Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-53306 State: PUBLISHED Published: 2025-09-16T16:11:45.592Z Last Updated: 2025-09-16T16:11:45.592Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fsdax: force clear dirty mark if CoW XFS allows CoW on non-shared extents to combat fragmentation[1]. The old non-shared extent could be mwrited before, its dax entry is marked dirty. This results in a WARNing: [ 28.512349] ------------[ cut here ]------------ [ 28.512622] WARNING: CPU: 2 PID: 5255 at fs/dax.c:390 dax_insert_entry+0x342/0x390 [ 28.513050] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace fscache netfs nft_fib_inet nft_fib_ipv4 nft_fi
050] Modules linked in: rpcsec_gss_krb5 auth_rpcgss nfsv4 nfs lockd grace fscache netfs nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nf_tables [ 28.515462] CPU: 2 PID: 5255 Comm: fsstress Kdump: loaded Not tainted 6.3.0-rc1-00001-g85e1481e19c1-dirty #117 [ 28.515902] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS Arch Linux 1.16.1-1-1 04/01/2014 [ 28.516307] RIP: 0010:dax_insert_entry+0x342/0x390 [ 28.516536] Code: 30 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 48 8b 45 20 48 83 c0 01 e9 e2 fe ff ff 48 8b 45 20 48 83 c0 01 e9 cd fe ff ff <0f> 0b e9 53 ff ff ff 48 8b
cc cc cc cc 48 8b 45 20 48 83 c0 01 e9 e2 fe ff ff 48 8b 45 20 48 83 c0 01 e9 cd fe ff ff <0f> 0b e9 53 ff ff ff 48 8b 7c 24 08 31 f6 e8 1b 61 a1 00 eb 8c 48 [ 28.517417] RSP: 0000:ffffc9000845fb18 EFLAGS: 00010086 [ 28.517721] RAX: 0000000000000053 RBX: 0000000000000155 RCX: 000000000018824b [ 28.518113] RDX: 0000000000000000 RSI: ffffffff827525a6 RDI: 00000000ffffffff [ 28.518515] RBP: ffffea00062092c0 R08: 0000000000000000 R09: ffffc9000845f9c8 [ 28.518905] R10: 0000000000000003 R11: ffffffff82ddb7e8 R12: 0000000000000155 [ 28.519301] R13: 0000000000000000 R14: 000000000018824b R15: ffff88810cfa76b8 [ 28.519703] FS: 00007f14a0c94740(0000) GS:ffff88817bd00000(0000) knlGS:0000000000000000
0018824b R15: ffff88810cfa76b8 [ 28.519703] FS: 00007f14a0c94740(0000) GS:ffff88817bd00000(0000) knlGS:0000000000000000 [ 28.520148] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.520472] CR2: 00007f14a0c8d000 CR3: 000000010321c004 CR4: 0000000000770ee0 [ 28.520863] PKRU: 55555554 [ 28.521043] Call Trace: [ 28.521219] <TASK> [ 28.521368] dax_fault_iter+0x196/0x390 [ 28.521595] dax_iomap_pte_fault+0x19b/0x3d0 [ 28.521852] __xfs_filemap_fault+0x234/0x2b0 [ 28.522116] __do_fault+0x30/0x130 [ 28.522334] do_fault+0x193/0x340 [ 28.522586] __handle_mm_fault+0x2d3/0x690 [ 28.522975] handle_mm_fault+0xe6/0x2c0 [ 28.523259] do_user_addr_fault+0x1bc/0x6f0 [ 28.523521] exc_page_fault+0x60/0x140 [
.522975] handle_mm_fault+0xe6/0x2c0 [ 28.523259] do_user_addr_fault+0x1bc/0x6f0 [ 28.523521] exc_page_fault+0x60/0x140 [ 28.523763] asm_exc_page_fault+0x22/0x30 [ 28.524001] RIP: 0033:0x7f14a0b589ca [ 28.524225] Code: c5 fe 7f 07 c5 fe 7f 47 20 c5 fe 7f 47 40 c5 fe 7f 47 60 c5 f8 77 c3 66 0f 1f 84 00 00 00 00 00 40 0f b6 c6 48 89 d1 48 89 fa <f3> aa 48 89 d0 c5 f8 77 c3 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 [ 28.525198] RSP: 002b:00007fff1dea1c98 EFLAGS: 00010202 [ 28.525505] RAX: 000000000000001e RBX: 000000000014a000 RCX: 0000000000006046 [ 28.525895] RDX: 00007f14a0c82000 RSI: 000000000000001e RDI: 00007f14a0c8d000 [ 28.526290] RBP: 000000000000006f R08: 0000000000000004 R09: 00000000001
00 RSI: 000000000000001e RDI: 00007f14a0c8d000 [ 28.526290] RBP: 000000000000006f R08: 0000000000000004 R09: 000000000014a000 [ 28.526681] R10: 0000000000000008 R11: 0000000000000246 R12: 028f5c28f5c28f5c [ 28.527067] R13: 8f5c28f5c28f5c29 R14: 0000000000011046 R15: 00007f14a0c946c0 [ 28.527449] </TASK> [ 28.527600] ---[ end trace 0000000000000000 ]--- To be able to delete this entry, clear its dirty mark before invalidate_inode_pages2_range(). [1] https://lore.kernel.org/linux-xfs/20230321151339.GA11376@frogsfrogsfrogs/ References: - https://git.kernel.org/stable/c/fac05f800abb63dc4d7cc48fe7edf16e0520dc1f - https://git.kernel.org/stable/c/f76b3a32879de215ced3f8c754c4077b0c2f79e3
