Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ut-of-bounds in ops_init+0x2de/0x320 Write of size 8 at addr ffff888109124978 by task modprobe/1018 CPU: 2 PID: 1018 Comm: modprobe Not tainted 6.2.0-rc2.mptcp_ae5ac65fbed5+ #1641 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x6a/0x9f print_address_description.constprop.0+0x86/0x2b5 print_report+0x11b/0x1fb kasan_report+0x87/0xc0 ops_init+0x2de/0x320 register_pernet_operations+0x2e4/0x750 register_pernet_subsys+0x24/0x40 tcf_register_action+0x9f/0x560 do_one_initcall+0xf9/0x570 do_init_module+0x190/0x650 load_module+0x1fa5/0x23c0 __do_sys_finit_module+0x10d/0x1b0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x72
load_module+0x1fa5/0x23c0 __do_sys_finit_module+0x10d/0x1b0 do_syscall_64+0x58/0x80 entry_SYSCALL_64_after_hwframe+0x72/0xdc RIP: 0033:0x7f42518f778d Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8 64 89 01 48 RSP: 002b:00007fff96869688 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 RAX: ffffffffffffffda RBX: 00005568ef7f7c90 RCX: 00007f42518f778d RDX: 0000000000000000 RSI: 00005568ef41d796 RDI: 0000000000000003 RBP: 00005568ef41d796 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 00005568e
0000000000000000 R09: 0000000000000000 R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 R13: 00005568ef7f7d30 R14: 0000000000040000 R15: 0000000000000000 </TASK> This change addresses the issue by skipping the gen pointer de-reference in the mentioned error-path. Found by code inspection and verified with explicit error injection on a kasan-enabled kernel. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ad0dfe9bcf0d78e699c7efb64c90ed062dc48bea - https://git.kernel.org/stable/c/ddd49cbbd4c1ceb38032018b589b44208e54f55e - https://git.kernel.org/stable/c/d4c008f3b7f7d4ffd311eb2dae5e75b3cbddacd0 - https://git.kernel.org/stable/c/6
08e54f55e - https://git.kernel.org/stable/c/d4c008f3b7f7d4ffd311eb2dae5e75b3cbddacd0 - https://git.kernel.org/stable/c/66689a72ba73575e76d4f6a8748d3fa2690ec1c4 - https://git.kernel.org/stable/c/12075708f2e77ee6a9f8bb2cf512c38be3099794 - https://git.kernel.org/stable/c/71ab9c3e2253619136c31c89dbb2c69305cc89b1
CVE ID: CVE-2023-53000 State: PUBLISHED Published: 2025-03-27T16:43:33.208Z Last Updated: 2025-05-04T07:47:15.178Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: netlink: prevent potential spectre v1 gadgets Most netlink attributes are parsed and validated from __nla_validate_parse() or validate_nla() u16 type = nla_type(nla); if (type == 0 || type > maxtype) { /* error or continue */ } @type is then used as an array index and can be used as a Spectre v1 gadget. array_index_nospec() can be used to prevent leaking content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is
ing content of kernel memory to malicious users. This should take care of vast majority of netlink uses, but an audit is needed to take care of others where validation is not yet centralized in core netlink functions. References: - https://git.kernel.org/stable/c/3e5082b1c66c7783fbcd79b5b178573230e528ff - https://git.kernel.org/stable/c/539ca5dcbc91134bbe2c45677811c31d8b030d2d - https://git.kernel.org/stable/c/41b74e95f297ac360ca7ed6bf200100717cb6c45 - https://git.kernel.org/stable/c/992e4ff7116a77968039277b5d6aaa535c2f2184 - https://git.kernel.org/stable/c/f0950402e8c76e7dcb08563f1b4e8000fbc62455
CVE ID: CVE-2023-53001 State: REJECTED Published: 2025-03-27T16:43:33.829Z Last Updated: 2025-07-15T15:27:33.132Z Description: No description available.
