Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-53289 State: PUBLISHED Published: 2025-09-16T08:11:21.984Z Last Updated: 2025-09-16T08:11:21.984Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: bdisp: Add missing check for create_workqueue Add the check for the return value of the create_workqueue in order to avoid NULL pointer dereference. References: - https://git.kernel.org/stable/c/fc1aeafdf6fb0a136c2257000f0d478ee62953fe - https://git.kernel.org/stable/c/2bfbe3ad371ac5349302833198df14e442622cbc - https://git.kernel.org/stable/c/c6a315f0b14074ac89723f55b749a557dda0ae2b - https://git.kernel.org/stable/c/4362444dca02ab44ac844feda3cf6238ef953673 - htt
6a315f0b14074ac89723f55b749a557dda0ae2b - https://git.kernel.org/stable/c/4362444dca02ab44ac844feda3cf6238ef953673 - https://git.kernel.org/stable/c/519b0849401194745ea40f9e07513b870afc1b42 - https://git.kernel.org/stable/c/c2e55481731b0e8c96f30f661e430aa884fbd354 - https://git.kernel.org/stable/c/eef95a2745cb91559bb03aa111c228fe38deaf64 - https://git.kernel.org/stable/c/0d09ce05724cfb3f5c5136893bec95305c641875 - https://git.kernel.org/stable/c/2371adeab717d8fe32144a84f3491a03c5838cfb
CVE ID: CVE-2023-53290 State: PUBLISHED Published: 2025-09-16T08:11:22.829Z Last Updated: 2025-09-29T10:47:35.861Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: samples/bpf: Fix fout leak in hbm's run_bpf_prog Fix fout being fopen'ed but then not subsequently fclose'd. In the affected branch, fout is otherwise going out of scope. References: - https://git.kernel.org/stable/c/a7ec2f424f6edad34651137783a0a59eca9aa37e - https://git.kernel.org/stable/c/7560ed6592ff4077528c239c71e91b19de985b97 - https://git.kernel.org/stable/c/e3e6e252d74f20f6fc610c7fef3ae7dda0109a6f - https://git.kernel.org/stable/c/f2065b8b0a215bc6aa061287a2e3d9e
.org/stable/c/e3e6e252d74f20f6fc610c7fef3ae7dda0109a6f - https://git.kernel.org/stable/c/f2065b8b0a215bc6aa061287a2e3d9eab2446422 - https://git.kernel.org/stable/c/edf37bc8b03d3f948e679b2fd2d14464495f5d1b - https://git.kernel.org/stable/c/23acb14af1914010dd0aae1bbb7fab28bf518b8e
CVE ID: CVE-2023-53291 State: PUBLISHED Published: 2025-09-16T08:11:23.666Z Last Updated: 2025-09-16T08:11:23.666Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale Running the 'kfree_rcu_test' test case [1] results in a splat [2]. The root cause is the kfree_scale_thread thread(s) continue running after unloading the rcuscale module. This commit fixes that isue by invoking kfree_scale_cleanup() from rcu_scale_cleanup() when removing the rcuscale module. [1] modprobe rcuscale kfree_rcu_test=1 // After some time rmmod rcuscale rmmod torture [2] BUG: unable to
scale module. [1] modprobe rcuscale kfree_rcu_test=1 // After some time rmmod rcuscale rmmod torture [2] BUG: unable to handle page fault for address: ffffffffc0601a87 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 11de4f067 P4D 11de4f067 PUD 11de51067 PMD 112f4d067 PTE 0 Oops: 0010 [#1] PREEMPT SMP NOPTI CPU: 1 PID: 1798 Comm: kfree_scale_thr Not tainted 6.3.0-rc1-rcu+ #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015 RIP: 0010:0xffffffffc0601a87 Code: Unable to access opcode bytes at 0xffffffffc0601a5d. RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000
c0601a5d. RSP: 0018:ffffb25bc2e57e18 EFLAGS: 00010297 RAX: 0000000000000000 RBX: ffffffffc061f0b6 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff962fd0de RDI: ffffffff962fd0de RBP: ffffb25bc2e57ea8 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000000 R14: 000000000000000a R15: 00000000001c1dbe FS: 0000000000000000(0000) GS:ffff921fa2200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffc0601a5d CR3: 000000011de4c006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000
