deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50491
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

coresight: cti: Fix hang in cti_disable_hw()

cti_enable_hw() and cti_disable_hw() are called from an atomic context
so shouldn't use runtime PM because it can result in a sleep when
communicating with firmware.

Since commit 3c[PII_REDACTED] ("Revert "firmware: arm_scmi: Add clock
management to the SCMI power domain""), this causes a hang on Juno when
running the Perf Coresight tests or running this command:

  perf record -e cs_etm//u -- ls

This was also missed until the revert commit because pm_runtime_put()
was called with the wrong device until commit 692c9a499b28 ("coresight:
cti: Correct the parameter for pm_runtime_put")

With lock and scheduler debugging enabled the following is output:

   coresight cti_sys0: cti_enable_hw -- dev:cti_sys0  parent: 20020000.cti
   BUG: sleeping function called from invalid context at drivers/base/power/runtime.c:1151
   in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 330, name: perf-exec
   preempt_count: 2, expected: 0
   RCU nest depth: 0, expected: 0
   INFO: lockdep is turned off.
   irq event stamp: 0
   hardirqs last  enabled at (0): [<[PII_REDACTED]>] 0x0
   hardirqs last disabled at (0): [<ffff80000822b394>] copy_process+0xa0c/0x1948
   softirqs last  enabled at (0): [<ffff80000822b394>] copy_process+0xa0c/0x1948
   softirqs last disabled at (0): [<[PII_REDACTED]>] 0x0
   CPU: 3 PID: 330 Comm: perf-exec Not tainted 6.0.0-00053-g042116d99298 #7
   Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform, BIOS EDK II Sep 13 2022
   Call trace:
    dump_backtrace+0x134/0x140
    show_stack+0x20/0x58
    dump_stack_lvl+0x8c/0xb8
    dump_stack+0x18/0x34
    __might_resched+0x180/0x228
    __might_sleep+0x50/0x88
    __pm_runtime_resume+0xac/0xb0
    cti_enable+0x44/0x120
    coresight_control_assoc_ectdev+0xc0/0x150
    coresight_enable_path+0xb4/0x288
    etm_event_start+0x138/0x170
    etm_event_add+0x48/0x70
    event_sched_in.isra.122+0xb4/0x280
    merge_sched_in+0x1fc/0x3d0
    visit_groups_merge.constprop.137+0x16c/0x4b0
    ctx_sched_in+0x114/0x1f0
    perf_event_sched_in+0x60/0x90
    ctx_resched+0x68/0xb0
    perf_event_exec+0x138/0x508
    begin_new_exec+0x52c/0xd40
    load_elf_binary+0x6b8/0x17d0
    bprm_execve+0x360/0x7f8
    do_execveat_common.isra.47+0x218/0x238
    __arm64_sys_execve+0x48/0x60
    invoke_syscall+0x4c/0x110
    el0_svc_common.constprop.4+0xfc/0x120
    do_el0_svc+0x34/0xc0
    el0_svc+0x40/0x98
    el0t_64_sync_handler+0x98/0xc0
    el0t_64_sync+0x170/0x174

Fix the issue by removing the runtime PM calls completely. They are not
needed here because it must have already been done when building the
path for a trace.

[ Fix build warnings ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4c365a0c21aaf2b8fcc88de8dc298803288f61ac; https://git.kernel.org/stable/c/6746eae4bbaddcc16b40efb33dab79210828b3ce; https://git.kernel.org/stable/c/c51cfba50df8b9e16bfe0e6d4f2f252a4a10063d
CVE: CVE-2022-50492
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/msm: fix use-after-free on probe deferral

The bridge counter was never reset when tearing down the DRM device so
that stale pointers to deallocated structures would be accessed on the
next tear down (e.g. after a second late bind deferral).

Given enough bridges and a few probe deferrals this could currently also
lead to data beyond the bridge array being corrupted.

