deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-53693
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

USB: gadget: Fix the memory leak in raw_gadget driver

Currently, increasing raw_dev->count happens before invoke the
raw_queue_event(), if the raw_queue_event() return error, invoke
raw_release() will not trigger the dev_free() to be called.

[  268.905865][ T5067] raw-gadget.0 gadget.0: failed to queue event
[  268.912053][ T5067] udc dummy_udc.0: failed to start USB Raw Gadget: -12
[  268.918885][ T5067] raw-gadget.0: probe of gadget.0 failed with error -12
[  268.925956][ T5067] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  268.934657][ T5067] misc raw-gadget: fail, usb_gadget_register_driver returned -16

BUG: memory leak

[<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076
[<ffffffff8347eb55>] kmalloc include/linux/slab.h:582 [inline]
[<ffffffff8347eb55>] kzalloc include/linux/slab.h:703 [inline]
[<ffffffff8347eb55>] dev_new drivers/usb/gadget/legacy/raw_gadget.c:191 [inline]
[<ffffffff8347eb55>] raw_open+0x45/0x110 drivers/usb/gadget/legacy/raw_gadget.c:385
[<ffffffff827d1d09>] misc_open+0x1a9/0x1f0 drivers/char/misc.c:165

[<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076
[<ffffffff8347cd2f>] kmalloc include/linux/slab.h:582 [inline]
[<ffffffff8347cd2f>] raw_ioctl_init+0xdf/0x410 drivers/usb/gadget/legacy/raw_gadget.c:460
[<ffffffff8347dfe9>] raw_ioctl+0x5f9/0x1120 drivers/usb/gadget/legacy/raw_gadget.c:1250
[<ffffffff81685173>] vfs_ioctl fs/ioctl.c:51 [inline]

[<ffffffff8154bf94>] kmalloc_trace+0x24/0x90 mm/slab_common.c:1076
[<ffffffff833ecc6a>] kmalloc include/linux/slab.h:582 [inline]
[<ffffffff833ecc6a>] kzalloc include/linux/slab.h:703 [inline]
[<ffffffff833ecc6a>] dummy_alloc_request+0x5a/0xe0 drivers/usb/gadget/udc/dummy_hcd.c:665
[<ffffffff833e9132>] usb_ep_alloc_request+0x22/0xd0 drivers/usb/gadget/udc/core.c:196
[<ffffffff8347f13d>] gadget_bind+0x6d/0x370 drivers/usb/gadget/legacy/raw_gadget.c:292

This commit therefore invoke kref_get() under the condition that
raw_queue_event() return success.
References: https://git.kernel.org/stable/c/0f7a2b567197798da7bfa2252f4485c0ca6c6266; https://git.kernel.org/stable/c/68e6287ac61dc22513cd39f02b9ac1fef28513e4; https://git.kernel.org/stable/c/83e30f2bf86ef7c38fbd476ed81a88522b620628
CVE: CVE-2023-53694
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

riscv: ftrace: Fixup panic by disabling preemption

In RISCV, we must use an AUIPC + JALR pair to encode an immediate,
forming a jump that jumps to an address over 4K. This may cause errors
if we want to enable kernel preemption and remove dependency from
patching code with stop_machine(). For example, if a task was switched
out on auipc. And, if we changed the ftrace function before it was
switched back, then it would jump to an address that has updated 11:0
bits mixing with previous XLEN:12 part.

p: patched area performed by dynamic ftrace
ftrace_prologue:
p|      REG_S   ra, -SZREG(sp)
p|      auipc   ra, 0x? ------------> preempted
					...
				change ftrace function
					...
p|      jalr    -?(ra) <------------- switched back
p|      REG_L   ra, -SZREG(sp)
func:
	xxx
	ret
References: https://git.kernel.org/stable/c/20a7510e[PII_REDACTED]91b4962de31de758194cc9; https://git.kernel.org/stable/c/84cfcf240f4a577733b1d98fcd2611a611612b03; https://git.kernel.org/stable/c/[PII_REDACTED]e6631328cd64f583667501ae385531
CVE: CVE-2023-53695
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

udf: Detect system inodes linked into directory hierarchy

When UDF filesystem is corrupted, hidden system inodes can be linked
into directory hierarchy which is an avenue for further serious
corruption of the filesystem and kernel confusion as noticed by syzbot
fuzzed images. Refuse to access system inodes linked into directory
hierarchy and vice versa.
References: https://git.kernel.org/stable/c/1dc71eeb198a8daa17d0c995998a53b0b749a158; https://git.kernel.org/stable/c/1f328751b65c49c13a312d67a3bf27766b85baf7; https://git.kernel.org/stable/c/37e74003d81e79457535cbbdfa1603431c03fac0
CVE: CVE-2023-53696
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()

