deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-54022
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix potential memory leaks at error path for UMP open

The allocation and initialization errors at alloc_midi_urbs() that is
called at MIDI 2.0 / UMP device are supposed to be handled at the
caller side by invoking free_midi_urbs().  However, free_midi_urbs()
loops only for ep->num_urbs entries, and since ep->num_entries wasn't
updated yet at the allocation / init error in alloc_midi_urbs(), this
entry won't be released.

The intention of free_midi_urbs() is to release the whole elements, so
change the loop size to NUM_URBS to scan over all elements for fixing
the missed releases.

Also, the call of free_midi_urbs() is missing at
snd_usb_midi_v2_open().  Although it'll be released later at
reopen/close or disconnection, it's better to release immediately at
the error path.
References: https://git.kernel.org/stable/c/b1757fa30ef14f254f4719bf6f7d54a4c8207216; https://git.kernel.org/stable/c/f819b343aa95d24d5f7d6e06660c7f62591abc5f
CVE: CVE-2023-54023
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: fix race between balance and cancel/pause

Syzbot reported a panic that looks like this:

  assertion failed: fs_info->exclusive_operation == BTRFS_EXCLOP_BALANCE_PAUSED, in fs/btrfs/ioctl.c:465
  ------------[ cut here ]------------
  kernel BUG at fs/btrfs/messages.c:259!
  RIP: 0010:btrfs_assertfail+0x2c/0x30 fs/btrfs/messages.c:259
  Call Trace:
   <TASK>
   btrfs_exclop_balance fs/btrfs/ioctl.c:465 [inline]
   btrfs_ioctl_balance fs/btrfs/ioctl.c:3564 [inline]
   btrfs_ioctl+0x531e/0x5b30 fs/btrfs/ioctl.c:4632
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:870 [inline]
   __se_sys_ioctl fs/ioctl.c:856 [inline]
   __x64_sys_ioctl+0x197/0x210 fs/ioctl.c:856
   do_syscall_x64 arch/x86/entry/common.c:50 [inline]
   do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
   entry_SYSCALL_64_after_hwframe+0x63/0xcd

The reproducer is running a balance and a cancel or pause in parallel.
The way balance finishes is a bit wonky, if we were paused we need to
save the balance_ctl in the fs_info, but clear it otherwise and cleanup.
However we rely on the return values being specific errors, or having a
cancel request or no pause request.  If balance completes and returns 0,
but we have a pause or cancel request we won't do the appropriate
cleanup, and then the next time we try to start a balance we'll trip
this ASSERT.

The error handling is just wrong here, we always want to clean up,
unless we got -ECANCELLED and we set the appropriate pause flag in the
exclusive op.  With this patch the reproducer ran for an hour without
tripping, previously it would trip in less than a few minutes.
References: https://git.kernel.org/stable/c/72efe5d44821e38540888a5fe3ff3d0faab6acad; https://git.kernel.org/stable/c/b19c98f237cd76981aaded52c258ce93f7daa8cb; https://git.kernel.org/stable/c/ddf7e8984c83aee[PII_REDACTED]f4e77291903f8d9
CVE: CVE-2023-54024
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

KVM: Destroy target device if coalesced MMIO unregistration fails

Destroy and free the target coalesced MMIO device if unregistering said
device fails.  As clearly noted in the code, kvm_io_bus_unregister_dev()
does not destroy the target device.

