deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2022-50455
Published: 2025-10-01
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2022-50457
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

mtd: core: Fix refcount error in del_mtd_device()

del_mtd_device() will call of_node_put() to mtd_get_of_node(mtd), which
is mtd->dev.of_node. However, memset(&mtd->dev, 0) is called before
of_node_put(). As the result, of_node_put() won't do anything in
del_mtd_device(), and causes the refcount leak.

del_mtd_device()
    memset(&mtd->dev, 0, sizeof(mtd->dev) # clear mtd->dev
    of_node_put()
        mtd_get_of_node(mtd) # mtd->dev is cleared, can't locate of_node
                             # of_node_put(NULL) won't do anything

Fix the error by caching the pointer of the device_node.

OF: ERROR: memory leak, expected refcount 1 instead of 2,
of_node_get()/of_node_put() unbalanced - destroy cset entry: attach
overlay node /spi/spi-sram@0
CPU: 3 PID: 275 Comm: python3 Tainted: G N 6.1.0-rc3+ #54
    0d8a1edddf51f172ff5226989a7565c6313b08e2
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
    dump_stack_lvl+0x67/0x83
    kobject_get+0x155/0x160
    of_node_get+0x1f/0x30
    of_fwnode_get+0x43/0x70
    fwnode_handle_get+0x54/0x80
    fwnode_get_nth_parent+0xc9/0xe0
    fwnode_full_name_string+0x3f/0xa0
    device_node_string+0x30f/0x750
    pointer+0x598/0x7a0
    vsnprintf+0x62d/0x9b0
    ...
    cfs_overlay_release+0x30/0x90
    config_item_release+0xbe/0x1a0
    config_item_put+0x5e/0x80
    configfs_rmdir+0x3bd/0x540
    vfs_rmdir+0x18c/0x320
    do_rmdir+0x198/0x330
    __x64_sys_rmdir+0x2c/0x40
    do_syscall_64+0x37/0x90
    entry_SYSCALL_64_after_hwframe+0x63/0xcd

[<miquel.raynal@bootlin.com>: Light reword of the commit log]
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/56570bdad5e31c5c538cd6efff5c4510256e1bb4; https://git.kernel.org/stable/c/616dc895d982026f41f500c88d1bfea004938cc8; https://git.kernel.org/stable/c/f6016557f1ef7735963bd8691592d2797bbf91d2
CVE: CVE-2022-50458
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

clk: tegra: Fix refcount leak in tegra210_clock_init

of_find_matching_node() returns a node pointer with refcount
incremented, we should use of_node_put() on it when not need anymore.
Add missing of_node_put() to avoid refcount leak.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/1a6d97139b0a370a9d0809a00e91c41f5bcd3ef1; https://git.kernel.org/stable/c/417ed4432b1b40526b1cb50e535d46900505f6d9; https://git.kernel.org/stable/c/56c78cb1f00a9dde8cd762131ce8f4c5eb046fbb
CVE: CVE-2022-50459
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()

Fix a NULL pointer crash that occurs when we are freeing the socket at the
same time we access it via sysfs.

The problem is that:

 1. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() take
    the frwd_lock and do sock_hold() then drop the frwd_lock. sock_hold()
    does a get on the "struct sock".

 2. iscsi_sw_tcp_release_conn() does sockfd_put() which does the last put
    on the "struct socket" and that does __sock_release() which sets the
    sock->ops to NULL.

 3. iscsi_sw_tcp_conn_get_param() and iscsi_sw_tcp_host_get_param() then
    call kernel_getpeername() which accesses the NULL sock->ops.

Above we do a get on the "struct sock", but we needed a get on the "struct
socket". Originally, we just held the frwd_lock the entire time but in
commit bcf3a2953d36 ("scsi: iscsi: iscsi_tcp: Avoid holding spinlock while
calling getpeername()") we switched to refcount based because the network
layer changed and started taking a mutex in that path, so we could no
longer hold the frwd_lock.

