Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
-free when the work function tries to access ishtp_dev. Use devm_work_autocancel() instead, so that the work is automatically cancelled if probe fails. References: - https://git.kernel.org/stable/c/8c1d378b8c224fd50247625255f09fc01dcc5836 - https://git.kernel.org/stable/c/0a594cb490ca6232671fc09e2dc1a0fc7ccbb0b5 - https://git.kernel.org/stable/c/d3ce3afd9f791dd1b7daedfcf8c396b60af5dec0 - https://git.kernel.org/stable/c/8ae2f2b0a28416ed2f6d8478ac8b9f7862f36785
CVE ID: CVE-2023-53040 State: PUBLISHED Published: 2025-05-02T15:54:58.527Z Last Updated: 2025-05-04T07:48:17.467Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ca8210: fix mac_len negative array access This patch fixes a buffer overflow access of skb->data if ieee802154_hdr_peek_addrs() fails. References: - https://git.kernel.org/stable/c/55d836f75778d2e2cafe37e023f9c106400bad4b - https://git.kernel.org/stable/c/5da4469a7aa011de614c3e2ae383c35a353a382e - https://git.kernel.org/stable/c/d2b3bd0d4cadfdb7f3454d2aef9d5d9e8b48aae4 - https://git.kernel.org/stable/c/7df72bedbdd1d02bb216e1f6eca0a16900238c4e - https://git.kernel.org/s
2aef9d5d9e8b48aae4 - https://git.kernel.org/stable/c/7df72bedbdd1d02bb216e1f6eca0a16900238c4e - https://git.kernel.org/stable/c/d143e327c97241599c958d1ba9fbaa88c37db721 - https://git.kernel.org/stable/c/fd176a18db96d574d8c4763708abcec4444a08b6 - https://git.kernel.org/stable/c/918944526a386f186dd818ea6b0bcbed75d8c16b - https://git.kernel.org/stable/c/6c993779ea1d0cccdb3a5d7d45446dd229e610a3
CVE ID: CVE-2023-53041 State: PUBLISHED Published: 2025-05-02T15:54:59.210Z Last Updated: 2025-05-04T07:48:18.921Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Perform lockless command completion in abort path While adding and removing the controller, the following call trace was observed: WARNING: CPU: 3 PID: 623596 at kernel/dma/mapping.c:532 dma_free_attrs+0x33/0x50 CPU: 3 PID: 623596 Comm: sh Kdump: loaded Not tainted 5.14.0-96.el9.x86_64 #1 RIP: 0010:dma_free_attrs+0x33/0x50 Call Trace: qla2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx] qla2x00_abort_srb+0x8e/0x250 [qla2xxx] ? ql_dbg+0x70/0x100 [qla2xxx] __ql
la2x00_async_sns_sp_done+0x107/0x1b0 [qla2xxx] qla2x00_abort_srb+0x8e/0x250 [qla2xxx] ? ql_dbg+0x70/0x100 [qla2xxx] __qla2x00_abort_all_cmds+0x108/0x190 [qla2xxx] qla2x00_abort_all_cmds+0x24/0x70 [qla2xxx] qla2x00_abort_isp_cleanup+0x305/0x3e0 [qla2xxx] qla2x00_remove_one+0x364/0x400 [qla2xxx] pci_device_remove+0x36/0xa0 __device_release_driver+0x17a/0x230 device_release_driver+0x24/0x30 pci_stop_bus_device+0x68/0x90 pci_stop_and_remove_bus_device_locked+0x16/0x30 remove_store+0x75/0x90 kernfs_fop_write_iter+0x11c/0x1b0 new_sync_write+0x11f/0x1b0 vfs_write+0x1eb/0x280 ksys_write+0x5f/0xe0 do_syscall_64+0x5c/0x80 ? do_user_addr_fault+0x1d8/0x680 ? do_syscall_64+0x69/0x80 ? exc_page_fault+0x62
write+0x5f/0xe0 do_syscall_64+0x5c/0x80 ? do_user_addr_fault+0x1d8/0x680 ? do_syscall_64+0x69/0x80 ? exc_page_fault+0x62/0x140 ? asm_exc_page_fault+0x8/0x30 entry_SYSCALL_64_after_hwframe+0x44/0xae The command was completed in the abort path during driver unload with a lock held, causing the warning in abort path. Hence complete the command without any lock held. References: - https://git.kernel.org/stable/c/9189f20b4c5307c0998682bb522e481b4567a8b8 - https://git.kernel.org/stable/c/231cfa78ec5badd84a1a2b09465bfad1a926aba1 - https://git.kernel.org/stable/c/d6f7377528d2abf338e504126e44439541be8f7d - https://git.kernel.org/stable/c/cd0a1804ac5bab2545ac700c8d0fe9ae9284c567 - https://git.kernel.o