  BUG: memory leak
  unreferenced object 0xffff888112a54880 (size 64):
    comm "syz-executor.2", pid 5258, jiffies[PII_REDACTED] (age 14.129s)
    hex dump (first 32 bytes):
      38 c7 67 15 00 c9 ff ff 38 c7 67 15 00 c9 ff ff  8.g.....8.g.....
      e0 c7 e1 83 ff ff ff ff 00 30 67 15 00 c9 ff ff  .........0g.....
    backtrace:
      [<[PII_REDACTED]995a8a>] kmalloc include/linux/slab.h:556 [inline]
      [<[PII_REDACTED]995a8a>] kzalloc include/linux/slab.h:690 [inline]
      [<[PII_REDACTED]995a8a>] kvm_vm_ioctl_register_coalesced_mmio+0x8e/0x3d0 arch/x86/kvm/../../../virt/kvm/coalesced_mmio.c:150
      [<[PII_REDACTED]2550c2>] kvm_vm_ioctl+0x47d/0x1600 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3323
      [<000000008a75102f>] vfs_ioctl fs/ioctl.c:46 [inline]
      [<000000008a75102f>] file_ioctl fs/ioctl.c:509 [inline]
      [<000000008a75102f>] do_vfs_ioctl+0xbab/0x1160 fs/ioctl.c:696
      [<[PII_REDACTED]e3f669>] ksys_ioctl+0x76/0xa0 fs/ioctl.c:713
      [<[PII_REDACTED]ef4888>] __do_sys_ioctl fs/ioctl.c:720 [inline]
      [<[PII_REDACTED]ef4888>] __se_sys_ioctl fs/ioctl.c:718 [inline]
      [<[PII_REDACTED]ef4888>] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:718
      [<[PII_REDACTED]44fa05>] do_syscall_64+0x9f/0x4e0 arch/x86/entry/common.c:290
      [<000000009a4ed50b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe

  BUG: leak checking failed
References: https://git.kernel.org/stable/c/10c2a20d73e99463e69b7e[PII_REDACTED]6adc16d7; https://git.kernel.org/stable/c/76a9886e1b61ce5592df5ae78a19ed30399ae189; https://git.kernel.org/stable/c/999439fd5da5a76253e2f2c37b94204f47d75491
CVE: CVE-2023-54025
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled

In case WoWlan was never configured during the operation of the system,
the hw->wiphy->wowlan_config will be NULL. rsi_config_wowlan() checks
whether wowlan_config is non-NULL and if it is not, then WARNs about it.
The warning is valid, as during normal operation the rsi_config_wowlan()
should only ever be called with non-NULL wowlan_config. In shutdown this
rsi_config_wowlan() should only ever be called if WoWlan was configured
before by the user.

Add checks for non-NULL wowlan_config into the shutdown hook. While at it,
check whether the wiphy is also non-NULL before accessing wowlan_config .
Drop the single-use wowlan_config variable, just inline it into function
call.
References: https://git.kernel.org/stable/c/1b51236aa49a0564280bd45c94118cab6d9b0fbd; https://git.kernel.org/stable/c/4391fa180856ff84a2cef4a92694a689eebb855e; https://git.kernel.org/stable/c/b241e260820b68c09586e8a0ae0fc23c0e3215bd
CVE: CVE-2023-54026
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

opp: Fix use-after-free in lazy_opp_tables after probe deferral

When dev_pm_opp_of_find_icc_paths() in _allocate_opp_table() returns
-EPROBE_DEFER, the opp_table is freed again, to wait until all the
interconnect paths are available.

However, if the OPP table is using required-opps then it may already
have been added to the global lazy_opp_tables list. The error path
does not remove the opp_table from the list again.

This can cause crashes later when the provider of the required-opps
is added, since we will iterate over OPP tables that have already been
freed. E.g.:

  Unable to handle kernel NULL pointer dereference when read
  CPU: 0 PID: 7 Comm: kworker/0:0 Not tainted 6.4.0-rc3
  PC is at _of_add_opp_table_v2 (include/linux/of.h:949
  drivers/opp/of.c:98 drivers/opp/of.c:344 drivers/opp/of.c:404
  drivers/opp/of.c:1032) -> lazy_link_required_opp_table()

