Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-53216 State: PUBLISHED Published: 2025-09-15T14:21:43.935Z Last Updated: 2025-09-15T14:21:43.935Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: efi: Make efi_rt_lock a raw_spinlock Running a rt-kernel base on 6.2.0-rc3-rt1 on an Ampere Altra outputs the following: BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46 in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 9, name: kworker/u320:0 preempt_count: 2, expected: 0 RCU nest depth: 0, expected: 0 3 locks held by kworker/u320:0/9: #0: ffff3fff8c27d128 ((wq_completion)efi_rts_wq){+.+.}-{0:0}, at: process_one_work (.
3 locks held by kworker/u320:0/9: #0: ffff3fff8c27d128 ((wq_completion)efi_rts_wq){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41) #1: ffff80000861bdd0 ((work_completion)(&efi_rts_work.work)){+.+.}-{0:0}, at: process_one_work (./include/linux/atomic/atomic-long.h:41) #2: ffffdf7e1ed3e460 (efi_rt_lock){+.+.}-{3:3}, at: efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) Preemption disabled at: efi_virtmap_load (./arch/arm64/include/asm/mmu_context.h:248) CPU: 0 PID: 9 Comm: kworker/u320:0 Tainted: G W 6.2.0-rc3-rt1 Hardware name: WIWYNN Mt.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18 Workqueue: ef
.Jade Server System B81.03001.0005/Mt.Jade Motherboard, BIOS 1.08.20220218 (SCP: 1.08.20220218) 2022/02/18 Workqueue: efi_rts_wq efi_call_rts Call trace: dump_backtrace (arch/arm64/kernel/stacktrace.c:158) show_stack (arch/arm64/kernel/stacktrace.c:165) dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) dump_stack (lib/dump_stack.c:114) __might_resched (kernel/sched/core.c:10134) rt_spin_lock (kernel/locking/rtmutex.c:1769 (discriminator 4)) efi_call_rts (drivers/firmware/efi/runtime-wrappers.c:101) [...] This seems to come from commit ff7a167961d1 ("arm64: efi: Execute runtime services from a dedicated stack") which adds a spinlock. This spinlock is taken through: efi_call_rts() \-efi_
e runtime services from a dedicated stack") which adds a spinlock. This spinlock is taken through: efi_call_rts() \-efi_call_virt() \-efi_call_virt_pointer() \-arch_efi_call_virt_setup() Make 'efi_rt_lock' a raw_spinlock to avoid being preempted. [ardb: The EFI runtime services are called with a different set of translation tables, and are permitted to use the SIMD registers. The context switch code preserves/restores neither, and so EFI calls must be made with preemption disabled, rather than only disabling migration.] References: - https://git.kernel.org/stable/c/030b1c4217a4f504c7d0795a2bd86b7181e56f11 - https://git.kernel.org/stable/c/6a72729ed6accc86dad5522895e8fa2f96642a2c - https://gi
17a4f504c7d0795a2bd86b7181e56f11 - https://git.kernel.org/stable/c/6a72729ed6accc86dad5522895e8fa2f96642a2c - https://git.kernel.org/stable/c/8b38969fa01662ec539a0d08a8ea5ec6f31fa4ed - https://git.kernel.org/stable/c/4e8f7d998b582a99aadedd07ae6086e99b89c97a - https://git.kernel.org/stable/c/0e68b5517d3767562889f1d83fdb828c26adb24f
CVE ID: CVE-2023-53217 State: PUBLISHED Published: 2025-09-15T14:21:44.831Z Last Updated: 2025-09-15T14:21:44.831Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nubus: Partially revert proc_create_single_data() conversion The conversion to proc_create_single_data() introduced a regression whereby reading a file in /proc/bus/nubus results in a seg fault: # grep -r . /proc/bus/nubus/e/ Data read fault at 0x00000020 in Super Data (pc=0x1074c2) BAD KERNEL BUSERR Oops: 00000000 Modules linked in: PC: [<001074c2>] PDE_DATA+0xc/0x16 SR: 2010 SP: 38284958 a2: 01152370 d0: 00000001 d1: 01013000 d2: 01002790 d3: 00000000 d4: 00000001 d5