e504126e44439541be8f7d - https://git.kernel.org/stable/c/cd0a1804ac5bab2545ac700c8d0fe9ae9284c567 - https://git.kernel.org/stable/c/415d614344a4f1bbddf55d724fc7eb9ef4b39aad - https://git.kernel.org/stable/c/0367076b0817d5c75dfb83001ce7ce5c64d803a9
CVE ID: CVE-2023-53042 State: PUBLISHED Published: 2025-05-02T15:54:59.917Z Last Updated: 2025-07-11T17:19:35.980Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not set DRR on pipe Commit [WHY] Writing to DRR registers such as OTG_V_TOTAL_MIN on the same frame as a pipe commit can cause underflow. References: - https://git.kernel.org/stable/c/f8080f1e300e7abcc03025ec8b5bab69ae98daaa - https://git.kernel.org/stable/c/3c20a098b507020936e02a98f4fbb924deeef44b - https://git.kernel.org/stable/c/56574f89dbd84004c3fd6485bcaafb5aa9b8be14
CVE ID: CVE-2023-53043 State: PUBLISHED Published: 2025-05-02T15:55:00.724Z Last Updated: 2025-05-04T07:48:21.724Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sc7280: Mark PCIe controller as cache coherent If the controller is not marked as cache coherent, then kernel will try to ensure coherency during dma-ops and that may cause data corruption. So, mark the PCIe node as dma-coherent as the devices on PCIe bus are cache coherent. References: - https://git.kernel.org/stable/c/267b899375bf38944d915c9654d6eb434edad0ce - https://git.kernel.org/stable/c/e43bba938e2c9104bb4f8bc417ac4d7bb29755e1 - https://git.ker
8944d915c9654d6eb434edad0ce - https://git.kernel.org/stable/c/e43bba938e2c9104bb4f8bc417ac4d7bb29755e1 - https://git.kernel.org/stable/c/8a63441e83724fee1ef3fd37b237d40d90780766
CVE ID: CVE-2023-53044 State: PUBLISHED Published: 2025-05-02T15:55:01.444Z Last Updated: 2025-05-04T07:48:23.084Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm stats: check for and propagate alloc_percpu failure Check alloc_precpu()'s return value and return an error from dm_stats_init() if it fails. Update alloc_dev() to fail if dm_stats_init() does. Otherwise, a NULL pointer dereference will occur in dm_stats_cleanup() even if dm-stats isn't being actively used. References: - https://git.kernel.org/stable/c/2287d7b721471a3d58bcd829250336e3cdf1635e - https://git.kernel.org/stable/c/0d96bd507ed7e7d565b6d53ebd3874686f123b2e
le/c/2287d7b721471a3d58bcd829250336e3cdf1635e - https://git.kernel.org/stable/c/0d96bd507ed7e7d565b6d53ebd3874686f123b2e - https://git.kernel.org/stable/c/4a32a9a818a895671bd43e0c40351e60e4e9140b - https://git.kernel.org/stable/c/c68f08cc745675a17894e1b4a5b5b9700ace6da4 - https://git.kernel.org/stable/c/443c9d522397511a4328dc2ec3c9c63c73049756 - https://git.kernel.org/stable/c/a42180dd361584816bfe15c137b665699b994d90 - https://git.kernel.org/stable/c/5b66e36a3efd24041b7374432bfa4dec2ff01e95 - https://git.kernel.org/stable/c/d3aa3e060c4a80827eb801fc448debc9daa7c46b