Instead of trying to maintain multiple refcounts, this just has us use a
mutex for accessing the socket in the interface code paths.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/0a0b861fce2657ba08ec356a74346b37ca4b2008; https://git.kernel.org/stable/c/57569c37f0add1b6489e1a1563c71519daf732cf; https://git.kernel.org/stable/c/884a788f065578bb640382279a83d1df433b13e6
CVE: CVE-2022-50460
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

cifs: Fix xid leak in cifs_flock()

If not flock, before return -ENOLCK, should free the xid,
otherwise, the xid will be leaked.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/2d08311aa3056a84bfdc09bc47777de6a9b16c30; https://git.kernel.org/stable/c/575e079c782b9862ec[PII_REDACTED]d041a42e6ed6; https://git.kernel.org/stable/c/8905d13b9ede4caa88c577faed832d6c7383f4fb
CVE: CVE-2022-50461
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

net: ethernet: ti: am65-cpsw: Fix PM runtime leakage in am65_cpsw_nuss_ndo_slave_open()

Ensure pm_runtime_put() is issued in error path.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2c14f5cf74c4995eaf284b496481866f012eba19; https://git.kernel.org/stable/c/5821504f[PII_REDACTED]465b8bc430049c4343bbd7; https://git.kernel.org/stable/c/a8846b3398600a632696b6cf79f8a44a107eb226
CVE: CVE-2022-50462
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

MIPS: vpe-mt: fix possible memory leak while module exiting

Afer commit 1fa5ae857bb1 ("driver core: get rid of struct device's
bus_id string array"), the name of device is allocated dynamically,
it need be freed when module exiting, call put_device() to give up
reference, so that it can be freed in kobject_cleanup() when the
refcount hit to 0. The vpe_device is static, so remove kfree() from
vpe_device_release().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/170e9913c2ed5cfc37c0adf0fdbd368d2d8d8168; https://git.kernel.org/stable/c/48d42f4464d713fbdd79f334fdcd6e5be534cc67; https://git.kernel.org/stable/c/5822e8cc84ee37338ab0bdc3124f6eec04dc232d
CVE: CVE-2022-50463
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

powerpc/52xx: Fix a resource leak in an error handling path

The error handling path of mpc52xx_lpbfifo_probe() has a request_irq()
that is not balanced by a corresponding free_irq().

Add the missing call, as already done in the remove function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/0accd460dc7bbe5f55e41a8867c63db9d07b3ec8; https://git.kernel.org/stable/c/40b4be399e0db7073dec5a0de5ca9994f7e31e58; https://git.kernel.org/stable/c/[PII_REDACTED]ef33d311b4eff6a32d019580a214f5
CVE: CVE-2022-50464
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2()

As comment of pci_get_device() says, it returns a pci_device with its
refcount increased. We need to call pci_dev_put() to decrease the
refcount. Save the return value of pci_get_device() and call
pci_dev_put() to decrease the refcount.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/2d4b9c7e81f3a4df27749ebecb426b145e68be2a; https://git.kernel.org/stable/c/5938196cc188ba4323bc6357f5ac55127d715888; https://git.kernel.org/stable/c/8abc[PII_REDACTED]afd13ff2ccb0319ba3f46e6995
CVE: CVE-2022-50465
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: fix leaking uninitialized memory in fast-commit journal

When space at the end of fast-commit journal blocks is unused, make sure
to zero it out so that uninitialized memory is not leaked to disk.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/594bc43b410316d70bb42aeff168837888d96810; https://git.kernel.org/stable/c/7c1fb65e8ce85c281d2cba9c236f9edbbc4eaca6; https://git.kernel.org/stable/c/871800770d7f2f952c7249ad52485c3564dab44e
CVE: CVE-2022-50466
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

fs/binfmt_elf: Fix memory leak in load_elf_binary()