PDE_DATA+0xc/0x16 SR: 2010 SP: 38284958 a2: 01152370 d0: 00000001 d1: 01013000 d2: 01002790 d3: 00000000 d4: 00000001 d5: 0008ce2e a0: 00000000 a1: 00222a40 Process grep (pid: 45, task=142f8727) Frame format=B ssw=074d isc=2008 isb=4e5e daddr=00000020 dobuf=01199e70 baddr=001074c8 dibuf=ffffffff ver=f Stack from 01199e48: 01199e70 00222a58 01002790 00000000 011a3000 01199eb0 015000c0 00000000 00000000 01199ec0 01199ec0 000d551a 011a3000 00000001 00000000 00018000 d003f000 00000003 00000001 0002800d 01052840 01199fa8 c01f8000 00000000 00000029 0b532b80 00000000 00000000 00000029 0b532b80 01199ee4 00103640 011198c0 d003f000 00018000 01199fa8 00000000 011198c0 00000000 01199f4c 000b3344 011198c
0029 0b532b80 01199ee4 00103640 011198c0 d003f000 00018000 01199fa8 00000000 011198c0 00000000 01199f4c 000b3344 011198c0 d003f000 00018000 01199fa8 00000000 00018000 011198c0 Call Trace: [<00222a58>] nubus_proc_rsrc_show+0x18/0xa0 [<000d551a>] seq_read+0xc4/0x510 [<00018000>] fp_fcos+0x2/0x82 [<0002800d>] __sys_setreuid+0x115/0x1c6 [<00103640>] proc_reg_read+0x5c/0xb0 [<00018000>] fp_fcos+0x2/0x82 [<000b3344>] __vfs_read+0x2c/0x13c [<00018000>] fp_fcos+0x2/0x82 [<00018000>] fp_fcos+0x2/0x82 [<000b8aa2>] sys_statx+0x60/0x7e [<000b34b6>] vfs_read+0x62/0x12a [<00018000>] fp_fcos+0x2/0x82 [<00018000>] fp_fcos+0x2/0x82 [<000b39c2>] ksys_read+0x48/0xbe [<00018000>] fp_fcos+0x2/0x82 [<000b3a4e>] s
cos+0x2/0x82 [<00018000>] fp_fcos+0x2/0x82 [<000b39c2>] ksys_read+0x48/0xbe [<00018000>] fp_fcos+0x2/0x82 [<000b3a4e>] sys_read+0x16/0x1a [<00018000>] fp_fcos+0x2/0x82 [<00002b84>] syscall+0x8/0xc [<00018000>] fp_fcos+0x2/0x82 [<0000c016>] not_ext+0xa/0x18 Code: 4e5e 4e75 4e56 0000 206e 0008 2068 ffe8 <2068> 0020 2008 4e5e 4e75 4e56 0000 2f0b 206e 0008 2068 0004 2668 0020 206b ffe8 Disabling lock debugging due to kernel taint Segmentation fault The proc_create_single_data() conversion does not work because single_open(file, nubus_proc_rsrc_show, PDE_DATA(inode)) is not equivalent to the original code. References: - https://git.kernel.org/stable/c/f70407e8e0272e00d133c5e039168ff1bae6bcac - ht
valent to the original code. References: - https://git.kernel.org/stable/c/f70407e8e0272e00d133c5e039168ff1bae6bcac - https://git.kernel.org/stable/c/c06edf13f4cf7f9e8ff4bc6f7e951e4f074dc105 - https://git.kernel.org/stable/c/67e3b5230cefed1eca470c460a2035f02986cebb - https://git.kernel.org/stable/c/9877533e1401dbbb2c7da8badda05d196aa07623 - https://git.kernel.org/stable/c/a03f2f4bd49030f57849227be9ba38a3eb1edb61 - https://git.kernel.org/stable/c/0e96647cff9224db564a1cee6efccb13dbe11ee2
CVE ID: CVE-2023-53218 State: PUBLISHED Published: 2025-09-15T14:21:45.843Z Last Updated: 2025-09-15T14:21:45.843Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Make it so that a waiting process can be aborted When sendmsg() creates an rxrpc call, it queues it to wait for a connection and channel to be assigned and then waits before it can start shovelling data as the encrypted DATA packet content includes a summary of the connection parameters. However, sendmsg() may get interrupted before a connection gets assigned and further sendmsg() calls will fail with EBUSY until an assignment is made. Fix this so that the call
n gets assigned and further sendmsg() calls will fail with EBUSY until an assignment is made. Fix this so that the call can at least be aborted without failing on EBUSY. We have to be careful here as sendmsg() mustn't be allowed to start the call timer if the call doesn't yet have a connection assigned as an oops may follow shortly thereafter. References: - https://git.kernel.org/stable/c/7161cf61c64e9e9413d790f2fa2b9dada71a2249 - https://git.kernel.org/stable/c/876d96faacbc407daf4978d7ec95051b68f5344a - https://git.kernel.org/stable/c/0eb362d254814ce04848730bf32e75b8ee1a4d6c
