Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-53150 State: PUBLISHED Published: 2025-09-15T14:03:14.494Z Last Updated: 2025-09-15T14:03:14.494Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Pointer may be dereferenced Klocwork tool reported pointer 'rport' returned from call to function fc_bsg_to_rport() may be NULL and will be dereferenced. Add a fix to validate rport before dereferencing. References: - https://git.kernel.org/stable/c/005961bd8f066fe931104f67c34ebfcc7f240099 - https://git.kernel.org/stable/c/a69125a3ce88d9a386872034e7664b30cc4bcbed - https://git.kernel.org/stable/c/3f22f9ddbb29dba369daddb084be3bacf1587529 - https://git.ker
9a386872034e7664b30cc4bcbed - https://git.kernel.org/stable/c/3f22f9ddbb29dba369daddb084be3bacf1587529 - https://git.kernel.org/stable/c/5addd62586a94a572359418464ce0ae12fa46187 - https://git.kernel.org/stable/c/0715da51391d223bf4981e28346770edea7eeb74 - https://git.kernel.org/stable/c/b06d1b525364bbcf4929b4b35d81945b10dc9883 - https://git.kernel.org/stable/c/22b1d7c8bb59c3376430a8bad5840194b12bf29a - https://git.kernel.org/stable/c/00eca15319d9ce8c31cdf22f32a3467775423df4
CVE ID: CVE-2023-53151 State: PUBLISHED Published: 2025-09-15T14:03:19.155Z Last Updated: 2025-09-15T14:03:19.155Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: md/raid10: prevent soft lockup while flush writes Currently, there is no limit for raid1/raid10 plugged bio. While flushing writes, raid1 has cond_resched() while raid10 doesn't, and too many writes can cause soft lockup. Follow up soft lockup can be triggered easily with writeback test for raid10 with ramdisks: watchdog: BUG: soft lockup - CPU#10 stuck for 27s! [md0_raid10:1293] Call Trace: <TASK> call_rcu+0x16/0x20 put_object+0x41/0x80 __delete_object+0x50/0x90 delet
ck for 27s! [md0_raid10:1293] Call Trace: <TASK> call_rcu+0x16/0x20 put_object+0x41/0x80 __delete_object+0x50/0x90 delete_object_full+0x2b/0x40 kmemleak_free+0x46/0xa0 slab_free_freelist_hook.constprop.0+0xed/0x1a0 kmem_cache_free+0xfd/0x300 mempool_free_slab+0x1f/0x30 mempool_free+0x3a/0x100 bio_free+0x59/0x80 bio_put+0xcf/0x2c0 free_r10bio+0xbf/0xf0 raid_end_bio_io+0x78/0xb0 one_write_done+0x8a/0xa0 raid10_end_write_request+0x1b4/0x430 bio_endio+0x175/0x320 brd_submit_bio+0x3b9/0x9b7 [brd] __submit_bio+0x69/0xe0 submit_bio_noacct_nocheck+0x1e6/0x5a0 submit_bio_noacct+0x38c/0x7e0 flush_pending_writes+0xf0/0x240 raid10d+0xac/0x1ed0 Fix the problem by adding cond_resched() to raid10 like what
c/0x7e0 flush_pending_writes+0xf0/0x240 raid10d+0xac/0x1ed0 Fix the problem by adding cond_resched() to raid10 like what raid1 did. Note that unlimited plugged bio still need to be optimized, for example, in the case of lots of dirty pages writeback, this will take lots of memory and io will spend a long time in plug, hence io latency is bad. References: - https://git.kernel.org/stable/c/f45b2fa7678ab385299de345f7e85d05caea386b - https://git.kernel.org/stable/c/00ecb6fa67c0f772290c5ea5ae8b46eefd503b83 - https://git.kernel.org/stable/c/d0345f7c7dbc5d42e4e6f1db99c1c1879d7b0eb5 - https://git.kernel.org/stable/c/634daf6b2c81015cc5e28bf694a6a94a50c641cd - https://git.kernel.org/stable/c/84a578961
5 - https://git.kernel.org/stable/c/634daf6b2c81015cc5e28bf694a6a94a50c641cd - https://git.kernel.org/stable/c/84a578961b2566e475bfa8740beaf0abcc781a6f - https://git.kernel.org/stable/c/1d467e10507167eb6dc2c281a87675b731955d86 - https://git.kernel.org/stable/c/fbf50184190d55f8717bd29aa9530c399be96f30 - https://git.kernel.org/stable/c/010444623e7f4da6b4a4dd603a7da7469981e293
