Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-53248 State: PUBLISHED Published: 2025-09-15T14:46:18.349Z Last Updated: 2025-09-16T08:02:26.382Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: install stub fence into potential unused fence pointers When using cpu to update page tables, vm update fences are unused. Install stub fence into these fence pointers instead of NULL to avoid NULL dereference when calling dma_fence_wait() on them. References: - https://git.kernel.org/stable/c/78b25110eb8c6990f7f5096bc0136c12a2b4cc99 - https://git.kernel.org/stable/c/aa9e9ba5748c524eb0925a2ef6984b78793646d6 - https://git.kernel.org/stable/c/187916e6ed9d0c3b
ps://git.kernel.org/stable/c/aa9e9ba5748c524eb0925a2ef6984b78793646d6 - https://git.kernel.org/stable/c/187916e6ed9d0c3b3abc27429f7a5f8c936bd1f0
CVE ID: CVE-2023-53249 State: PUBLISHED Published: 2025-09-15T14:46:19.184Z Last Updated: 2025-09-15T14:46:19.184Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe Use devm_of_iomap() instead of of_iomap() to automatically handle the unused ioremap region. If any error occurs, regions allocated by kzalloc() will leak, but using devm_kzalloc() instead will automatically free the memory using devm_kfree(). References: - https://git.kernel.org/stable/c/294321349bd3b0680847fc2bbe66b9ab3e522fea - https://git.kernel.org/stable/c/50b5ddde8fad5f0ffd239029d0956af633a0f9b1 - http
4321349bd3b0680847fc2bbe66b9ab3e522fea - https://git.kernel.org/stable/c/50b5ddde8fad5f0ffd239029d0956af633a0f9b1 - https://git.kernel.org/stable/c/9ba3693b0350b154fdd7830559bbc7b04c067096 - https://git.kernel.org/stable/c/9428cf0fbf4be9a24f3e15a0c166b861b12666af - https://git.kernel.org/stable/c/d4fa5e47af1e7bb2bbcaac062b14216c00e92148 - https://git.kernel.org/stable/c/188d070de9132667956f5aadd98d2bd87d3eac89
CVE ID: CVE-2023-53250 State: PUBLISHED Published: 2025-09-15T14:46:20.011Z Last Updated: 2025-09-15T14:46:20.011Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle KASAN reported a null-ptr-deref error: KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 1373 Comm: modprobe Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:dmi_sysfs_entry_release ... Call Trace: <TASK> kobject_put dmi_sysfs_register_handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers
handle (drivers/firmware/dmi-sysfs.c:540) dmi_sysfs dmi_decode_table (drivers/firmware/dmi_scan.c:133) dmi_walk (drivers/firmware/dmi_scan.c:1115) dmi_sysfs_init (drivers/firmware/dmi-sysfs.c:149) dmi_sysfs do_one_initcall (init/main.c:1296) ... Kernel panic - not syncing: Fatal exception Kernel Offset: 0x4000000 from 0xffffffff81000000 ---[ end Kernel panic - not syncing: Fatal exception ]--- It is because previous patch added kobject_put() to release the memory which will call dmi_sysfs_entry_release() and list_del(). However, list_add_tail(entry->list) is called after the error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fi
e error block, so the list_head is uninitialized and cannot be deleted. Move error handling to after list_add_tail to fix this. References: - https://git.kernel.org/stable/c/b4fe158259fb5fead52ff2b55841ec5c39492604 - https://git.kernel.org/stable/c/e851996b32264e78a10863c2ac41a8689d7b9252 - https://git.kernel.org/stable/c/5d0492d1d934642bdfd2057acc1b56f4b57be465 - https://git.kernel.org/stable/c/18e126e97c961f7a93823795c879d7c085fe5098