CVE ID: CVE-2023-53045 State: PUBLISHED Published: 2025-05-02T15:55:02.518Z Last Updated: 2025-05-04T07:48:29.370Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: don't let userspace block driver unbind In the unbind callback for f_uac1 and f_uac2, a call to snd_card_free() via g_audio_cleanup() will disconnect the card and then wait for all resources to be released, which happens when the refcount falls to zero. Since userspace can keep the refcount incremented by not closing the relevant file descriptor, the call to unbind may block indefinitely. This can cause a deadlock during reboot, as evidenced by th
file descriptor, the call to unbind may block indefinitely. This can cause a deadlock during reboot, as evidenced by the following blocked task observed on my machine: task:reboot state:D stack:0 pid:2827 ppid:569 flags:0x0000000c Call trace: __switch_to+0xc8/0x140 __schedule+0x2f0/0x7c0 schedule+0x60/0xd0 schedule_timeout+0x180/0x1d4 wait_for_completion+0x78/0x180 snd_card_free+0x90/0xa0 g_audio_cleanup+0x2c/0x64 afunc_unbind+0x28/0x60 ... kernel_restart+0x4c/0xac __do_sys_reboot+0xcc/0x1ec __arm64_sys_reboot+0x28/0x30 invoke_syscall+0x4c/0x110 ... The issue can also be observed by opening the card with arecord and then stopping the process through the shell before unbinding: # arecord -D
bserved by opening the card with arecord and then stopping the process through the shell before unbinding: # arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null Recording WAVE '/dev/null' : Signed 32 bit Little Endian, Rate 48000 Hz, Stereo ^Z[1]+ Stopped arecord -D hw:UAC2Gadget -f S32_LE -c 2 -r 48000 /dev/null # echo gadget.0 > /sys/bus/gadget/drivers/configfs-gadget/unbind (observe that the unbind command never finishes) Fix the problem by using snd_card_free_when_closed() instead, which will still disconnect the card as desired, but defer the task of freeing the resources to the core once userspace closes its file descriptor. References: - https://git.kernel.org/stable/c/3e016ef2
resources to the core once userspace closes its file descriptor. References: - https://git.kernel.org/stable/c/3e016ef2e72da93a2ea7afbb45de1b481b44d761 - https://git.kernel.org/stable/c/3256e152b645fc1e788ba44c2d8ced690113e3e6 - https://git.kernel.org/stable/c/0eda2004f38d95ef5715d62be884cd344260535b - https://git.kernel.org/stable/c/33f341c1fc60e172a3515c51bdabee11e83d1ee9 - https://git.kernel.org/stable/c/b131989797f7287d7fdadb2bababc05a15d44750 - https://git.kernel.org/stable/c/3bc7324e4911351e39c54a62e6ca46321cb10faf - https://git.kernel.org/stable/c/43ca70753dfffd517d2af126da28690f8f615605 - https://git.kernel.org/stable/c/6c67ed9ad9b83e453e808f9b31a931a20a25629b
CVE ID: CVE-2023-53046 State: PUBLISHED Published: 2025-05-02T15:55:03.270Z Last Updated: 2025-05-04T07:48:31.079Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hci_cmd_sync_clear There is a potential race condition in hci_cmd_sync_work and hci_cmd_sync_clear, and could lead to use-after-free. For instance, hci_cmd_sync_work is added to the 'req_workqueue' after cancel_work_sync The entry of 'cmd_sync_work_list' may be freed in hci_cmd_sync_clear, and causing kernel panic when it is used in 'hci_cmd_sync_work'. Here's the call trace: dump_stack_lvl+0x49/0x63 print_report.cold+0x5e/0x5d3 ? hci_c
