huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53547: kernel: drm/amdgpu: Fix sdma v4 sw fini error
Component: kernel
Severity: Moderate
CWE: CWE-1341 (Multiple Releases of Same Resource or Handle)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

An invalid pointer dereference flaw was found in the Linux kernel AMD GPU SDMA v4 driver's cleanup code. On systems with SDMA 4.2.2 hardware, driver unload or system shutdown triggers the sdma_v4_0_sw_fini() cleanup path, which attempts to release firmware using an uninitialized or corrupted pointer, causing a general protection fault with a non-canonical address and denial of service through kernel crash.

Statement: For SDMA 4.2.2 hardware, sdma_v4_0_sw_fini() fails to properly handle firmware context cleanup. During driver finalization, the code calls amdgpu_sdma_destroy_inst_ctx() which attempts to release firmware via amdgpu_ucode_release(). The firmware pointer appears to be uninitialized or corrupted, causing free_fw_priv() to dereference an invalid address (0xd5e5a4ae79d24a32).

Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 210ef6cd8e634f18fd889421012192b81325b27b
CVE-2023-53549: kernel: netfilter: ipset: Rework long task execution when adding/deleting entries
Component: kernel
Severity: Moderate
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

An uncontrolled resource consumption flaw was found in the Linux kernel's netfilter ipset subsystem when processing large batch operations. A local user with CAP_NET_ADMIN capability can trigger this issue by adding or deleting a large number of ipset entries in a single operation, causing the kernel to execute long-running tasks without yielding. This results in soft lockup conditions and denial of service through system unresponsiveness.

Statement: The ipset code processes batch add/delete operations in a tight loop while holding the nfnl mutex. When users specify a large range of IP addresses or ports to add to or remove from a set, the kernel can spend extended periods (potentially seconds) without scheduling, leading to soft lockup detector warnings and system unresponsiveness. Previous attempts to limit the batch size were insufficient—the limits were still too high to prevent hung task conditions on slower systems. Exploitation requires CAP_NET_ADMIN capability, which is typically restricted to root or containers with explicit network administration privileges.

Affected upstream versions: 5.10.157 < 5.10.163, 5.13.14 < 5.14, 5.14
Fixed upstream versions: 0, 5.10.163, 5.14, 5.15.87, 6.0.19, 6.1.5, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ee756980e491c829ba0495bb420b7224a9ee26b2
CVE-2023-53550: kernel: cpufreq: amd-pstate: fix global sysfs attribute type
Component: kernel
Severity: Low
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: amd-pstate: fix global sysfs attribute type

In commit 3666062b87ec ("cpufreq: amd-pstate: move to use bus_get_dev_root()")
the "amd_pstate" attributes where moved from a dedicated kobject to the
cpu root kobject.

While the dedicated kobject expects to contain kobj_attributes the root
kobject needs device_attributes.

As the changed arguments are not used by the callbacks it works most of
the time.
However CFI will detect this issue:

[ 4947.849350] CFI failure at dev_attr_show+0x24/0x60 (target: show_status+0x0/0x70; expected type: 0x8651b1de)
...
[ 4947.849409] Call Trace:
[ 4947.849410]  <TASK>
[ 4947.849411]  ? __warn+0xcf/0x1c0
[ 4947.849414]  ? dev_attr_show+0x24/0x60
[ 4947.849415]  ? report_cfi_failure+0x4e/0x60
[ 4947.849417]  ? handle_cfi_failure+0x14c/0x1d0
[ 4947.849419]  ? __cfi_show_status+0x10/0x10
[ 4947.849420]  ? handle_bug+0x4f/0x90
[ 4947.849421]  ? exc_invalid_op+0x1a/0x60
[ 4947.849422]  ? asm_exc_invalid_op+0x1a/0x20
[ 4947.849424]  ? __cfi_show_status+0x10/0x10
[ 4947.849425]  ? dev_attr_show+0x24/0x60
[ 4947.849426]  sysfs_kf_seq_show+0xa6/0x110
[ 4947.849433]  seq_read_iter+0x16c/0x4b0
[ 4947.849436]  vfs_read+0x272/0x2d0
[ 4947.849438]  ksys_read+0x72/0xe0
[ 4947.849439]  do_syscall_64+0x76/0xb0
[ 4947.849440]  ? do_user_addr_fault+0x252/0x650
[ 4947.849442]  ? exc_page_fault+0x7a/0x1b0
[ 4947.849443]  entry_SYSCALL_64_after_hwframe+0x72/0xdc


Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.4.11, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ddcfc33a20380508f7fea18e1c330abe17ed4fc0
CVE-2023-53552: kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-04T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel Intel i915 graphics driver's GuC virtual engine request handling. A local user with access to GPU rendering can create requests on GuC virtual engines and trap references via sync_file or dmabuf, causing fence release operations to access freed engine structures when validating whether rq->engine points to a valid hardware engine, which results in memory corruption and potential privilege escalation or denial of service.