CVE ID: CVE-2023-53251 State: PUBLISHED Published: 2025-09-15T14:46:20.886Z Last Updated: 2025-09-15T14:46:20.886Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() rxq can be NULL only when trans_pcie->rxq is NULL and entry->entry is zero. For the case when entry->entry is not equal to 0, rxq won't be NULL even if trans_pcie->rxq is NULL. Modify checker to check for trans_pcie->rxq. References: - https://git.kernel.org/stable/c/3b9de981fe7f1c6e07c7b852421ad69be3d4b6c2 - https://git.kernel.org/stable/c/2d690495eb2766d58e25c83676f422219c4fcf18 - htt
b9de981fe7f1c6e07c7b852421ad69be3d4b6c2 - https://git.kernel.org/stable/c/2d690495eb2766d58e25c83676f422219c4fcf18 - https://git.kernel.org/stable/c/390e44efcf4d390b5053ad112553155d2d097c73 - https://git.kernel.org/stable/c/f71d0fc407dd028416bec002ddcc62f5acb0346a - https://git.kernel.org/stable/c/1902f1953b8ba100ee8705cb8a6f1a9795550eca
CVE ID: CVE-2023-53252 State: PUBLISHED Published: 2025-09-15T14:46:21.720Z Last Updated: 2025-09-15T14:46:21.720Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync hci_update_accept_list_sync iterates over hdev->pend_le_conns and hdev->pend_le_reports, and waits for controller events in the loop body, without holding hdev lock. Meanwhile, these lists and the items may be modified e.g. by le_scan_cleanup. This can invalidate the list cursor or any other item in the list, resulting to invalid behavior (eg use-after-free). Use RCU for the hci_conn_params action li
any other item in the list, resulting to invalid behavior (eg use-after-free). Use RCU for the hci_conn_params action lists. Since the loop bodies in hci_sync block and we cannot use RCU or hdev->lock for the whole loop, copy list items first and then iterate on the copy. Only the flags field is written from elsewhere, so READ_ONCE/WRITE_ONCE should guarantee we read valid values. Free params everywhere with hci_conn_params_free so the cleanup is guaranteed to be done properly. This fixes the following, which can be triggered e.g. by BlueZ new mgmt-tester case "Add + Remove Device Nowait - Success", or by changing hci_le_set_cig_params to always return false, and running iso-tester: ========
Device Nowait - Success", or by changing hci_le_set_cig_params to always return false, and running iso-tester: ================================================================== BUG: KASAN: slab-use-after-free in hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) Read of size 8 at addr ffff888001265018 by task kworker/u3:0/32 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-1.fc38 04/01/2014 Workqueue: hci0 hci_cmd_sync_work Call Trace: <TASK> dump_stack_lvl (./arch/x86/include/asm/irqflags.h:134 lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) ? __virt_addr_valid (./include/
s.h:134 lib/dump_stack.c:107) print_report (mm/kasan/report.c:320 mm/kasan/report.c:430) ? __virt_addr_valid (./include/linux/mmzone.h:1915 ./include/linux/mmzone.h:2011 arch/x86/mm/physaddr.c:65) ? hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) kasan_report (mm/kasan/report.c:538) ? hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2536 net/bluetooth/hci_sync.c:2723 net/bluetooth/hci_sync.c:2841) ? __pfx_hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2780) ? mutex_lock (kernel/locking/m
oth/hci_sync.c:2841) ? __pfx_hci_update_passive_scan_sync (net/bluetooth/hci_sync.c:2780) ? mutex_lock (kernel/locking/mutex.c:282) ? __pfx_mutex_lock (kernel/locking/mutex.c:282) ? __pfx_mutex_unlock (kernel/locking/mutex.c:538) ? __pfx_update_passive_scan_sync (net/bluetooth/hci_sync.c:2861) hci_cmd_sync_work (net/bluetooth/hci_sync.c:306) process_one_work (./arch/x86/include/asm/preempt.h:27 kernel/workqueue.c:2399) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2538) ? __pfx_worker_thread (kernel/workqueue.c:2480) kthread (kernel/kthread.c:376) ? __pfx_kthread (kernel/kthread.c:331) ret_from_fork (arch/x86/entry/entry_64.S:314) </TASK> Allocated by task 31: kasan_save_stack