There is a memory leak reported by kmemleak:

  unreferenced object 0xffffc900003f0000 (size 12288):
    comm "modprobe", pid 19117, jiffies[PII_REDACTED] (age 42490.264s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    backtrace:
      [<[PII_REDACTED]9261a8>] __vmalloc_node_range+0xe56/0x1110
      [<[PII_REDACTED]>] __vmalloc_node+0xbd/0x150
      [<000000005bb4dc34>] vmalloc+0x25/0x30
      [<00000000a2dc1194>] qla2x00_create_host+0x7a0/0xe30 [qla2xxx]
      [<[PII_REDACTED]b14b47>] qla2x00_probe_one+0x2eb8/0xd160 [qla2xxx]
      [<[PII_REDACTED]1ccc04>] local_pci_probe+0xeb/0x1a0

The root cause is traced to an error-handling path in qla2x00_probe_one()
when the adapter "base_vha" initialize failed. The fab_scan_rp "scan.l" is
used to record the port information and it is allocated in
qla2x00_create_host(). However, it is not released in the error handling
path "probe_failed".

Fix this by freeing the memory of "scan.l" when an error occurs in the
adapter initialization process.
References: https://git.kernel.org/stable/c/44374911ac63f769c442f56fdfadea673c5f4425; https://git.kernel.org/stable/c/582e35e97318ccd9c81774bac[PII_REDACTED]9525f; https://git.kernel.org/stable/c/85ade4010e13ef152ea925c74d94253db92e5428
CVE: CVE-2023-53697
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu()

Memory pointed by 'nd_pmu->pmu.attr_groups' is allocated in function
'register_nvdimm_pmu' and is lost after 'kfree(nd_pmu)' call in function
'unregister_nvdimm_pmu'.
References: https://git.kernel.org/stable/c/16259c80542ee8945aaa39cfc6a1809bcdc08ffe; https://git.kernel.org/stable/c/4999f2ec5fde7c45e3ecafda5b78560cc1c7bdb5; https://git.kernel.org/stable/c/500a6ff9c2a81348fe0f04e2deb758145e8ab94e
CVE: CVE-2023-53698
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

xsk: fix refcount underflow in error path

Fix a refcount underflow problem reported by syzbot that can happen
when a system is running out of memory. If xp_alloc_tx_descs() fails,
and it can only fail due to not having enough memory, then the error
path is triggered. In this error path, the refcount of the pool is
decremented as it has incremented before. However, the reference to
the pool in the socket was not nulled. This means that when the socket
is closed later, the socket teardown logic will think that there is a
pool attached to the socket and try to decrease the refcount again,
leading to a refcount underflow.

I chose this fix as it involved adding just a single line. Another
option would have been to move xp_get_pool() and the assignment of
xs->pool to after the if-statement and using xs_umem->pool instead of
xs->pool in the whole if-statement resulting in somewhat simpler code,
but this would have led to much more churn in the code base perhaps
making it harder to backport.
References: https://git.kernel.org/stable/c/15b453cf[PII_REDACTED]558235b9ece2ee5fea6777; https://git.kernel.org/stable/c/3e7722c31d4167eb7f3ffd35aba52cab69b79072; https://git.kernel.org/stable/c/789fcd94c9cac133dd4d96e193188661aca9f6c3
CVE: CVE-2023-53700
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

media: max9286: Fix memleak in max9286_v4l2_register()