Patchwork: https://patchwork.freedesktop.org/patch/502665/
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/0a30a47741b6df1f9555a0fac6aebb7e8c363bad; https://git.kernel.org/stable/c/6808abdb33bf90330e70a687d29f038507e06ebb
CVE: CVE-2022-50493
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix crash when I/O abort times out

While performing CPU hotplug, a crash with the following stack was seen:

Call Trace:
     qla24xx_process_response_queue+0x42a/0x970 [qla2xxx]
     qla2x00_start_nvme_mq+0x3a2/0x4b0 [qla2xxx]
     qla_nvme_post_cmd+0x166/0x240 [qla2xxx]
     nvme_fc_start_fcp_op.part.0+0x119/0x2e0 [nvme_fc]
     blk_mq_dispatch_rq_list+0x17b/0x610
     __blk_mq_sched_dispatch_requests+0xb0/0x140
     blk_mq_sched_dispatch_requests+0x30/0x60
     __blk_mq_run_hw_queue+0x35/0x90
     __blk_mq_delay_run_hw_queue+0x161/0x180
     blk_execute_rq+0xbe/0x160
     __nvme_submit_sync_cmd+0x16f/0x220 [nvme_core]
     nvmf_connect_admin_queue+0x11a/0x170 [nvme_fabrics]
     nvme_fc_create_association.cold+0x50/0x3dc [nvme_fc]
     nvme_fc_connect_ctrl_work+0x19/0x30 [nvme_fc]
     process_one_work+0x1e8/0x3c0

On abort timeout, completion was called without checking if the I/O was
already completed.

Verify that I/O and abort request are indeed outstanding before attempting
completion.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/05382ed9142cf8a8a3fb662224477eecc415778b; https://git.kernel.org/stable/c/68ad83188d782b2ecef2e41ac245d27e0710fe8e; https://git.kernel.org/stable/c/cb4dff498468b62e8c520568559b3a9007e104d7
CVE: CVE-2022-50494
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash

When CPU 0 is offline and intel_powerclamp is used to inject
idle, it generates kernel BUG:

BUG: using smp_processor_id() in preemptible [00000000] code: bash/15687
caller is debug_smp_processor_id+0x17/0x20
CPU: 4 PID: 15687 Comm: bash Not tainted 5.19.0-rc7+ #57
Call Trace:
<TASK>
dump_stack_lvl+0x49/0x63
dump_stack+0x10/0x16
check_preemption_disabled+0xdd/0xe0
debug_smp_processor_id+0x17/0x20
powerclamp_set_cur_state+0x7f/0xf9 [intel_powerclamp]
...
...

Here CPU 0 is the control CPU by default and changed to the current CPU,
if CPU 0 offlined. This check has to be performed under cpus_read_lock(),
hence the above warning.

Use get_cpu() instead of smp_processor_id() to avoid this BUG.

[ rjw: Subject edits ]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0f91f66c568b316b19cb042cf50584467b3bdff4; https://git.kernel.org/stable/c/3e799e815097febbcb81b472285be824f5d089f9; https://git.kernel.org/stable/c/418fae0700e85a498062424f8656435c32cdb200
CVE: CVE-2022-50495
Published: 2025-10-04
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50496
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

dm cache: Fix UAF in destroy()

Dm_cache also has the same UAF problem when dm_resume()
and dm_destroy() are concurrent.

Therefore, cancelling timer again in destroy().
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/034cbc8d3b47a56acd89453c29632a9c117de09d; https://git.kernel.org/stable/c/2b17026685a270b2beaf1cdd9857fcedd3505c7e; https://git.kernel.org/stable/c/2f097dfac7579fd84ff98eb1d3acd41d53a485f3
CVE: CVE-2022-50497
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

binfmt_misc: fix shift-out-of-bounds in check_special_flags

UBSAN reported a shift-out-of-bounds warning:

 left shift of 1 by 31 places cannot be represented in type 'int'
 Call Trace:
  <TASK>
  __dump_stack lib/dump_stack.c:88 [inline]
  dump_stack_lvl+0x8d/0xcf lib/dump_stack.c:106
  ubsan_epilogue+0xa/0x44 lib/ubsan.c:151
  __ubsan_handle_shift_out_of_bounds+0x1e7/0x208 lib/ubsan.c:322
  check_special_flags fs/binfmt_misc.c:241 [inline]
  create_entry fs/binfmt_misc.c:456 [inline]
  bm_register_write+0x9d3/0xa20 fs/binfmt_misc.c:654
  vfs_write+0x11e/0x580 fs/read_write.c:582
  ksys_write+0xcf/0x120 fs/read_write.c:637
  do_syscall_x64 arch/x86/entry/common.c:50 [inline]
  do_syscall_64+0x34/0x80 arch/x86/entry/common.c:80
  entry_SYSCALL_64_after_hwframe+0x63/0xcd
 RIP: 0033:0x4194e1