There is a memory leak reported by kmemleak:

  unreferenced object 0xffff88817104ef80 (size 224):
    comm "xfs_admin", pid 47165, jiffies[PII_REDACTED] (age 1333.476s)
    hex dump (first 32 bytes):
      00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
      60 a8 b3 00 81 88 ff ff a8 10 5a 00 81 88 ff ff  `.........Z.....
    backtrace:
      [<ffffffff819171e1>] __alloc_file+0x21/0x250
      [<ffffffff81918061>] alloc_empty_file+0x41/0xf0
      [<ffffffff81948cda>] path_openat+0xea/0x3d30
      [<ffffffff8194ec89>] do_filp_open+0x1b9/0x290
      [<ffffffff8192660e>] do_open_execat+0xce/0x5b0
      [<ffffffff81926b17>] open_exec+0x27/0x50
      [<ffffffff81a69250>] load_elf_binary+0x510/0x3ed0
      [<ffffffff81927759>] bprm_execve+0x599/0x1240
      [<ffffffff8192a997>] do_execveat_common.isra.0+0x4c7/0x680
      [<ffffffff8192b078>] __x64_sys_execve+0x88/0xb0
      [<ffffffff83bbf0a5>] do_syscall_64+0x35/0x80

If "interp_elf_ex" fails to allocate memory in load_elf_binary(),
the program will take the "out_free_ph" error handing path,
resulting in "interpreter" file resource is not released.

Fix it by adding an error handing path "out_free_file", which will
release the file resource when "interp_elf_ex" failed to allocate
memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/265b6fb780f57d10449a40e94219b28fa52479cc; https://git.kernel.org/stable/c/594d2a14f2168c09b13b114c3d457aa939403e52; https://git.kernel.org/stable/c/[PII_REDACTED]11d48db6b51a5832b872632a84bbc1
CVE: CVE-2022-50467
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID

An error case exit from lpfc_cmpl_ct_cmd_gft_id() results in a call to
lpfc_nlp_put() with a null pointer to a nodelist structure.

Changed lpfc_cmpl_ct_cmd_gft_id() to initialize nodelist pointer upon
entry.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/04e7cd8c85636a329d1a6e5a269a7c8b6f71c41c; https://git.kernel.org/stable/c/59b7e210a522b836a01516c71ee85d1d92c1f075; https://git.kernel.org/stable/c/82dc1fe4324e2c897f2ed1c66f4fcff03094ac3a
CVE: CVE-2022-50468
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

platform/chrome: cros_usbpd_notify: Fix error handling in cros_usbpd_notify_init()

The following WARNING message was given when rmmod cros_usbpd_notify:

 Unexpected driver unregister!
 WARNING: CPU: 0 PID: 253 at drivers/base/driver.c:270 driver_unregister+0x8a/0xb0
 Modules linked in: cros_usbpd_notify(-)
 CPU: 0 PID: 253 Comm: rmmod Not tainted 6.1.0-rc3 #24
 ...
 Call Trace:
  <TASK>
  cros_usbpd_notify_exit+0x11/0x1e [cros_usbpd_notify]
  __x64_sys_delete_module+0x3c7/0x570
  ? __ia32_sys_delete_module+0x570/0x570
  ? lock_is_held_type+0xe3/0x140
  ? syscall_enter_from_user_mode+0x17/0x50
  ? rcu_read_lock_sched_held+0xa0/0xd0
  ? syscall_enter_from_user_mode+0x1c/0x50
  do_syscall_64+0x37/0x90
  entry_SYSCALL_64_after_hwframe+0x63/0xcd
 RIP: 0033:0x7f333fe9b1b7

The reason is that the cros_usbpd_notify_init() does not check the return
value of platform_driver_register(), and the cros_usbpd_notify can
install successfully even if platform_driver_register() failed.

Fix by checking the return value of platform_driver_register() and
unregister cros_usbpd_notify_plat_driver when it failed.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/5a2d[PII_REDACTED]5d94aca72c320c0ac27bdc6bd2; https://git.kernel.org/stable/c/5c0cacdd354987f8f5348d16908716f154047890; https://git.kernel.org/stable/c/751f12696d797e785d2611099fe9f0569d47556e
CVE: CVE-2022-50469
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

staging: rtl8723bs: fix potential memory leak in rtw_init_drv_sw()

In rtw_init_drv_sw(), there are various init functions are called to
populate the padapter structure and some checks for their return value.
However, except for the first one error path, the other five error paths
do not properly release the previous allocated resources, which leads to
various memory leaks.