0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> ? kvfree_call_rcu+0xf0/0x3a0 ? kthread+0xf3/0x120 ? kthread_complete_and_exit+0x20/0x20 ? ret_from_fork+0x1f/0x30 </TASK> Modules linked in: rfkill sunrpc ... [last unloaded: torture] CR2: ffffffffc0601a87 ---[ end trace 0000000000000000 ]--- References: - https://git.kernel.org/stable/c/604d6a5ff718874904b0fe614878a42b42c0d699 - https://git.kernel.org/stable/c/f766d45ab294871a3d588ee76c666852f151cad9 - https://git.kernel.org/stable/c/b8a6ba524d41f4da102e65f90498d9a910839621 - https://git.kernel.org/stable/c/1dd7547c7610723b2b6afe1a3c4ddb2bde63387c
le/c/b8a6ba524d41f4da102e65f90498d9a910839621 - https://git.kernel.org/stable/c/1dd7547c7610723b2b6afe1a3c4ddb2bde63387c - https://git.kernel.org/stable/c/29b1da4f90fc42c91beb4e400d926194925ad31b - https://git.kernel.org/stable/c/23fc8df26dead16687ae6eb47b0561a4a832e2f6
CVE ID: CVE-2023-53292 State: PUBLISHED Published: 2025-09-16T08:11:24.583Z Last Updated: 2025-09-16T08:11:24.583Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none After grabbing q->sysfs_lock, q->elevator may become NULL because of elevator switch. Fix the NULL dereference on q->elevator by checking it with lock. References: - https://git.kernel.org/stable/c/3e977386521b71471e66ec2ba82efdfcc456adf2 - https://git.kernel.org/stable/c/245165658e1c9f95c0fecfe02b9b1ebd30a1198a
CVE ID: CVE-2023-53293 State: REJECTED Published: 2025-09-16T08:11:25.732Z Last Updated: 2025-10-29T10:52:41.527Z Description: No description available.
CVE ID: CVE-2023-53294 State: PUBLISHED Published: 2025-09-16T08:11:26.926Z Last Updated: 2025-09-16T08:11:26.926Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix null-ptr-deref on inode->i_op in ntfs_lookup() Syzbot reported a null-ptr-deref bug: ntfs3: loop0: Different NTFS' sector size (1024) and media sector size (512) ntfs3: loop0: Mark volume as dirty due to NTFS errors general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:d_flags_for_inode fs/dcache.c:1980 [inline] RIP: 0010
r-deref in range [0x0000000000000008-0x000000000000000f] RIP: 0010:d_flags_for_inode fs/dcache.c:1980 [inline] RIP: 0010:__d_add+0x5ce/0x800 fs/dcache.c:2796 Call Trace: <TASK> d_splice_alias+0x122/0x3b0 fs/dcache.c:3191 lookup_open fs/namei.c:3391 [inline] open_last_lookups fs/namei.c:3481 [inline] path_openat+0x10e6/0x2df0 fs/namei.c:3688 do_filp_open+0x264/0x4f0 fs/namei.c:3718 do_sys_openat2+0x124/0x4e0 fs/open.c:1310 do_sys_open fs/open.c:1326 [inline] __do_sys_open fs/open.c:1334 [inline] __se_sys_open fs/open.c:1330 [inline] __x64_sys_open+0x221/0x270 fs/open.c:1330 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_a
do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd If the MFT record of ntfs inode is not a base record, inode->i_op can be NULL. And a null-ptr-deref may happen: ntfs_lookup() dir_search_u() # inode->i_op is set to NULL d_splice_alias() __d_add() d_flags_for_inode() # inode->i_op->get_link null-ptr-deref Fix this by adding a Check on inode->i_op before calling the d_splice_alias() function. References: - https://git.kernel.org/stable/c/f8d9e062a695a3665c4635c4f216a75912687598 - https://git.kernel.org/stable/c/d69d5e2a81df94534bdb468bcdd26060fcb7191a - https://git.kernel.org/stable/c/2ba22cbc6a1cf4b58
s://git.kernel.org/stable/c/d69d5e2a81df94534bdb468bcdd26060fcb7191a - https://git.kernel.org/stable/c/2ba22cbc6a1cf4b58195adbee0b80262e53992d3 - https://git.kernel.org/stable/c/e78240bc4b94fc42854d65e657bb998100cc8e1b - https://git.kernel.org/stable/c/254e69f284d7270e0abdc023ee53b71401c3ba0c