CVE ID: CVE-2023-53219 State: PUBLISHED Published: 2025-09-15T14:21:47.459Z Last Updated: 2025-09-15T14:21:47.459Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: netup_unidvb: fix use-after-free at del_timer() When Universal DVB card is detaching, netup_unidvb_dma_fini() uses del_timer() to stop dma->timeout timer. But when timer handler netup_unidvb_dma_timeout() is running, del_timer() could not stop it. As a result, the use-after-free bug could happen. The process is shown below: (cleanup routine) | (timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | net
(timer routine) | mod_timer(&dev->tx_sim_timer, ..) netup_unidvb_finidev() | (wait a time) netup_unidvb_dma_fini() | netup_unidvb_dma_timeout() del_timer(&dma->timeout); | | ndev->pci_dev->dev //USE Fix by changing del_timer() to del_timer_sync(). References: - https://git.kernel.org/stable/c/dd5c77814f290b353917df329f36de1472d47154 - https://git.kernel.org/stable/c/90229e9ee957d4514425e4a4d82c50ab5d57ac4d - https://git.kernel.org/stable/c/1550bcf2983ae1220cc8ab899a39a423fa7cb523 - https://git.kernel.org/stable/c/f9982db735a8495eee14267cf193c806b957e942 - https://git.kernel.org/stable/c/051af3f0b7d1cd8ab7f3e2523ad8ae1af44caba3 - https://git.kernel.org/stable/c/07821524f67bf920342bc84ae8b3dea
.org/stable/c/051af3f0b7d1cd8ab7f3e2523ad8ae1af44caba3 - https://git.kernel.org/stable/c/07821524f67bf920342bc84ae8b3dea2a315a89e - https://git.kernel.org/stable/c/c8f9c05e1ebcc9c7bc211cc8b74d8fb86a8756fc - https://git.kernel.org/stable/c/0f5bb36bf9b39a2a96e730bf4455095b50713f63
CVE ID: CVE-2023-53220 State: PUBLISHED Published: 2025-09-15T14:21:49.075Z Last Updated: 2025-09-15T14:21:49.075Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") Refer
ent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()") References: - https://git.kernel.org/stable/c/c6763fefa267f6e62595a6ac1f57815d99fc90b7 - https://git.kernel.org/stable/c/adcb73f8ce9aec48b1f85223f401c1574015d8d2 - https://git.kernel.org/stable/c/991c77fe18c6f374bbf83376f8c42550aa565662 - https://git.kernel.org/stable/c/a9def3e9718a4dc756f48db147d42ec41a966240 - https://git.kernel.org/stable/c/5b1ea100ad3695025969dc4693f307877fb688d6 - https://git.kernel.org/stable/c/6ab7ea4e17d6a605d05308adf8f3408924770cba - https://git.kernel.org/stable/c/a1110f19d4940e4185251d072cbb0ff51486a1e7 - https://git.kernel.org/stable/c/1047f9343011f2
ttps://git.kernel.org/stable/c/a1110f19d4940e4185251d072cbb0ff51486a1e7 - https://git.kernel.org/stable/c/1047f9343011f2cedc73c64829686206a7e9fc3f
CVE ID: CVE-2023-53221 State: PUBLISHED Published: 2025-09-15T14:21:50.053Z Last Updated: 2025-09-15T14:21:50.053Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix memleak due to fentry attach failure If it fails to attach fentry, the allocated bpf trampoline image will be left in the system. That can be verified by checking /proc/kallsyms. This meamleak can be verified by a simple bpf program as follows: SEC("fentry/trap_init") int fentry_run() { return 0; } It will fail to attach trap_init because this function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc
s function is freed after kernel init, and then we can find the trampoline image is left in the system by checking /proc/kallsyms. $ tail /proc/kallsyms ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf] ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf] $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'" [2522] FUNC 'trap_init' type_id=119 linkage=static $ echo $((6442453466 & 0x7fffffff)) 2522 Note that there are two left bpf trampoline images, that is because the libbpf will fallback to raw tracepoint if -EINVAL is returned. References: - https://git.kernel.org/stable/c/20109ddd5bea2c24d790debf5d02584ef24c3f5e - https://git.kernel.org/stable/c/f72c67d1a82dada7d6d
//git.kernel.org/stable/c/20109ddd5bea2c24d790debf5d02584ef24c3f5e - https://git.kernel.org/stable/c/f72c67d1a82dada7d6d504c806e111e913721a30 - https://git.kernel.org/stable/c/6aa27775db63ba8c7c73891c7dfb71ddc230c48d - https://git.kernel.org/stable/c/108598c39eefbedc9882273ac0df96127a629220
CVE ID: CVE-2023-53222 State: PUBLISHED Published: 2025-09-15T14:21:50.970Z Last Updated: 2025-09-15T14:21:50.970Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nb
his happens because the large value is set without any validation in dbMount() at line 181. Thus, make sure that db_l2nbperpage is correct while mounting. Max number of blocks per page = Page size / Min block size => log2(Max num_block per page) = log2(Page size / Min block size) = log2(Page size) - log2(Min block size) => Max db_l2nbperpage = L2PSIZE - L2MINBLOCKSIZE References: - https://git.kernel.org/stable/c/8c1efe3f74a7864461b0dff281c5562154b4aa8e - https://git.kernel.org/stable/c/ef5c205b6e6f8d1f18ef0b4a9832b1b5fa85f7f2 - https://git.kernel.org/stable/c/a4855aeb13e4ad1f23e16753b68212e180f7d848 - https://git.kernel.org/stable/c/47b7eaae08e8b2f25bdf37bc14d21be090bcb20f - https://git.ker
d1f23e16753b68212e180f7d848 - https://git.kernel.org/stable/c/47b7eaae08e8b2f25bdf37bc14d21be090bcb20f - https://git.kernel.org/stable/c/de984faecddb900fa850af4df574a25b32bb93f5 - https://git.kernel.org/stable/c/c7feb54b113802d2aba98708769d3c33fb017254 - https://git.kernel.org/stable/c/2a03c4e683d33d17b667418eb717b13dda1fac6b - https://git.kernel.org/stable/c/11509910c599cbd04585ec35a6d5e1a0053d84c1
CVE ID: CVE-2023-53223 State: PUBLISHED Published: 2025-09-15T14:21:51.822Z Last Updated: 2025-09-15T14:21:51.822Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: Add missing check for alloc_ordered_workqueue Add check for the return value of alloc_ordered_workqueue as it may return NULL pointer and cause NULL pointer dereference. Patchwork: https://patchwork.freedesktop.org/patch/517646/ References: - https://git.kernel.org/stable/c/3e18f157faeeb59034404569e8e07cbe1c0030a7 - https://git.kernel.org/stable/c/9257974858ee847b2e1fd552691b8ba5c2fc1c7b - https://git.kernel.org/stable/c/3a9a4a9725c60f04326b5019a52ce15aee8
/stable/c/9257974858ee847b2e1fd552691b8ba5c2fc1c7b - https://git.kernel.org/stable/c/3a9a4a9725c60f04326b5019a52ce15aee808506 - https://git.kernel.org/stable/c/540c66180afd59309a442d3bf1f2393464c8b4c5 - https://git.kernel.org/stable/c/5dfe7a5386fde5a656ca06602b31bf50e26954cd - https://git.kernel.org/stable/c/25a6499b1a53d854eda2b161b5c8a20296515dbe - https://git.kernel.org/stable/c/759ea5677c362fb1e3edc667260ba9f409dc931d - https://git.kernel.org/stable/c/115906ca7b535afb1fe7b5406c566ccd3873f82b
CVE ID: CVE-2023-53224 State: PUBLISHED Published: 2025-09-15T14:21:53.061Z Last Updated: 2025-09-15T14:21:53.061Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ext4: Fix function prototype mismatch for ext4_feat_ktype With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. ext4_feat_ktype was setting the "release" handler to "kfree", which
