pie.c:415 fq_pie_timer+0x1da/0x4f0 net/sched/sch_fq_pie.c:387 call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700 References: - https://git.kernel.org/stable/c/94d527c3759d76c29220758362f622954612bea7 - https://git.kernel.org/stable/c/973a4c302d7f3804098ff9824d9f56926901f293 - https://git.kernel
9220758362f622954612bea7 - https://git.kernel.org/stable/c/973a4c302d7f3804098ff9824d9f56926901f293 - https://git.kernel.org/stable/c/f39b49077abec4c9c3a4c2966532004851c51006 - https://git.kernel.org/stable/c/e093000e7d13569c9cb07d7500acd5142c3c43cb - https://git.kernel.org/stable/c/8c21ab1bae945686c602c5bfa4e3f3352c2452c5
CVE ID: CVE-2023-53728 State: PUBLISHED Published: 2025-10-22T13:23:57.127Z Last Updated: 2025-10-22T13:23:57.127Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: posix-timers: Ensure timer ID search-loop limit is valid posix_timer_add() tries to allocate a posix timer ID by starting from the cached ID which was stored by the last successful allocation. This is done in a loop searching the ID space for a free slot one by one. The loop has to terminate when the search wrapped around to the starting point. But that's racy vs. establishing the starting point. That is read out lockless, which leads to the following problem: CPU0 CPU
at's racy vs. establishing the starting point. That is read out lockless, which leads to the following problem: CPU0 CPU1 posix_timer_add() start = sig->posix_timer_id; lock(hash_lock); ... posix_timer_add() if (++sig->posix_timer_id < 0) start = sig->posix_timer_id; sig->posix_timer_id = 0; So CPU1 can observe a negative start value, i.e. -1, and the loop break never happens because the condition can never be true: if (sig->posix_timer_id == start) break; While this is unlikely to ever turn into an endless loop as the ID space is huge (INT_MAX), the racy read of the start value caught the attention of KCSAN and Dmitry unearthed that incorrectness. Rewrite it so that all id operations are un
value caught the attention of KCSAN and Dmitry unearthed that incorrectness. Rewrite it so that all id operations are under the hash lock. References: - https://git.kernel.org/stable/c/8dc52c200b889bc1cb34288fbf623d4ff381d2ae - https://git.kernel.org/stable/c/9ea26a8494a0a9337e7415eafd6f3ed940327dc5 - https://git.kernel.org/stable/c/8ad6679a5bb97cdb3e14942729292b4bfcc0e223 - https://git.kernel.org/stable/c/322377cc909defcca9451487484845e7e1d20d1b - https://git.kernel.org/stable/c/ef535e0315afd098c4beb1da364847eca4b56a20 - https://git.kernel.org/stable/c/6a0ac84501b4fec73a1a823c55cf13584c43f418 - https://git.kernel.org/stable/c/37175e25edf7cc0d5a2cd2c2a1cbe2dcbf4a1937 - https://git.kernel.org
823c55cf13584c43f418 - https://git.kernel.org/stable/c/37175e25edf7cc0d5a2cd2c2a1cbe2dcbf4a1937 - https://git.kernel.org/stable/c/8ce8849dd1e78dadcee0ec9acbd259d239b7069f
CVE ID: CVE-2023-53729 State: PUBLISHED Published: 2025-10-22T13:23:57.739Z Last Updated: 2025-10-22T13:23:57.739Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: soc: qcom: qmi_encdec: Restrict string length in decode The QMI TLV value for strings in a lot of qmi element info structures account for null terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of bounds access when the NULL character is appended in decoding. References: - https://git.kernel.org/stable/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2 - https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8
ble/c/6b58859e7c4ac357517a59f0801e8ce1b58a8ee2 - https://git.kernel.org/stable/c/64c5e916fabe5ef7bef0210b8a59fa8941ee1b8e - https://git.kernel.org/stable/c/2ccab9f82772ead618689d17dbc6950d6bd1e741 - https://git.kernel.org/stable/c/b2f39b813d1eed4a522428d1e6acd7dfe9b81579 - https://git.kernel.org/stable/c/f6250ecb7fbb934b89539e7e2ba6c1d8555c0975 - https://git.kernel.org/stable/c/22ee7c9c7f381be178b4457bc54530002e08e938 - https://git.kernel.org/stable/c/8d207400fd6b79c92aeb2f33bb79f62dff904ea2