CVE ID: CVE-2023-53295 State: PUBLISHED Published: 2025-09-16T08:11:27.678Z Last Updated: 2025-09-16T08:11:27.678Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: udf: Do not update file length for failed writes to inline files When write to inline file fails (or happens only partly), we still updated length of inline data as if the whole write succeeded. Fix the update of length of inline data to happen only if the write succeeds. References: - https://git.kernel.org/stable/c/5621f7a8139053d0c3c47fb68ee9f602139eb40a - https://git.kernel.org/stable/c/5a6c373d761f55635e175fa2f407544bae8f583b - https://git.kernel.org/stable/c/7bd8
9eb40a - https://git.kernel.org/stable/c/5a6c373d761f55635e175fa2f407544bae8f583b - https://git.kernel.org/stable/c/7bd8d9e1cf5607ee14407f4060b9a1dbb3c42802 - https://git.kernel.org/stable/c/eb2133900cac2d2f78befd6be41666cf1a2315d9 - https://git.kernel.org/stable/c/c5787d77a5c29fffd295d138bd118b334990a567 - https://git.kernel.org/stable/c/6837910aeb2c9101fc036dcd1b1f32615c20ec1a - https://git.kernel.org/stable/c/6d18cedc1ef0caeb1567cab660079e48844ff6d6 - https://git.kernel.org/stable/c/256fe4162f8b5a1625b8603ca5f7ff79725bfb47
CVE ID: CVE-2023-53296 State: PUBLISHED Published: 2025-09-16T08:11:28.519Z Last Updated: 2025-09-16T08:11:28.519Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: sctp: check send stream number after wait_for_sndbuf This patch fixes a corner case where the asoc out stream count may change after wait_for_sndbuf. When the main thread in the client starts a connection, if its out stream count is set to N while the in stream count in the server is set to N - 2, another thread in the client keeps sending the msgs with stream number N - 1, and waits for sndbuf before processing INIT_ACK. However, after processing INIT_ACK, the out str
th stream number N - 1, and waits for sndbuf before processing INIT_ACK. However, after processing INIT_ACK, the out stream count in the client is shrunk to N - 2, the same to the in stream count in the server. The crash occurs when the thread waiting for sndbuf is awake and sends the msg in a non-existing stream(N - 1), the call trace is as below: KASAN: null-ptr-deref in range [0x0000000000000038-0x000000000000003f] Call Trace: <TASK> sctp_cmd_send_msg net/sctp/sm_sideeffect.c:1114 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1777 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x9f/0xc0
sctp/sm_sideeffect.c:1199 [inline] sctp_do_sm+0x197d/0x5310 net/sctp/sm_sideeffect.c:1170 sctp_primitive_SEND+0x9f/0xc0 net/sctp/primitive.c:163 sctp_sendmsg_to_asoc+0x10eb/0x1a30 net/sctp/socket.c:1868 sctp_sendmsg+0x8d4/0x1d90 net/sctp/socket.c:2026 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:825 sock_sendmsg_nosec net/socket.c:722 [inline] sock_sendmsg+0xde/0x190 net/socket.c:745 The fix is to add an unlikely check for the send stream number after the thread wakes up from the wait_for_sndbuf. References: - https://git.kernel.org/stable/c/9346a1a21142357972a6f466ba6275ddc54b04ac - https://git.kernel.org/stable/c/0443fff49d6352160c200064156c25898bd9f58c - https://git.kernel.org/stable/c/b4b6d
b04ac - https://git.kernel.org/stable/c/0443fff49d6352160c200064156c25898bd9f58c - https://git.kernel.org/stable/c/b4b6dfad41aaae9e36e44327b18d5cf4b20dd2ce - https://git.kernel.org/stable/c/667eb99cf7c15fe5b0ecefe75cf658e20ef20c9f - https://git.kernel.org/stable/c/d2128636b303aa9cf065055402ee6697409a8837 - https://git.kernel.org/stable/c/a615e7270318fa0b98bf1ff38daf6cf52d840312 - https://git.kernel.org/stable/c/2584024b23552c00d95b50255e47bd18d306d31a