Fix this by calling _of_clear_opp_table() to remove the opp_table from
the list and clear other allocated resources. While at it, also add the
missing mutex_destroy() calls in the error path.
References: https://git.kernel.org/stable/c/39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc; https://git.kernel.org/stable/c/76ab057de777723ec924654502d1a260ba7d7d54; https://git.kernel.org/stable/c/b2a2ab039bd58f51355e33d7d3fc64605d7f870d
CVE: CVE-2023-54027
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

iio: core: Prevent invalid memory access when there is no parent

Commit 813665564b3d ("iio: core: Convert to use firmware node handle
instead of OF node") switched the kind of nodes to use for label
retrieval in device registration.  Probably an unwanted change in that
commit was that if the device has no parent then NULL pointer is
accessed.  This is what happens in the stock IIO dummy driver when a
new entry is created in configfs:

  # mkdir /sys/kernel/config/iio/devices/dummy/foo
  BUG: kernel NULL pointer dereference, address: ...
  ...
  Call Trace:
  __iio_device_register
  iio_dummy_probe

Since there seems to be no reason to make a parent device of an IIO
dummy device mandatory, let’s prevent the invalid memory access in
__iio_device_register when the parent device is NULL.  With this
change, the IIO dummy driver works fine with configfs.
References: https://git.kernel.org/stable/c/312f04ede209f0a186799fe8e64a19b49700d5dc; https://git.kernel.org/stable/c/a4b34cccff14ce74bb7d77fbfd56e7c9d7c28a97; https://git.kernel.org/stable/c/b2a69969908fcaf68596dfc04369af0fe2e1d2f7
CVE: CVE-2023-54028
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

RDMA/rxe: Fix the error "trying to register non-static key in rxe_cleanup_task"

In the function rxe_create_qp(), rxe_qp_from_init() is called to
initialize qp, internally things like rxe_init_task are not setup until
rxe_qp_init_req().

If an error occurred before this point then the unwind will call
rxe_cleanup() and eventually to rxe_qp_do_cleanup()/rxe_cleanup_task()
which will oops when trying to access the uninitialized spinlock.

If rxe_init_task is not executed, rxe_cleanup_task will not be called.
References: https://git.kernel.org/stable/c/0d938264fcfe4927e54f0e519da05af1d5d720b4; https://git.kernel.org/stable/c/3236221bb8e4de8e3d0c8385f634064fb26b8e38; https://git.kernel.org/stable/c/b2b1ddc457458fecd1c6f385baa9fbda5f0c63ad
CVE: CVE-2023-54029
Published: 2025-12-24
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2023-54030
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring/net: don't overflow multishot recv

Don't allow overflowing multishot recv CQEs, it might get out of
hand, hurt performance, and in the worst case scenario OOM the task.
References: https://git.kernel.org/stable/c/1e2db9837be7d24a2a74eb3f3906d0872bee8907; https://git.kernel.org/stable/c/b2e74db55dd93d6db22a813c9a775b5dbf87c560
CVE: CVE-2023-54031
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check

The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.

That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa queue index attr to avoid
such bugs.
References: https://git.kernel.org/stable/c/8ad9bc25cbdcec72e7ca43dd8281decb69ea9a70; https://git.kernel.org/stable/c/b3003e1b54e057f5f3124e437b80c3bef26ed3fe; https://git.kernel.org/stable/c/ccb533b7070aeeb65c66ea5d590e9c62421dcd61
CVE: CVE-2023-54033
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps

The LRU and LRU_PERCPU maps allocate a new element on update before locking the
target hash table bucket. Right after that the maps try to lock the bucket.
If this fails, then maps return -EBUSY to the caller without releasing the
allocated element. This makes the element untracked: it doesn't belong to
either of free lists, and it doesn't belong to the hash table, so can't be
re-used; this eventually leads to the permanent -ENOMEM on LRU map updates,
which is unexpected. Fix this by returning the element to the local free list
if bucket locking fails.
References: https://git.kernel.org/stable/c/1a9e80f757bbb1562d82e350afce2bb2f712cc3d; https://git.kernel.org/stable/c/79ea1a12fb9a8275b6e19d4ca625dd872dedcbb9; https://git.kernel.org/stable/c/965e9cccbe6b9c7b379908cebcb5e3a47f20dd5e
CVE: CVE-2023-54034
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