CVE ID: CVE-2023-53152 State: PUBLISHED Published: 2025-09-15T14:03:20.482Z Last Updated: 2025-09-16T08:02:19.214Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix calltrace warning in amddrm_buddy_fini The following call trace is observed when removing the amdgpu driver, which is caused by that BOs allocated for psp are not freed until removing. [61811.450562] RIP: 0010:amddrm_buddy_fini.cold+0x29/0x47 [amddrm_buddy] [61811.450577] Call Trace: [61811.450577] <TASK> [61811.450579] amdgpu_vram_mgr_fini+0x135/0x1c0 [amdgpu] [61811.450728] amdgpu_ttm_fini+0x207/0x290 [amdgpu] [61811.450870] amdgpu_bo_fini+0x27/0xa0 [
_fini+0x135/0x1c0 [amdgpu] [61811.450728] amdgpu_ttm_fini+0x207/0x290 [amdgpu] [61811.450870] amdgpu_bo_fini+0x27/0xa0 [amdgpu] [61811.451012] gmc_v9_0_sw_fini+0x4a/0x60 [amdgpu] [61811.451166] amdgpu_device_fini_sw+0x117/0x520 [amdgpu] [61811.451306] amdgpu_driver_release_kms+0x16/0x30 [amdgpu] [61811.451447] devm_drm_dev_init_release+0x4d/0x80 [drm] [61811.451466] devm_action_release+0x15/0x20 [61811.451469] release_nodes+0x40/0xb0 [61811.451471] devres_release_all+0x9b/0xd0 [61811.451473] __device_release_driver+0x1bb/0x2a0 [61811.451476] driver_detach+0xf3/0x140 [61811.451479] bus_remove_driver+0x6c/0xf0 [61811.451481] driver_unregister+0x31/0x60 [61811.451483] pci_unregister_driver+0x40
451479] bus_remove_driver+0x6c/0xf0 [61811.451481] driver_unregister+0x31/0x60 [61811.451483] pci_unregister_driver+0x40/0x90 [61811.451486] amdgpu_exit+0x15/0x447 [amdgpu] For smu v13_0_2, if the GPU supports xgmi, refer to commit f5c7e7797060 ("drm/amdgpu: Adjust removal control flow for smu v13_0_2"), it will run gpu recover in AMDGPU_RESET_FOR_DEVICE_REMOVE mode when removing, which makes all devices in hive list have hw reset but no resume except the basic ip blocks, then other ip blocks will not call .hw_fini according to ip_block.status.hw. Since psp_free_shared_bufs just includes some software operations, so move it to psp_sw_fini. References: - https://git.kernel.org/stable/c/ab6f44
just includes some software operations, so move it to psp_sw_fini. References: - https://git.kernel.org/stable/c/ab6f446c220db0c131f2071846afd835799be0fb - https://git.kernel.org/stable/c/756d674117f5c451f415d1c4046b927052a90c14 - https://git.kernel.org/stable/c/01382501509871d0799bab6bd412c228486af5bf
CVE ID: CVE-2023-53153 State: PUBLISHED Published: 2025-09-15T14:03:21.590Z Last Updated: 2025-09-15T14:03:21.590Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: Fix use after free for wext Key information in wext.connect is not reset on (re)connect and can hold data from a previous connection. Reset key data to avoid that drivers or mac80211 incorrectly detect a WEP connection request and access the freed or already reused memory. Additionally optimize cfg80211_sme_connect() and avoid an useless schedule of conn_work. References: - https://git.kernel.org/stable/c/66af4a2ab1d65d556d638cb9555a3b823c2557a9 - https
ss schedule of conn_work. References: - https://git.kernel.org/stable/c/66af4a2ab1d65d556d638cb9555a3b823c2557a9 - https://git.kernel.org/stable/c/a2a92b3e9d8e03ee3f9ee407fc46a9b4bd02d8b6 - https://git.kernel.org/stable/c/6f1959c17d4cb5b74af6fc31dc787e1dc3e4f6e2 - https://git.kernel.org/stable/c/2cfe78619b0de6d2da773978bc2d22797212eaa7 - https://git.kernel.org/stable/c/fd081afd21eb35b968b0330700c43ec94986e1c4 - https://git.kernel.org/stable/c/22dfb21bf1cd876616d45cda1bc6daa89eec6747 - https://git.kernel.org/stable/c/f4b6a138efb8a32507b8946104e32cb926308da7 - https://git.kernel.org/stable/c/015b8cc5e7c4d7bb671f1984d7b7338c310b185b
CVE ID: CVE-2023-53154 State: PUBLISHED Published: 2025-05-23T00:00:00.000Z Last Updated: 2025-11-03T19:28:58.976Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: cJSON project Products: cJSON Problem Types: CWE-125 Description: parse_string in cJSON before 1.7.18 has a heap-based buffer over-read via {"1":1, with no trailing newline if cJSON_ParseWithLength is called. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/DaveGamble/cJSON/compare/v1.7.17...v1.7.18 - https://github.com/DaveGamble/cJSON/issues/800
