Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
IZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries Modules linked in: CPU: 7 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc5-150500.34-default+ #2 5c90a668b6bbd142599890245c2fb5de19d7d28a Hardware name: IBM,9009-42G POWER9 (raw) 0x4e0202 0xf000005 of:IBM,FW950.40 (VL950_099) hv:phyp pSeries NIP: c000000001269d90 LR: c0000000004c57d4 CTR: 0000000000000000 REGS: c000000003632c30 TRAP: 0300 Not tainted (6.3.0-rc5-150500.34-default+) MSR: 8000000000009033 <SF,EE,ME,IR,DR,RI,LE> CR: 24842228 XER: 00000000 CFAR: c0000000004c57d0 DAR: c00c000100400038 DSISR: 42000000 IRQMASK: 0 .... NIP [c000000001269d90] __init_single_page.isra.74+0x14/0x4c LR [c0000000004c57d4] __init_zone_device_page+0x44/0xd0 Call Tra
[c000000001269d90] __init_single_page.isra.74+0x14/0x4c LR [c0000000004c57d4] __init_zone_device_page+0x44/0xd0 Call Trace: [c000000003632ed0] [c000000003632f60] 0xc000000003632f60 (unreliable) [c000000003632f10] [c0000000004c5ca0] memmap_init_zone_device+0x170/0x250 [c000000003632fe0] [c0000000005575f8] memremap_pages+0x2c8/0x7f0 [c0000000036330c0] [c000000000557b5c] devm_memremap_pages+0x3c/0xa0 [c000000003633100] [c000000000d458a8] dev_dax_probe+0x108/0x3e0 [c0000000036331a0] [c000000000d41430] dax_bus_probe+0xb0/0x140 [c0000000036331d0] [c000000000cef27c] really_probe+0x19c/0x520 [c000000003633260] [c000000000cef6b4] __driver_probe_device+0xb4/0x230 [c0000000036332e0] [c000000000cef888]
x19c/0x520 [c000000003633260] [c000000000cef6b4] __driver_probe_device+0xb4/0x230 [c0000000036332e0] [c000000000cef888] driver_probe_device+0x58/0x120 [c000000003633320] [c000000000cefa6c] __device_attach_driver+0x11c/0x1e0 [c0000000036333a0] [c000000000cebc58] bus_for_each_drv+0xa8/0x130 [c000000003633400] [c000000000ceefcc] __device_attach+0x15c/0x250 [c0000000036334a0] [c000000000ced458] bus_probe_device+0x108/0x110 [c0000000036334f0] [c000000000ce92dc] device_add+0x7fc/0xa10 [c0000000036335b0] [c000000000d447c8] devm_create_dev_dax+0x1d8/0x530 [c000000003633640] [c000000000d46b60] __dax_pmem_probe+0x200/0x270 [c0000000036337b0] [c000000000d46bf0] dax_pmem_probe+0x20/0x70 [c0000000036337d
0000d46b60] __dax_pmem_probe+0x200/0x270 [c0000000036337b0] [c000000000d46bf0] dax_pmem_probe+0x20/0x70 [c0000000036337d0] [c000000000d2279c] nvdimm_bus_probe+0xac/0x2b0 [c000000003633860] [c000000000cef27c] really_probe+0x19c/0x520 [c0000000036338f0] [c000000000cef6b4] __driver_probe_device+0xb4/0x230 [c000000003633970] [c000000000cef888] driver_probe_device+0x58/0x120 [c0000000036339b0] [c000000000cefd08] __driver_attach+0x1d8/0x240 [c000000003633a30] [c000000000cebb04] bus_for_each_dev+0xb4/0x130 [c000000003633a90] [c000000000cee564] driver_attach+0x34/0x50 [c000000003633ab0] [c000000000ced878] bus_add_driver+0x218/0x300 [c000000003633b40] [c000000000cf1144] driver_register+0xa4/0x1b0 [c0
3ab0] [c000000000ced878] bus_add_driver+0x218/0x300 [c000000003633b40] [c000000000cf1144] driver_register+0xa4/0x1b0 [c000000003633bb0] [c000000000d21a0c] __nd_driver_register+0x5c/0x100 [c000000003633c10] [c00000000206a2e8] dax_pmem_init+0x34/0x48 [c000000003633c30] [c0000000000132d0] do_one_initcall+0x60/0x320 [c000000003633d00] [c0000000020051b0] kernel_init_freeable+0x360/0x400 [c000000003633de0] [c000000000013764] kernel_init+0x34/0x1d0 [c000000003633e50] [c00000000000de14] ret_from_kernel_thread+0x5c/0x64 References: - https://git.kernel.org/stable/c/8f4603588acf5807aa1f1b4b1ea2b0365acd71f0 - https://git.kernel.org/stable/c/87a7ae75d7383afa998f57656d1d14e2a730cc47