This patch fixes them and keeps the success and error separate.
Note that these changes keep the form of `rtw_init_drv_sw()` in
"drivers/staging/r8188eu/os_dep/os_intfs.c". As there is no proper device
to test with, no runtime testing was performed.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/5a5aa9cce621e2c0e25a1e5d72d6be1749167cc0; https://git.kernel.org/stable/c/6b2052b365f8035ab7f09ac24b5b499002b298cb; https://git.kernel.org/stable/c/b4573a2bad3c3e2643ef3939079eb7035a30e6ee
CVE: CVE-2023-53448
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

fbdev: imxfb: Removed unneeded release_mem_region

Remove unnecessary release_mem_region from the error path to prevent
mem region from being released twice, which could avoid resource leak
or other unexpected issues.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/38282a92c30422836d49e519bd109237f86a0888; https://git.kernel.org/stable/c/45fcc058a75bf5d65cf4c32da44a252fbe873cd4; https://git.kernel.org/stable/c/6aa851f6276fa08cd59b044bc2b803c49edf58a2
CVE: CVE-2023-53449
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

s390/dasd: Fix potential memleak in dasd_eckd_init()

`dasd_reserve_req` is allocated before `dasd_vol_info_req`, and it
also needs to be freed before the error returns, just like the other
cases in this function.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/460e9bed82e49db1b823dcb4e421783854d86c40; https://git.kernel.org/stable/c/544a552be[PII_REDACTED]784279d52704c4d314d33; https://git.kernel.org/stable/c/a50e28d433acf22258f9f[PII_REDACTED]7f04ef074
CVE: CVE-2023-53450
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

ext4: remove a BUG_ON in ext4_mb_release_group_pa()

If a malicious fuzzer overwrites the ext4 superblock while it is
mounted such that the s_first_data_block is set to a very large
number, the calculation of the block group can underflow, and trigger
a BUG_ON check.  Change this to be an ext4_warning so that we don't
crash the kernel.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-617
References: https://git.kernel.org/stable/c/185062a21976fbc38f2efd296951b02c4500cf65; https://git.kernel.org/stable/c/463808f237cf73e98a1a45ff7460c2406a150a0b; https://git.kernel.org/stable/c/53c14e7cc2257191ba15425c15638fc4f8abb92b
CVE: CVE-2023-53451
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix potential NULL pointer dereference

Klocwork tool reported 'cur_dsd' may be dereferenced.  Add fix to validate
pointer before dereferencing the pointer.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/02405f4023866ae91a611b5b85cb2e074ec2de5a; https://git.kernel.org/stable/c/2bea9c1c983152c5411f5a2f1113cb790ce1389d; https://git.kernel.org/stable/c/464ea494a40c6e3e0e8f91dd325408aaf21515ba
CVE: CVE-2023-53452
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: rtw89: fix potential race condition between napi_init and napi_enable

A race condition can happen if netdev is registered, but NAPI isn't
initialized yet, and meanwhile user space starts the netdev that will
enable NAPI. Then, it hits BUG_ON():