CVE ID: CVE-2023-53155 State: PUBLISHED Published: 2025-07-25T00:00:00.000Z Last Updated: 2025-07-29T13:54:12.010Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: EmbedThis Products: GoAhead Problem Types: CWE-79 Description: goform/formTest in EmbedThis GoAhead 2.5 allows HTML injection via the name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.exploit-db.com/exploits/51762
CVE ID: CVE-2023-53156 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T15:15:28.514Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: ejmahler Products: transpose Problem Types: CWE-190 Description: The transpose crate before 0.2.3 for Rust allows an integer overflow via input_width and input_height arguments. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2023-0080.html - https://github.com/ejmahler/transpose/issues/11 - https://github.com/advisories/GHSA-5gmm-6m36-r7jh - https://crates.io/crates/transpose
CVE ID: CVE-2023-53157 State: PUBLISHED Published: 2025-07-27T00:00:00.000Z Last Updated: 2025-07-28T15:03:12.080Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: rosenpass Products: rosenpass Problem Types: CWE-130 Description: The rosenpass crate before 0.2.1 for Rust allows remote attackers to cause a denial of service (panic) via a one-byte UDP packet. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rosenpass/rosenpass/commit/93439858d1c44294a7b377f775c4fc897a370bb2 - https://github.com/advisories/GHSA-6ggr-cwv4-g7qg - https://rustsec.org/advisories/RUSTSEC-2023-0077.html - https://crates.io/crates/rosenpass
CVE ID: CVE-2023-53158 State: PUBLISHED Published: 2025-07-28T00:00:00.000Z Last Updated: 2025-07-28T17:24:12.615Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GitoxideLabs Products: gix-transport Problem Types: CWE-78 Description: The gix-transport crate before 0.36.1 for Rust allows command execution via the "gix clone 'ssh://-oProxyCommand=open$IFS" substring. NOTE: this was discovered before CVE-2024-32884, a similar vulnerability (involving a username field) that is more difficult to exploit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2023-0064.html - https://github.com/GitoxideLabs/gitoxid
nrichment: References: - https://rustsec.org/advisories/RUSTSEC-2023-0064.html - https://github.com/GitoxideLabs/gitoxide/pull/1032 - https://github.com/advisories/GHSA-rrjw-j4m2-mf34 - https://crates.io/crates/gix-transport
CVE ID: CVE-2023-53159 State: PUBLISHED Published: 2025-07-28T00:00:00.000Z Last Updated: 2025-07-28T13:54:23.689Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:L) Vendors: sfackler Products: openssl Problem Types: CWE-126 Description: The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://rustsec.org/advisories/RUSTSEC-2023-0044.html - https://github.com/sfackler/rust-openssl/issues/1965 - https://crates.io/crates/openssl
CVE ID: CVE-2023-53160 State: PUBLISHED Published: 2025-07-28T00:00:00.000Z Last Updated: 2025-07-28T13:53:39.946Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: sequoia-pgp Products: sequoia Problem Types: CWE-125 Description: The sequoia-openpgp crate before 1.16.0 for Rust allows out-of-bounds array access and a panic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://crates.io/crates/sequoia-openpgp - https://rustsec.org/advisories/RUSTSEC-2023-0038.html - https://github.com/advisories/GHSA-25mx-8f3v-8wh7 - https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/