CVE ID: CVE-2023-53707 State: PUBLISHED Published: 2025-10-22T13:23:43.822Z Last Updated: 2025-10-22T13:23:43.822Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1 The type of size is unsigned int, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later. References: - https://git.kernel.org/stable/c/9f55d300541cb5b435984d269087810581580b00 - https://git.kernel.org/stable/c/c3deb091398e9e469d08dd1599b6d76fd6b29df8 - https://git.kernel.org/stable/c/87c2213e85bd81e4a9a4d0880c2
rnel.org/stable/c/c3deb091398e9e469d08dd1599b6d76fd6b29df8 - https://git.kernel.org/stable/c/87c2213e85bd81e4a9a4d0880c256568794ae388
CVE ID: CVE-2023-53708 State: PUBLISHED Published: 2025-10-22T13:23:44.496Z Last Updated: 2025-10-22T13:23:44.496Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects If a badly constructed firmware includes multiple `ACPI_TYPE_PACKAGE` objects while evaluating the AMD LPS0 _DSM, there will be a memory leak. Explicitly guard against this. References: - https://git.kernel.org/stable/c/7b7964cd9db30bc84808a40d13a0633b4313f149 - https://git.kernel.org/stable/c/1ea7e47807279369c82718efd2677ea25c6579e3 - https://git.kernel.org/stable/c/9e8bbde9293151430884aed882a88eaa22298f72 -
c/1ea7e47807279369c82718efd2677ea25c6579e3 - https://git.kernel.org/stable/c/9e8bbde9293151430884aed882a88eaa22298f72 - https://git.kernel.org/stable/c/883cf0d4cf288313b71146ddebdf5d647b76c78b
CVE ID: CVE-2023-53709 State: PUBLISHED Published: 2025-10-22T13:23:45.155Z Last Updated: 2025-10-22T13:23:45.155Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Handle race between rb_move_tail and rb_check_pages It seems a data race between ring_buffer writing and integrity check. That is, RB_FLAG of head_page is been updating, while at same time RB_FLAG was cleared when doing integrity check rb_check_pages(): rb_check_pages() rb_handle_head_page(): -------- -------- rb_head_page_deactivate() rb_head_page_set_normal() rb_head_page_activate() We do intergrity test of the list to check if the list is corrupted and
_head_page_set_normal() rb_head_page_activate() We do intergrity test of the list to check if the list is corrupted and it is still worth doing it. So, let's refactor rb_check_pages() such that we no longer clear and set flag during the list sanity checking. [1] and [2] are the test to reproduce and the crash report respectively. 1: ``` read_trace.sh while true; do # the "trace" file is closed after read head -1 /sys/kernel/tracing/trace > /dev/null done ``` ``` repro.sh sysctl -w kernel.panic_on_warn=1 # function tracer will writing enough data into ring_buffer echo function > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_t
on > /sys/kernel/tracing/current_tracer ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ./read_trace.sh & ``` 2: ------------[ cut here ]------------ WARNING: CPU: 9 PID: 62 at kernel/trace/ring_buffer.c:2653 rb_move_tail+0x450/0x470 Modules linked in: CPU: 9 PID: 62 Comm: ksoftirqd/9 Tainted: G W 6.2.0-rc6+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014 RIP: 0010:rb_move_tail+0x450/0x470 Code: ff ff 4c 89 c8 f0 4d 0f b1 02 48 89 c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 f8 02 0f 84 ce fb
c2 48 83 e2 fc 49 39 d0 75 24 83 e0 03 83 f8 02 0f 84 e1 fb ff ff 48 8b 57 10 f0 ff 42 08 <0f> 0b 83 f8 02 0f 84 ce fb ff ff e9 db RSP: 0018:ffffb5564089bd00 EFLAGS: 00000203 RAX: 0000000000000000 RBX: ffff9db385a2bf81 RCX: ffffb5564089bd18 RDX: ffff9db281110100 RSI: 0000000000000fe4 RDI: ffff9db380145400 RBP: ffff9db385a2bf80 R08: ffff9db385a2bfc0 R09: ffff9db385a2bfc2 R10: ffff9db385a6c000 R11: ffff9db385a2bf80 R12: 0000000000000000 R13: 00000000000003e8 R14: ffff9db281110100 R15: ffffffffbb006108 FS: 0000000000000000(0000) GS:ffff9db3bdcc0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 Cal