CVE ID: CVE-2023-53002 State: PUBLISHED Published: 2025-03-27T16:43:34.479Z Last Updated: 2025-10-01T20:17:03.710Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix a memory leak with reused mmap_offset drm_vma_node_allow() and drm_vma_node_revoke() should be called in balanced pairs. We call drm_vma_node_allow() once per-file everytime a user calls mmap_offset, but only call drm_vma_node_revoke once per-file on each mmap_offset. As the mmap_offset is reused by the client, the per-file vm_count may remain non-zero and the rbtree leaked. Call drm_vma_node_allow_once() instead to prevent that memory leak. Additional An
remain non-zero and the rbtree leaked. Call drm_vma_node_allow_once() instead to prevent that memory leak. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/0bdc4b4ba7206c452ee81c82fa66e39d0e1780fb - https://git.kernel.org/stable/c/0220e4fe178c3390eb0291cdb34912d66972db8a
CVE ID: CVE-2023-53003 State: PUBLISHED Published: 2025-03-27T16:43:35.155Z Last Updated: 2025-05-04T07:47:19.184Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driver gets probed again, it will try to use the freed data leading to the use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data poin
e use-after-free bug. Hence, do not pass llcc_driv_data as pvt_info but rather reference it using the platform_data pointer in the qcom_edac driver. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/66e10d5f399629ef7877304d9ba2b35d0474e7eb - https://git.kernel.org/stable/c/76d9ebb7f0bc10fbc78b6d576751552edf743968 - https://git.kernel.org/stable/c/bff5243bd32661cf9ce66f6d9210fc8f89bda145 - https://git.kernel.org/stable/c/6f0351d0c311951b8b3064db91e61841e85b2b96 - https://git.kernel.org/stable/c/977c6ba624f24ae20cf0faee871257a39348d4a9
CVE ID: CVE-2023-53004 State: PUBLISHED Published: 2025-03-27T16:43:35.854Z Last Updated: 2025-05-04T07:47:20.315Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ovl: fix tmpfile leak Missed an error cleanup. References: - https://git.kernel.org/stable/c/caa0ea92503f8afa1941f6ac899e5c4e3f6ec8bb - https://git.kernel.org/stable/c/baabaa505563362b71f2637aedd7b807d270656c
CVE ID: CVE-2023-53005 State: PUBLISHED Published: 2025-03-27T16:43:36.547Z Last Updated: 2025-10-01T20:17:03.566Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: trace_events_hist: add check for return value of 'create_hist_field' Function 'create_hist_field' is called recursively at trace_events_hist.c:1954 and can return NULL-value that's why we have to check it to avoid null pointer dereference. Found by Linux Verification Center (linuxtesting.org) with SVACE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/d2d1ada58e7cc100b8d7d6b082d19321ba4a700a - https://git.kernel.org/stab
nt: References: - https://git.kernel.org/stable/c/d2d1ada58e7cc100b8d7d6b082d19321ba4a700a - https://git.kernel.org/stable/c/31b2414abeaa6de0490e85164badc6dcb1bb8ec9 - https://git.kernel.org/stable/c/886aa449235f478e262bbd5dcdee6ed6bc202949 - https://git.kernel.org/stable/c/592ba7116fa620425725ff0972691f352ba3caf6 - https://git.kernel.org/stable/c/b4e7e81b4fdfcf457daee6b7a61769f62198d840 - https://git.kernel.org/stable/c/8b152e9150d07a885f95e1fd401fc81af202d9a4
CVE ID: CVE-2023-53006 State: PUBLISHED Published: 2025-03-27T16:43:37.225Z Last Updated: 2025-05-04T07:47:22.461Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: Fix oops due to uncleared server->smbd_conn in reconnect In smbd_destroy(), clear the server->smbd_conn pointer after freeing the smbd_connection struct that it points to so that reconnection doesn't get confused. References: - https://git.kernel.org/stable/c/a9640c0b268405f2540e8203a545e930ea88bb7d - https://git.kernel.org/stable/c/91be54849d5392050f5b847b42bd5e6221551ac8 - https://git.kernel.org/stable/c/e037baee16e0b9ace7e730888fcae9cec11daff2 - https://git.ke
