deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2023-54169
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: fix memory leak in mlx5e_ptp_open

When kvzalloc_node or kvzalloc failed in mlx5e_ptp_open, the memory
pointed by "c" or "cparams" is not freed, which can lead to a memory
leak. Fix by freeing the array in the error path.
References: https://git.kernel.org/stable/c/4892e1e548b5bd6524c1c89df06e4849df26fc20; https://git.kernel.org/stable/c/7035e3ae600c4e9cb3dc220c24dd77112ddff8b1; https://git.kernel.org/stable/c/83a8f7337a14cdb215c76a8f4cf3f3be8b59177d
CVE: CVE-2023-54171
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

tracing: Fix memory leak of iter->temp when reading trace_pipe

kmemleak reports:
  unreferenced object 0xffff88814d14e200 (size 256):
    comm "cat", pid 336, jiffies[PII_REDACTED] (age 779.490s)
    hex dump (first 32 bytes):
      04 00 01 03 00 00 00 00 08 00 00 00 00 00 00 00  ................
      0c d8 c8 9b ff ff ff ff 04 5a ca 9b ff ff ff ff  .........Z......
    backtrace:
      [<ffffffff9bdff18f>] __kmalloc+0x4f/0x140
      [<ffffffff9bc9238b>] trace_find_next_entry+0xbb/0x1d0
      [<ffffffff9bc9caef>] trace_print_lat_context+0xaf/0x4e0
      [<ffffffff9bc94490>] print_trace_line+0x3e0/0x950
      [<ffffffff9bc95499>] tracing_read_pipe+0x2d9/0x5a0
      [<ffffffff9bf03a43>] vfs_read+0x143/0x520
      [<ffffffff9bf04c2d>] ksys_read+0xbd/0x160
      [<ffffffff9d0f0edf>] do_syscall_64+0x3f/0x90
      [<ffffffff9d2000aa>] entry_SYSCALL_64_after_hwframe+0x6e/0xd8

when reading file 'trace_pipe', 'iter->temp' is allocated or relocated
in trace_find_next_entry() but not freed before 'trace_pipe' is closed.

To fix it, free 'iter->temp' in tracing_release_pipe().
References: https://git.kernel.org/stable/c/1a1e793e021d75cd0accd8f329ec9456e5cd105e; https://git.kernel.org/stable/c/3f42d57a76e7e96585f08855554e002218cbca0c; https://git.kernel.org/stable/c/954792db9f61b6c0b8a94b8831fed5f146014029
CVE: CVE-2023-54172
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction

On hardware that supports Indirect Branch Tracking (IBT), Hyper-V VMs
with ConfigVersion 9.3 or later support IBT in the guest. However,
current versions of Hyper-V have a bug in that there's not an ENDBR64
instruction at the beginning of the hypercall page. Since hypercalls are
made with an indirect call to the hypercall page, all hypercall attempts
fail with an exception and Linux panics.

A Hyper-V fix is in progress to add ENDBR64. But guard against the Linux
panic by clearing X86_FEATURE_IBT if the hypercall page doesn't start
with ENDBR. The VM will boot and run without IBT.

If future Linux 32-bit kernels were to support IBT, additional hypercall
page hackery would be needed to make IBT work for such kernels in a
Hyper-V VM.
References: https://git.kernel.org/stable/c/73626b70b361ddda7c380e52c236aa4f2487c402; https://git.kernel.org/stable/c/98cccbd0a19a161971bc7f7feb10577adc62c400; https://git.kernel.org/stable/c/d5ace2a776442d80674eff9ed42e737f7dd95056
CVE: CVE-2023-54173
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Disable preemption in bpf_event_output

We received report [1] of kernel crash, which is caused by
using nesting protection without disabled preemption.

The bpf_event_output can be called by programs executed by
bpf_prog_run_array_cg function that disabled migration but
keeps preemption enabled.