0 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005602323024c8 CR3: 0000000022e0c000 CR4: 00000000000006e0 Call Trace: <TASK> ring_buffer_lock_reserve+0x136/0x360 ? __do_softirq+0x287/0x2df ? __pfx_rcu_softirq_qs+0x10/0x10 trace_function+0x21/0x110 ? __pfx_rcu_softirq_qs+0x10/0x10 ? __do_softirq+0x287/0x2df function_trace_call+0xf6/0x120 0xffffffffc038f097 ? rcu_softirq_qs+0x5/0x140 rcu_softirq_qs+0x5/0x140 __do_softirq+0x287/0x2df run_ksoftirqd+0x2a/0x30 smpboot_thread_fn+0x188/0x220 ? __pfx_smpboot_thread_fn+0x10/0x10 kthread+0xe7/0x110 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x2c/0x50 </TASK> ---[ end trace 0000000000000000 ]--- [ crash report and test reproducer credit goes to
ret_from_fork+0x2c/0x50 </TASK> ---[ end trace 0000000000000000 ]--- [ crash report and test reproducer credit goes to Zheng Yejian] References: - https://git.kernel.org/stable/c/6e02a43acd0691791df79ce538f2dd497a6c9b76 - https://git.kernel.org/stable/c/d41db100bc386b9433a3fc87026f5e8b453653e3 - https://git.kernel.org/stable/c/9674390ac540ed06768e3fbc2dba553929fbd736 - https://git.kernel.org/stable/c/09b1bf25f7f7a8f2bf8cd4278bba9c3172db8013 - https://git.kernel.org/stable/c/8843e06f67b14f71c044bf6267b2387784c7e198
CVE ID: CVE-2023-53710 State: PUBLISHED Published: 2025-10-22T13:23:45.785Z Last Updated: 2025-10-22T13:23:45.785Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read Kernel NULL pointer dereference when ACPI SAR table isn't implemented well. Fix the error code of return to mark the ACPI SAR table as invalid. [ 5.077128] mt7921e 0000:06:00.0: sar cnt = 0 [ 5.077381] BUG: kernel NULL pointer dereference, address: 0000000000000004 [ 5.077630] #PF: supervisor read access in kernel mode [ 5.077883] #PF: error_code(0x0000) - not-present page [ 5.078138] PGD 0 P4D 0 [ 5.0783
visor read access in kernel mode [ 5.077883] #PF: error_code(0x0000) - not-present page [ 5.078138] PGD 0 P4D 0 [ 5.078398] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 5.079202] RIP: 0010:mt7921_init_acpi_sar+0x106/0x220 [mt7921_common] ... [ 5.080786] Call Trace: [ 5.080786] <TASK> [ 5.080786] mt7921_register_device+0x37d/0x490 [mt7921_common] [ 5.080786] mt7921_pci_probe.part.0+0x2ee/0x310 [mt7921e] [ 5.080786] mt7921_pci_probe+0x52/0x70 [mt7921e] [ 5.080786] local_pci_probe+0x47/0x90 [ 5.080786] pci_call_probe+0x55/0x190 [ 5.080786] pci_device_probe+0x84/0x120 References: - https://git.kernel.org/stable/c/2a9a5f88e0da71c8e4f30aacbda45b1a1af5469d - https://git.kernel.org/stable/c/59c2b0aec7a5aa350
s://git.kernel.org/stable/c/2a9a5f88e0da71c8e4f30aacbda45b1a1af5469d - https://git.kernel.org/stable/c/59c2b0aec7a5aa350aa3edfb4363b19348c2269f - https://git.kernel.org/stable/c/888d89034f9eaeab9b5b75f13dbe35376c7dd471
CVE ID: CVE-2023-53711 State: PUBLISHED Published: 2025-10-22T13:23:46.458Z Last Updated: 2025-10-22T13:23:46.458Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: NFS: Fix a potential data corruption We must ensure that the subrequests are joined back into the head before we can retransmit a request. If the head was not on the commit lists, because the server wrote it synchronously, we still need to add it back to the retransmission list. Add a call that mirrors the effect of nfs_cancel_remove_inode() for O_DIRECT. References: - https://git.kernel.org/stable/c/4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf - https://git.kernel.org/sta
ECT. References: - https://git.kernel.org/stable/c/4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf - https://git.kernel.org/stable/c/da302f1d476a44245823a74546debb5d160bf5bd - https://git.kernel.org/stable/c/dac14a1dbe20e003215dacb8a3a1a7e4ca4e0ad0 - https://git.kernel.org/stable/c/0ec26716e45d615edfff46012e7dedcc0ac5f7ab - https://git.kernel.org/stable/c/88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4