as either a kernel panic or thread getting killed. ext4_feat_ktype was setting the "release" handler to "kfree", which doesn't have a matching function prototype. Add a simple wrapper with the correct prototype. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Note that this code is only reached when ext4 is a loadable module and it is being unloaded: CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698) ... RIP: 0010:kobject_put+0xbb/0x1b0 ... Call Trace: <TASK> ext4_exit_sysfs+0x14/0x60 [ext4] cleanup_module+0x67/0xedb
... RIP: 0010:kobject_put+0xbb/0x1b0 ... Call Trace: <TASK> ext4_exit_sysfs+0x14/0x60 [ext4] cleanup_module+0x67/0xedb [ext4] References: - https://git.kernel.org/stable/c/2b69cdd9f9a7f596e3dd31f05f9852940d177924 - https://git.kernel.org/stable/c/99e3fd21f8fc975c95e8cf76fbf6a3d2656f8f71 - https://git.kernel.org/stable/c/1ba10d3640e9783dad811fe4e24d55465c37c64d - https://git.kernel.org/stable/c/c98077f7598a562f51051eec043be0cb3e1b1b5e - https://git.kernel.org/stable/c/0a1394e07c5d6bf1bfc25db8589ff1b1bfb6f46a - https://git.kernel.org/stable/c/94d8de83286fb1827340eba35b61c308f6b46ead - https://git.kernel.org/stable/c/118901ad1f25d2334255b3d50512fa20591531cd
CVE ID: CVE-2023-53225 State: PUBLISHED Published: 2025-09-15T14:21:54.138Z Last Updated: 2025-09-15T14:21:54.138Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: spi: imx: Don't skip cleanup in remove's error path Returning early in a platform driver's remove callback is wrong. In this case the dma resources are not released in the error path. this is never retried later and so this is a permanent leak. To fix this, only skip hardware disabling if waking the device fails. References: - https://git.kernel.org/stable/c/aa93a46f998a9069368026ac52bba96868c59157 - https://git.kernel.org/stable/c/f90822ad63d11301e425311dac0c8e12ca173
table/c/aa93a46f998a9069368026ac52bba96868c59157 - https://git.kernel.org/stable/c/f90822ad63d11301e425311dac0c8e12ca1737b8 - https://git.kernel.org/stable/c/6d16305a1535873e0a8a8ae92ea2d9106ec2d7df - https://git.kernel.org/stable/c/57a463226638f1ceabbb029cbd21b0c94640f1b5 - https://git.kernel.org/stable/c/b64cb3f085fed296103c91f0db6acad30a021b36 - https://git.kernel.org/stable/c/11951c9e3f364d7ae3b568a0e52c8335d43066b5
CVE ID: CVE-2023-53226 State: PUBLISHED Published: 2025-09-15T14:21:55.884Z Last Updated: 2025-09-15T14:21:55.884Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix OOB and integer underflow when rx packets Make sure mwifiex_process_mgmt_packet, mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet, mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet not out-of-bounds access the skb->data buffer. References: - https://git.kernel.org/stable/c/f517c97fc129995de77dd06aa5a74f909ebf568f - https://git.kernel.org/stable/c/8824aa4ab62c800f75d96f48e1883a5f56ec5869 - https://git.kernel.org/stable/c/29eca
f568f - https://git.kernel.org/stable/c/8824aa4ab62c800f75d96f48e1883a5f56ec5869 - https://git.kernel.org/stable/c/29eca8b7863d1d7de6c5b746b374e3487d14f154 - https://git.kernel.org/stable/c/3fe3923d092e22d87d1ed03e2729db444b8c1331 - https://git.kernel.org/stable/c/7c54b6fc39eb1aac51cf2945f8a25e2a47fdca02 - https://git.kernel.org/stable/c/3975e21d4d01efaf0296ded40d11c06589c49245 - https://git.kernel.org/stable/c/a7300e3800e9fd5405e88ce67709c1a97783b9c8 - https://git.kernel.org/stable/c/650d1bc02fba7b42f476d8b6643324abac5921ed - https://git.kernel.org/stable/c/11958528161731c58e105b501ed60b83a91ea941
CVE ID: CVE-2023-53227 State: REJECTED Published: 2025-09-15T14:21:57.523Z Last Updated: 2025-09-16T09:14:27.556Z Description: No description available.