it is used in 'hci_cmd_sync_work'. Here's the call trace: dump_stack_lvl+0x49/0x63 print_report.cold+0x5e/0x5d3 ? hci_cmd_sync_work+0x282/0x320 kasan_report+0xaa/0x120 ? hci_cmd_sync_work+0x282/0x320 __asan_report_load8_noabort+0x14/0x20 hci_cmd_sync_work+0x282/0x320 process_one_work+0x77b/0x11c0 ? _raw_spin_lock_irq+0x8e/0xf0 worker_thread+0x544/0x1180 ? poll_idle+0x1e0/0x1e0 kthread+0x285/0x320 ? process_one_work+0x11c0/0x11c0 ? kthread_complete_and_exit+0x30/0x30 ret_from_fork+0x22/0x30 </TASK> Allocated by task 266: kasan_save_stack+0x26/0x50 __kasan_kmalloc+0xae/0xe0 kmem_cache_alloc_trace+0x191/0x350 hci_cmd_sync_queue+0x97/0x2b0 hci_update_passive_scan+0x176/0x1d0 le_conn_complete_ev
kmem_cache_alloc_trace+0x191/0x350 hci_cmd_sync_queue+0x97/0x2b0 hci_update_passive_scan+0x176/0x1d0 le_conn_complete_evt+0x1b5/0x1a00 hci_le_conn_complete_evt+0x234/0x340 hci_le_meta_evt+0x231/0x4e0 hci_event_packet+0x4c5/0xf00 hci_rx_work+0x37d/0x880 process_one_work+0x77b/0x11c0 worker_thread+0x544/0x1180 kthread+0x285/0x320 ret_from_fork+0x22/0x30 Freed by task 269: kasan_save_stack+0x26/0x50 kasan_set_track+0x25/0x40 kasan_set_free_info+0x24/0x40 ____kasan_slab_free+0x176/0x1c0 __kasan_slab_free+0x12/0x20 slab_free_freelist_hook+0x95/0x1a0 kfree+0xba/0x2f0 hci_cmd_sync_clear+0x14c/0x210 hci_unregister_dev+0xff/0x440 vhci_release+0x7b/0xf0 __fput+0x1f3/0x970 ____fput+0xe/0x20 task_work_r
_clear+0x14c/0x210 hci_unregister_dev+0xff/0x440 vhci_release+0x7b/0xf0 __fput+0x1f3/0x970 ____fput+0xe/0x20 task_work_run+0xd4/0x160 do_exit+0x8b0/0x22a0 do_group_exit+0xba/0x2a0 get_signal+0x1e4a/0x25b0 arch_do_signal_or_restart+0x93/0x1f80 exit_to_user_mode_prepare+0xf5/0x1a0 syscall_exit_to_user_mode+0x26/0x50 ret_from_fork+0x15/0x30 References: - https://git.kernel.org/stable/c/608901a77c945ac15dea23f6098c9882ef19d9f0 - https://git.kernel.org/stable/c/be586211a3ab40a4f4ca60450e0d31606afc55ec - https://git.kernel.org/stable/c/1c66bee492a5fe00ae3fe890bb693bfc99f994c6
CVE ID: CVE-2023-53047 State: PUBLISHED Published: 2025-05-02T15:55:04.071Z Last Updated: 2025-05-04T07:48:32.190Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tee: amdtee: fix race condition in amdtee_open_session There is a potential race condition in amdtee_open_session that may lead to use-after-free. For instance, in amdtee_open_session() after sess->sess_mask is set, and before setting: sess->session_info[i] = session_info; if amdtee_close_session() closes this same session, then 'sess' data structure will be released, causing kernel panic when 'sess' is accessed within amdtee_open_session(). The solution is to set the
will be released, causing kernel panic when 'sess' is accessed within amdtee_open_session(). The solution is to set the bit sess->sess_mask as the last step in amdtee_open_session(). References: - https://git.kernel.org/stable/c/f632a90f8e39db39b322107b9a8d438b826a7f4f - https://git.kernel.org/stable/c/02b296978a2137d7128151c542e84dc96400bc00 - https://git.kernel.org/stable/c/a63cce9393e4e7dbc5af82dc87e68cb321cb1a78 - https://git.kernel.org/stable/c/b3ef9e6fe09f1a132af28c623edcf4d4f39d9f35 - https://git.kernel.org/stable/c/f8502fba45bd30e1a6a354d9d898bc99d1a11e6d
CVE ID: CVE-2023-53048 State: PUBLISHED Published: 2025-05-02T15:55:04.815Z Last Updated: 2025-05-04T07:48:33.257Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix warning when handle discover_identity message Since both source and sink device can send discover_identity message in PD3, kernel may dump below warning: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 169 at drivers/usb/typec/tcpm/tcpm.c:1446 tcpm_queue_vdm+0xe0/0xf0 Modules linked in: CPU: 0 PID: 169 Comm: 1-0050 Not tainted 6.1.1-00038-g6a3c36cf1da2-dirty #567 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: 20000005 (nzCv daif -P