Statement: Fence release code needs to determine if rq->engine is valid for non-virtual requests, but the check was insufficient for GuC virtual engines. Userspace can hold i915_request references indefinitely across processes via sync_file or dmabuf (dma-resv). The driver attempts to free request resources after completion to prevent memory leaks, but on fence release it must validate the engine pointer. For GuC virtual engines, the validation was incorrect, allowing use-after-free when the engine structure was freed but still referenced.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8017a27cec32eac8c8f9430b0a3055840136b856
CVE-2023-53553: kernel: HID: hyperv: avoid struct memcpy overrun warning
Component: kernel
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

A compiler warning issue was found in the Linux kernel's Hyper-V HID driver that could lead to potential memory safety issues. A local user can trigger this issue when the fortified memcpy implementation detects potential buffer overflows in the mousevsc_on_receive function, where the compiler cannot verify that memory copy operations stay within bounds. This could potentially result in memory corruption and denial of service.

Statement: The Hyper-V HID driver's mousevsc_on_receive function performs memcpy operations on packet data received from the Hyper-V host. The fortified string functions (enabled with CONFIG_FORTIFY_SOURCE) perform compile-time checks to detect potential buffer overflows. With certain compiler versions (specifically GCC 9), the fortification checks trigger warnings about potential writes beyond field boundaries. While the code includes proper range checks via WARN_ON, the compiler's data flow analysis is confused by the assertion and cannot verify the bounds are correct. This creates a situation where either the range check is insufficient (potential buffer overflow) or the compiler analysis is overly conservative (false positive). The code was reworked to satisfy the compiler while maintaining safety. The issue affects Hyper-V Linux guests.

Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a7902cc5f5b9c95997017c8e309da760fb1deb6e
CVE-2023-53555: kernel: mm/damon/core: initialize damo_filter->list from damos_new_filter()
Component: kernel
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: initialize damo_filter->list from damos_new_filter()

damos_new_filter() is not initializing the list field of newly allocated
filter object.  However, DAMON sysfs interface and DAMON_RECLAIM are not
initializing it after calling damos_new_filter().  As a result, accessing
uninitialized memory is possible.  Actually, adding multiple DAMOS filters
via DAMON sysfs interface caused NULL pointer dereferencing.  Initialize
the field just after the allocation from damos_new_filter().


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.4.11, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: da7beebb49c643cd03c54447ed66595936a7a1ce
CVE-2023-53556: kernel: Linux kernel iavf driver: Denial of Service via use-after-free vulnerability
Component: kernel
Severity: Moderate
CWE: CWE-664 (Improper Control of a Resource Through its Lifetime)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-04T00:00:00+00:00

A flaw was found in the Linux kernel's iavf driver. A local user with administrative capabilities can exploit a use-after-free vulnerability, caused by a mismatch in network interface (NAPI) list management functions. This can lead to dangling NAPI entries, resulting in a kernel crash and a Denial of Service (DoS).

Statement: A use-after-free in the Intel iavf driver could be triggered by a mismatch between netif_napi_add() and netif_napi_del(), leaving dangling NAPI entries and crashing in free_netdev(). Exploitation requires local administrative capabilities (SR-IOV toggling and channel reconfiguration), so the practical impact is mostly a kernel DoS rather than privilege escalation. For the CVSS the PR:H — because changing sriov_numvfs (PF) and ethtool -L (VF) requires CAP_SYS_ADMIN/CAP_NET_ADMIN.

Affected upstream versions: 3.14
Fixed upstream versions: 0, 5.10.188, 5.15.123, 5.4.251, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 17046107ca15d7571551539d94e76aba2bf71fd3
CVE-2023-53558: kernel: rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic()
Component: kernel
Severity: Moderate
CWE: CWE-1322 (Use of Blocking Code in Single-threaded, Non-blocking Context)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

A locking violation was found in the Linux kernel RCU-tasks subsystem's callback list initialization. During system boot, the initialization code calls pr_info() while holding the rtp->cbs_gbl_lock spinlock, causing a potentially sleeping function to be called in atomic context, which results in kernel lockdep warnings and potential deadlock leading to denial of service.