CVE ID: CVE-2023-53307 State: PUBLISHED Published: 2025-09-16T16:11:46.288Z Last Updated: 2025-09-16T16:11:46.288Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails If getting an ID or setting up a work queue in rbd_dev_create() fails, use-after-free on rbd_dev->rbd_client, rbd_dev->spec and rbd_dev->opts is triggered in do_rbd_add(). The root cause is that the ownership of these structures is transfered to rbd_dev prematurely and they all end up getting freed when rbd_dev_create() calls rbd_dev_free() prior to returning to do_rbd_add(). Found by Linux Verificat
up getting freed when rbd_dev_create() calls rbd_dev_free() prior to returning to do_rbd_add(). Found by Linux Verification Center (linuxtesting.org) with SVACE, an incomplete patch submitted by Natalia Petrova <n.petrova@fintech.ru>. References: - https://git.kernel.org/stable/c/71da2a151ed1adb0aea4252b16d81b53012e7afd - https://git.kernel.org/stable/c/e3cbb4d60764295992c95344f2d779439e8b34ce - https://git.kernel.org/stable/c/9787b328c42c13c4f31e7d5042c4e877e9344068 - https://git.kernel.org/stable/c/ae16346078b1189aee934afd872d9f3d0a682c33 - https://git.kernel.org/stable/c/a73783e4e0c4d1507794da211eeca75498544dff - https://git.kernel.org/stable/c/faa7b683e436664fff5648426950718277831348 - h
/a73783e4e0c4d1507794da211eeca75498544dff - https://git.kernel.org/stable/c/faa7b683e436664fff5648426950718277831348 - https://git.kernel.org/stable/c/cc8c0dd2984503ed09efa37bcafcef3d3da104e8 - https://git.kernel.org/stable/c/f7c4d9b133c7a04ca619355574e96b6abf209fba
CVE ID: CVE-2023-53308 State: PUBLISHED Published: 2025-09-16T16:11:46.998Z Last Updated: 2025-09-16T16:11:46.998Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: fec: Better handle pm_runtime_get() failing in .remove() In the (unlikely) event that pm_runtime_get() (disguised as pm_runtime_resume_and_get()) fails, the remove callback returned an error early. The problem with this is that the driver core ignores the error value and continues removing the device. This results in a resource leak. Worse the devm allocated resources are freed and so if a callback of the driver is called later the register mapping is already gone
vm allocated resources are freed and so if a callback of the driver is called later the register mapping is already gone which probably results in a crash. References: - https://git.kernel.org/stable/c/d52a0cca591e899d4e5c8ab19e067b4c6b7d104f - https://git.kernel.org/stable/c/be85912c36ddca3e8b2eef1b5392cd8db6bdb730 - https://git.kernel.org/stable/c/b22b514209ff8c4287abb853399890ab97e1b5ca - https://git.kernel.org/stable/c/83996d317b1deddc85006376082e8886f55aa709 - https://git.kernel.org/stable/c/c1bc2870f14e526a01897e14c747a0a0ca125231 - https://git.kernel.org/stable/c/9407454a9b18bbeff216e8ecde87ffb2171e9ccf - https://git.kernel.org/stable/c/e02d8d5b1602689b98d9b91550a11b9b57baedbe - https
7454a9b18bbeff216e8ecde87ffb2171e9ccf - https://git.kernel.org/stable/c/e02d8d5b1602689b98d9b91550a11b9b57baedbe - https://git.kernel.org/stable/c/f816b9829b19394d318e01953aa3b2721bca040d
CVE ID: CVE-2023-53309 State: PUBLISHED Published: 2025-09-16T16:11:47.700Z Last Updated: 2025-09-16T16:11:47.700Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Fix integer overflow in radeon_cs_parser_init The type of size is unsigned, if size is 0x40000000, there will be an integer overflow, size will be zero after size *= sizeof(uint32_t), will cause uninitialized memory to be referenced later References: - https://git.kernel.org/stable/c/d05ba46134d07e889de7d23cf8503574a22ede09 - https://git.kernel.org/stable/c/cfa9148bafb2d3292b65de1bac79dcca65be2643 - https://git.kernel.org/stable/c/b8fab6aebdf2115ec2d7bd2f34