 kernel BUG at net/core/dev.c:6423!
 invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
 CPU: 0 PID: 417 Comm: iwd Not tainted 6.2.7-slab-dirty #3 eb0f5a8a9d91
 Hardware name: LENOVO 21DL/LNVNB161216, BIOS JPCN20WW(V1.06) 09/20/2022
 RIP: 0010:napi_enable+0x3f/0x50
 Code: 48 89 c2 48 83 e2 f6 f6 81 89 08 00 00 02 74 0d 48 83 ...
 RSP: 0018:ffffada1414f3548 EFLAGS: 00010246
 RAX: [PII_REDACTED] RBX: ffffa[PII_REDACTED]0 RCX: [PII_REDACTED]
 RDX:[PII_REDACTED]0002ff RSI: ffffada14e50c614 RDI: ffffa01425808dc0
 RBP: [PII_REDACTED] R08: [PII_REDACTED] R09: [PII_REDACTED]
 R10: [PII_REDACTED] R11: [PII_REDACTED] R12: ffffa01425808f58
 R13: [PII_REDACTED] R14: ffffa[PII_REDACTED]0 R15: [PII_REDACTED]
 FS:  00007f5577c0a740(0000) GS:ffffa0169fc00000(0000) knlGS:[PII_REDACTED]
 CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
 CR2: 00007f5577a19972 CR3:[PII_REDACTED]a7a000 CR4:[PII_REDACTED]750ef0
 PKRU: 55555554
 Call Trace:
  <TASK>
  rtw89_pci_ops_start+0x1c/0x70 [rtw89_pci 6cbc75429515c181cbc386478d5cfb32ffc5a0f8]
  rtw89_core_start+0xbe/0x160 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22]
  rtw89_ops_start+0x26/0x40 [rtw89_core fe07ecb874820b6d778370d4acb6ef8a37847f22]
  drv_start+0x42/0x100 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2]
  ieee80211_do_open+0x311/0x7d0 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2]
  ieee80211_open+0x6a/0x90 [mac80211 c07fa22af8c3cf3f7d7ab3884ca990784d72e2d2]
  __dev_open+0xe0/0x180
  __dev_change_flags+0x1da/0x250
  dev_change_flags+0x26/0x70
  do_setlink+0x37c/0x12c0
  ? ep_poll_callback+0x246/0x290
  ? __nla_validate_parse+0x61/0xd00
  ? __wake_up_common_lock+0x8f/0xd0

To fix this, follow Jonas' suggestion to switch the order of these
functions and move register netdev to be the last step of PCI probe.
Also, correct the error handling of rtw89_core_register_hw().
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/39712c8aeb79691bcec8bd6ff658cde1651e0803; https://git.kernel.org/stable/c/47515664ecfbde11425dff121f298ae4499425c9; https://git.kernel.org/stable/c/aa48073c2f993e1b0c0bc66b03ae105cac0130bc
CVE: CVE-2023-53453
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: free iio for atombios when driver shutdown

Fix below kmemleak when unload radeon driver:

unreferenced object 0xffff9f8608ede200 (size 512):
  comm "systemd-udevd", pid 326, jiffies[PII_REDACTED] (age 716.338s)
  hex dump (first 32 bytes):
    00 00 00 00 c4 aa ec aa 14 ab 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<[PII_REDACTED]fadebe>] kmem_cache_alloc_trace+0x2f1/0x500
    [<00000000b6883cea>] atom_parse+0x117/0x230 [radeon]
    [<[PII_REDACTED]8c23fd>] radeon_atombios_init+0xab/0x170 [radeon]
    [<[PII_REDACTED]3f672e>] si_init+0x57/0x750 [radeon]
    [<[PII_REDACTED]6cc31f>] radeon_device_init+0x559/0x9c0 [radeon]
    [<[PII_REDACTED]efabb3>] radeon_driver_load_kms+0xc1/0x1a0 [radeon]
    [<00000000b5155064>] drm_dev_register+0xdd/0x1d0
    [<[PII_REDACTED]fec835>] radeon_pci_probe+0xbd/0x100 [radeon]
    [<00000000e69ecca3>] pci_device_probe+0xe1/0x160
    [<[PII_REDACTED]484b76>] really_probe.part.0+0xc1/0x2c0
    [<000000003f2649da>] __driver_probe_device+0x96/0x130
    [<[PII_REDACTED]1c5bb1>] driver_probe_device+0x24/0xf0
    [<[PII_REDACTED]a42377>] __driver_attach+0x77/0x190
    [<00000000d7574da6>] bus_for_each_dev+0x7f/0xd0
    [<[PII_REDACTED]3166d2>] driver_attach+0x1e/0x30
    [<[PII_REDACTED]3b05b8>] bus_add_driver+0x12c/0x1e0

iio was allocated in atom_index_iio() called by atom_parse(),
but it doesn't got released when the dirver is shutdown.
Fix this kmemleak by free it in radeon_atombios_fini().
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-401
References: https://git.kernel.org/stable/c/107b8b542bb9dab4cbdc3276c85fbdd7f6782313; https://git.kernel.org/stable/c/4773fadedca918faec443daaca5e4ea1c0ced144; https://git.kernel.org/stable/c/9cdb96b55651c92fc949cfd54124406c3c912b6b
CVE: CVE-2023-53454
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: multitouch: Correct devm device reference for hidinput input_dev name

Reference the HID device rather than the input device for the devm
allocation of the input_dev name. Referencing the input_dev would lead to a
use-after-free when the input_dev was unregistered and subsequently fires a
uevent that depends on the name. At the point of firing the uevent, the
name would be freed by devres management.