CVE ID: CVE-2023-53712 State: PUBLISHED Published: 2025-10-22T13:23:47.100Z Last Updated: 2025-10-22T13:23:47.100Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ARM: 9317/1: kexec: Make smp stop calls asynchronous If a panic is triggered by a hrtimer interrupt all online cpus will be notified and set offline. But as highlighted by commit 19dbdcb8039c ("smp: Warn on function calls from softirq context") this call should not be made synchronous with disabled interrupts: softdog: Initiating panic Kernel panic - not syncing: Software Watchdog Timer expired WARNING: CPU: 1 PID: 0 at kernel/smp.c:753 smp_call_function_many_cond unwi
not syncing: Software Watchdog Timer expired WARNING: CPU: 1 PID: 0 at kernel/smp.c:753 smp_call_function_many_cond unwind_backtrace: show_stack dump_stack_lvl __warn warn_slowpath_fmt smp_call_function_many_cond smp_call_function crash_smp_send_stop.part.0 machine_crash_shutdown __crash_kexec panic softdog_fire __hrtimer_run_queues hrtimer_interrupt Make the smp call for machine_crash_nonpanic_core() asynchronous. References: - https://git.kernel.org/stable/c/46870eea5496ff277e86187a49ac5a667cfe60c4 - https://git.kernel.org/stable/c/ee378f45a70d09b51373ba495d30d99ef12219c1 - https://git.kernel.org/stable/c/5590ba4560eefbd19a4ed07c7e7c8e4c51ffc628 - https://git.kernel.org/stable/c/8922ba71c9
- https://git.kernel.org/stable/c/5590ba4560eefbd19a4ed07c7e7c8e4c51ffc628 - https://git.kernel.org/stable/c/8922ba71c969d2a0c01a94372a71477d879470de
CVE ID: CVE-2023-53713 State: PUBLISHED Published: 2025-10-22T13:23:47.720Z Last Updated: 2025-10-22T13:23:47.720Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: sme: Use STR P to clear FFR context field in streaming SVE mode The FFR is a predicate register which can vary between 16 and 256 bits in size depending upon the configured vector length. When saving the SVE state in streaming SVE mode, the FFR register is inaccessible and so commit 9f5848665788 ("arm64/sve: Make access to FFR optional") simply clears the FFR field of the in-memory context structure. Unfortunately, it achieves this using an unconditional 8-byte
clears the FFR field of the in-memory context structure. Unfortunately, it achieves this using an unconditional 8-byte store and so if the SME vector length is anything other than 64 bytes in size we will either fail to clear the entire field or, worse, we will corrupt memory immediately following the structure. This has led to intermittent kfence splats in CI [1] and can trigger kmalloc Redzone corruption messages when running the 'fp-stress' kselftest: | ============================================================================= | BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten | ----------------------------------------------------------------------------- | | 0xffff000809bf1e
Redzone overwritten | ----------------------------------------------------------------------------- | | 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc | Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531 | __kmalloc+0x8c/0xcc | do_sme_acc+0x9c/0x220 | ... Replace the 8-byte store with a store of a predicate register which has been zero-initialised with PFALSE, ensuring that the entire field is cleared in memory. [1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com References: - https://git.kernel.org/stable/c/97669214944e80d3756657c21c4f286f3da6a423 - https://git.kernel.org/stable/c/8769a62faacbbb6cac5e35d