There is a kmemleak when testing the media/i2c/max9286.c with bpf mock
device:

kmemleak: 5 new suspected memory leaks (see /sys/kernel/debug/kmemleak)

unreferenced object 0xffff88810defc400 (size 256):
  comm "python3", pid 278, jiffies[PII_REDACTED] (age 31.978s)
  hex dump (first 32 bytes):
    28 06 a7 0a 81 88 ff ff 00 fe 22 12 81 88 ff ff  (.........".....
    10 c4 ef 0d 81 88 ff ff 10 c4 ef 0d 81 88 ff ff  ................
  backtrace:
    [<[PII_REDACTED]1de6a7>] __kmalloc_node+0x44/0x1b0
    [<000000002f4912b7>] kvmalloc_node+0x34/0x180
    [<[PII_REDACTED]dc4cae>] v4l2_ctrl_new+0x325/0x10f0 [videodev]
    [<[PII_REDACTED]>] v4l2_ctrl_new_std+0x16f/0x210 [videodev]
    [<00000000f0d9ea2f>] max9286_probe+0x76e/0xbff [max9286]
    [<00000000ea8f6455>] i2c_device_probe+0x28d/0x680
    [<[PII_REDACTED]529af3>] really_probe+0x17c/0x3f0
    [<00000000b08be526>] __driver_probe_device+0xe3/0x170
    [<[PII_REDACTED]82edea>] driver_probe_device+0x49/0x120
    [<000000007bde528a>] __device_attach_driver+0xf7/0x150
    [<000000009f9c6ab4>] bus_for_each_drv+0x114/0x180
    [<00000000c8aaf588>] __device_attach+0x1e5/0x2d0
    [<[PII_REDACTED]cc06b9>] bus_probe_device+0x126/0x140
    [<[PII_REDACTED]09860d>] device_add+0x810/0x1130
    [<[PII_REDACTED]27bf98>] i2c_new_client_device+0x359/0x4f0
    [<[PII_REDACTED]3bdc85>] of_i2c_register_device+0xf1/0x110

max9286_v4l2_register() calls v4l2_ctrl_new_std(), but won't free the
created v412_ctrl when fwnode_graph_get_endpoint_by_id() failed, which
causes the memleak. Call v4l2_ctrl_handler_free() to free the v412_ctrl.
References: https://git.kernel.org/stable/c/505ff3a0c5951684c3a43094ca4c1a74683d5681; https://git.kernel.org/stable/c/5897fe3ebe[PII_REDACTED]e1bee715ebfe5504e052; https://git.kernel.org/stable/c/5e31213fa017c20ccc989033a5f4a626473aa2ca
CVE: CVE-2023-53701
Published: 2025-10-22
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-53702
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/crypto: use vector instructions only if available for ChaCha20

Commit 349d03ffd5f6 ("crypto: s390 - add crypto library interface for
ChaCha20") added a library interface to the s390 specific ChaCha20
implementation. However no check was added to verify if the required
facilities are installed before branching into the assembler code.

If compiled into the kernel, this will lead to the following crash,
if vector instructions are not available:

data exception: 0007 ilc:3 [#1] SMP
Modules linked in:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.3.0-rc7+ #11
Hardware name: IBM 3931 A01 704 (KVM/Linux)
Krnl PSW : 0704e[PII_REDACTED]0[PII_REDACTED]57277a (chacha20_vx+0x32/0x818)
           R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
Krnl GPRS: 0000037f0000000a ffffffffffffff60[PII_REDACTED]84b[PII_REDACTED]019f5c8e6
           [PII_REDACTED] 0000037fffb13c58 0000037fffb13c78[PII_REDACTED]bb1780
           0000037fffb13c58[PII_REDACTED]f5c8e6[PII_REDACTED]84b000 [PII_REDACTED]
          [PII_REDACTED]2d8000 [PII_REDACTED][PII_REDACTED]571ebc 0000037fffb13718
Krnl Code:[PII_REDACTED]57276a: c07000b1f80b        larl    %r7,[PII_REDACTED]bb1780
           [PII_REDACTED]: a708000a            lhi     %r0,10
          #[PII_REDACTED]: e78950000c36        vlm     %v24,%v25,0(%r5),0
          >[PII_REDACTED]57277a: e7a060000806        vl      %v26,0(%r6),0
           [PII_REDACTED]: e7bf70004c36        vlm     %v27,%v31,0(%r7),4
           [PII_REDACTED]: e70b00000456        vlr     %v0,%v27
          [PII_REDACTED]57278c: e[PII_REDACTED]6        vlr     %v1,%v24
           [PII_REDACTED]: e74b00000456        vlr     %v4,%v27
Call Trace:
 [<[PII_REDACTED]57277a>] chacha20_vx+0x32/0x818
Last Breaking-Event-Address:
 [<[PII_REDACTED]571eb6>] chacha20_crypt_s390.constprop.0+0x6e/0xd8
---[ end trace [PII_REDACTED] ]---
Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b

Fix this by adding a missing MACHINE_HAS_VX check.