This can cause task to be preempted by another one inside the
nesting protection and lead eventually to two tasks using same
perf_sample_data buffer and cause crashes like:

  BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
  #PF: supervisor instruction fetch in kernel mode
  #PF: error_code(0x0010) - not-present page
  ...
  ? perf_output_sample+0x12a/0x9a0
  ? finish_task_switch.isra.0+0x81/0x280
  ? perf_event_output+0x66/0xa0
  ? bpf_event_output+0x13a/0x190
  ? bpf_event_output_data+0x22/0x40
  ? bpf_prog_dfc84bbde731b257_cil_sock4_connect+0x40a/0xacb
  ? xa_load+0x87/0xe0
  ? __cgroup_bpf_run_filter_sock_addr+0xc1/0x1a0
  ? release_sock+0x3e/0x90
  ? sk_setsockopt+0x1a1/0x12f0
  ? udp_pre_connect+0x36/0x50
  ? inet_dgram_connect+0x93/0xa0
  ? __sys_connect+0xb4/0xe0
  ? udp_setsockopt+0x27/0x40
  ? __pfx_udp_push_pending_frames+0x10/0x10
  ? __sys_setsockopt+0xdf/0x1a0
  ? __x64_sys_connect+0xf/0x20
  ? do_syscall_64+0x3a/0x90
  ? entry_SYSCALL_64_after_hwframe+0x72/0xdc

Fixing this by disabling preemption in bpf_event_output.

[1] https://github.com/cilium/cilium/issues/26756
References: https://git.kernel.org/stable/c/063c9ce8e74e07bf94f99cd13146f42867875e8b; https://git.kernel.org/stable/c/3048cb0dc0cc9dc74ed93690dffef00733bcad5b; https://git.kernel.org/stable/c/36dd8ca330b76585640ed32255a3c99f901e1502
CVE: CVE-2023-54174
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd

group->iommufd is not initialized for the iommufd_ctx_put()

[20018.331541] BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
[20018.377508] RIP: 0010:iommufd_ctx_put+0x5/0x10 [iommufd]
...
[20018.476483] Call Trace:
[20018.479214]  <TASK>
[20018.481555]  vfio_group_fops_unl_ioctl+0x506/0x690 [vfio]
[20018.487586]  __x64_sys_ioctl+0x6a/0xb0
[20018.491773]  ? trace_hardirqs_on+0xc5/0xe0
[20018.496347]  do_syscall_64+0x67/0x90
[20018.500340]  entry_SYSCALL_64_after_hwframe+0x4b/0xb5
References: https://git.kernel.org/stable/c/8f24eef598ce7cce0bbefe0ec642bcc031d0f528; https://git.kernel.org/stable/c/d649c34cb916b015fdcb487e51409fcc5caeca8d
CVE: CVE-2023-54175
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

i2c: xiic: xiic_xfer(): Fix runtime PM leak on error path

The xiic_xfer() function gets a runtime PM reference when the function is
entered. This reference is released when the function is exited. There is
currently one error path where the function exits directly, which leads to
a leak of the runtime PM reference.

Make sure that this error path also releases the runtime PM reference.
References: https://git.kernel.org/stable/c/06e661a259978305c0015f6f33d14477a0cfbe8f; https://git.kernel.org/stable/c/2d320d9de7d31c0eb279b3f8a02cf1af473a3737; https://git.kernel.org/stable/c/6027d84c073e26cb1b32a90d69c5fbad57776406
CVE: CVE-2023-54176
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

mptcp: stricter state check in mptcp_worker

As reported by Christoph, the mptcp protocol can run the
worker when the relevant msk socket is in an unexpected state:

connect()
// incoming reset + fastclose
// the mptcp worker is scheduled
mptcp_disconnect()
// msk is now CLOSED
listen()
mptcp_worker()

Leading to the following splat:

divide error: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
Workqueue: events mptcp_worker
RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018
RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293
RAX:[PII_REDACTED]00ffd7 RBX:[PII_REDACTED]00ffd7 RCX: [PII_REDACTED]
RDX: [PII_REDACTED] RSI: ffffffff8214ce97 RDI: [PII_REDACTED]
RBP:[PII_REDACTED]00ffd7 R08: [PII_REDACTED] R09: [PII_REDACTED]
R10:[PII_REDACTED]00ffd7 R11: ffff888005afa148 R12:[PII_REDACTED]00ffd7
R13: [PII_REDACTED] R14: [PII_REDACTED] R15: [PII_REDACTED]
FS:  [PII_REDACTED](0000) GS:ffff88803ed00000(0000) knlGS:[PII_REDACTED]
CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
CR2: [PII_REDACTED] CR3:[PII_REDACTED]11e006 CR4:[PII_REDACTED]370ee0
DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
Call Trace:
 <TASK>
 tcp_select_window net/ipv4/tcp_output.c:262 [inline]
 __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345
 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline]
 tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459
 mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline]
 mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705
 process_one_work+0x3bd/0x950 kernel/workqueue.c:2390
 worker_thread+0x5b/0x610 kernel/workqueue.c:2537
 kthread+0x138/0x170 kernel/kthread.c:376
 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308
 </TASK>

This change addresses the issue explicitly checking for bad states
before running the mptcp worker.
References: https://git.kernel.org/stable/c/19ea79e87af32c2b3c6fc49bd84efeb35ca57678; https://git.kernel.org/stable/c/aff9099e9c51f15c8def05c75b2b73e8487b5d54; https://git.kernel.org/stable/c/d6a[PII_REDACTED]408f2cbd4c53fea6910599bab9e
CVE: CVE-2023-54178
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()

when kmalloc() fail to allocate memory in kasprintf(), name
or full_name will be NULL, strcmp() will cause
null pointer dereference.
References: https://git.kernel.org/stable/c/0b7d715511915a1b39f5fdcbe57a7922dfd66513; https://git.kernel.org/stable/c/2dd8ee9de71ad8447f8459fb01dade7f6c7132da; https://git.kernel.org/stable/c/43cc228099c514467b8074d7ede6673cef9f33b9
CVE: CVE-2023-54179
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Array index may go out of bound

Klocwork reports array 'vha->host_str' of size 16 may use index value(s)
16..19.  Use snprintf() instead of sprintf().
References: https://git.kernel.org/stable/c/2b3bdef089b920b4a19fefb4f4e6dda56a4bb583; https://git.kernel.org/stable/c/748d8f8698a2f48ffe32dd7b35dbab1810ed1f82; https://git.kernel.org/stable/c/bcd773969a87d9802053c0db5be84abd6594a024
CVE: CVE-2023-54180
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: handle case when repair happens with dev-replace

[BUG]
There is a bug report that a BUG_ON() in btrfs_repair_io_failure()
(originally repair_io_failure() in v6.0 kernel) got triggered when
replacing a unreliable disk:

  BTRFS warning (device sda1): csum failed root 257 ino 2397453 off 39624704 csum 0xb0d18c75 expected csum 0x4dae9c5e mirror 3
  kernel BUG at fs/btrfs/extent_io.c:2380!
  invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
  CPU: 9 PID: 3614331 Comm: kworker/u257:2 Tainted: G           OE      6.0.0-5-amd64 #1  Debian 6.0.10-2
  Hardware name: Micro-Star International Co., Ltd. MS-7C60/TRX40 PRO WIFI (MS-7C60), BIOS 2.70 07/01/2021
  Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]
  RIP: 0010:repair_io_failure+0x24a/0x260 [btrfs]
  Call Trace:
   <TASK>
   clean_io_failure+0x14d/0x180 [btrfs]
   end_bio_extent_readpage+0x412/0x6e0 [btrfs]
   ? __switch_to+0x106/0x420
   process_one_work+0x1c7/0x380
   worker_thread+0x4d/0x380
   ? rescuer_thread+0x3a0/0x3a0
   kthread+0xe9/0x110
   ? kthread_complete_and_exit+0x20/0x20
   ret_from_fork+0x22/0x30

[CAUSE]

Before the BUG_ON(), we got some read errors from the replace target
first, note the mirror number (3, which is beyond RAID1 duplication,
thus it's read from the replace target device).

Then at the BUG_ON() location, we are trying to writeback the repaired
sectors back the failed device.