Statement: The issue arises because cblist_init_generic() calls pr_info() while holding the rtp->cbs_gbl_lock spinlock. The pr_info() function calls printk(), which may sleep because it acquires the console_lock and can block waiting for console output. Calling a potentially sleeping function while holding a spinlock violates kernel locking rules and can lead to deadlock. During RCU-tasks initialization at boot time, if lockdep is enabled, the kernel detects this violation and emits an "Invalid wait context" warning showing the problematic lock chain. While this primarily manifests as warnings with lockdep enabled, the underlying locking violation could lead to actual deadlocks in production systems under the right timing conditions.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9027d69221ff96e1356f070f7feb2ff989ae7388
CVE-2023-53559: kernel: ip_vti: fix potential slab-use-after-free in decode_session6
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-04T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's ip_vti (IPsec Virtual Tunnel Interface) implementation when transmitting IPv6 packets with the SFB qdisc attached. A local user with CAP_NET_ADMIN capability can trigger this issue by configuring an ip_vti interface with an SFB qdisc and sending IPv6 traffic, causing the socket buffer control block to be modified during packet enqueuing and subsequently accessed after potential freeing during session decoding. This results in slab use-after-free, leading to kernel panic or potential memory corruption.

Statement: The ip_vti driver uses the socket buffer's control block (cb field) for internal state tracking. When the SFB (Stochastic Fair Blue) qdisc is attached to an ip_vti device, the qdisc modifies this cb field during packet enqueuing. Later, when decode_session6 is called on the transmit path, it attempts to access IP6CB(skb)->nhoff, which was designed only for the receive path and is not initialized during transmission. The modified cb field contents from the qdisc can cause the decoder to access invalid memory regions, potentially accessing already-freed slab objects.

Affected upstream versions: 3.19
Fixed upstream versions: 0, 4.14.324, 4.19.293, 5.10.192, 5.15.128, 5.4.255, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 82fb41c5de243e7dfa90f32ca58e35adaff56c1d
CVE-2023-53563: kernel: cpufreq: amd-pstate-ut: Fix kernel panic when loading the driver
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

A reference leak flaw was found in the Linux kernel's AMD P-state unit test driver in the CPU policy access logic. A local user can trigger this issue by loading the amd-pstate-ut driver, which acquires CPU policy references via cpufreq_cpu_get without releasing them via cpufreq_cpu_put. This causes other processes attempting to access the policy to block indefinitely, resulting in hung tasks and denial of service through system unresponsiveness.

Statement: The amd_pstate_ut_check_perf and amd_pstate_ut_check_freq functions in the unit test driver call cpufreq_cpu_get to obtain and mark the CPU policy as busy. However, these functions fail to call the corresponding cpufreq_cpu_put to release the reference. This violates the cpufreq reference counting protocol and causes any subsequent attempt to access the policy—such as during mode changes or driver unload—to wait indefinitely for the reference to be released. The most visible manifestation is when changing amd_pstate modes, where processes hang for over 120 seconds waiting for completion. Since this is a unit test driver rather than production code, the practical impact is limited to testing scenarios, though the hang can affect system stability when the driver is loaded.

Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fcf78a17bbb94bebaa912f0460a1848f7d374c94
CVE-2023-53566: kernel: netfilter: nft_set_rbtree: fix null deref on element insertion
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-04T00:00:00+00:00

A flaw was found in the Netfilter subsystem in the Linux kernel. A NULL pointer dereference and a use-after-free issue can be triggered due to an improper check and an improper way of iterating a red-black tree during garbage collector operations, potentially resulting in a denial of service and possibly privilege escalation.

Statement: The Netfilter subsystem as shipped in Red Hat Enterprise Linux 6, 7, 8 and 10 is not affected by this vulnerability because the vulnerable code is not present or is already fixed.

This issue has been fixed in Red Hat Enterprise Linux 9.0 and 9.3 via RHSA-2024:3421 [1] and RHSA-2023:6583 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2024:3421

[2]. https://access.redhat.com/errata/RHSA-2023:6583

Affected upstream versions: 5.10.166 < 5.10.181, 5.15.91 < 5.15.113, 6.1.9 < 6.1.30, 6.2
Fixed upstream versions: 0, 5.10.181, 5.15.113, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56
CVE-2023-53568: kernel: s390/zcrypt: don't leak memory if dev_set_name() fails
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

A resource leak was found in the Linux kernel's s390 cryptographic device driver in the device creation path. When the dev_set_name function fails during creation of a zcrypt device node, the zcdn_create function returns an error without freeing the newly allocated device structure and associated resources. This creates a permanent memory leak, leading to resource exhaustion and denial of service.