ernel.org/stable/c/cfa9148bafb2d3292b65de1bac79dcca65be2643 - https://git.kernel.org/stable/c/b8fab6aebdf2115ec2d7bd2f3498d5b911ff351e - https://git.kernel.org/stable/c/e6825b30d37fe89ceb87f926d33d4fad321a331e - https://git.kernel.org/stable/c/c0d7dbc6b7a61a56028118c00af2c8319d44a682 - https://git.kernel.org/stable/c/2e1be420b86980c25a75325e90dfc3fc73126f61 - https://git.kernel.org/stable/c/25e634d7f44eb13113139040e5366bebe48c882f - https://git.kernel.org/stable/c/f828b681d0cd566f86351c0b913e6cb6ed8c7b9c
CVE ID: CVE-2023-53310 State: PUBLISHED Published: 2025-09-16T16:11:48.399Z Last Updated: 2025-09-16T16:11:48.399Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: power: supply: axp288_fuel_gauge: Fix external_power_changed race fuel_gauge_external_power_changed() dereferences info->bat, which gets sets in axp288_fuel_gauge_probe() like this: info->bat = devm_power_supply_register(dev, &fuel_gauge_desc, &psy_cfg); As soon as devm_power_supply_register() has called device_add() the external_power_changed callback can get called. So there is a window where fuel_gauge_external_power_changed() may get called while info->bat has not
k can get called. So there is a window where fuel_gauge_external_power_changed() may get called while info->bat has not been set yet leading to a NULL pointer dereference. Fixing this is easy. The external_power_changed callback gets passed the power_supply which will eventually get stored in info->bat, so fuel_gauge_external_power_changed() can simply directly use the passed in psy argument which is always valid. References: - https://git.kernel.org/stable/c/0456b912121e45b3ef54abe3135e5dcb541f956c - https://git.kernel.org/stable/c/a636c6ba9ce898207f283271cb28511206ab739b - https://git.kernel.org/stable/c/f8319774d6f1567d6e7d03653174ab0c82c5c66d
CVE ID: CVE-2023-53311 State: PUBLISHED Published: 2025-09-16T16:11:49.099Z Last Updated: 2025-09-16T16:11:49.099Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput During unmount process of nilfs2, nothing holds nilfs_root structure after nilfs2 detaches its writer in nilfs_detach_log_writer(). Previously, nilfs_evict_inode() could cause use-after-free read for nilfs_root if inodes are left in "garbage_list" and released by nilfs_dispose_list at the end of nilfs_detach_log_writer(), and this bug was fixed by commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug o
t the end of nilfs_detach_log_writer(), and this bug was fixed by commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()"). However, it turned out that there is another possibility of UAF in the call path where mark_inode_dirty_sync() is called from iput(): nilfs_detach_log_writer() nilfs_dispose_list() iput() mark_inode_dirty_sync() __mark_inode_dirty() nilfs_dirty_inode() __nilfs_mark_inode_dirty() nilfs_load_inode_block() --> causes UAF of nilfs_root struct This can happen after commit 0ae45f63d4ef ("vfs: add support for a lazytime mount option"), which changed iput() to call mark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME flag
t option"), which changed iput() to call mark_inode_dirty_sync() on its final reference if i_state has I_DIRTY_TIME flag and i_nlink is non-zero. This issue appears after commit 28a65b49eb53 ("nilfs2: do not write dirty data after degenerating to read-only") when using the syzbot reproducer, but the issue has potentially existed before. Fix this issue by adding a "purging flag" to the nilfs structure, setting that flag while disposing the "garbage_list" and checking it in __nilfs_mark_inode_dirty(). Unlike commit 9b5a04ac3ad9 ("nilfs2: fix use-after-free bug of nilfs_root in nilfs_evict_inode()"), this patch does not rely on ns_writer to determine whether to skip operations, so as not to bre