Use devm_kasprintf to simplify the logic for allocating memory and
formatting the input_dev name string.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/15ec7cb55e7d88755aa01d44a7a1015a42bfce86; https://git.kernel.org/stable/c/1d7833db9fd118415dace2ca157bfa603dec9c8c; https://git.kernel.org/stable/c/2763732ec1e68910719c75b6b896e11b6d3d622b
CVE: CVE-2023-53456
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: qla4xxx: Add length check when parsing nlattrs

There are three places that qla4xxx parses nlattrs:

 - qla4xxx_set_chap_entry()

 - qla4xxx_iface_set_param()

 - qla4xxx_sysfs_ddb_set_param()

and each of them directly converts the nlattr to specific pointer of
structure without length checking. This could be dangerous as those
attributes are not validated and a malformed nlattr (e.g., length 0) could
result in an OOB read that leaks heap dirty data.

Add the nla_len check before accessing the nlattr data and return EINVAL if
the length check fails.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/25feffb3fbd51ae81d92c65cebc0e932663828b3; https://git.kernel.org/stable/c/47cd3770e31df942e2bb925a9a855c79ed0662eb; https://git.kernel.org/stable/c/47f3be62eab50b8cd7e1ae5fc2c4dae687497c34
CVE: CVE-2023-53457
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

FS: JFS: Fix null-ptr-deref Read in txBegin

 Syzkaller reported an issue where txBegin may be called
 on a superblock in a read-only mounted filesystem which leads
 to NULL pointer deref. This could be solved by checking if
 the filesystem is read-only before calling txBegin, and returning
 with appropiate error code.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/1b4c[PII_REDACTED]1cad92c132f72b3c6ed06a0ea; https://git.kernel.org/stable/c/2a3f20efe6c901d4c0871cfd1d8c65e2ade71fc1; https://git.kernel.org/stable/c/3e5eb6c5ecd8ddb9cfea751cf30f9e23eac97ca3
CVE: CVE-2023-53458
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

media: cx23885: Fix a null-ptr-deref bug in buffer_prepare() and buffer_finish()

When the driver calls cx23885_risc_buffer() to prepare the buffer, the
function call dma_alloc_coherent may fail, resulting in a empty buffer
risc->cpu. Later when we free the buffer or access the buffer, null ptr
deref is triggered.

This bug is similar to the following one:
https://git.linuxtv.org/media_stage.git/commit/?id=2b064d91440b33fba5b452f2d1b31f13ae911d71.

We believe the bug can be also dynamically triggered from user side.
Similarly, we fix this by checking the return value of cx23885_risc_buffer()
and the value of risc->cpu before buffer free.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: https://git.kernel.org/stable/c/47e8b73bc35d7c54642f78e498697692f6358996; https://git.kernel.org/stable/c/5b8e5e28e85a546dfccc3895befe0e823fdd7c89; https://git.kernel.org/stable/c/6738841f6fcf23e9fc30e2449f32fc84ee19c6f1
CVE: CVE-2023-53459
Published: 2025-10-01
Description: In the Linux kernel, the following vulnerability has been resolved:

HID: mcp-2221: prevent UAF in delayed work

If the device is plugged/unplugged without giving time for mcp_init_work()
to complete, we might kick in the devm free code path and thus have
unavailable struct mcp_2221 while in delayed work.

Canceling the delayed_work item is enough to solve the issue, because
cancel_delayed_work_sync will prevent the work item to requeue itself.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://git.kernel.org/stable/c/47e91fdfa511139f2549687edb0d8649b123227b; https://git.kernel.org/stable/c/5dc297652dbc557eba7ca7d6a4c5f1940dffffb1