Since the type of Node's flags is unsigned long, we should define these
macros with same type too.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/0f1a48994b3e516d5c7fd5d12204fdba7a604771; https://git.kernel.org/stable/c/419b808504c26b3e3342365f34ccd0843e09a7f8; https://git.kernel.org/stable/c/6a46bf558803dd2b959ca7435a5c143efe837217
CVE: CVE-2022-50498
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

eth: alx: take rtnl_lock on resume

Zbynek reports that alx trips an rtnl assertion on resume:

 RTNL: assertion failed at net/core/dev.c (2891)
 RIP: 0010:netif_set_real_num_tx_queues+0x1ac/0x1c0
 Call Trace:
  <TASK>
  __alx_open+0x230/0x570 [alx]
  alx_resume+0x54/0x80 [alx]
  ? pci_legacy_resume+0x80/0x80
  dpm_run_callback+0x4a/0x150
  device_resume+0x8b/0x190
  async_resume+0x19/0x30
  async_run_entry_fn+0x30/0x130
  process_one_work+0x1e5/0x3b0

indeed the driver does not hold rtnl_lock during its internal close
and re-open functions during suspend/resume. Note that this is not
a huge bug as the driver implements its own locking, and does not
implement changing the number of queues, but we need to silence
the splat.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/6ad1c94e1e7e374d88f0cfd77936dddb8339aaba; https://git.kernel.org/stable/c/6f1991a940b90753b34570f093a21dba366e8cc0; https://git.kernel.org/stable/c/a845a0c4bdece2c0073ecea2fca7c4d5f0550f78
CVE: CVE-2022-50499
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

media: dvb-core: Fix double free in dvb_register_device()

In function dvb_register_device() -> dvb_register_media_device() ->
dvb_create_media_entity(), dvb->entity is allocated and initialized. If
the initialization fails, it frees the dvb->entity, and return an error
code. The caller takes the error code and handles the error by calling
dvb_media_device_free(), which unregisters the entity and frees the
field again if it is not NULL. As dvb->entity may not NULLed in
dvb_create_media_entity() when the allocation of dvbdev->pad fails, a
double free may occur. This may also cause an Use After free in
media_device_unregister_entity().

Fix this by storing NULL to dvb->entity when it is freed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://git.kernel.org/stable/c/0588b12c418c3e4f927ced11f27b02ef4a5bfb07; https://git.kernel.org/stable/c/123eddf92a114e[PII_REDACTED]1d2c2b1f4ca56ea6; https://git.kernel.org/stable/c/6b0d0477fce747d4137aa65856318b55fba72198
CVE: CVE-2022-50500
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed

If some items in nsim_dev_resources_register() fail, memory leak will
occur. The following is the memory leak information.

unreferenced object 0xffff888074c02600 (size 128):
  comm "echo", pid 8159, jiffies[PII_REDACTED] (age 493.530s)
  hex dump (first 32 bytes):
    40 47 ea 89 ff ff ff ff 01 00 00 00 00 00 00 00  @G..............
    ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff  ................
  backtrace:
    [<[PII_REDACTED]a31c98>] kmalloc_trace+0x22/0x60
    [<[PII_REDACTED]384c69>] devl_resource_register+0x144/0x4e0
    [<00000000a16db248>] nsim_drv_probe+0x37a/0x1260
    [<000000007d1f448c>] really_probe+0x20b/0xb10
    [<00000000c416848a>] __driver_probe_device+0x1b3/0x4a0
    [<[PII_REDACTED]7e0351>] driver_probe_device+0x49/0x140
    [<[PII_REDACTED]f2465a>] __device_attach_driver+0x18c/0x2a0
    [<[PII_REDACTED]38f359>] bus_for_each_drv+0x151/0x1d0
    [<[PII_REDACTED]e09747>] __device_attach+0x1c9/0x4e0
    [<00000000dd86e533>] bus_probe_device+0x1d5/0x280
    [<[PII_REDACTED]9bea35>] device_add+0xae0/0x1cb0
    [<000000009c2abf46>] new_device_store+0x3b6/0x5f0
    [<00000000fb823d7f>] bus_attr_store+0x72/0xa0
    [<000000007acc4295>] sysfs_kf_write+0x106/0x160
    [<000000005f50cb4d>] kernfs_fop_write_iter+0x3a8/0x5a0
    [<[PII_REDACTED]eb41bf>] vfs_write+0x8f0/0xc80
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/6b1da9f7126f05e857da6db24c6a04aa7974d644; https://git.kernel.org/stable/c/7c4957fe40e2a628b7cceaf4c9bfb5b701774d05
CVE: CVE-2022-50501
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