CVE ID: CVE-2023-53161 State: PUBLISHED Published: 2025-07-28T00:00:00.000Z Last Updated: 2025-07-28T13:52:30.036Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: sequoia-pgp Products: buffered-reader Problem Types: CWE-125 Description: The buffered-reader crate before 1.1.5 for Rust allows out-of-bounds array access and a panic. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://lists.sequoia-pgp.org/hyperkitty/list/announce@lists.sequoia-pgp.org/thread/SN2E3QRT4DMQ5JNEK6VIN6DJ5SH766DI/ - https://rustsec.org/advisories/RUSTSEC-2023-0039.html - https://github.com/advisories/GHSA-29mf-62xx-28jq - https://crates.io/crates/buffered-reader - h
USTSEC-2023-0039.html - https://github.com/advisories/GHSA-29mf-62xx-28jq - https://crates.io/crates/buffered-reader - https://gitlab.com/sequoia-pgp/sequoia/-/tags/buffered-reader%2Fv1.0.2 - https://gitlab.com/sequoia-pgp/sequoia/-/tags/buffered-reader%2Fv1.1.5
CVE ID: CVE-2023-53163 State: PUBLISHED Published: 2025-09-15T14:03:33.777Z Last Updated: 2025-09-15T14:03:33.777Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: don't hold ni_lock when calling truncate_setsize() syzbot is reporting hung task at do_user_addr_fault() [1], for there is a silent deadlock between PG_locked bit and ni_lock lock. Since filemap_update_page() calls filemap_read_folio() after calling folio_trylock() which will set PG_locked bit, ntfs_truncate() must not call truncate_setsize() which will wait for PG_locked bit to be cleared when holding ni_lock lock. References: - https://git.kernel.org/stable
) which will wait for PG_locked bit to be cleared when holding ni_lock lock. References: - https://git.kernel.org/stable/c/8414983c2e649364d8af29080a0869266b31abb6 - https://git.kernel.org/stable/c/6bb6b1c6b0c31e36736b87a39dd1cbbd9d5ec22f - https://git.kernel.org/stable/c/73fee7e1e5ea11b51c51c46e0577a197ca3602cf - https://git.kernel.org/stable/c/0226635c304cfd5c9db9b78c259cb713819b057e
CVE ID: CVE-2023-53164 State: PUBLISHED Published: 2025-09-15T14:03:50.681Z Last Updated: 2025-09-15T14:03:50.681Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: irqchip/ti-sci: Fix refcount leak in ti_sci_intr_irq_domain_probe of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_node_put() to avoid refcount leak. References: - https://git.kernel.org/stable/c/07fceab32096c1290b491f2fcaace03f78e2db37 - https://git.kernel.org/stable/c/df8d3536b660c6c6f6b25fa8b157e9b38ad78142 - https://git.kernel.org/stable/c/856fc2195494d1175ada0f1f46f92c5
.org/stable/c/df8d3536b660c6c6f6b25fa8b157e9b38ad78142 - https://git.kernel.org/stable/c/856fc2195494d1175ada0f1f46f92c5b28ce12eb - https://git.kernel.org/stable/c/a0d91a48e1a020fb636f0fcaf44672f123bb0799 - https://git.kernel.org/stable/c/4ae40c20f1519e1767ba01609abc7e8d6485fc0c - https://git.kernel.org/stable/c/02298b7bae12936ca313975b02e7f98b06670d37
CVE ID: CVE-2023-53165 State: PUBLISHED Published: 2025-09-15T14:03:53.987Z Last Updated: 2025-10-29T10:50:22.490Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are between 2 and 5 characters long, UDF charset conversion code would read uninitialized memory in the output buffer. The only practical impact is that the name may be prepended a "unification hash" when it is not actually needed but still it is good to fix this. References: - https://git.kernel.org/stable/c/008ae78d1e12efa904dc819b1ec83e2bca6b2c56 - https://git.kernel.org/stabl
s. References: - https://git.kernel.org/stable/c/008ae78d1e12efa904dc819b1ec83e2bca6b2c56 - https://git.kernel.org/stable/c/b37f998d357102e8eb0f8eeb33f03fff22e49cbf - https://git.kernel.org/stable/c/3f1368af47acf4d0b2a5fb0d2c0d6919d2234b6d - https://git.kernel.org/stable/c/4503f6fc95d6dee85fb2c54785848799e192c51c - https://git.kernel.org/stable/c/985f9666698960dfc87a106d6314203fa90fda75 - https://git.kernel.org/stable/c/a6824149809395dfbb5bc36bc7057cc3cb84e56d - https://git.kernel.org/stable/c/4d50988da0db167aed6f38685145cb5cd526c4f8 - https://git.kernel.org/stable/c/028f6055c912588e6f72722d89c30b401bbcf013