iommufd: Make sure to zero vfio_iommu_type1_info before copying to user

Missed a zero initialization here. Most of the struct is filled with
a copy_from_user(), however minsz for that copy is smaller than the
actual struct by 8 bytes, thus we don't fill the padding.
References: https://git.kernel.org/stable/c/7adcec686e4d699c169d34c722132b2bce5232cb; https://git.kernel.org/stable/c/b3551ead616318ea155558cdbe7e91495b8d9b33
CVE: CVE-2023-54035
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: fix underflow in chain reference counter

Set element addition error path decrements reference counter on chains
twice: once on element release and again via nft_data_release().

Then, d6b478666ffa ("netfilter: nf_tables: fix underflow in object
reference counter") incorrectly fixed this by removing the stateful
object reference count decrement.

Restore the stateful object decrement as in b91d90368837 ("netfilter:
nf_tables: fix leaking object reference count") and let
nft_data_release() decrement the chain reference counter, so this is
done only once.
References: https://git.kernel.org/stable/c/9c959671abc7d4ffdf34eed10c64492d43cb6a3c; https://git.kernel.org/stable/c/b068314fd8ce751a7f906e55bb90f3551815f1a0; https://git.kernel.org/stable/c/b389139f12f287b8ed2e2628b72df89a081f0b59
CVE: CVE-2023-54036
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU

The wifi + bluetooth combo chip RTL8723BU can leak memory (especially?)
when it's connected to a bluetooth audio device. The busy bluetooth
traffic generates lots of C2H (card to host) messages, which are not
freed correctly.

To fix this, move the dev_kfree_skb() call in rtl8xxxu_c2hcmd_callback()
inside the loop where skb_dequeue() is called.

The RTL8192EU leaks memory because the C2H messages are added to the
queue and left there forever. (This was fine in the past because it
probably wasn't sending any C2H messages until commit e542e66b7c2e
("wifi: rtl8xxxu: gen2: Turn on the rate control"). Since that commit
it sends a C2H message when the TX rate changes.)

To fix this, delete the check for rf_paths > 1 and the goto. Let the
function process the C2H messages from RTL8192EU like the ones from
the other chips.

Theoretically the RTL8188FU could also leak like RTL8723BU, but it
most likely doesn't send C2H messages frequently enough.

This change was tested with RTL8723BU by Erhard F. I tested it with
RTL8188FU and RTL8192EU.
References: https://git.kernel.org/stable/c/35fb0e275af1aa1ca0a9784417e90f988aaf8e78; https://git.kernel.org/stable/c/430f9f9bec53a75f9ccc53e156a66f13fc098b83; https://git.kernel.org/stable/c/93c3f34ec02fc81188d328287d4fddd498ccddea
CVE: CVE-2023-54038
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: return ERR_PTR instead of NULL when there is no link

hci_connect_sco currently returns NULL when there is no link (i.e. when
hci_conn_link() returns NULL).

sco_connect() expects an ERR_PTR in case of any error (see line 266 in
sco.c). Thus, hcon set as NULL passes through to sco_conn_add(), which
tries to get hcon->hdev, resulting in dereferencing a NULL pointer as
reported by syzkaller.

The same issue exists for iso_connect_cis() calling hci_connect_cis().

Thus, make hci_connect_sco() and hci_connect_cis() return ERR_PTR
instead of NULL.
References: https://git.kernel.org/stable/c/357ab53c83a5322437fa434e9a9e3e0bafe6b383; https://git.kernel.org/stable/c/b4066eb04bb67e7ff66e5aaab0db4a753f37eaad
CVE: CVE-2023-54039
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

can: j1939: j1939_tp_tx_dat_new(): fix out-of-bounds memory access

In the j1939_tp_tx_dat_new() function, an out-of-bounds memory access
could occur during the memcpy() operation if the size of skb->cb is
larger than the size of struct j1939_sk_buff_cb. This is because the
memcpy() operation uses the size of skb->cb, leading to a read beyond
the struct j1939_sk_buff_cb.