CVE ID: CVE-2023-53297 State: PUBLISHED Published: 2025-09-16T08:11:29.283Z Last Updated: 2025-09-16T08:11:29.283Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp conn->chan_lock isn't acquired before l2cap_get_chan_by_scid, if l2cap_get_chan_by_scid returns NULL, then 'bad unlock balance' is triggered. References: - https://git.kernel.org/stable/c/5f352a56f0e607e6ff539cbf12156bfd8af232be - https://git.kernel.org/stable/c/6a27762340ad08643de3bc17fe1646ea489ca2e2 - https://git.kernel.org/stable/c/2112c4c47d36bc5aba3ddeb9afedce6ae6a67e7d - https://git.kernel.org/st
7fe1646ea489ca2e2 - https://git.kernel.org/stable/c/2112c4c47d36bc5aba3ddeb9afedce6ae6a67e7d - https://git.kernel.org/stable/c/55410a9144c76ecda126e6cdec556dfcd8f343b2 - https://git.kernel.org/stable/c/116b9c002c894097adc2b8684db2d1da4229ed46 - https://git.kernel.org/stable/c/fd269a0435f8e9943b7a57c5a59688848d42d449 - https://git.kernel.org/stable/c/5134556c9be582793f30695c09d18a26fe1ff2d7 - https://git.kernel.org/stable/c/25e97f7b1866e6b8503be349eeea44bb52d661ce
CVE ID: CVE-2023-53298 State: PUBLISHED Published: 2025-09-16T08:11:30.044Z Last Updated: 2025-09-16T08:11:30.044Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nfc: fix memory leak of se_io context in nfc_genl_se_io The callback context for sending/receiving APDUs to/from the selected secure element is allocated inside nfc_genl_se_io and supposed to be eventually freed in se_io_cb callback function. However, there are several error paths where the bwi_timer is not charged to call se_io_cb later, and the cb_context is leaked. The patch proposes to free the cb_context explicitly on those error paths. At the moment we can't simp
ontext is leaked. The patch proposes to free the cb_context explicitly on those error paths. At the moment we can't simply check 'dev->ops->se_io()' return value as it may be negative in both cases: when the timer was charged and was not. References: - https://git.kernel.org/stable/c/5321da6d84b87a34eea441677d649c34bd854169 - https://git.kernel.org/stable/c/af452e35b9e6a87cd49e54a7a3d60d934b194651 - https://git.kernel.org/stable/c/271eed1736426103335c5aac50f15b0f4d236bc0 - https://git.kernel.org/stable/c/8978315cb4bf8878c9c8ec05dafd8f7ff539860d - https://git.kernel.org/stable/c/c494365432dcdc549986f4d9af9eb6190cbdb153 - https://git.kernel.org/stable/c/b2036a252381949d3b743a3de069324ae3028a57
le/c/c494365432dcdc549986f4d9af9eb6190cbdb153 - https://git.kernel.org/stable/c/b2036a252381949d3b743a3de069324ae3028a57 - https://git.kernel.org/stable/c/ba98db08895748c12e5ded52cd1598dce2c79e55 - https://git.kernel.org/stable/c/25ff6f8a5a3b8dc48e8abda6f013e8cc4b14ffea
CVE ID: CVE-2023-53299 State: PUBLISHED Published: 2025-09-16T08:11:30.854Z Last Updated: 2025-09-16T08:11:30.854Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix leak of 'r10bio->remaining' for recovery raid10_sync_request() will add 'r10bio->remaining' for both rdev and replacement rdev. However, if the read io fails, recovery_request_write() returns without issuing the write io, in this case, end_sync_request() is only called once and 'remaining' is leaked, cause an io hang. Fix the problem by decreasing 'remaining' according to if 'bio' and 'repl_bio' is valid. References: - https://git.kernel.org/stable/c/cb8
decreasing 'remaining' according to if 'bio' and 'repl_bio' is valid. References: - https://git.kernel.org/stable/c/cb827ed2bb34480dc102146d3a1f89fdbcafc028 - https://git.kernel.org/stable/c/1d2c6c6e37fe5de11fd01a82badf03390e12df7a - https://git.kernel.org/stable/c/8c5d5d7ffd1e76734811b8ea5417cf0432b9952c - https://git.kernel.org/stable/c/1697fb124c6d6c5237e9cbd78890310154738084 - https://git.kernel.org/stable/c/8d09065802c53cc938d162b62f6c4150b392c90e - https://git.kernel.org/stable/c/11141630f03efffdfe260b3582b2d93d38171b97 - https://git.kernel.org/stable/c/3481dec5ecbbbbe44ab23e22c2b14bd65c644ec6 - https://git.kernel.org/stable/c/4f82e7e07cdaf2947d71968e3d6b73370a217093 - https://git.ker