Statement: The z/Architecture cryptographic device interface allows creation of additional device nodes for accessing crypto hardware. The zcdn_create function allocates a device structure and attempts to assign it a name using dev_set_name. If this naming operation fails—perhaps due to name collisions, memory allocation failures, or invalid characters—the function immediately returns an error code. At this point, the device structure has been allocated but never registered with the device core, so there's no automatic cleanup mechanism in place. The allocated memory, along with any other resources acquired during partial initialization, becomes orphaned. While dev_set_name failures are presumably rare in practice, any failure creates a leak that persists until system reboot. This is specific to s390 architecture systems with cryptographic hardware.

Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.195, 5.15.132, 5.4.257, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6b0cb9c055843777b374309503d89eabeb769355
CVE-2023-53570: kernel: wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

An integer overflow flaw was found in the Linux kernel's nl80211 wireless configuration interface in the MBSSID element parsing logic. 
A local user with CAP_NET_ADMIN capability can trigger this issue by specifying 256 or more MBSSID elements through the nl80211 interface, causing the u8 counter num_elems to wrap to zero. This results in a heap buffer overflow when the code allocates space based on the wrapped value but then writes data for all supplied elements, leading to memory corruption and denial of service through kernel crash.

Statement: The nl80211_parse_mbssid_elems function counts MBSSID (Multiple BSSID) configuration elements using a u8 variable that can only represent values 0-255. When userspace provides 256 or more elements, the counter wraps to zero due to integer overflow. The function then allocates a structure with a trailing array sized according to num_elems, but subsequently iterates through all supplied elements in attrs, writing beyond the allocated buffer. This heap overflow can cause memory corruption affecting kernel stability. The vulnerability only affects wireless devices where the driver sets wiphy->mbssid_max_interfaces, and exploitation requires CAP_NET_ADMIN capability, limiting the attack surface to privileged network configuration operations. The fix enforces a maximum of 255 elements.

Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.46, 6.4.11, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e642eb67b8c10dcce758d549cc81564116e0fa49
CVE-2023-53572: kernel: clk: imx: scu: use _safe list iterator to avoid a use after free
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's i.MX system control unit clock driver in the error cleanup path. 
A local user can trigger this issue during clock initialization failure scenarios on i.MX hardware with System Control Unit firmware, where the cleanup loop incorrectly uses a standard list iterator instead of the safe variant while freeing clock structures. This causes the kernel to dereference freed memory when traversing to the next list element, resulting in memory corruption that can lead to a crash or denial of service.

Statement: The bug appears in the cleanup path that executes when SCU clock registration fails. The code walks a linked list of clock structures, freeing each one, but uses list_for_each_entry() instead of list_for_each_entry_safe(). Since the macro dereferences the current entry to find the next pointer, freeing the entry first creates a use-after-free when the loop tries to advance. Exploitation requires triggering a clock initialization failure, which typically happens only during early boot on specific i.MX platforms with SCU firmware (like i.MX8QM or i.MX8QXP).

Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f95ff838ac39f861d1f95a0f3bbb1e01c2517d79
CVE-2023-53575: kernel: wifi: iwlwifi: mvm: fix potential array out of bounds access
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: fix potential array out of bounds access

Account for IWL_SEC_WEP_KEY_OFFSET when needed while verifying
key_len size in iwl_mvm_sec_key_add().


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 133b1cd4d98bb8b272335c8e6b0e0c399c0b2ffa
CVE-2023-53576: kernel: null_blk: Always check queue mode setting from configfs
Component: kernel
Severity: Moderate
CWE: CWE-1288 (Improper Validation of Consistency within Input)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

A missing validation flaw was found in the Linux kernel null_blk driver's configuration handling. A local user with access to configfs can configure a null_blk device with queue_mode set to 1 (legacy I/O path), which is no longer supported, causing the driver to proceed without proper validation and triggering a kernel oops and denial of service through system crash.

Statement: The null_validate_conf() function fails to check the device queue mode setting when configured via configfs. When userspace sets queue_mode to 1 (NULL_Q_RQ, representing the legacy request-based I/O path), the driver should reject this configuration since the legacy path has been removed. Instead, the driver accepts the invalid mode and attempts to initialize with it, causing a kernel oops when the incompatible code paths execute.

Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.181, 5.15.113, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e732a266b973cd4e115e2cc2ea5007119e8a7fbc