n nilfs_evict_inode()"), this patch does not rely on ns_writer to determine whether to skip operations, so as not to break recovery on mount. The nilfs_salvage_orphan_logs routine dirties the buffer of salvaged data before attaching the log writer, so changing __nilfs_mark_inode_dirty() to skip the operation when ns_writer is NULL will cause recovery write to fail. The purpose of using the cleanup-only flag is to allow for narrowing of such conditions. References: - https://git.kernel.org/stable/c/11afd67f1b3c28eb216e50a3ca8dbcb69bb71793 - https://git.kernel.org/stable/c/a3c3b4cbf9b8554120fb230e6516e980c6277487 - https://git.kernel.org/stable/c/d2c539c216cce74837a9cf5804eb205939b82227 - http
c3b4cbf9b8554120fb230e6516e980c6277487 - https://git.kernel.org/stable/c/d2c539c216cce74837a9cf5804eb205939b82227 - https://git.kernel.org/stable/c/37207240872456fbab44a110bde6640445233963 - https://git.kernel.org/stable/c/3645510cf926e6af2f4d44899370d7e5331c93bd - https://git.kernel.org/stable/c/7532ff6edbf5242376b24a95a2fefb59bb653e5a - https://git.kernel.org/stable/c/5828d5f5dc877dcfdd7b23102e978e2ecfd86d82 - https://git.kernel.org/stable/c/f8654743a0e6909dc634cbfad6db6816f10f3399
CVE ID: CVE-2023-53312 State: PUBLISHED Published: 2025-09-16T16:11:49.832Z Last Updated: 2025-09-16T16:11:49.832Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: net: fix net_dev_start_xmit trace event vs skb_transport_offset() After blamed commit, we must be more careful about using skb_transport_offset(), as reminded us by syzbot: WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 skb_transport_offset include/linux/skbuff.h:2977 [inline] WARNING: CPU: 0 PID: 10 at include/linux/skbuff.h:2868 perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 Modules linked in: CPU: 0 PID: 10 Comm: kworker/u4:1 Not tai
et_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 Modules linked in: CPU: 0 PID: 10 Comm: kworker/u4:1 Not tainted 6.1.30-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet RIP: 0010:skb_transport_header include/linux/skbuff.h:2868 [inline] RIP: 0010:skb_transport_offset include/linux/skbuff.h:2977 [inline] RIP: 0010:perf_trace_net_dev_start_xmit+0x89a/0xce0 include/trace/events/net.h:14 Code: 8b 04 25 28 00 00 00 48 3b 84 24 c0 00 00 00 0f 85 4e 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc e8 56 22 01 fd <0f> 0b e9 f6 fc ff ff 89 f9 80 e1 07 80 c1 03 38 c
00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc e8 56 22 01 fd <0f> 0b e9 f6 fc ff ff 89 f9 80 e1 07 80 c1 03 38 c1 0f 8c 86 f9 ff RSP: 0018:ffffc900002bf700 EFLAGS: 00010293 RAX: ffffffff8485d8ca RBX: 000000000000ffff RCX: ffff888100914280 RDX: 0000000000000000 RSI: 000000000000ffff RDI: 000000000000ffff RBP: ffffc900002bf818 R08: ffffffff8485d5b6 R09: fffffbfff0f8fb5e R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffff110217d8f67 R13: ffff88810bec7b3a R14: dffffc0000000000 R15: dffffc0000000000 FS: 0000000000000000(0000) GS:ffff8881f6a00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f96cf6d52f0 CR3: 000000012224c000 CR4: 0000000000350ef
000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f96cf6d52f0 CR3: 000000012224c000 CR4: 0000000000350ef0 Call Trace: <TASK> [<ffffffff84715e35>] trace_net_dev_start_xmit include/trace/events/net.h:14 [inline] [<ffffffff84715e35>] xmit_one net/core/dev.c:3643 [inline] [<ffffffff84715e35>] dev_hard_start_xmit+0x705/0x980 net/core/dev.c:3660 [<ffffffff8471a232>] __dev_queue_xmit+0x16b2/0x3370 net/core/dev.c:4324 [<ffffffff85416493>] dev_queue_xmit include/linux/netdevice.h:3030 [inline] [<ffffffff85416493>] batadv_send_skb_packet+0x3f3/0x680 net/batman-adv/send.c:108 [<ffffffff85416744>] batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 [<ffffffff853bc52a>] batadv_i