Updated the memcpy() operation to use the size of struct
j1939_sk_buff_cb instead of the size of skb->cb. This ensures that the
memcpy() operation only reads the memory within the bounds of struct
j1939_sk_buff_cb, preventing out-of-bounds memory access.

Additionally, add a BUILD_BUG_ON() to check that the size of skb->cb
is greater than or equal to the size of struct j1939_sk_buff_cb. This
ensures that the skb->cb buffer is large enough to hold the
j1939_sk_buff_cb structure.

[mkl: rephrase commit message]
References: https://git.kernel.org/stable/c/36befc9aed6202b4a9b906529aea13eacd7e34ff; https://git.kernel.org/stable/c/4c3fb22a6ec68258ee129a2e6b720f43dffc562f; https://git.kernel.org/stable/c/4fe1d9b6231a68ffc91318f57fd8e4982f028cf7
CVE: CVE-2023-54040
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ice: fix wrong fallback logic for FDIR

When adding a FDIR filter, if ice_vc_fdir_set_irq_ctx returns failure,
the inserted fdir entry will not be removed and if ice_vc_fdir_write_fltr
returns failure, the fdir context info for irq handler will not be cleared
which may lead to inconsistent or memory leak issue. This patch refines
failure cases to resolve this issue.
References: https://git.kernel.org/stable/c/391d28c0e38c0e5b11a4240a2b4976cf63e87f45; https://git.kernel.org/stable/c/aad3b871efe26f36f45f8b4649653b5d3fd9c35e; https://git.kernel.org/stable/c/b4a01ace20f5c93c724abffc0a83ec84f514b98d
CVE: CVE-2023-54041
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix memory leak when removing provided buffers

When removing provided buffers, io_buffer structs are not being disposed
of, leading to a memory leak. They can't be freed individually, because
they are allocated in page-sized groups. They need to be added to some
free list instead, such as io_buffers_cache. All callers already hold
the lock protecting it, apart from when destroying buffers, so had to
extend the lock there.
References: https://git.kernel.org/stable/c/ac48787f58d1068f4e06d627c1135784d64b4c72; https://git.kernel.org/stable/c/b4a72c0589fdea[PII_REDACTED][PII_REDACTED]69d6a2; https://git.kernel.org/stable/c/c117c15927772d1624c29c092b6bd3f47c7faa48
CVE: CVE-2023-54042
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/64s: Fix VAS mm use after free

The refcount on mm is dropped before the coprocessor is detached.
References: https://git.kernel.org/stable/c/421cd1544480f2458042fe7f4913a2069c4d7251; https://git.kernel.org/stable/c/4e82f92c349ea603736ade1e814861c0182a55ad; https://git.kernel.org/stable/c/b4bda59b47879cce38a6ec5a01cd3cac702b5331
CVE: CVE-2025-68344
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: wavefront: Fix integer overflow in sample size validation

The wavefront_send_sample() function has an integer overflow issue
when validating sample size. The header->size field is u32 but gets
cast to int for comparison with dev->freemem

Fix by using unsigned comparison to avoid integer overflow.
References: https://git.kernel.org/stable/c/02b63f3bc29265bd9e83191792d200ed563acacf; https://git.kernel.org/stable/c/0c4a13ba88594fd4a27292853e736c6b4349823d; https://git.kernel.org/stable/c/1823e08f76c68b9e1d26f6d5ef831b96f61a62a0
CVE: CVE-2025-68345
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi()

The acpi_get_first_physical_node() function can return NULL, in which
case the get_device() function also returns NULL, but this value is
then dereferenced without checking,so add a check to prevent a crash.