read (kernel/kthread.c:331) ret_from_fork (arch/x86/entry/entry_64.S:314) </TASK> Allocated by task 31: kasan_save_stack (mm/kasan/common.c:46) kasan_set_track (mm/kasan/common.c:52) __kasan_kmalloc (mm/kasan/common.c:374 mm/kasan/common.c:383) hci_conn_params_add (./include/linux/slab.h:580 ./include/linux/slab.h:720 net/bluetooth/hci_core.c:2277) hci_connect_le_scan (net/bluetooth/hci_conn.c:1419 net/bluetooth/hci_conn.c:1589) hci_connect_cis (net/bluetooth/hci_conn.c:2266) iso_connect_cis (net/bluetooth/iso.c:390) iso_sock_connect (net/bluetooth/iso.c:899) __sys_connect (net/socket.c:2003 net/socket.c:2020) __x64_sys_connect (net/socket.c:2027) do_syscall_64 (arch/x86/entry/common.c:50 ar
(net/socket.c:2003 net/socket.c:2020) __x64_sys_connect (net/socket.c:2027) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) Freed by task 15: kasan_save_stack (mm/kasan/common.c:46) kasan_set_track (mm/kasan/common.c:52) kasan_save_free_info (mm/kasan/generic.c:523) __kasan_slab_free (mm/kasan/common.c:238 mm/kasan/common.c:200 mm/kasan/common.c:244) __kmem_cache_free (mm/slub.c:1807 mm/slub.c:3787 mm/slub.c:3800) hci_conn_params_del (net/bluetooth/hci_core.c:2323) le_scan_cleanup (net/bluetooth/hci_conn.c:202) process_one_work (./arch/x86/include/asm/preempt. ---truncated--- References: - https://git.kernel
tooth/hci_conn.c:202) process_one_work (./arch/x86/include/asm/preempt. ---truncated--- References: - https://git.kernel.org/stable/c/13ad45ad14df992a6754a130a19abc8c142d54e2 - https://git.kernel.org/stable/c/cef88a0fd8e9c2e838162fbb742b3e713b811a7e - https://git.kernel.org/stable/c/195ef75e19287b4bc413da3e3e3722b030ac881e
CVE ID: CVE-2023-53253 State: PUBLISHED Published: 2025-09-15T14:46:23.661Z Last Updated: 2025-09-15T14:46:23.661Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: nvidia-shield: Reference hid_device devm allocation of input_dev name Use hid_device for devm allocation of the input_dev name to avoid a use-after-free. input_unregister_device would trigger devres cleanup of all resources associated with the input_dev, free-ing the name. The name would subsequently be used in a uevent fired at the end of unregistering the input_dev. References: - https://git.kernel.org/stable/c/b85d3807e5ec368bfd5b20245347d7c1434aff76 - https://
stering the input_dev. References: - https://git.kernel.org/stable/c/b85d3807e5ec368bfd5b20245347d7c1434aff76 - https://git.kernel.org/stable/c/197d3143520fec9fde89aebabc9f0d7464f08e50
CVE ID: CVE-2023-53254 State: PUBLISHED Published: 2025-09-15T14:46:24.670Z Last Updated: 2025-09-15T14:46:24.670Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels The cacheinfo sets up the shared_cpu_map by checking whether the caches with the same index are shared between CPUs. However, this will trigger slab-out-of-bounds access if the CPUs do not have the same cache hierarchy. Another problem is the mismatched shared_cpu_map when the shared cache does not have the same index between CPUs. CPU0 I D L3 index 0 1 2 x ^ ^ ^ ^ index 0 1 2 3 CPU1 I D L2 L3 Th
hared cache does not have the same index between CPUs. CPU0 I D L3 index 0 1 2 x ^ ^ ^ ^ index 0 1 2 3 CPU1 I D L2 L3 This patch checks each cache is shared with all caches on other CPUs. References: - https://git.kernel.org/stable/c/2f588d0345d69a35e451077afed428fd057a5e34 - https://git.kernel.org/stable/c/dea49f2993f57d8a2df2cacb0bf649ef49b28879 - https://git.kernel.org/stable/c/198102c9103fc78d8478495971947af77edb05c1