d.c:108 [<ffffffff85416744>] batadv_send_broadcast_skb+0x24/0x30 net/batman-adv/send.c:127 [<ffffffff853bc52a>] batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:393 [inline] [<ffffffff853bc52a>] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:421 [inline] [<ffffffff853bc52a>] batadv_iv_send_outstanding_bat_ogm_packet+0x69a/0x840 net/batman-adv/bat_iv_ogm.c:1701 [<ffffffff8151023c>] process_one_work+0x8ac/0x1170 kernel/workqueue.c:2289 [<ffffffff81511938>] worker_thread+0xaa8/0x12d0 kernel/workqueue.c:2436 References: - https://git.kernel.org/stable/c/ced61418f46993d571385812bafed3a7d4ab6918 - https://git.kernel.org/stable/c/58f9e88eb247263c74383b4ee8858abac15cdbe0 - https://git.kernel.org
5812bafed3a7d4ab6918 - https://git.kernel.org/stable/c/58f9e88eb247263c74383b4ee8858abac15cdbe0 - https://git.kernel.org/stable/c/f88fcb1d7d961b4b402d675109726f94db87571c
CVE ID: CVE-2023-53313 State: PUBLISHED Published: 2025-09-16T16:11:50.642Z Last Updated: 2025-09-16T16:11:50.642Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: md/raid10: fix wrong setting of max_corr_read_errors There is no input check when echo md/max_read_errors and overflow might occur. Add check of input number. References: - https://git.kernel.org/stable/c/74050a3fdd4aecfd2cbf74d3c145812ab2744375 - https://git.kernel.org/stable/c/025fde32fb957a5c271711bc66841f817ff5f299 - https://git.kernel.org/stable/c/31c805a44b7569ca1017a4714385182d98bba212 - https://git.kernel.org/stable/c/b1d8f38310bce3282374983b229d94edbaf1e570 -
c/31c805a44b7569ca1017a4714385182d98bba212 - https://git.kernel.org/stable/c/b1d8f38310bce3282374983b229d94edbaf1e570 - https://git.kernel.org/stable/c/3c76920e547d4b931bed758bad83fd658dd88b4e - https://git.kernel.org/stable/c/05d10428e8dffed0bac2502f34151729fc189cd3 - https://git.kernel.org/stable/c/aef6e98eb772594edd4399625e4e1bbe45971fa1 - https://git.kernel.org/stable/c/e83cb411aa1c6c9617db9329897f4506ba9e9b9d - https://git.kernel.org/stable/c/f8b20a405428803bd9881881d8242c9d72c6b2b2
CVE ID: CVE-2023-53314 State: PUBLISHED Published: 2025-09-16T16:11:51.435Z Last Updated: 2025-09-16T16:11:51.435Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: fbdev/ep93xx-fb: Do not assign to struct fb_info.dev Do not assing the Linux device to struct fb_info.dev. The call to register_framebuffer() initializes the field to the fbdev device. Drivers should not override its value. Fixes a bug where the driver incorrectly decreases the hardware device's reference counter and leaks the fbdev device. v2: * add Fixes tag (Dan) References: - https://git.kernel.org/stable/c/ffdf2b020db717853167391a3a8d912e13428fa6 - https://git.ker
Fixes tag (Dan) References: - https://git.kernel.org/stable/c/ffdf2b020db717853167391a3a8d912e13428fa6 - https://git.kernel.org/stable/c/1c6ff2a7c593db851f23e31ace2baf557ea9d0ff - https://git.kernel.org/stable/c/8ffa40ff64aa43a9a28fcf209b48d86a3e0f4972 - https://git.kernel.org/stable/c/4aade6c9100a3537788b6a9c7ac481037d19efdf - https://git.kernel.org/stable/c/309c27162afea79b3c7f8747bb650faf6923b639 - https://git.kernel.org/stable/c/f83c1b13f8154e0284448912756d0a351a1a602a - https://git.kernel.org/stable/c/0517fc5a71333b315164736bbd32608894fbb872 - https://git.kernel.org/stable/c/f90a0e5265b60cdd3c77990e8105f79aa2fac994
CVE ID: CVE-2023-53315 State: PUBLISHED Published: 2025-09-16T16:11:52.242Z Last Updated: 2025-09-19T15:21:32.519Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: Fix SKB corruption in REO destination ring While running traffics for a long time, randomly an RX descriptor filled with value "0" from REO destination ring is received. This descriptor which is invalid causes the wrong SKB (SKB stored in the IDR lookup with buffer id "0") to be fetched which in turn causes SKB memory corruption issue and the same leads to crash after some time. Changed the start id for idr allocation to "1" and the buffer id "0" is reser