CVE ID: CVE-2023-53166 State: PUBLISHED Published: 2025-09-15T14:03:55.131Z Last Updated: 2025-09-15T14:03:55.131Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix external_power_changed race bq25890_charger_external_power_changed() dereferences bq->charger, which gets sets in bq25890_power_supply_init() like this: bq->charger = devm_power_supply_register(bq->dev, &bq->desc, &psy_cfg); As soon as devm_power_supply_register() has called device_add() the external_power_changed callback can get called. So there is a window where bq25890_charger_external_power_changed() may get called while bq->charger has
can get called. So there is a window where bq25890_charger_external_power_changed() may get called while bq->charger has not been set yet leading to a NULL pointer dereference. This race hits during boot sometimes on a Lenovo Yoga Book 1 yb1-x90f when the cht_wcove_pwrsrc (extcon) power_supply is done with detecting the connected charger-type which happens to exactly hit the small window: BUG: kernel NULL pointer dereference, address: 0000000000000018 <snip> RIP: 0010:__power_supply_is_supplied_by+0xb/0xb0 <snip> Call Trace: <TASK> __power_supply_get_supplier_property+0x19/0x50 class_for_each_device+0xb1/0xe0 power_supply_get_property_from_supplier+0x2e/0x50 bq25890_charger_external_power_ch
0x50 class_for_each_device+0xb1/0xe0 power_supply_get_property_from_supplier+0x2e/0x50 bq25890_charger_external_power_changed+0x38/0x1b0 [bq25890_charger] __power_supply_changed_work+0x30/0x40 class_for_each_device+0xb1/0xe0 power_supply_changed_work+0x5f/0xe0 <snip> Fixing this is easy. The external_power_changed callback gets passed the power_supply which will eventually get stored in bq->charger, so bq25890_charger_external_power_changed() can simply directly use the passed in psy argument which is always valid. References: - https://git.kernel.org/stable/c/72c28207c19c2c46fab8ae994aff25e197fb2949 - https://git.kernel.org/stable/c/9d20fa1982c35697f3f8c4ae0f12791691ae5958 - https://git.ker
c46fab8ae994aff25e197fb2949 - https://git.kernel.org/stable/c/9d20fa1982c35697f3f8c4ae0f12791691ae5958 - https://git.kernel.org/stable/c/029a443b9b6424170f00f6dd5b7682e682cce92e
CVE ID: CVE-2023-53167 State: PUBLISHED Published: 2025-09-15T14:03:56.025Z Last Updated: 2025-09-15T14:03:56.025Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix null pointer dereference in tracing_err_log_open() Fix an issue in function 'tracing_err_log_open'. The function doesn't call 'seq_open' if the file is opened only with write permissions, which results in 'file->private_data' being left as null. If we then use 'lseek' on that opened file, 'seq_lseek' dereferences 'file->private_data' in 'mutex_lock(&m->lock)', resulting in a kernel panic. Writing to this node requires root privileges, therefore this bug ha
mutex_lock(&m->lock)', resulting in a kernel panic. Writing to this node requires root privileges, therefore this bug has very little security impact. Tracefs node: /sys/kernel/tracing/error_log Example Kernel panic: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 Call trace: mutex_lock+0x30/0x110 seq_lseek+0x34/0xb8 __arm64_sys_lseek+0x6c/0xb8 invoke_syscall+0x58/0x13c el0_svc_common+0xc4/0x10c do_el0_svc+0x24/0x98 el0_svc+0x24/0x88 el0t_64_sync_handler+0x84/0xe4 el0t_64_sync+0x1b4/0x1b8 Code: d503201f aa0803e0 aa1f03e1 aa0103e9 (c8e97d02) ---[ end trace 561d1b49c12cf8a5 ]--- Kernel panic - not syncing: Oops: Fatal exception References: - https://git.ker
02) ---[ end trace 561d1b49c12cf8a5 ]--- Kernel panic - not syncing: Oops: Fatal exception References: - https://git.kernel.org/stable/c/93114cbc7cb169f6f26eeaed5286b91bb86b463b - https://git.kernel.org/stable/c/7060e5aac6dc195124c106f49106d653a416323a - https://git.kernel.org/stable/c/3b5d9b7b875968a8a8c99dac45cb85b705c44802 - https://git.kernel.org/stable/c/938d5b7a75e18264887387ddf9169db6d8aeef98 - https://git.kernel.org/stable/c/1e1c9aa9288a46c342f0f2c5c0b1c0876b9b0276 - https://git.kernel.org/stable/c/02b0095e2fbbc060560c1065f86a211d91e27b26