CVE ID: CVE-2023-53255 State: PUBLISHED Published: 2025-09-15T14:46:27.124Z Last Updated: 2025-09-15T14:46:27.124Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() svc_create_memory_pool() is only called from stratix10_svc_drv_probe(). Most of resources in the probe are managed, but not this memremap() call. There is also no memunmap() call in the file. So switch to devm_memremap() to avoid a resource leak. References: - https://git.kernel.org/stable/c/e3373e6b6c79aff698442b00d20c9f285d296e46 - https://git.kernel.org/stable/c/c04ed61ebf01968d7699b1
it.kernel.org/stable/c/e3373e6b6c79aff698442b00d20c9f285d296e46 - https://git.kernel.org/stable/c/c04ed61ebf01968d7699b121663982493ed577fb - https://git.kernel.org/stable/c/974ac045a05ad12a0b4578fb303f00dcc22f3aba - https://git.kernel.org/stable/c/cb8a31a56df8492fb0d900959238e1a3ff8b8981 - https://git.kernel.org/stable/c/7363de081c793e47866cb54ce7cb8a480cffc259 - https://git.kernel.org/stable/c/1995f15590ca222f91193ed11461862b450abfd6
CVE ID: CVE-2023-53256 State: PUBLISHED Published: 2025-09-15T14:46:28.024Z Last Updated: 2025-09-15T14:46:28.024Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_ffa: Fix FFA device names for logical partitions Each physical partition can provide multiple services each with UUID. Each such service can be presented as logical partition with a unique combination of VM ID and UUID. The number of distinct UUID in a system will be less than or equal to the number of logical partitions. However, currently it fails to register more than one logical partition or service within a physical partition as the device name conta
tly it fails to register more than one logical partition or service within a physical partition as the device name contains only VM ID while both VM ID and UUID are maintained in the partition information. The kernel complains with the below message: | sysfs: cannot create duplicate filename '/devices/arm-ffa-8001' | CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7 #8 | Hardware name: FVP Base RevC (DT) | Call trace: | dump_backtrace+0xf8/0x118 | show_stack+0x18/0x24 | dump_stack_lvl+0x50/0x68 | dump_stack+0x18/0x24 | sysfs_create_dir_ns+0xe0/0x13c | kobject_add_internal+0x220/0x3d4 | kobject_add+0x94/0x100 | device_add+0x144/0x5d8 | device_register+0x20/0x30 | ffa_device_register+0x88/0x
+0x220/0x3d4 | kobject_add+0x94/0x100 | device_add+0x144/0x5d8 | device_register+0x20/0x30 | ffa_device_register+0x88/0xd8 | ffa_setup_partitions+0x108/0x1b8 | ffa_init+0x2ec/0x3a4 | do_one_initcall+0xcc/0x240 | do_initcall_level+0x8c/0xac | do_initcalls+0x54/0x94 | do_basic_setup+0x1c/0x28 | kernel_init_freeable+0x100/0x16c | kernel_init+0x20/0x1a0 | ret_from_fork+0x10/0x20 | kobject_add_internal failed for arm-ffa-8001 with -EEXIST, don't try to | register things with the same name in the same directory. | arm_ffa arm-ffa: unable to register device arm-ffa-8001 err=-17 | ARM FF-A: ffa_setup_partitions: failed to register partition ID 0x8001 By virtue of being random enough to avoid collisi
ARM FF-A: ffa_setup_partitions: failed to register partition ID 0x8001 By virtue of being random enough to avoid collisions when generated in a distributed system, there is no way to compress UUID keys to the number of bits required to identify each. We can eliminate '-' in the name but it is not worth eliminating 4 bytes and add unnecessary logic for doing that. Also v1.0 doesn't provide the UUID of the partitions which makes it hard to use the same for the device name. So to keep it simple, let us alloc an ID using ida_alloc() and append the same to "arm-ffa" to make up a unique device name. Also stash the id value in ffa_dev to help freeing the ID later when the device is destroyed. Refer