be44ab23e22c2b14bd65c644ec6 - https://git.kernel.org/stable/c/4f82e7e07cdaf2947d71968e3d6b73370a217093 - https://git.kernel.org/stable/c/26208a7cffd0c7cbf14237ccd20c7270b3ffeb7e
CVE ID: CVE-2023-53300 State: PUBLISHED Published: 2025-09-16T08:11:31.629Z Last Updated: 2025-09-16T08:11:31.629Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: hi846: Fix memleak in hi846_init_controls() hi846_init_controls doesn't clean the allocated ctrl_hdlr in case there is a failure, which causes memleak. Add v4l2_ctrl_handler_free to free the resource properly. References: - https://git.kernel.org/stable/c/fd22e8c8c38fb40f130d3a60e52c59996a5bbae9 - https://git.kernel.org/stable/c/12a80b1490e398f5ad7157508cf32b73511de5fc - https://git.kernel.org/stable/c/07f0f15e5db60c5b0722049d3251ef4a46dc3b76 - https://git.kerne
5ad7157508cf32b73511de5fc - https://git.kernel.org/stable/c/07f0f15e5db60c5b0722049d3251ef4a46dc3b76 - https://git.kernel.org/stable/c/2649c1a20e8e399ee955d0e22192f9992662c3d2
CVE ID: CVE-2023-53301 State: PUBLISHED Published: 2025-09-16T08:11:32.344Z Last Updated: 2025-09-16T08:11:32.344Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix kernel crash due to null io->bio We should return when io->bio is null before doing anything. Otherwise, panic. BUG: kernel NULL pointer dereference, address: 0000000000000010 RIP: 0010:__submit_merged_write_cond+0x164/0x240 [f2fs] Call Trace: <TASK> f2fs_submit_merged_write+0x1d/0x30 [f2fs] commit_checkpoint+0x110/0x1e0 [f2fs] f2fs_write_checkpoint+0x9f7/0xf00 [f2fs] ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] __checkpoint_and_complete_reqs+0x84/0x190 [
eckpoint+0x9f7/0xf00 [f2fs] ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] __checkpoint_and_complete_reqs+0x84/0x190 [f2fs] ? preempt_count_add+0x82/0xc0 ? __pfx_issue_checkpoint_thread+0x10/0x10 [f2fs] issue_checkpoint_thread+0x4c/0xf0 [f2fs] ? __pfx_autoremove_wake_function+0x10/0x10 kthread+0xff/0x130 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> References: - https://git.kernel.org/stable/c/83dbb9a1bd5ef2eea73275906fc50b2fdda39cd5 - https://git.kernel.org/stable/c/eb52f13c6093ac761dbeaa459c810fc0253209fc - https://git.kernel.org/stable/c/267c159f9c7bcb7009dae16889b880c5ed8759a8
CVE ID: CVE-2023-53302 State: PUBLISHED Published: 2025-09-16T08:11:33.082Z Last Updated: 2025-09-16T08:11:33.082Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwl4965: Add missing check for create_singlethread_workqueue() Add the check for the return value of the create_singlethread_workqueue() in order to avoid NULL pointer dereference. References: - https://git.kernel.org/stable/c/874a85051cc8df8c5b928d8ff172b342cdc5424b - https://git.kernel.org/stable/c/c002d2741400771171b68dde9af937a4dfa0d1b3 - https://git.kernel.org/stable/c/3185d6cfc59277a77bf311dce701b7e25193f66a - https://git.kernel.org/stable/c/f15ef0ebcf56be1
tps://git.kernel.org/stable/c/3185d6cfc59277a77bf311dce701b7e25193f66a - https://git.kernel.org/stable/c/f15ef0ebcf56be1d4a3c9a7a80a1f1f82ab0eaad - https://git.kernel.org/stable/c/2f85c768bea2057e3299d19514da9e932c4f92d2 - https://git.kernel.org/stable/c/878a7c8357764e08bc778bcb26127fc12a4b36b7 - https://git.kernel.org/stable/c/26e6775f75517ad6844fe5b79bc5f3fa8c22ee61
CVE ID: CVE-2023-53303 State: PUBLISHED Published: 2025-09-16T08:11:33.842Z Last Updated: 2025-09-16T08:11:33.842Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: microchip: vcap api: Fix possible memory leak for vcap_dup_rule() Inject fault When select CONFIG_VCAP_KUNIT_TEST, the below memory leak occurs. If kzalloc() for duprule succeeds, but the following kmemdup() fails, the duprule, ckf and caf memory will be leaked. So kfree them in the error path. unreferenced object 0xffff122744c50600 (size 192): comm "kunit_try_catch", pid 346, jiffies 4294896122 (age 911.812s) hex dump (first 32 bytes): 10 27 00 00 04 00 00 00 1e