Found by Linux Verification Center (linuxtesting.org) with SVACE.
References: https://git.kernel.org/stable/c/343fa9800cf9870ec681e21f0a6f2157b74ae520; https://git.kernel.org/stable/c/7a35a505d76a4b6cd426b59ff2d800d0394cc5d3; https://git.kernel.org/stable/c/c28946b7409b7b68fb0481ec738c8b04578b11c6
CVE: CVE-2025-68346
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: dice: fix buffer overflow in detect_stream_formats()

The function detect_stream_formats() reads the stream_count value directly
from a FireWire device without validating it. This can lead to
out-of-bounds writes when a malicious device provides a stream_count value
greater than MAX_STREAMS.

Fix by applying the same validation to both TX and RX stream counts in
detect_stream_formats().
References: https://git.kernel.org/stable/c/1e1b3207a53e50d5a66289fffc1f7d52cd9c50f9; https://git.kernel.org/stable/c/324f3e03e8a85931ce0880654e3c3eb38b0f0bba; https://git.kernel.org/stable/c/3cf854cec0eb371da47ff5fe56eab189d7fa623a
CVE: CVE-2025-68347
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events

The DSP event handling code in hwdep_read() could write more bytes to
the user buffer than requested, when a user provides a buffer smaller
than the event header size (8 bytes).

Fix by using min_t() to clamp the copy size, This ensures we never copy
more than the user requested.
References: https://git.kernel.org/stable/c/161291bac551821bba98eb4ea84c82338578d1b0; https://git.kernel.org/stable/c/16620f[PII_REDACTED]984362c3d6ac547eeae1d35f; https://git.kernel.org/stable/c/210d77cca3d0494ed30a5c628b20c1d95fa04fb1
CVE: CVE-2025-68348
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

block: fix memory leak in __blkdev_issue_zero_pages

Move the fatal signal check before bio_alloc() to prevent a memory
leak when BLKDEV_ZERO_KILLABLE is set and a fatal signal is pending.

Previously, the bio was allocated before checking for a fatal signal.
If a signal was pending, the code would break out of the loop without
freeing or chaining the just-allocated bio, causing a memory leak.

This matches the pattern already used in __blkdev_issue_write_zeroes()
where the signal check precedes the allocation.
References: https://git.kernel.org/stable/c/453e4b0c84d0db1454ff0adf655d91179e6fca3a; https://git.kernel.org/stable/c/7193407bc4457212fa38ec3aff9c640e63a8dbef; https://git.kernel.org/stable/c/7957635c679e8a01147163a3a4a1f16e1210fa03
CVE: CVE-2025-68349
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

Fixes a crash when layout is null during this call stack:

write_inode
    -> nfs4_write_inode
        -> pnfs_layoutcommit_inode

pnfs_set_layoutcommit relies on the lseg refcount to keep the layout
around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt
to reference a null layout.
References: https://git.kernel.org/stable/c/084bebe82ad86f718a3af84f34761863e63164ed; https://git.kernel.org/stable/c/104080582ae0aa6dce6c6d75ff89062efe84673b; https://git.kernel.org/stable/c/38694f9aae00459ab443a7dc8b3949a6b33b560a
CVE: CVE-2025-68350
Published: 2025-12-24
Description: In the Linux kernel, the following vulnerability has been resolved:

exfat: fix divide-by-zero in exfat_allocate_bitmap

The variable max_ra_count can be 0 in exfat_allocate_bitmap(),
which causes a divide-by-zero error in the subsequent modulo operation
(i % max_ra_count), leading to a system crash.
When max_ra_count is 0, it means that readahead is not used. This patch
load the bitmap without readahead.
References: https://git.kernel.org/stable/c/88fc3dd6e631b3e2975f898c6c2b6bc6f7058b44; https://git.kernel.org/stable/c/d70a5804c563b5e34825353ba9927509df709651