92050f5b847b42bd5e6221551ac8 - https://git.kernel.org/stable/c/e037baee16e0b9ace7e730888fcae9cec11daff2 - https://git.kernel.org/stable/c/4b83bc6f87eedab4599b0123e572a422689444be - https://git.kernel.org/stable/c/5109607a4ece7cd8536172bf7549eb4dce1f3576 - https://git.kernel.org/stable/c/b7ab9161cf5ddc42a288edf9d1a61f3bdffe17c7
CVE ID: CVE-2023-53007 State: PUBLISHED Published: 2025-03-27T16:43:38.102Z Last Updated: 2025-05-04T07:47:23.690Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: tracing: Make sure trace_printk() can output as soon as it can be used Currently trace_printk() can be used as soon as early_trace_init() is called from start_kernel(). But if a crash happens, and "ftrace_dump_on_oops" is set on the kernel command line, all you get will be: [ 0.456075] <idle>-0 0dN.2. 347519us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 353141us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 358684us : Unknown type 6 This is because the trace_printk() e
.2. 353141us : Unknown type 6 [ 0.456075] <idle>-0 0dN.2. 358684us : Unknown type 6 This is because the trace_printk() event (type 6) hasn't been registered yet. That gets done via an early_initcall(), which may be early, but not early enough. Instead of registering the trace_printk() event (and other ftrace events, which are not trace events) via an early_initcall(), have them registered at the same time that trace_printk() can be used. This way, if there is a crash before early_initcall(), then the trace_printk()s will actually be useful. References: - https://git.kernel.org/stable/c/f97eb0ab066133483a65c93eb894748de2f6b598 - https://git.kernel.org/stable/c/b94d7c7654356860dd7719120c7d15ba
org/stable/c/f97eb0ab066133483a65c93eb894748de2f6b598 - https://git.kernel.org/stable/c/b94d7c7654356860dd7719120c7d15ba38b6162a - https://git.kernel.org/stable/c/76b2390fdc80c0a8300e5da5b6b62d201b6fe9ce - https://git.kernel.org/stable/c/de3930a4883ddad2244efd6d349013294c62c75c - https://git.kernel.org/stable/c/b0af180514edea6c83dc9a299d9f383009c99f25 - https://git.kernel.org/stable/c/198c83963f6335ca6d690cff067679560f2a3a22 - https://git.kernel.org/stable/c/3bb06eb6e9acf7c4a3e1b5bc87aed398ff8e2253
CVE ID: CVE-2023-53008 State: PUBLISHED Published: 2025-03-27T16:43:38.718Z Last Updated: 2025-10-01T20:17:03.428Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential memory leaks in session setup Make sure to free cifs_ses::auth_key.response before allocating it as we might end up leaking memory in reconnect or mounting. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/893d45394dbe4b5cbf3723c19e2ccc8b93a6ac9b - https://git.kernel.org/stable/c/2fe58d977ee05da5bb89ef5dc4f5bf2dc15db46f
CVE ID: CVE-2023-53009 State: PUBLISHED Published: 2025-03-27T16:43:39.481Z Last Updated: 2025-05-04T07:47:31.021Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add sync after creating vram bo There will be data corruption on vram allocated by svm if the initialization is not complete and application is writting on the memory. Adding sync to wait for the initialization completion is to resolve this issue. References: - https://git.kernel.org/stable/c/92af2d3b57a1afdfdcafb1c6a07ffd89cf3e98fb - https://git.kernel.org/stable/c/ba029e9991d9be90a28b6a0ceb25e9a6fb348829