The check looks like this:

		ret = btrfs_map_block(fs_info, BTRFS_MAP_WRITE, logical,
				      &map_length, &bioc, mirror_num);
		if (ret)
			goto out_counter_dec;
		BUG_ON(mirror_num != bioc->mirror_num);

But inside btrfs_map_block(), we can modify bioc->mirror_num especially
for dev-replace:

	if (dev_replace_is_ongoing && mirror_num == map->num_stripes + 1 &&
	    !need_full_stripe(op) && dev_replace->tgtdev != NULL) {
		ret = get_extra_mirror_from_replace(fs_info, logical, *length,
						    dev_replace->srcdev->devid,
						    &mirror_num,
					    &physical_to_patch_in_first_stripe);
		patch_the_first_stripe_for_dev_replace = 1;
	}

Thus if we're repairing the replace target device, we're going to
trigger that BUG_ON().

But in reality, the read failure from the replace target device may be
that, our replace hasn't reached the range we're reading, thus we're
reading garbage, but with replace running, the range would be properly
filled later.

Thus in that case, we don't need to do anything but let the replace
routine to handle it.

[FIX]
Instead of a BUG_ON(), just skip the repair if we're repairing the
device replace target device.
References: https://git.kernel.org/stable/c/53e9d6851b[PII_REDACTED]6a2966194ba994f8bb4b; https://git.kernel.org/stable/c/a7018b40b49c37fb55736499f790ec0d2b381ae4; https://git.kernel.org/stable/c/d73a27b86fc722c28a26ec64002e3a7dc86d1c07
CVE: CVE-2023-54181
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix issue in verifying allow_ptr_leaks

After we converted the capabilities of our networking-bpf program from
cap_sys_admin to cap_net_admin+cap_bpf, our networking-bpf program
failed to start. Because it failed the bpf verifier, and the error log
is "R3 pointer comparison prohibited".

A simple reproducer as follows,

SEC("cls-ingress")
int ingress(struct __sk_buff *skb)
{
	struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);

	if ((long)(iph + 1) > (long)skb->data_end)
		return TC_ACT_STOLEN;
	return TC_ACT_OK;
}

Per discussion with Yonghong and Alexei [1], comparison of two packet
pointers is not a pointer leak. This patch fixes it.

Our local kernel is 6.1.y and we expect this fix to be backported to
6.1.y, so stable is CCed.

[1]. https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/
References: https://git.kernel.org/stable/c/5927f0172d2809d8fc09c1ba667280b0387e9f73; https://git.kernel.org/stable/c/acfdc8b77016c8e648aadc283177546c88083dd3; https://git.kernel.org/stable/c/c96c67991aac6401b4c6996093bccb704bb2ea4b
CVE: CVE-2023-54182
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to check readonly condition correctly

With below case, it can mount multi-device image w/ rw option, however
one of secondary device is set as ro, later update will cause panic, so
let's introduce f2fs_dev_is_readonly(), and check multi-devices rw status
in f2fs_remount() w/ it in order to avoid such inconsistent mount status.

mkfs.f2fs -c /dev/zram1 /dev/zram0 -f
blockdev --setro /dev/zram1
mount -t f2fs dev/zram0 /mnt/f2fs
mount: /mnt/f2fs: WARNING: source write-protected, mounted read-only.
mount -t f2fs -o remount,rw mnt/f2fs
dd if=/dev/zero  of=/mnt/f2fs/file bs=1M count=8192

kernel BUG at fs/f2fs/inline.c:258!
RIP: 0010:f2fs_write_inline_data+0x23e/0x2d0 [f2fs]
Call Trace:
  f2fs_write_single_data_page+0x26b/0x9f0 [f2fs]
  f2fs_write_cache_pages+0x389/0xa60 [f2fs]
  __f2fs_write_data_pages+0x26b/0x2d0 [f2fs]
  f2fs_write_data_pages+0x2e/0x40 [f2fs]
  do_writepages+0xd3/0x1b0
  __writeback_single_inode+0x5b/0x420
  writeback_sb_inodes+0x236/0x5a0
  __writeback_inodes_wb+0x56/0xf0
  wb_writeback+0x2a3/0x490
  wb_do_writeback+0x2b2/0x330
  wb_workfn+0x6a/0x260
  process_one_work+0x270/0x5e0
  worker_thread+0x52/0x3e0
  kthread+0xf4/0x120
  ret_from_fork+0x29/0x50
References: https://git.kernel.org/stable/c/d78dfefcde9d[PII_REDACTED]60d69c0478c55a657e; https://git.kernel.org/stable/c/da8c535b28696017e5d1532d12ea78e836432d9e; https://git.kernel.org/stable/c/e05d63f8b48aad4613bd582c945bee41e2dd7255
CVE: CVE-2023-54183
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()

If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL,
so fwnode_handle_put() is a no-op.