tainted 6.1.1-00038-g6a3c36cf1da2-dirty #567 Hardware name: NXP i.MX8MPlus EVK board (DT) pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : tcpm_queue_vdm+0xe0/0xf0 lr : tcpm_queue_vdm+0x2c/0xf0 sp : ffff80000c19bcd0 x29: ffff80000c19bcd0 x28: 0000000000000001 x27: ffff0000d11c8ab8 x26: ffff0000d11cc000 x25: 0000000000000000 x24: 00000000ff008081 x23: 0000000000000001 x22: 00000000ff00a081 x21: ffff80000c19bdbc x20: 0000000000000000 x19: ffff0000d11c8080 x18: ffffffffffffffff x17: 0000000000000000 x16: 0000000000000000 x15: ffff0000d716f580 x14: 0000000000000001 x13: ffff0000d716f507 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000020 x9 : 00000000000ee098 x8
0000001 x13: ffff0000d716f507 x12: 0000000000000001 x11: 0000000000000000 x10: 0000000000000020 x9 : 00000000000ee098 x8 : 00000000ffffffff x7 : 000000000000001c x6 : ffff0000d716f580 x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 x2 : ffff80000c19bdbc x1 : 00000000ff00a081 x0 : 0000000000000004 Call trace: tcpm_queue_vdm+0xe0/0xf0 tcpm_pd_rx_handler+0x340/0x1ab0 kthread_worker_fn+0xcc/0x18c kthread+0x10c/0x110 ret_from_fork+0x10/0x20 ---[ end trace 0000000000000000 ]--- Below sequences may trigger this warning: tcpm_send_discover_work(work) tcpm_send_vdm(port, USB_SID_PD, CMD_DISCOVER_IDENT, NULL, 0); tcpm_queue_vdm(port, header, data, count); port->vdm_state = VDM_STATE_
(port, USB_SID_PD, CMD_DISCOVER_IDENT, NULL, 0); tcpm_queue_vdm(port, header, data, count); port->vdm_state = VDM_STATE_READY; vdm_state_machine_work(work); <-- received discover_identity from partner vdm_run_state_machine(port); port->vdm_state = VDM_STATE_SEND_MESSAGE; mod_vdm_delayed_work(port, x); tcpm_pd_rx_handler(work); tcpm_pd_data_request(port, msg); tcpm_handle_vdm_request(port, msg->payload, cnt); tcpm_queue_vdm(port, response[0], &response[1], rlen - 1); --> WARN_ON(port->vdm_state > VDM_STATE_DONE); For this case, the state machine could still send out discover identity message later if we skip current discover_identity message. So we should handle the received message firstly a
identity message later if we skip current discover_identity message. So we should handle the received message firstly and override the pending discover_identity message without warning in this case. Then, a delayed send_discover work will send discover_identity message again. References: - https://git.kernel.org/stable/c/bb579b3f75c60bf488a7c36e092e8be583407d53 - https://git.kernel.org/stable/c/d55ca2d2ea1a7ec553213986993fba8c0257381c - https://git.kernel.org/stable/c/e37d2c489d71e94ed4a39529bc9520a7fd983d42 - https://git.kernel.org/stable/c/abfc4fa28f0160df61c7149567da4f6494dfb488
CVE ID: CVE-2023-53049 State: PUBLISHED Published: 2025-05-02T15:55:05.568Z Last Updated: 2025-05-04T07:48:34.393Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: ucsi: Fix NULL pointer deref in ucsi_connector_change() When ucsi_init() fails, ucsi->connector is NULL, yet in case of ucsi_acpi we may still get events which cause the ucs_acpi code to call ucsi_connector_change(), which then derefs the NULL ucsi->connector pointer. Fix this by not setting ucsi->ntfy inside ucsi_init() until ucsi_init() has succeeded, so that ucsi_connector_change() ignores the events because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the n