media: coda: Add check for dcoda_iram_alloc

As the coda_iram_alloc may return NULL pointer,
it should be better to check the return value
in order to avoid NULL poineter dereference,
same as the others.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/05f165ded4a7baec31b65aba88e2cd1fb9b91db2; https://git.kernel.org/stable/c/2b436f[PII_REDACTED]ea5e4c356a175a928d73eed3; https://git.kernel.org/stable/c/2c6887d5a29024bada6928d1d0959c[PII_REDACTED]
CVE: CVE-2022-50502
Published: 2025-10-04
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50503
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: lpddr2_nvm: Fix possible null-ptr-deref

It will cause null-ptr-deref when resource_size(add_range) invoked,
if platform_get_resource() returns NULL.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0919982a[PII_REDACTED]20615615c7deb14106661; https://git.kernel.org/stable/c/4d10bd7416e8383340b5524b8d616b8ad01ef1e1; https://git.kernel.org/stable/c/6bdd45d795adf9e73b38ced5e7f750cd199499ff
CVE: CVE-2022-50504
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/rtas: avoid scheduling in rtas_os_term()

It's unsafe to use rtas_busy_delay() to handle a busy status from
the ibm,os-term RTAS function in rtas_os_term():

Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b
BUG: sleeping function called from invalid context at arch/powerpc/kernel/rtas.c:618
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0
preempt_count: 2, expected: 0
CPU: 7 PID: 1 Comm: swapper/0 Tainted: G      D            6.0.0-rc5-02182-gf8553a572277-dirty #9
Call Trace:
[c000000007b8f000] [c[PII_REDACTED]37110] dump_stack_lvl+0xb4/0x110 (unreliable)
[c000000007b8f040] [c[PII_REDACTED]440e4] __might_resched+0x394/0x3c0
[c000000007b8f0e0] [c[PII_REDACTED]4f680] rtas_busy_delay+0x120/0x1b0
[c000000007b8f100] [c[PII_REDACTED]52d04] rtas_os_term+0xb8/0xf4
[c000000007b8f180] [c[PII_REDACTED]150fc] pseries_panic+0x50/0x68
[c000000007b8f1f0] [c[PII_REDACTED]36354] ppc_panic_platform_handler+0x34/0x50
[c000000007b8f210] [c[PII_REDACTED]303c4] notifier_call_chain+0xd4/0x1c0
[c000000007b8f2b0] [c[PII_REDACTED]306cc] atomic_notifier_call_chain+0xac/0x1c0
[c000000007b8f2f0] [c[PII_REDACTED]d62b8] panic+0x228/0x4d0
[c000000007b8f390] [c[PII_REDACTED]e573c] do_exit+0x140c/0x1420
[c000000007b8f480] [c[PII_REDACTED]e586c] make_task_dead+0xdc/0x200

Use rtas_busy_delay_time() instead, which signals without side effects
whether to attempt the ibm,os-term RTAS call again.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/4768935b8cc2d2afeb7956292df0f6e2c49ca0a5; https://git.kernel.org/stable/c/482d990a5dd1027ee0b70a8a570d56749cac8103; https://git.kernel.org/stable/c/515959eb49e6d218a46979d66f36fdef329ac7d2
CVE: CVE-2022-50505
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix pci device refcount leak in ppr_notifier()