Release the reference taken from a previous fwnode_graph_get_port_parent()
call instead.

Also handle fwnode_graph_get_port_parent() failures.

In order to fix these issues, add an error handling path to the function
and the needed gotos.
References: https://git.kernel.org/stable/c/[PII_REDACTED]e1f034ff58f293e10d0d9b7581601f; https://git.kernel.org/stable/c/25afb3e03bf8ab02567af4b6ffbfd6250a91a9f8; https://git.kernel.org/stable/c/4bc5ffaf8ac4f3e7a1fcd10a0a0e7b022b694877
CVE: CVE-2023-54184
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsit: Free cmds before session free

Commands from recovery entries are freed after session has been closed.
That leads to use-after-free at command free or NPE with such call trace:

Time2Retain timer expired for SID: 1, cleaning up iSCSI session.
BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
RIP: 0010:sbitmap_queue_clear+0x3a/0xa0
Call Trace:
 target_release_cmd_kref+0xd1/0x1f0 [target_core_mod]
 transport_generic_free_cmd+0xd1/0x180 [target_core_mod]
 iscsit_free_cmd+0x53/0xd0 [iscsi_target_mod]
 iscsit_free_connection_recovery_entries+0x29d/0x320 [iscsi_target_mod]
 iscsit_close_session+0x13a/0x140 [iscsi_target_mod]
 iscsit_check_post_dataout+0x440/0x440 [iscsi_target_mod]
 call_timer_fn+0x24/0x140

Move cleanup of recovery enrties to before session freeing.
References: https://git.kernel.org/stable/c/1911cca5916b6e106de7afa3ec0a[PII_REDACTED]6c; https://git.kernel.org/stable/c/4621e24c9257c6379343bf0c11b473817cf7edcd; https://git.kernel.org/stable/c/4ce221d295f53e6c6b835ab33181e735482c9aac
CVE: CVE-2023-54185
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

btrfs: remove BUG_ON()'s in add_new_free_space()

At add_new_free_space() we have these BUG_ON()'s that are there to deal
with any failure to add free space to the in memory free space cache.
Such failures are mostly -ENOMEM that should be very rare. However there's
no need to have these BUG_ON()'s, we can just return any error to the
caller and all callers and their upper call chain are already dealing with
errors.

So just make add_new_free_space() return any errors, while removing the
BUG_ON()'s, and returning the total amount of added free space to an
optional u64 pointer argument.
References: https://git.kernel.org/stable/c/23e72231f[PII_REDACTED]514b23709076e234d4f27; https://git.kernel.org/stable/c/d8ccbd21918fd7fa6ce3226cffc22c444228e8ad; https://git.kernel.org/stable/c/f775ceb0cb530e4a469b718fb2a[PII_REDACTED]7f5
CVE: CVE-2023-54186
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

usb: typec: altmodes/displayport: fix pin_assignment_show

This patch fixes negative indexing of buf array in pin_assignment_show
when get_current_pin_assignments returns 0 i.e. no compatible pin
assignments are found.

BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c
...
Call trace:
dump_backtrace+0x110/0x204
dump_stack_lvl+0x84/0xbc
print_report+0x358/0x974
kasan_report+0x9c/0xfc
__do_kernel_fault+0xd4/0x2d4
do_bad_area+0x48/0x168
do_tag_check_fault+0x24/0x38
do_mem_abort+0x6c/0x14c
el1_abort+0x44/0x68
el1h_64_sync_handler+0x64/0xa4
el1h_64_sync+0x78/0x7c
pin_assignment_show+0x26c/0x33c
dev_attr_show+0x50/0xc0
References: https://git.kernel.org/stable/c/08bd1be1c716fd50a7df48f82dcbc59a103082b5; https://git.kernel.org/stable/c/0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2; https://git.kernel.org/stable/c/4f9c0a7c272626cb6716ffc7800e8c73260cdce6
CVE: CVE-2023-54187
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix potential corruption when moving a directory

F2FS has the same issue in ext4_rename causing crash revealed by
xfstests/generic/707.