d the same leads to crash after some time. Changed the start id for idr allocation to "1" and the buffer id "0" is reserved for error validation. Introduced Sanity check to validate the descriptor, before processing the SKB. Crash Signature : Unable to handle kernel paging request at virtual address 3f004900 PC points to "b15_dma_inv_range+0x30/0x50" LR points to "dma_cache_maint_page+0x8c/0x128". The Backtrace obtained is as follows: [<8031716c>] (b15_dma_inv_range) from [<80313a4c>] (dma_cache_maint_page+0x8c/0x128) [<80313a4c>] (dma_cache_maint_page) from [<80313b90>] (__dma_page_dev_to_cpu+0x28/0xcc) [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4
_dma_page_dev_to_cpu+0x28/0xcc) [<80313b90>] (__dma_page_dev_to_cpu) from [<7fb5dd68>] (ath11k_dp_process_rx+0x1e8/0x4a4 [ath11k]) [<7fb5dd68>] (ath11k_dp_process_rx [ath11k]) from [<7fb53c20>] (ath11k_dp_service_srng+0xb0/0x2ac [ath11k]) [<7fb53c20>] (ath11k_dp_service_srng [ath11k]) from [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll+0x1c/0x78 [ath11k_pci]) [<7f67bba4>] (ath11k_pci_ext_grp_napi_poll [ath11k_pci]) from [<807d5cf4>] (__napi_poll+0x28/0xb8) [<807d5cf4>] (__napi_poll) from [<807d5f28>] (net_rx_action+0xf0/0x280) [<807d5f28>] (net_rx_action) from [<80302148>] (__do_softirq+0xd0/0x280) [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4) [<80320408>] (irq_exit) from [<
o_softirq+0xd0/0x280) [<80302148>] (__do_softirq) from [<80320408>] (irq_exit+0x74/0xd4) [<80320408>] (irq_exit) from [<803638a4>] (__handle_domain_irq+0x90/0xb4) [<803638a4>] (__handle_domain_irq) from [<805bedec>] (gic_handle_irq+0x58/0x90) [<805bedec>] (gic_handle_irq) from [<80301a78>] (__irq_svc+0x58/0x8c) Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1 References: - https://git.kernel.org/stable/c/866921dc06b94df91acfcf9359b57da943ed99b3 - https://git.kernel.org/stable/c/3d3f8fe01a01d94a17fe1ae0d2e894049a972717 - https://git.kernel.org/stable/c/068fd06148fbf0af95bb08dc77cff34ee679fdbc - https://git.kernel.org/stable/c/67459491f78146bcf7d93596e5b709d063dff5d8 - h
/068fd06148fbf0af95bb08dc77cff34ee679fdbc - https://git.kernel.org/stable/c/67459491f78146bcf7d93596e5b709d063dff5d8 - https://git.kernel.org/stable/c/f9fff67d2d7ca6fa8066132003a3deef654c55b1
CVE ID: CVE-2023-53316 State: PUBLISHED Published: 2025-09-16T16:11:53.059Z Last Updated: 2025-09-16T16:11:53.059Z Vendors: Linux Products: Linux Description: In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: Free resources after unregistering them The DP component's unbind operation walks through the submodules to unregister and clean things up. But if the unbind happens because the DP controller itself is being removed, all the memory for those submodules has just been freed. Change the order of these operations to avoid the many use-after-free that otherwise happens in this code path. Patchwork: https://patchwork.freedesktop.org/patch/542166/ References: - ht
ee that otherwise happens in this code path. Patchwork: https://patchwork.freedesktop.org/patch/542166/ References: - https://git.kernel.org/stable/c/c67a55f7cc8d767d624235bf1bcd0947e56abe0f - https://git.kernel.org/stable/c/3c3f3d35f5e05c468b048eb42a4f8c62c6655692 - https://git.kernel.org/stable/c/4e9f1a2367aea7d61f6781213e25313cd983b0d7 - https://git.kernel.org/stable/c/5c3278db06e332fdc14f3f297499fb88ded264d2 - https://git.kernel.org/stable/c/ca47d0dc00968358c136a1847cfed550cedfd1b5 - https://git.kernel.org/stable/c/fa0048a4b1fa7a50c8b0e514f5b428abdf69a6f8