t.kernel.org/stable/c/97669214944e80d3756657c21c4f286f3da6a423 - https://git.kernel.org/stable/c/8769a62faacbbb6cac5e35d9047ce445183d4e9f - https://git.kernel.org/stable/c/1403a899153a12d93fd510e463fd6d0eafba4336 - https://git.kernel.org/stable/c/893b24181b4c4bf1fa2841b1ed192e5413a97cb1
CVE ID: CVE-2023-53714 State: PUBLISHED Published: 2025-10-22T13:23:48.341Z Last Updated: 2025-10-22T13:23:48.341Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/stm: ltdc: fix late dereference check In ltdc_crtc_set_crc_source(), struct drm_crtc was dereferenced in a container_of() before the pointer check. This could cause a kernel panic. Fix this smatch warning: drivers/gpu/drm/stm/ltdc.c:1124 ltdc_crtc_set_crc_source() warn: variable dereferenced before check 'crtc' (see line 1119) References: - https://git.kernel.org/stable/c/340dba127bbed51e8425cd8e097aacfadd175462 - https://git.kernel.org/stable/c/04fe3b82528232aa85a
//git.kernel.org/stable/c/340dba127bbed51e8425cd8e097aacfadd175462 - https://git.kernel.org/stable/c/04fe3b82528232aa85a6c45464906d0727ef4f20 - https://git.kernel.org/stable/c/898a9e3f56db9860ab091d4bf41b6caa99aafc3d
CVE ID: CVE-2023-53715 State: PUBLISHED Published: 2025-10-22T13:23:48.905Z Last Updated: 2025-10-22T13:23:48.905Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex Apparently the hex passphrase mechanism does not work on newer chips/firmware (e.g. BCM4387). It seems there was a simple way of passing it in binary all along, so use that and avoid the hexification. OpenBSD has been doing it like this from the beginning, so this should work on all chips. Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to the device. Referenc
. Also clear the structure before setting the PMK. This was leaking uninitialized stack contents to the device. References: - https://git.kernel.org/stable/c/1687845eb8f37360a9ee849a3587ab659b090773 - https://git.kernel.org/stable/c/2bc34facb90ceeff6f8c17d2006575a6d07c3825 - https://git.kernel.org/stable/c/56c7e9c39bd54fd753c0c4b1ed10278cbd3a5f02 - https://git.kernel.org/stable/c/4e8dc0e5c7636efaadbd7e488acd34b4291c0431 - https://git.kernel.org/stable/c/e242c66f7ecfe8f5b6eb308f4ea464fd8589c866 - https://git.kernel.org/stable/c/f8a6c53ff1d91acd5a20eb627edbffd816eb9a4e - https://git.kernel.org/stable/c/2fa3a5226b05e0a797c68b9609dcebe0cd236b27 - https://git.kernel.org/stable/c/89b89e52153fda273
s://git.kernel.org/stable/c/2fa3a5226b05e0a797c68b9609dcebe0cd236b27 - https://git.kernel.org/stable/c/89b89e52153fda2733562776c7c9d9d3ebf8dd6d
CVE ID: CVE-2023-53716 State: PUBLISHED Published: 2025-10-22T13:23:49.536Z Last Updated: 2025-10-22T13:23:49.536Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: fix skb leak in __skb_tstamp_tx() Commit 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with zerocopy skbs. But it ended up adding a leak of its own. When skb_orphan_frags_rx() fails, the function just returns, leaking the skb it just cloned. Free it before returning. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Ref
rning. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. References: - https://git.kernel.org/stable/c/82501f1ead557cbee1c2467654ec109a80334d22 - https://git.kernel.org/stable/c/779332447108545ef04682ea29af5f85c0202aee - https://git.kernel.org/stable/c/58766252f6b2c0487cda6976a53d2bb03ae28e2a - https://git.kernel.org/stable/c/a594382ec6d0cc8cff5a8bc7e61b54e3858fb243 - https://git.kernel.org/stable/c/e06841a2abf9c82735cee39e88b1d79464088840 - https://git.kernel.org/stable/c/cc18b4685910d5d9de8314bae9c55790701b1811 - https://git.kernel.org/stable/c/f4d928c00254cfc9dd0ee7076f4a59bceec675f4 - https://git.kernel.org/stable/c/8a02fb71d719
https://git.kernel.org/stable/c/f4d928c00254cfc9dd0ee7076f4a59bceec675f4 - https://git.kernel.org/stable/c/8a02fb71d7192ff1a9a47c9d937624966c6e09af