omm "kunit_try_catch", pid 346, jiffies 4294896122 (age 911.812s) hex dump (first 32 bytes): 10 27 00 00 04 00 00 00 1e 00 00 00 2c 01 00 00 .'..........,... 00 00 00 00 00 00 00 00 18 06 c5 44 27 12 ff ff ...........D'... backtrace: [<00000000394b0db8>] __kmem_cache_alloc_node+0x274/0x2f8 [<0000000001bedc67>] kmalloc_trace+0x38/0x88 [<00000000b0612f98>] vcap_dup_rule+0x50/0x460 [<000000005d2d3aca>] vcap_add_rule+0x8cc/0x1038 [<00000000eef9d0f8>] test_vcap_xn_rule_creator.constprop.0.isra.0+0x238/0x494 [<00000000cbda607b>] vcap_api_rule_remove_in_front_test+0x1ac/0x698 [<00000000c8766299>] kunit_try_run_case+0xe0/0x20c [<00000000c4fe9186>] kunit_generic_run_threadfn_adapter+0x50/0x94 [<00000
000000c8766299>] kunit_try_run_case+0xe0/0x20c [<00000000c4fe9186>] kunit_generic_run_threadfn_adapter+0x50/0x94 [<00000000f6864acf>] kthread+0x2e8/0x374 [<0000000022e639b3>] ret_from_fork+0x10/0x20 References: - https://git.kernel.org/stable/c/a26ba60413b2c8f95daf0ee0152cf82abd7bfbe4 - https://git.kernel.org/stable/c/281f65d29d6da1a9b6907fb0b145aaf34f4e4822
CVE ID: CVE-2023-53304 State: PUBLISHED Published: 2025-09-16T16:11:44.147Z Last Updated: 2025-09-16T16:11:44.147Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_rbtree: fix overlap expiration walk The lazy gc on insert that should remove timed-out entries fails to release the other half of the interval, if any. Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0 in nftables.git and kmemleak enabled kernel. Second bug is the use of rbe_prev vs. prev pointer. If rbe_prev() returns NULL after at least one iteration, rbe_prev points to element that is not an end interval, hence it should not
) returns NULL after at least one iteration, rbe_prev points to element that is not an end interval, hence it should not be removed. Lastly, check the genmask of the end interval if this is active in the current generation. References: - https://git.kernel.org/stable/c/8284a79136c384059e85e278da2210b809730287 - https://git.kernel.org/stable/c/acaee227cf79c45a5d2d49c3e9a66333a462802c - https://git.kernel.org/stable/c/893cb3c3513cf661a0ff45fe0cfa83fe27131f76 - https://git.kernel.org/stable/c/50cbb9d195c197af671869c8cadce3bd483735a0 - https://git.kernel.org/stable/c/89a4d1a89751a0fbd520e64091873e19cc0979e8 - https://git.kernel.org/stable/c/cd66733932399475fe933cb3ec03e687ed401462 - https://git.
51a0fbd520e64091873e19cc0979e8 - https://git.kernel.org/stable/c/cd66733932399475fe933cb3ec03e687ed401462 - https://git.kernel.org/stable/c/f718863aca469a109895cb855e6b81fff4827d71
CVE ID: CVE-2023-53305 State: PUBLISHED Published: 2025-09-16T16:11:44.845Z Last Updated: 2025-09-16T16:11:44.845Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free Fix potential use-after-free in l2cap_le_command_rej. References: - https://git.kernel.org/stable/c/e76bab1b7afa580cd76362540fc37551ada4359b - https://git.kernel.org/stable/c/1a40c56e8bff3e424724d78a9a6b3272dd8a371d - https://git.kernel.org/stable/c/fe49aa73cca6608714477b74bfc6874b9db979df - https://git.kernel.org/stable/c/2958cf9f805b9f0bdc4a761bf6ea281eb8d44f8e - https://git.kernel.org/stable/c/548a6b64b3c0688f01119a6fcccceb41f8c9
stable/c/2958cf9f805b9f0bdc4a761bf6ea281eb8d44f8e - https://git.kernel.org/stable/c/548a6b64b3c0688f01119a6fcccceb41f8c984e4 - https://git.kernel.org/stable/c/149daab45922ab1ac7f0cbeacab7251a46bf5e63 - https://git.kernel.org/stable/c/255be68150291440657b2cdb09420b69441af3d8 - https://git.kernel.org/stable/c/f752a0b334bb95fe9b42ecb511e0864e2768046f