CVE ID: CVE-2023-53010 State: PUBLISHED Published: 2025-03-27T16:43:40.228Z Last Updated: 2025-05-04T07:47:32.221Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: bnxt: Do not read past the end of test names Test names were being concatenated based on a offset beyond the end of the first name, which tripped the buffer overflow detection logic: detected buffer overflow in strnlen [...] Call Trace: bnxt_ethtool_init.cold+0x18/0x18 Refactor struct hwrm_selftest_qlist_output to use an actual array, and adjust the concatenation to use snprintf() rather than a series of strncat() calls. References: - https://git.kernel.org/stable/c/ce
oncatenation to use snprintf() rather than a series of strncat() calls. References: - https://git.kernel.org/stable/c/cefa85480ac99c0bef5a09daadb48d65fc28e279 - https://git.kernel.org/stable/c/d3e599c090fc6977331150c5f0a69ab8ce87da21
CVE ID: CVE-2023-53011 State: PUBLISHED Published: 2025-03-27T16:43:40.897Z Last Updated: 2025-10-01T20:17:03.248Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: enable all safety features by default In the original implementation of dwmac5 commit 8bf993a5877e ("net: stmmac: Add support for DWMAC5 and implement Safety Features") all safety features were enabled by default. Later it seems some implementations didn't have support for all the features, so in commit 5ac712dcdfef ("net: stmmac: enable platform specific safety features") the safety_feat_cfg structure was added to the callback and defined for some platfor
platform specific safety features") the safety_feat_cfg structure was added to the callback and defined for some platforms to selectively enable these safety features. The problem is that only certain platforms were given that software support. If the automotive safety package bit is set in the hardware features register the safety feature callback is called for the platform, and for platforms that didn't get a safety_feat_cfg defined this results in the following NULL pointer dereference: [ 7.933303] Call trace: [ 7.935812] dwmac5_safety_feat_config+0x20/0x170 [stmmac] [ 7.941455] __stmmac_open+0x16c/0x474 [stmmac] [ 7.946117] stmmac_open+0x38/0x70 [stmmac] [ 7.950414] __dev_open+0x100/0x1d
.941455] __stmmac_open+0x16c/0x474 [stmmac] [ 7.946117] stmmac_open+0x38/0x70 [stmmac] [ 7.950414] __dev_open+0x100/0x1dc [ 7.954006] __dev_change_flags+0x18c/0x204 [ 7.958297] dev_change_flags+0x24/0x6c [ 7.962237] do_setlink+0x2b8/0xfa4 [ 7.965827] __rtnl_newlink+0x4ec/0x840 [ 7.969766] rtnl_newlink+0x50/0x80 [ 7.973353] rtnetlink_rcv_msg+0x12c/0x374 [ 7.977557] netlink_rcv_skb+0x5c/0x130 [ 7.981500] rtnetlink_rcv+0x18/0x2c [ 7.985172] netlink_unicast+0x2e8/0x340 [ 7.989197] netlink_sendmsg+0x1a8/0x420 [ 7.993222] ____sys_sendmsg+0x218/0x280 [ 7.997249] ___sys_sendmsg+0xac/0x100 [ 8.001103] __sys_sendmsg+0x84/0xe0 [ 8.004776] __arm64_sys_sendmsg+0x24/0x30 [ 8.008983] invoke_syscall+0x48/0x
c/0x100 [ 8.001103] __sys_sendmsg+0x84/0xe0 [ 8.004776] __arm64_sys_sendmsg+0x24/0x30 [ 8.008983] invoke_syscall+0x48/0x114 [ 8.012840] el0_svc_common.constprop.0+0xcc/0xec [ 8.017665] do_el0_svc+0x38/0xb0 [ 8.021071] el0_svc+0x2c/0x84 [ 8.024212] el0t_64_sync_handler+0xf4/0x120 [ 8.028598] el0t_64_sync+0x190/0x194 Go back to the original behavior, if the automotive safety package is found to be supported in hardware enable all the features unless safety_feat_cfg is passed in saying this particular platform only supports a subset of the features. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/120b8e527e07c65de7f2b9018dcd9d17e66f2427 - https:/
CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/120b8e527e07c65de7f2b9018dcd9d17e66f2427 - https://git.kernel.org/stable/c/aebf7e62708ba706ee7bf484c9023b15c214e92a - https://git.kernel.org/stable/c/fdfc76a116b5e9d3e98e6c96fe83b42d011d21d4