[agordeev@linux.ibm.com: remove duplicates in commit message]
References: https://git.kernel.org/stable/c/25e8d30507aa2f251152df1af7809e85b5538f4a; https://git.kernel.org/stable/c/8703dd6b238da0ec6c276e53836f8200983d3d9b; https://git.kernel.org/stable/c/debb7797bba0caffdbdadc3e7968bb2c414f50da
CVE: CVE-2023-53703
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: amd_sfh: Fix for shift-out-of-bounds

Shift operation of 'exp' and 'shift' variables exceeds the maximum number
of shift values in the u32 range leading to UBSAN shift-out-of-bounds.

...
[    6.120512] UBSAN: shift-out-of-bounds in drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c:149:50
[    6.120598] shift exponent 104 is too large for 64-bit type 'long unsigned int'
[    6.120659] CPU: 4 PID: 96 Comm: kworker/4:1 Not tainted 6.4.0amd_1-next-20230519-dirty #10
[    6.120665] Hardware name: AMD Birman-PHX/Birman-PHX, BIOS SFH_with_HPD_SEN.FD 04/05/2023
[    6.120667] Workqueue: events amd_sfh_work_buffer [amd_sfh]
[    6.120687] Call Trace:
[    6.120690]  <TASK>
[    6.120694]  dump_stack_lvl+0x48/0x70
[    6.120704]  dump_stack+0x10/0x20
[    6.120707]  ubsan_epilogue+0x9/0x40
[    6.120716]  __ubsan_handle_shift_out_of_bounds+0x10f/0x170
[    6.120720]  ? psi_group_change+0x25f/0x4b0
[    6.120729]  float_to_int.cold+0x18/0xba [amd_sfh]
[    6.120739]  get_input_rep+0x57/0x340 [amd_sfh]
[    6.120748]  ? __schedule+0xba7/0x1b60
[    6.120756]  ? __pfx_get_input_rep+0x10/0x10 [amd_sfh]
[    6.120764]  amd_sfh_work_buffer+0x91/0x180 [amd_sfh]
[    6.120772]  process_one_work+0x229/0x430
[    6.120780]  worker_thread+0x4a/0x3c0
[    6.120784]  ? __pfx_worker_thread+0x10/0x10
[    6.120788]  kthread+0xf7/0x130
[    6.120792]  ? __pfx_kthread+0x10/0x10
[    6.120795]  ret_from_fork+0x29/0x50
[    6.120804]  </TASK>
...

Fix this by adding the condition to validate shift ranges.
References: https://git.kernel.org/stable/c/1e50bc2c177d4b2953d77037ac46ea0702d6aa1f; https://git.kernel.org/stable/c/5a45ed1ae34bb0e68944471f4bafb68e0a572791; https://git.kernel.org/stable/c/[PII_REDACTED]6403438d01f368b09de3ec2234e0f5
CVE: CVE-2023-53704
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe()

Replace of_iomap() and kzalloc() with devm_of_iomap() and devm_kzalloc()
which can automatically release the related memory when the device
or driver is removed or unloaded to avoid potential memory leak.

In this case, iounmap(anatop_base) in line 427,433 are removed
as manual release is not required.

Besides, referring to clk-imx8mq.c, check the return code of
of_clk_add_hw_provider, if it returns negtive, print error info
and unregister hws, which makes the program more robust.
References: https://git.kernel.org/stable/c/5bcf140e9e6cf76f1f1bd1f489a14ca4d49f9a1a; https://git.kernel.org/stable/c/6317d0302655f7e854cd4f31e93b47d35cb058bb; https://git.kernel.org/stable/c/878b02d5f3b56cb090dbe2c70c89273be144087f
CVE: CVE-2023-53705
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix out-of-bounds access in ipv6_find_tlv()

optlen is fetched without checking whether there is more than one byte to parse.
It can lead to out-of-bounds access.

Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
References: https://git.kernel.org/stable/c/011f47c8b8389154f996f5f69da8efc3a3beefef; https://git.kernel.org/stable/c/04bf69e3de435d793a203aacc4b774f8f9f2baeb; https://git.kernel.org/stable/c/59e656d0d4a84ea0ee9a39c6f69160a3effccc94
CVE: CVE-2023-53707
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: Fix integer overflow in amdgpu_cs_pass1

The type of size is unsigned int, if size is 0x40000000, there will
be an integer overflow, size will be zero after size *= sizeof(uint32_t),
will cause uninitialized memory to be referenced later.
References: https://git.kernel.org/stable/c/87c2213e85bd81e4a9a4d0880c256568794ae388; https://git.kernel.org/stable/c/9f55d300541cb5b435984d[PII_REDACTED]81580b00; https://git.kernel.org/stable/c/c3deb091398e9e469d08dd1599b6d76fd6b29df8
CVE: CVE-2023-53708
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects

If a badly constructed firmware includes multiple `ACPI_TYPE_PACKAGE`
objects while evaluating the AMD LPS0 _DSM, there will be a memory
leak.  Explicitly guard against this.
References: https://git.kernel.org/stable/c/1ea7e[PII_REDACTED]9c82718efd2677ea25c6579e3; https://git.kernel.org/stable/c/7b7964cd9db30bc84808a40d13a0633b4313f149; https://git.kernel.org/stable/c/883cf0d4cf288313b71146ddebdf5d647b76c78b
CVE: CVE-2023-53710
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read

Kernel NULL pointer dereference when ACPI SAR table isn't implemented well.
Fix the error code of return to mark the ACPI SAR table as invalid.

[    5.077128] mt7921e 0000:06:00.0: sar cnt = 0
[    5.077381] BUG: kernel NULL pointer dereference, address:
[PII_REDACTED]
[    5.077630] #PF: supervisor read access in kernel mode
[    5.077883] #PF: error_code(0x0000) - not-present page
[    5.078138] PGD 0 P4D 0
[    5.078398] Oops: 0000 [#1] PREEMPT SMP NOPTI
[    5.079202] RIP: 0010:mt7921_init_acpi_sar+0x106/0x220
[mt7921_common]
...
[    5.080786] Call Trace:
[    5.080786]  <TASK>
[    5.080786]  mt7921_register_device+0x37d/0x490 [mt7921_common]
[    5.080786]  mt7921_pci_probe.part.0+0x2ee/0x310 [mt7921e]
[    5.080786]  mt7921_pci_probe+0x52/0x70 [mt7921e]
[    5.080786]  local_pci_probe+0x47/0x90
[    5.080786]  pci_call_probe+0x55/0x190
[    5.080786]  pci_device_probe+0x84/0x120
References: https://git.kernel.org/stable/c/2a9a5f88e0da71c8e4f30aacbda45b1a1af5469d; https://git.kernel.org/stable/c/59c2b0aec7a5aa350aa3edfb4363b19348c2269f; https://git.kernel.org/stable/c/888d89034f9eaeab9b5b75f13dbe35376c7dd471
CVE: CVE-2023-53711
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix a potential data corruption

We must ensure that the subrequests are joined back into the head before
we can retransmit a request. If the head was not on the commit lists,
because the server wrote it synchronously, we still need to add it back
to the retransmission list.
Add a call that mirrors the effect of nfs_cancel_remove_inode() for
O_DIRECT.
References: https://git.kernel.org/stable/c/0ec26716e45d615edfff46012e7dedcc0ac5f7ab; https://git.kernel.org/stable/c/4185605cd0f72ec8bf8b423aacd94cd5ee13bbcf; https://git.kernel.org/stable/c/88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4
CVE: CVE-2023-53712
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

ARM: 9317/1: kexec: Make smp stop calls asynchronous

If a panic is triggered by a hrtimer interrupt all online cpus will be
notified and set offline. But as highlighted by commit 19dbdcb8039c
("smp: Warn on function calls from softirq context") this call should
not be made synchronous with disabled interrupts:

 softdog: Initiating panic
 Kernel panic - not syncing: Software Watchdog Timer expired
 WARNING: CPU: 1 PID: 0 at kernel/smp.c:753 smp_call_function_many_cond
   unwind_backtrace:
     show_stack
     dump_stack_lvl
     __warn
     warn_slowpath_fmt
     smp_call_function_many_cond
     smp_call_function
     crash_smp_send_stop.part.0
     machine_crash_shutdown
     __crash_kexec
     panic
     softdog_fire
     __hrtimer_run_queues
     hrtimer_interrupt