See also commit 0813299c586b ("ext4: Fix possible corruption when moving a directory")
References: https://git.kernel.org/stable/c/0a76082a4a32a90d1ef33dee8b400efc082b4b6f; https://git.kernel.org/stable/c/3e[PII_REDACTED]3ff710fa2661dcaa12a45284f09b; https://git.kernel.org/stable/c/8a0b544b7caedfbc05065b6377fd1d8bf7ef5e70
CVE: CVE-2023-54188
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

dmaengine: apple-admac: Fix 'current_tx' not getting freed

In terminate_all we should queue up all submitted descriptors to be
freed. We do that for the content of the 'issued' and 'submitted' lists,
but the 'current_tx' descriptor falls through the cracks as it's
removed from the 'issued' list once it gets assigned to be the current
descriptor. Explicitly queue up freeing of the 'current_tx' descriptor
to address a memory leak that is otherwise present.
References: https://git.kernel.org/stable/c/b7abd535881a48587961c2099b1d2933ebd42c4b; https://git.kernel.org/stable/c/d9503be5a100c553731c0e8a82c7b4201e8a970c; https://git.kernel.org/stable/c/fd4d88e68c75caf5c6f8293a36bc3ae289e0369e
CVE: CVE-2023-54189
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

pstore/ram: Add check for kstrdup

Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.
References: https://git.kernel.org/stable/c/065c81ae5817b245bb9feb6d54e027702740b49a; https://git.kernel.org/stable/c/2a764a2facd9dd88a69777200f65dfd0182765dc; https://git.kernel.org/stable/c/38a9d7dac3ad25323145b4aaea3b5f434f50011d
CVE: CVE-2023-54190
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

leds: led-core: Fix refcount leak in of_led_get()

class_find_device_by_of_node() calls class_find_device(), it will take
the reference, use the put_device() to drop the reference when not need
anymore.
References: https://git.kernel.org/stable/c/1d6101d9222e1ca8c01b3fa9ebf0dcf7bcd82564; https://git.kernel.org/stable/c/690efcb5827c3bacbf1de90cd14907b91bf8cb7b; https://git.kernel.org/stable/c/d880981b82223f9bf128dfdd2424abb0c658f345
CVE: CVE-2023-54191
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit

Always purge mcu skb queues in mt7996_mcu_exit routine even if
mt7996_firmware_state fails.
References: https://git.kernel.org/stable/c/b539d35e13e5d6b3dca[PII_REDACTED]6b2356aa64c; https://git.kernel.org/stable/c/da5b4d93e141b52c5a71d0c41a042d1bcaf70d2e
CVE: CVE-2023-54192
Published: 2025-12-30
Description: In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix null pointer panic in tracepoint in __replace_atomic_write_block

We got a kernel panic if old_addr is NULL.

https://bugzilla.kernel.org/show_bug.cgi?id=217266

BUG: kernel NULL pointer dereference, address: [PII_REDACTED]
 Call Trace:
  <TASK>
  f2fs_commit_atomic_write+0x619/0x990 [f2fs a1b985b80f5babd6f3ea[PII_REDACTED]80812bfa43]
  __f2fs_ioctl+0xd8e/0x4080 [f2fs a1b985b80f5babd6f3ea[PII_REDACTED]80812bfa43]
  ? vfs_write+0x2ae/0x3f0
  ? vfs_write+0x2ae/0x3f0
  __x64_sys_ioctl+0x91/0xd0
  do_syscall_64+0x5c/0x90
  entry_SYSCALL_64_after_hwframe+0x72/0xdc
 RIP: 0033:0x7f69095fe53f
References: https://git.kernel.org/stable/c/1424358cd66c[PII_REDACTED]3497b54cb72e0213cc; https://git.kernel.org/stable/c/424f8cdc0ad29e4940be96dcc0b935ba497adeda; https://git.kernel.org/stable/c/da6ea0b050fa720302b56fbb59307e7c7531a342