CVE ID: CVE-2023-53012 State: PUBLISHED Published: 2025-03-27T16:43:41.693Z Last Updated: 2025-05-04T12:50:04.932Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: thermal: core: call put_device() only after device_register() fails put_device() shouldn't be called before a prior call to device_register(). __thermal_cooling_device_register() doesn't follow that properly and needs fixing. Also thermal_cooling_device_destroy_sysfs() is getting called unnecessarily on few error paths. Fix all this by placing the calls at the right place. Based on initial work done by Caleb Connolly. References: - https://git.kernel.org/stable/c/a7d73
ls at the right place. Based on initial work done by Caleb Connolly. References: - https://git.kernel.org/stable/c/a7d736cc3c6cb0d7498bbfb56515d414e35e9510 - https://git.kernel.org/stable/c/2846a7412f6246fd5171f51011bf76dfebcec0ee - https://git.kernel.org/stable/c/6c54b7bc8a31ce0f7cc7f8deef05067df414f1d8
CVE ID: CVE-2023-53013 State: PUBLISHED Published: 2025-03-27T16:43:42.437Z Last Updated: 2025-10-01T19:26:35.427Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: ptdma: pt_core_execute_cmd() should use spinlock The interrupt handler (pt_core_irq_handler()) of the ptdma driver can be called from interrupt context. The code flow in this function can lead down to pt_core_execute_cmd() which will attempt to grab a mutex, which is not appropriate in interrupt context and ultimately leads to a kernel panic. The fix here changes this mutex to a spinlock, which has been verified to resolve the issue. Additional Analyst Notes: - CISA AD
here changes this mutex to a spinlock, which has been verified to resolve the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/ed0d8f731e0bf1bb12a7a37698ac613db20e2794 - https://git.kernel.org/stable/c/13ba563c2c8055ba8a637c9f70bb833b43cb4207 - https://git.kernel.org/stable/c/95e5fda3b5f9ed8239b145da3fa01e641cf5d53c
CVE ID: CVE-2023-53014 State: PUBLISHED Published: 2025-03-27T16:43:43.172Z Last Updated: 2025-10-01T19:26:35.276Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra: Fix memory leak in terminate_all() Terminate vdesc when terminating an ongoing transfer. This will ensure that the vdesc is present in the desc_terminated list The descriptor will be freed later in desc_free_list(). This fixes the memory leaks which can happen when terminating an ongoing transfer. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/567128076d554e41609c61b7d447089094ff72c5 - https://git.kern
Vulnrichment: References: - https://git.kernel.org/stable/c/567128076d554e41609c61b7d447089094ff72c5 - https://git.kernel.org/stable/c/a7a7ee6f5a019ad72852c001abbce50d35e992f2
CVE ID: CVE-2023-53015 State: PUBLISHED Published: 2025-03-27T16:43:43.886Z Last Updated: 2025-10-01T17:20:35.709Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: HID: betop: check shape of output reports betopff_init() only checks the total sum of the report counts for each report field to be at least 4, but hid_betopff_play() expects 4 report fields. A device advertising an output report with one field and 4 report counts would pass the check but crash the kernel with a NULL pointer dereference in hid_betopff_play(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/dbab4dba400d6e
_play(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/dbab4dba400d6ea9a9697fbbd287adbf7db1dac4 - https://git.kernel.org/stable/c/7317326f685824c7c29bd80841fd18041af6bb73 - https://git.kernel.org/stable/c/d3065cc56221d1a5eda237e94eaf2a627b88ab79 - https://git.kernel.org/stable/c/28fc6095da22dc88433d79578ae1c495ebe8ca43 - https://git.kernel.org/stable/c/1a2a47b85cab50a3c146731bfeaf2d860f5344ee - https://git.kernel.org/stable/c/07bc32e53c7bd5c91472cc485231ef6274db9b76 - https://git.kernel.org/stable/c/3782c0d6edf658b71354a64d60aa7a296188fc90