unique device name. Also stash the id value in ffa_dev to help freeing the ID later when the device is destroyed. References: - https://git.kernel.org/stable/c/c2f65991097a62efbdb2bed3c06fc86b08c9593b - https://git.kernel.org/stable/c/dfc5aaa57f52a5800c339369d235fa30fb734feb - https://git.kernel.org/stable/c/93d0cbe88118fcef234d3ebcbdadcb9ebe9d34f1 - https://git.kernel.org/stable/c/19b8766459c41c6f318f8a548cc1c66dffd18363
CVE ID: CVE-2023-53257 State: PUBLISHED Published: 2025-09-15T14:46:29.009Z Last Updated: 2025-09-15T14:46:29.009Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: check S1G action frame size Before checking the action code, check that it even exists in the frame. References: - https://git.kernel.org/stable/c/fedd9377dd9c71a950d432fbe1628eebfbed70a1 - https://git.kernel.org/stable/c/7ae7a1378a119780c8c17a6b5fc03011c3bb7029 - https://git.kernel.org/stable/c/5e030a2509be72b452b6f4a800786d43229414db - https://git.kernel.org/stable/c/19e4a47ee74718a22e963e8a647c8c3bfe8bb05c
CVE ID: CVE-2023-53258 State: PUBLISHED Published: 2025-09-15T14:46:29.867Z Last Updated: 2025-09-16T08:02:27.741Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix possible underflow for displays with large vblank [Why] Underflow observed when using a display with a large vblank region and low refresh rate [How] Simplify calculation of vblank_nom Increase value for VBlankNomDefaultUS to 800us References: - https://git.kernel.org/stable/c/d5741133e6e2f304b40ca1da0e16f62af06f4d22 - https://git.kernel.org/stable/c/64bc8e10c87adf60b2d32aacf3afb288e51d5a62 - https://git.kernel.org/stable/c/1a4bcdbea4319efeb26cc4b0
.kernel.org/stable/c/64bc8e10c87adf60b2d32aacf3afb288e51d5a62 - https://git.kernel.org/stable/c/1a4bcdbea4319efeb26cc4b05be859a7867e02dc
CVE ID: CVE-2023-53259 State: PUBLISHED Published: 2025-09-15T14:46:30.955Z Last Updated: 2025-11-03T17:31:06.014Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF The call to get_user_pages_fast() in vmci_host_setup_notify() can return NULL context->notify_page causing a GPF. To avoid GPF check if context->notify_page == NULL and return error if so. general protection fault, probably for non-canonical address 0xe0009d1000000060: 0000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] CPU:
000 [#1] PREEMPT SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0x0005088000000300- 0x0005088000000307] CPU: 2 PID: 26180 Comm: repro_34802241 Not tainted 6.1.0-rc4 #1 Hardware name: Red Hat KVM, BIOS 1.15.0-2.module+el8.6.0 04/01/2014 RIP: 0010:vmci_ctx_check_signal_notify+0x91/0xe0 Call Trace: <TASK> vmci_host_unlocked_ioctl+0x362/0x1f40 __x64_sys_ioctl+0x1a1/0x230 do_syscall_64+0x3a/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/stable/c/b4239bfb260d1e6837766c41a0b241d7670f1402 - https://git.kernel.org/stable/c/d4198f67e7556b1507f14f60d81a72660e5560e4 - https://git.kernel.org/stable/c/a3c89e8
402 - https://git.kernel.org/stable/c/d4198f67e7556b1507f14f60d81a72660e5560e4 - https://git.kernel.org/stable/c/a3c89e8c69a58f62451c0a75b77fcab25979b897 - https://git.kernel.org/stable/c/055891397f530f9b1b22be38d7eca8b08382941f - https://git.kernel.org/stable/c/91b8e4f61f8f4594ee65368c8d89e6fdc29d3fb1 - https://git.kernel.org/stable/c/1a726cb47fd204109c767409fa9ca15a96328f14
CVE ID: CVE-2023-53260 State: PUBLISHED Published: 2025-09-15T14:46:31.919Z Last Updated: 2025-09-15T14:46:31.919Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovl_permission() Following process: P1 P2 path_lookupat link_path_walk inode_permission ovl_permission ovl_i_path_real(inode, &realpath) path->dentry = ovl_i_dentry_upper(inode) drop_cache __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry) dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL realinode = d_inode(realpath.dentry) // return NULL inode_permission(realinode)