ceeded, so that ucsi_connector_change() ignores the events because UCSI_ENABLE_NTFY_CONNECTOR_CHANGE is not set in the ntfy mask. References: - https://git.kernel.org/stable/c/a6adfe9bbd6ac11e398b54ccd99a0f8eea09f3c0 - https://git.kernel.org/stable/c/7dd27aed9c456670b3882877ef17a48195f21693 - https://git.kernel.org/stable/c/1c5abcb13491da8c049f20462189c12c753ba978 - https://git.kernel.org/stable/c/7ef0423e43f877a328454059d46763043ce3da44 - https://git.kernel.org/stable/c/f87fb985452ab2083967103ac00bfd68fb182764
CVE ID: CVE-2023-53050 State: PUBLISHED Published: 2025-05-02T15:55:06.355Z Last Updated: 2025-05-04T07:48:35.513Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix memory leak in margining Memory for the usb4->margining needs to be relased for the upstream port of the router as well, even though the debugfs directory gets released with the router device removal. Fix this. References: - https://git.kernel.org/stable/c/f390095bbd131ec2dfb29792d9f6fd0f0656bfc0 - https://git.kernel.org/stable/c/0b357b360e671688f9bf38ff94300515b68bc247 - https://git.kernel.org/stable/c/acec726473822bc6b585961f4ca2a11fa7f28341
CVE ID: CVE-2023-53051 State: PUBLISHED Published: 2025-05-02T15:55:07.069Z Last Updated: 2025-05-04T07:48:41.599Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dm crypt: add cond_resched() to dmcrypt_write() The loop in dmcrypt_write may be running for unbounded amount of time, thus we need cond_resched() in it. This commit fixes the following warning: [ 3391.153255][ C12] watchdog: BUG: soft lockup - CPU#12 stuck for 23s! [dmcrypt_write/2:2897] ... [ 3391.387210][ C12] Call trace: [ 3391.390338][ C12] blk_attempt_bio_merge.part.6+0x38/0x158 [ 3391.395970][ C12] blk_attempt_plug_merge+0xc0/0x1b0 [ 3391.401085][ C12] blk_mq_su
ttempt_bio_merge.part.6+0x38/0x158 [ 3391.395970][ C12] blk_attempt_plug_merge+0xc0/0x1b0 [ 3391.401085][ C12] blk_mq_submit_bio+0x398/0x550 [ 3391.405856][ C12] submit_bio_noacct+0x308/0x380 [ 3391.410630][ C12] dmcrypt_write+0x1e4/0x208 [dm_crypt] [ 3391.416005][ C12] kthread+0x130/0x138 [ 3391.419911][ C12] ret_from_fork+0x10/0x18 References: - https://git.kernel.org/stable/c/e87cd83f70504f1cd2e428966f353c007d6d2d7f - https://git.kernel.org/stable/c/7b9f8efb5fc888dd938d2964e705b8e00f1dc0f6 - https://git.kernel.org/stable/c/885c28ceae7dab2b18c2cc0eb95f1f82b1f629d1 - https://git.kernel.org/stable/c/66ff37993dd7e9954b6446237fe2453b380ce40d - https://git.kernel.org/stable/c/eb485b7404a281d974
://git.kernel.org/stable/c/66ff37993dd7e9954b6446237fe2453b380ce40d - https://git.kernel.org/stable/c/eb485b7404a281d974bd445ddc5b0b8d5958f371 - https://git.kernel.org/stable/c/f0eb61b493dbbc32529fbd0d2e945b71b0e47306 - https://git.kernel.org/stable/c/2c743db1193bf0e76c73d71ede08bd9b96e6c31d - https://git.kernel.org/stable/c/fb294b1c0ba982144ca467a75e7d01ff26304e2b
CVE ID: CVE-2023-53052 State: PUBLISHED Published: 2025-05-02T15:55:07.755Z Last Updated: 2025-06-19T12:56:34.456Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: fix use-after-free bug in refresh_cache_worker() The UAF bug occurred because we were putting DFS root sessions in cifs_umount() while DFS cache refresher was being executed. Make DFS root sessions have same lifetime as DFS tcons so we can avoid the use-after-free bug is DFS cache refresher and other places that require IPCs to get new DFS referrals on. Also, get rid of mount group handling in DFS cache as we no longer need it. This fixes below use-after-free bug