As comment of pci_get_domain_bus_and_slot() says, it returns
a pci device with refcount increment, when finish using it,
the caller must decrement the reference count by calling
pci_dev_put(). So call it before returning from ppr_notifier()
to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/03f51c72997559e73b327608f0cccfded715c9a0; https://git.kernel.org/stable/c/6cf0981c2233f97d56938d9d61845383d6eb227c; https://git.kernel.org/stable/c/6e501b3fd7a2e1c4372d72bc70717aaca2beb8a5
CVE: CVE-2022-50506
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

drbd: only clone bio if we have a backing device

Commit c347a787e34cb (drbd: set ->bi_bdev in drbd_req_new) moved a
bio_set_dev call (which has since been removed) to "earlier", from
drbd_request_prepare to drbd_req_new.

The problem is that this accesses device->ldev->backing_bdev, which is
not NULL-checked at this point. When we don't have an ldev (i.e. when
the DRBD device is diskless), this leads to a null pointer deref.

So, only allocate the private_bio if we actually have a disk. This is
also a small optimization, since we don't clone the bio to only to
immediately free it again in the diskless case.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/05580a3bbf3cec677cb00a85dfeb21d6a9b48eaf; https://git.kernel.org/stable/c/6d42ddf7f27b6723549ee6d4c8b1b418b59bf6b5
CVE: CVE-2022-50508
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt76x0: fix oob access in mt76x0_phy_get_target_power

After 'commit ba45841ca5eb ("wifi: mt76: mt76x02: simplify struct
mt76x02_rate_power")', mt76x02 relies on ht[0-7] rate_power data for
vht mcs{0,7}, while it uses vth[0-1] rate_power for vht mcs {8,9}.
Fix a possible out-of-bound access in mt76x0_phy_get_target_power routine.
CVSS Score: 7.1 (HIGH)
CWE: CWE-125
References: https://git.kernel.org/stable/c/6e1abc51c945663bddebfa1beb9590ff5b250eb7; https://git.kernel.org/stable/c/bf425c5d7ef6fb4083c1e0d46440f886127b5ee5
CVE: CVE-2023-53533
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe

rpi_firmware_get() take reference, we need to release it in error paths
as well. Use devm_rpi_firmware_get() helper to handling the resources.
Also remove the existing rpi_firmware_put().
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0d6a5c9489c8a3d434e685066119c4333476dccd; https://git.kernel.org/stable/c/1dfa3c9dd27bdc347733d06e[PII_REDACTED]20bc3e; https://git.kernel.org/stable/c/36d087e49dabd28d2c13a7532dac72d625ce69fb
CVE: CVE-2023-53534
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/mediatek: mtk_drm_crtc: Add checks for devm_kcalloc

As the devm_kcalloc may return NULL, the return value needs to be checked
to avoid NULL poineter dereference.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/5bf1e3bd7da625ccf9a22c8cb7d65271e6e47f4c; https://git.kernel.org/stable/c/62952905e195f7350bc230cf0960a74ddbceed5d; https://git.kernel.org/stable/c/67ea657c7891c2f86a[PII_REDACTED]d9bdf2555926
CVE: CVE-2023-53535
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

net: bcmgenet: Add a check for oversized packets

Occasionnaly we may get oversized packets from the hardware which
exceed the nomimal 2KiB buffer size we allocate SKBs with. Add an early
check which drops the packet to avoid invoking skb_over_panic() and move
on to processing the next packet.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/124ca24e0de958d2e20e0aa1e2434af7b72f8887; https://git.kernel.org/stable/c/411317d2a4a7d6049d8efeef0d32ae43f8baefce; https://git.kernel.org/stable/c/5c0862c2c962052ed5055220a00ac1cefb92fbcd
CVE: CVE-2023-53536
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

blk-crypto: make blk_crypto_evict_key() more robust

If blk_crypto_evict_key() sees that the key is still in-use (due to a
bug) or that ->keyslot_evict failed, it currently just returns while
leaving the key linked into the keyslot management structures.