unlink_inode upperdentry->d_inode = NULL realinode = d_inode(realpath.dentry) // return NULL inode_permission(realinode) inode->i_sb // NULL pointer dereference , will trigger an null pointer dereference at realinode: [ 335.664979] BUG: kernel NULL pointer dereference, address: 0000000000000002 [ 335.668032] CPU: 0 PID: 2592 Comm: ls Not tainted 6.3.0 [ 335.669956] RIP: 0010:inode_permission+0x33/0x2c0 [ 335.678939] Call Trace: [ 335.679165] <TASK> [ 335.679371] ovl_permission+0xde/0x320 [ 335.679723] inode_permission+0x15e/0x2c0 [ 335.680090] link_path_walk+0x115/0x550 [ 335.680771] path_lookupat.isra.0+0xb2/0x200 [ 335.681170] filename_lookup+0xda/0x240 [ 335.681922] vfs_statx+0xa6/0x1f0 [
35.680771] path_lookupat.isra.0+0xb2/0x200 [ 335.681170] filename_lookup+0xda/0x240 [ 335.681922] vfs_statx+0xa6/0x1f0 [ 335.682233] vfs_fstatat+0x7b/0xb0 Fetch a reproducer in [Link]. Use the helper ovl_i_path_realinode() to get realinode and then do non-nullptr checking. References: - https://git.kernel.org/stable/c/53dd2ca2c02fdcfe3aad2345091d371063f97d17 - https://git.kernel.org/stable/c/69f9ae7edf9ec0ff500429101923347fcba5c8c4 - https://git.kernel.org/stable/c/1a73f5b8f079fd42a544c1600beface50c63af7c
CVE ID: CVE-2023-53261 State: PUBLISHED Published: 2025-09-15T14:46:33.065Z Last Updated: 2025-09-15T14:46:33.065Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: coresight: Fix memory leak in acpi_buffer->pointer There are memory leaks reported by kmemleak: ... unreferenced object 0xffff00213c141000 (size 1024): comm "systemd-udevd", pid 2123, jiffies 4294909467 (age 6062.160s) hex dump (first 32 bytes): 04 00 00 00 02 00 00 00 18 10 14 3c 21 00 ff ff ...........<!... 00 00 00 00 00 00 00 00 03 00 00 00 10 00 00 00 ................ backtrace: [<000000004b7c9001>] __kmem_cache_alloc_node+0x2f8/0x348 [<00000000b0fc7ceb>] __kmallo
00 00 ................ backtrace: [<000000004b7c9001>] __kmem_cache_alloc_node+0x2f8/0x348 [<00000000b0fc7ceb>] __kmalloc+0x58/0x108 [<0000000064ff4695>] acpi_os_allocate+0x2c/0x68 [<000000007d57d116>] acpi_ut_initialize_buffer+0x54/0xe0 [<0000000024583908>] acpi_evaluate_object+0x388/0x438 [<0000000017b2e72b>] acpi_evaluate_object_typed+0xe8/0x240 [<000000005df0eac2>] coresight_get_platform_data+0x1b4/0x988 [coresight] ... The ACPI buffer memory (buf.pointer) should be freed. But the buffer is also used after returning from acpi_get_dsd_graph(). Move the temporary variables buf to acpi_coresight_parse_graph(), and free it before the function return to prevent memory leak. References: - http
s buf to acpi_coresight_parse_graph(), and free it before the function return to prevent memory leak. References: - https://git.kernel.org/stable/c/d1b60e7c9fee34eaedf1fc4e0471f75b33f83a4a - https://git.kernel.org/stable/c/1a9e02673e2550f5612099e64e8761f0c8fc0f50
CVE ID: CVE-2023-53262 State: PUBLISHED Published: 2025-09-15T14:46:34.842Z Last Updated: 2025-09-15T14:46:34.842Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix scheduling while atomic in decompression path [ 16.945668][ C0] Call trace: [ 16.945678][ C0] dump_backtrace+0x110/0x204 [ 16.945706][ C0] dump_stack_lvl+0x84/0xbc [ 16.945735][ C0] __schedule_bug+0xb8/0x1ac [ 16.945756][ C0] __schedule+0x724/0xbdc [ 16.945778][ C0] schedule+0x154/0x258 [ 16.945793][ C0] bit_wait_io+0x48/0xa4 [ 16.945808][ C0] out_of_line_wait_on_bit+0x114/0x198 [ 16.945824][ C0] __sync_dirty_buffer+0x1f8/0x2e8 [ 16.945853][ C0] __f2fs_commit