CVE ID: CVE-2023-53717 State: PUBLISHED Published: 2025-10-22T13:23:50.161Z Last Updated: 2025-10-22T13:23:50.161Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() Fix a stack-out-of-bounds write that occurs in a WMI response callback function that is called after a timeout occurs in ath9k_wmi_cmd(). The callback writes to wmi->cmd_rsp_buf, a stack-allocated buffer that could no longer be valid when a timeout occurs. Set wmi->last_seq_id to 0 when a timeout occurred. Found by a modified version of syzkaller. BUG: KASAN: stack-out-of-bounds in ath9k_w
eq_id to 0 when a timeout occurred. Found by a modified version of syzkaller. BUG: KASAN: stack-out-of-bounds in ath9k_wmi_ctrl_rx Write of size 4 Call Trace: memcpy ath9k_wmi_ctrl_rx ath9k_htc_rx_msg ath9k_hif_usb_reg_in_cb __usb_hcd_giveback_urb usb_hcd_giveback_urb dummy_timer call_timer_fn run_timer_softirq __do_softirq irq_exit_rcu sysvec_apic_timer_interrupt References: - https://git.kernel.org/stable/c/89a33c3c847b19b19205cde1d924df2a6c70d8eb - https://git.kernel.org/stable/c/ae4933b4f17de8e2b7ff6f91b17d3b0099a6d6bc - https://git.kernel.org/stable/c/bf6dc175a2b53098a69db1236d9d53982f4b1bc0 - https://git.kernel.org/stable/c/78b56b0a613a87b61290b95be497fdfe2fe58aa6 - https://git.kernel.
69db1236d9d53982f4b1bc0 - https://git.kernel.org/stable/c/78b56b0a613a87b61290b95be497fdfe2fe58aa6 - https://git.kernel.org/stable/c/1af7eacfad45149c54893a8a9df9e92ef89f0a90 - https://git.kernel.org/stable/c/8f28513d9520184059530c01a9f928a1b3809d3f - https://git.kernel.org/stable/c/554048a72d7ecfdd58cc1bfb56e0a1864e64e82c - https://git.kernel.org/stable/c/8a2f35b9830692f7a616f2f627f943bc748af13a
CVE ID: CVE-2023-53718 State: PUBLISHED Published: 2025-10-22T13:23:50.809Z Last Updated: 2025-10-22T13:23:50.809Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not swap cpu_buffer during resize process When ring_buffer_swap_cpu was called during resize process, the cpu buffer was swapped in the middle, resulting in incorrect state. Continuing to run in the wrong state will result in oops. This issue can be easily reproduced using the following two scripts: /tmp # cat test1.sh //#! /bin/sh for i in `seq 0 100000` do echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 echo 5000 > /sys/kernel/debug/tra
i in `seq 0 100000` do echo 2000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 echo 5000 > /sys/kernel/debug/tracing/buffer_size_kb sleep 0.5 done /tmp # cat test2.sh //#! /bin/sh for i in `seq 0 100000` do echo irqsoff > /sys/kernel/debug/tracing/current_tracer sleep 1 echo nop > /sys/kernel/debug/tracing/current_tracer sleep 1 done /tmp # ./test1.sh & /tmp # ./test2.sh & A typical oops log is as follows, sometimes with other different oops logs. [ 231.711293] WARNING: CPU: 0 PID: 9 at kernel/trace/ring_buffer.c:2026 rb_update_pages+0x378/0x3f8 [ 231.713375] Modules linked in: [ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 231.716750]
s linked in: [ 231.714735] CPU: 0 PID: 9 Comm: kworker/0:1 Tainted: G W 6.5.0-rc1-00276-g20edcec23f92 #15 [ 231.716750] Hardware name: linux,dummy-virt (DT) [ 231.718152] Workqueue: events update_pages_handler [ 231.719714] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 231.721171] pc : rb_update_pages+0x378/0x3f8 [ 231.722212] lr : rb_update_pages+0x25c/0x3f8 [ 231.723248] sp : ffff800082b9bd50 [ 231.724169] x29: ffff800082b9bd50 x28: ffff8000825f7000 x27: 0000000000000000 [ 231.726102] x26: 0000000000000001 x25: fffffffffffff010 x24: 0000000000000ff0 [ 231.728122] x23: ffff0000c3a0b600 x22: ffff0000c3a0b5c0 x21: fffffffffffffe0a [ 231.730203] x20: ffff0000c3a0b600 x19: f