rals on. Also, get rid of mount group handling in DFS cache as we no longer need it. This fixes below use-after-free bug catched by KASAN [ 379.946955] BUG: KASAN: use-after-free in __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.947642] Read of size 8 at addr ffff888018f57030 by task kworker/u4:3/56 [ 379.948096] [ 379.948208] CPU: 0 PID: 56 Comm: kworker/u4:3 Not tainted 6.2.0-rc7-lku #23 [ 379.948661] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552-rebuilt.opensuse.org 04/01/2014 [ 379.949368] Workqueue: cifs-dfscache refresh_cache_worker [cifs] [ 379.949942] Call Trace: [ 379.950113] <TASK> [ 379.950260] dump_stack_lvl+0x50/0x67 [ 379.950510] print_report+0x
ifs] [ 379.949942] Call Trace: [ 379.950113] <TASK> [ 379.950260] dump_stack_lvl+0x50/0x67 [ 379.950510] print_report+0x16a/0x48e [ 379.950759] ? __virt_addr_valid+0xd8/0x160 [ 379.951040] ? __phys_addr+0x41/0x80 [ 379.951285] kasan_report+0xdb/0x110 [ 379.951533] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952056] ? __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.952585] __refresh_tcon.isra.0+0x10b/0xc10 [cifs] [ 379.953096] ? __pfx___refresh_tcon.isra.0+0x10/0x10 [cifs] [ 379.953637] ? __pfx___mutex_lock+0x10/0x10 [ 379.953915] ? lock_release+0xb6/0x720 [ 379.954167] ? __pfx_lock_acquire+0x10/0x10 [ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs] [ 379.954960] ? __pfx_wb_workfn+0
? __pfx_lock_acquire+0x10/0x10 [ 379.954443] ? refresh_cache_worker+0x34e/0x6d0 [cifs] [ 379.954960] ? __pfx_wb_workfn+0x10/0x10 [ 379.955239] refresh_cache_worker+0x4ad/0x6d0 [cifs] [ 379.955755] ? __pfx_refresh_cache_worker+0x10/0x10 [cifs] [ 379.956323] ? __pfx_lock_acquired+0x10/0x10 [ 379.956615] ? read_word_at_a_time+0xe/0x20 [ 379.956898] ? lockdep_hardirqs_on_prepare+0x12/0x220 [ 379.957235] process_one_work+0x535/0x990 [ 379.957509] ? __pfx_process_one_work+0x10/0x10 [ 379.957812] ? lock_acquired+0xb7/0x5f0 [ 379.958069] ? __list_add_valid+0x37/0xd0 [ 379.958341] ? __list_add_valid+0x37/0xd0 [ 379.958611] worker_thread+0x8e/0x630 [ 379.958861] ? __pfx_worker_thread+0x10/0x10 [ 379.9
__list_add_valid+0x37/0xd0 [ 379.958611] worker_thread+0x8e/0x630 [ 379.958861] ? __pfx_worker_thread+0x10/0x10 [ 379.959148] kthread+0x17d/0x1b0 [ 379.959369] ? __pfx_kthread+0x10/0x10 [ 379.959630] ret_from_fork+0x2c/0x50 [ 379.959879] </TASK> References: - https://git.kernel.org/stable/c/5a89d81c1a3c152837ea204fd29572228e54ce0b - https://git.kernel.org/stable/c/396935de145589c8bfe552fa03a5e38604071829
CVE ID: CVE-2023-53053 State: PUBLISHED Published: 2025-05-02T15:55:08.575Z Last Updated: 2025-05-04T07:48:43.999Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: erspan: do not use skb_mac_header() in ndo_start_xmit() Drivers should not assume skb_mac_header(skb) == skb->data in their ndo_start_xmit(). Use skb_network_offset() and skb_transport_offset() which better describe what is needed in erspan_fb_xmit() and ip6erspan_tunnel_xmit() syzbot reported: WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 skb_mac_header include/linux/skbuff.h:2873 [inline] WARNING: CPU: 0 PID: 5083 at include/linux/skbuff.h:2873 ip6erspan_t