CVE ID: CVE-2023-53228 State: PUBLISHED Published: 2025-09-15T14:21:59.550Z Last Updated: 2025-09-15T14:21:59.550Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: drop redundant sched job cleanup when cs is aborted Once command submission failed due to userptr invalidation in amdgpu_cs_submit, legacy code will perform cleanup of scheduler job. However, it's not needed at all, as former commit has integrated job cleanup stuff into amdgpu_job_free. Otherwise, because of double free, a NULL pointer dereference will occur in such scenario. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2457 References: - https://gi
eference will occur in such scenario. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2457 References: - https://git.kernel.org/stable/c/c1564d4b105ae535eb3183ecaaa987685b20a888 - https://git.kernel.org/stable/c/ec02a29c3c2ef8ad3e15a0e3f96b99a00e5d97b4 - https://git.kernel.org/stable/c/1253685f0d3eb3eab0bfc4bf15ab341a5f3da0c8
CVE ID: CVE-2023-53229 State: PUBLISHED Published: 2025-09-15T14:22:01.784Z Last Updated: 2025-09-15T14:22:01.784Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta Avoid potential data corruption issues caused by uninitialized driver private data structures. References: - https://git.kernel.org/stable/c/db8d32d6b25fdb75c387daee496b96209d477780 - https://git.kernel.org/stable/c/7e68d7c640d41d8a371b8f6c2d2682ea437cbe21 - https://git.kernel.org/stable/c/a3593082e0dadf87f17ea4ca9fa0210caaa2aebf - https://git.kernel.org/stable/c/3fe20515449a80a177526d2ecd13b
el.org/stable/c/a3593082e0dadf87f17ea4ca9fa0210caaa2aebf - https://git.kernel.org/stable/c/3fe20515449a80a177526d2ecd13b43f6ee41aeb - https://git.kernel.org/stable/c/30c5a016a37a668c1c07442cf94de6e99ea7417a - https://git.kernel.org/stable/c/022c8320d9eb7394538bd716fa1a07a5ed92621b - https://git.kernel.org/stable/c/73752a39e2a6e38eee3ba90ece2ded598ea88006 - https://git.kernel.org/stable/c/12b220a6171faf10638ab683a975cadcf1a352d6
CVE ID: CVE-2023-53230 State: PUBLISHED Published: 2025-09-15T14:22:02.687Z Last Updated: 2025-09-15T14:22:02.687Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix warning in cifs_smb3_do_mount() This fixes the following warning reported by kernel test robot fs/smb/client/cifsfs.c:982 cifs_smb3_do_mount() warn: possible memory leak of 'cifs_sb' References: - https://git.kernel.org/stable/c/9850867042674361f455ea8901375cff5b800be5 - https://git.kernel.org/stable/c/945f4a7aff84fde1f825d17a5050880345da3228 - https://git.kernel.org/stable/c/eb79f8dfba343667f9a82a252743f4e8f67ce420 - https://git.kernel.org/stable/c/12
45da3228 - https://git.kernel.org/stable/c/eb79f8dfba343667f9a82a252743f4e8f67ce420 - https://git.kernel.org/stable/c/12c30f33cc6769bf411088a2872843c4f9ea32f9
CVE ID: CVE-2023-53231 State: PUBLISHED Published: 2025-09-15T14:22:03.599Z Last Updated: 2025-09-16T08:02:24.954Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: erofs: Fix detection of atomic context Current check for atomic context is not sufficient as z_erofs_decompressqueue_endio can be called under rcu lock from blk_mq_flush_plug_list(). See the stacktrace [1] In such case we should hand off the decompression work for async processing rather than trying to do sync decompression in current context. Patch fixes the detection by checking for rcu_read_lock_any_held() and while at it use more appropriate !in_task() check than i