CVE ID: CVE-2023-53168 State: PUBLISHED Published: 2025-09-15T14:03:59.766Z Last Updated: 2025-09-15T14:03:59.766Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: usb: ucsi_acpi: Increase the command completion timeout Commit 130a96d698d7 ("usb: typec: ucsi: acpi: Increase command completion timeout value") increased the timeout from 5 seconds to 60 seconds due to issues related to alternate mode discovery. After the alternate mode discovery switch to polled mode the timeout was reduced, but instead of being set back to 5 seconds it was reduced to 1 second. This is causing problems when using a Lenovo ThinkPad X1 yoga gen7 conne
t back to 5 seconds it was reduced to 1 second. This is causing problems when using a Lenovo ThinkPad X1 yoga gen7 connected over Type-C to a LG 27UL850-W (charging DP over Type-C). When the monitor is already connected at boot the following error is logged: "PPM init failed (-110)", /sys/class/typec is empty and on unplugging the NULL pointer deref fixed earlier in this series happens. When the monitor is connected after boot the following error is logged instead: "GET_CONNECTOR_STATUS failed (-110)". Setting the timeout back to 5 seconds fixes both cases. References: - https://git.kernel.org/stable/c/1e8525f37871741a52370627633962f8bdcab15a - https://git.kernel.org/stable/c/8346d21d1d8a63f
tps://git.kernel.org/stable/c/1e8525f37871741a52370627633962f8bdcab15a - https://git.kernel.org/stable/c/8346d21d1d8a63f46f60e6899f4f80b1306acf32 - https://git.kernel.org/stable/c/02d210f434249a7edbc160969b75df030dc6934d
CVE ID: CVE-2023-53169 State: PUBLISHED Published: 2025-09-15T14:04:02.395Z Last Updated: 2025-09-15T14:04:02.395Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Clear staged_config[] before and after it is used As a temporary storage, staged_config[] in rdt_domain should be cleared before and after it is used. The stale value in staged_config[] could cause an MSR access error. Here is a reproducer on a system with 16 usable CLOSIDs for a 15-way L3 Cache (MBA should be disabled if the number of CLOSIDs for MB is less than 16.) : mount -t resctrl resctrl -o cdp /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..7} umount /s
OSIDs for MB is less than 16.) : mount -t resctrl resctrl -o cdp /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..7} umount /sys/fs/resctrl/ mount -t resctrl resctrl /sys/fs/resctrl mkdir /sys/fs/resctrl/p{1..8} An error occurs when creating resource group named p8: unchecked MSR access error: WRMSR to 0xca0 (tried to write 0x00000000000007ff) at rIP: 0xffffffff82249142 (cat_wrmsr+0x32/0x60) Call Trace: <IRQ> __flush_smp_call_function_queue+0x11d/0x170 __sysvec_call_function+0x24/0xd0 sysvec_call_function+0x89/0xc0 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 When creating a new resource control group, hardware will be configured by the following process: rdtgroup_mkdir() rdtgroup_mkdir_ctrl_m
new resource control group, hardware will be configured by the following process: rdtgroup_mkdir() rdtgroup_mkdir_ctrl_mon() rdtgroup_init_alloc() resctrl_arch_update_domains() resctrl_arch_update_domains() iterates and updates all resctrl_conf_type whose have_new_ctrl is true. Since staged_config[] holds the same values as when CDP was enabled, it will continue to update the CDP_CODE and CDP_DATA configurations. When group p8 is created, get_config_index() called in resctrl_arch_update_domains() will return 16 and 17 as the CLOSIDs for CDP_CODE and CDP_DATA, which will be translated to an invalid register - 0xca0 in this scenario. Fix it by clearing staged_config[] before and after it is us