CVE ID: CVE-2023-53016 State: PUBLISHED Published: 2025-03-27T16:43:44.528Z Last Updated: 2025-10-01T17:20:23.878Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix possible deadlock in rfcomm_sk_state_change syzbot reports a possible deadlock in rfcomm_sk_state_change [1]. While rfcomm_sock_connect acquires the sk lock and waits for the rfcomm lock, rfcomm_sock_release could have the rfcomm lock and hit a deadlock for acquiring the sk lock. Here's a simplified flow: rfcomm_sock_connect: lock_sock(sk) rfcomm_dlc_open: rfcomm_lock() rfcomm_sock_release: rfcomm_sock_shutdown: rfcomm_lock() __rfcomm_dlc_close: rfcomm_k
sk) rfcomm_dlc_open: rfcomm_lock() rfcomm_sock_release: rfcomm_sock_shutdown: rfcomm_lock() __rfcomm_dlc_close: rfcomm_k_state_change: lock_sock(sk) This patch drops the sk lock before calling rfcomm_dlc_open to avoid the possible deadlock and holds sk's reference count to prevent use-after-free after rfcomm_dlc_open completes. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/98aec50ff7f60cc6f2d6a4396b475c547e58b04d - https://git.kernel.org/stable/c/17511bd84871f4a6106cb335616e086880313f3f - https://git.kernel.org/stable/c/1d80d57ffcb55488f0ec0b77928d4f82d16b6a90
CVE ID: CVE-2023-53017 State: PUBLISHED Published: 2025-03-27T16:43:45.211Z Last Updated: 2025-10-01T17:20:11.426Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: fix memory leak in hci_update_adv_data() When hci_cmd_sync_queue() failed in hci_update_adv_data(), inst_ptr is not freed, which will cause memory leak, convert to use ERR_PTR/PTR_ERR to pass the instance to callback so no memory needs to be allocated. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/8ac6043bd3e5b58d30f50737aedc2e58e8087ad5 - https://git.kernel.org/stable/c/1ed8b37cbaf14574c779064ef13
rnel.org/stable/c/8ac6043bd3e5b58d30f50737aedc2e58e8087ad5 - https://git.kernel.org/stable/c/1ed8b37cbaf14574c779064ef1372af62e8ba6aa
CVE ID: CVE-2023-53018 State: PUBLISHED Published: 2025-03-27T16:43:45.849Z Last Updated: 2025-10-01T17:19:40.332Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leaks When hci_cmd_sync_queue() failed in hci_le_terminate_big() or hci_le_big_terminate(), the memory pointed by variable d is not freed, which will cause memory leak. Add release process to error path. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://git.kernel.org/stable/c/f51a825b9f730a782aa768454906b4468e67b667 - https://git.kernel.org/stable/c/3aa21311f36d8a2730c7ccef37235e951f23927b
CVE ID: CVE-2023-53019 State: PUBLISHED Published: 2025-03-27T16:43:46.493Z Last Updated: 2025-05-04T07:47:48.426Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: mdio: validate parameter addr in mdiobus_get_phy() The caller may pass any value as addr, what may result in an out-of-bounds access to array mdio_map. One existing case is stmmac_init_phy() that may pass -1 as addr. Therefore validate addr before using it. References: - https://git.kernel.org/stable/c/1d80c259dfbadefa61b7ea334dfce5cb57f8c72f - https://git.kernel.org/stable/c/c431a3d642593bbdb99e8a9e3eed608b730db6f8 - https://git.kernel.org/stable/c/8a7b9560a3a8eb
ttps://git.kernel.org/stable/c/c431a3d642593bbdb99e8a9e3eed608b730db6f8 - https://git.kernel.org/stable/c/8a7b9560a3a8eb8724888c426e05926752f73aa0 - https://git.kernel.org/stable/c/4bc5f1f6bc94e695dfd912122af96e7115a0ddb8 - https://git.kernel.org/stable/c/ad67de330d83e8078372b52af18ffe8d39e26c85 - https://git.kernel.org/stable/c/7879626296e6ffd838ae0f2af1ab49ee46354973 - https://git.kernel.org/stable/c/867dbe784c5010a466f00a7d1467c1c5ea569c75