However, blk_crypto_evict_key() is only called in contexts such as inode
eviction where failure is not an option.  So actually the caller
proceeds with freeing the blk_crypto_key regardless of the return value
of blk_crypto_evict_key().

These two assumptions don't match, and the result is that there can be a
use-after-free in blk_crypto_reprogram_all_keys() after one of these
errors occurs.  (Note, these errors *shouldn't* happen; we're just
talking about what happens if they do anyway.)

Fix this by making blk_crypto_evict_key() unlink the key from the
keyslot management structures even on failure.

Also improve some comments.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/5bb4005fb667c6e2188fa87950f8d5faf2994410; https://git.kernel.org/stable/c/5c[PII_REDACTED]7c613de0458fc797c5b8c36112b5; https://git.kernel.org/stable/c/5c7cb94452901a93e90c2230632e2c12a681bc92
CVE: CVE-2023-53537
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid use-after-free for cached IPU bio

xfstest generic/019 reports a bug:

kernel BUG at mm/filemap.c:1619!
RIP: 0010:folio_end_writeback+0x8a/0x90
Call Trace:
 end_page_writeback+0x1c/0x60
 f2fs_write_end_io+0x199/0x420
 bio_endio+0x104/0x180
 submit_bio_noacct+0xa5/0x510
 submit_bio+0x48/0x80
 f2fs_submit_write_bio+0x35/0x300
 f2fs_submit_merged_ipu_write+0x2a0/0x2b0
 f2fs_write_single_data_page+0x838/0x8b0
 f2fs_write_cache_pages+0x379/0xa30
 f2fs_write_data_pages+0x30c/0x340
 do_writepages+0xd8/0x1b0
 __writeback_single_inode+0x44/0x370
 writeback_sb_inodes+0x233/0x4d0
 __writeback_inodes_wb+0x56/0xf0
 wb_writeback+0x1dd/0x2d0
 wb_workfn+0x367/0x4a0
 process_one_work+0x21d/0x430
 worker_thread+0x4e/0x3c0
 kthread+0x103/0x130
 ret_from_fork+0x2c/0x50

The root cause is: after cp_error is set, f2fs_submit_merged_ipu_write()
in f2fs_write_single_data_page() tries to flush IPU bio in cache, however
f2fs_submit_merged_ipu_write() missed to check validity of @bio parameter,
result in submitting random cached bio which belong to other IO context,
then it will cause use-after-free issue, fix it by adding additional
validity check.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/5cdb422c[PII_REDACTED]66208dad5360835ddb9794; https://git.kernel.org/stable/c/7d058f0ab161437369ad6e45a4b67c2886e71373; https://git.kernel.org/stable/c/97ec6f1788cc6bee3f8c89cb908e1a2a1cd859bb
CVE: CVE-2023-53539
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix incomplete state save in rxe_requester

If a send packet is dropped by the IP layer in rxe_requester()
the call to rxe_xmit_packet() can fail with err == -EAGAIN.
To recover, the state of the wqe is restored to the state before
the packet was sent so it can be resent. However, the routines
that save and restore the state miss a significnt part of the
variable state in the wqe, the dma struct which is used to process
through the sge table. And, the state is not saved before the packet
is built which modifies the dma struct.

Under heavy stress testing with many QPs on a fast node sending
large messages to a slow node dropped packets are observed and
the resent packets are corrupted because the dma struct was not
restored. This patch fixes this behavior and allows the test cases
to succeed.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/255c0e60e1d16874fc151358d94bc8df661600dd; https://git.kernel.org/stable/c/2f2a6422287fe29f9343247d77b645100ece0652; https://git.kernel.org/stable/c/5d122db2ff80cd2aed4dcd630befb56b51ddf947
CVE: CVE-2023-53540
Published: 2025-10-04
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: cfg80211: reject auth/assoc to AP with our address

If the AP uses our own address as its MLD address or BSSID, then
clearly something's wrong. Reject such connections so we don't
try and fail later.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/07added2c6cd63de047bc786b39436322abb67c0; https://git.kernel.org/stable/c/5d4e04bf3a0f098bd9033de3a5291810fa14c7a6; https://git.kernel.org/stable/c/676a423410131d111a264d29aecbe6aadd57fb22