Make the smp call for machine_crash_nonpanic_core() asynchronous.
References: https://git.kernel.org/stable/c/46870eea5496ff277e86187a49ac5a667cfe60c4; https://git.kernel.org/stable/c/5590ba4560eefbd19a4ed07c7e7c8e4c51ffc628; https://git.kernel.org/stable/c/8922ba71c969d2a0c01a94372a71477d879470de
CVE: CVE-2023-53713
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

arm64: sme: Use STR P to clear FFR context field in streaming SVE mode

The FFR is a predicate register which can vary between 16 and 256 bits
in size depending upon the configured vector length. When saving the
SVE state in streaming SVE mode, the FFR register is inaccessible and
so commit 9f[PII_REDACTED] ("arm64/sve: Make access to FFR optional") simply
clears the FFR field of the in-memory context structure. Unfortunately,
it achieves this using an unconditional 8-byte store and so if the SME
vector length is anything other than 64 bytes in size we will either
fail to clear the entire field or, worse, we will corrupt memory
immediately following the structure. This has led to intermittent kfence
splats in CI [1] and can trigger kmalloc Redzone corruption messages
when running the 'fp-stress' kselftest:

 | =============================================================================
 | BUG kmalloc-1k (Not tainted): kmalloc Redzone overwritten
 | -----------------------------------------------------------------------------
 |
 | 0xffff000809bf1e22-0xffff000809bf1e27 @offset=7714. First byte 0x0 instead of 0xcc
 | Allocated in do_sme_acc+0x9c/0x220 age=2613 cpu=1 pid=531
 |  __kmalloc+0x8c/0xcc
 |  do_sme_acc+0x9c/0x220
 |  ...

Replace the 8-byte store with a store of a predicate register which has
been zero-initialised with PFALSE, ensuring that the entire field is
cleared in memory.

[1] https://lore.kernel.org/r/CA+G9fYtU7HsV0R0dp4XEH5xXHSJFw8KyDf5VQrLLfMxWfxQkag@mail.gmail.com
References: https://git.kernel.org/stable/c/1403a899153a12d93fd510e463fd6d0eafba4336; https://git.kernel.org/stable/c/8769a62faacbbb6cac5e35d9047ce445183d4e9f; https://git.kernel.org/stable/c/893b24181b4c4bf1fa2841b1ed192e5413a97cb1
CVE: CVE-2023-53714
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/stm: ltdc: fix late dereference check

In ltdc_crtc_set_crc_source(), struct drm_crtc was dereferenced in a
container_of() before the pointer check. This could cause a kernel panic.

Fix this smatch warning:
drivers/gpu/drm/stm/ltdc.c:1124 ltdc_crtc_set_crc_source() warn: variable dereferenced before check 'crtc' (see line 1119)
References: https://git.kernel.org/stable/c/04fe3b82528232aa85a6c45464906d0727ef4f20; https://git.kernel.org/stable/c/340dba127bbed51e8425cd8e097aacfadd175462; https://git.kernel.org/stable/c/898a9e3f56db9860ab091d4bf41b6caa99aafc3d
CVE: CVE-2023-53715
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: brcmfmac: cfg80211: Pass the PMK in binary instead of hex

Apparently the hex passphrase mechanism does not work on newer
chips/firmware (e.g. BCM4387). It seems there was a simple way of
passing it in binary all along, so use that and avoid the hexification.

OpenBSD has been doing it like this from the beginning, so this should
work on all chips.

Also clear the structure before setting the PMK. This was leaking
uninitialized stack contents to the device.
References: https://git.kernel.org/stable/c/1687845eb8f37360a9ee849a3587ab659b090773; https://git.kernel.org/stable/c/2bc34facb90ceeff6f8c17d2006575a6d07c3825; https://git.kernel.org/stable/c/2fa3a5226b05e0a797c68b9609dcebe0cd236b27
CVE: CVE-2023-53716
Published: 2025-10-22
Description: In the Linux kernel, the following vulnerability has been resolved:

net: fix skb leak in __skb_tstamp_tx()

Commit 50749f2dd685 ("tcp/udp: Fix memleaks of sk and zerocopy skbs with
TX timestamp.") added a call to skb_orphan_frags_rx() to fix leaks with
zerocopy skbs. But it ended up adding a leak of its own. When
skb_orphan_frags_rx() fails, the function just returns, leaking the skb
it just cloned. Free it before returning.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.
References: https://git.kernel.org/stable/c/58766252f6b2c0487cda6976a53d2bb03ae28e2a; https://git.kernel.org/stable/c/[PII_REDACTED]08545ef04682ea29af5f85c0202aee; https://git.kernel.org/stable/c/82501f1ead557cbee1c2467654ec109a80334d22