huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-54100: kernel: scsi: qedi: Fix use after free bug in qedi_remove()
Component: kernel
Severity: Low
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's QLogic qedi iSCSI driver. When the driver is removed via qedi_remove(), the SCSI host structure may be freed while recovery_work or board_disable_work are still running. The work handlers then access the freed qedi->shost structure, causing a use-after-free condition.

Statement: This flaw affects systems with QLogic iSCSI HBAs using the qedi driver. The race condition occurs during driver removal when recovery or board disable operations are in progress. While the UAF requires specific timing between driver removal and recovery work execution, it can cause kernel crashes on affected systems.

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.180, 5.15.112, 6.1.29, 6.2.16, 6.3.3, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fa19c533ab19161298f0780bcc6523af88f6fd20
CVE-2023-54102: kernel: scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow
Component: kernel
Severity: Moderate
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow

A static code analysis tool flagged the possibility of buffer overflow when
using copy_from_user() for a debugfs entry.

Currently, it is possible that copy_from_user() copies more bytes than what
would fit in the mybuf char array.  Add a min() restriction check between
sizeof(mybuf) - 1 and nbytes passed from the userspace buffer to protect
against buffer overflow.


Affected upstream versions: 5.1
Fixed upstream versions: 0, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 644a9d5e22761a41d5005a26996a643da96de962
CVE-2023-54106: kernel: Linux kernel: Denial of Service via memory leak in mlx5e_init_rep_rx
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a memory leak in the `mlx5e_init_rep_rx` function within the `net/mlx5` module. This vulnerability occurs when memory is not properly released during an error handling path. Successful exploitation could lead to a Denial of Service (DoS) condition, making the system unresponsive.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0582a3caaa3e2f7b80bcb113ad3c910eac15a63e
CVE-2023-54108: kernel: scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests
Component: kernel
Severity: Low
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests

The following message and call trace was seen with debug kernels:

DMA-API: qla2xxx 0000:41:00.0: device driver failed to check map
error [device address=0x00000002a3ff38d8] [size=1024 bytes] [mapped as
single]
WARNING: CPU: 0 PID: 2930 at kernel/dma/debug.c:1017
	 check_unmap+0xf42/0x1990

Call Trace:
	debug_dma_unmap_page+0xc9/0x100
	qla_nvme_ls_unmap+0x141/0x210 [qla2xxx]

Remove DMA mapping from the driver altogether, as it is already done by FC
layer. This prevents the warning.

Statement: This vulnerability is rated Low for Red Hat Enterprise Linux 8 and 9. The flaw in the `qla2xxx` SCSI driver can lead to a DMA-API call trace, potentially impacting system availability. This issue affects systems utilizing QLogic Fibre Channel HBAs with NVMe LS requests. Triggering this vulnerability affects availability, though it will not typically crash the kernel, but more likely degrade system stability or flood logs.

Affected upstream versions: 5.4.189 < 5.4.235, 5.10.110 < 5.10.173, 5.15.33 < 5.15.99, 5.16.19 < 5.17, 5.17.2 < 5.18, 5.18
Fixed upstream versions: 0, 5.10.173, 5.15.99, 5.17, 5.18, 5.4.235, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3a564de3a299856f2cbd289649cea2e20d671a43
CVE-2023-54113: kernel: rcu: dump vmalloc memory info safely
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
CVSS v3: 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Read-Copy-Update (RCU) core of the Linux kernel related to how memory information for vmalloc-allocated objects is dumped. Under certain sequences, calling call_rcu() may lead to the invocation of vmalloc_dump_obj() while holding the vmap_area_lock spinlock in an interrupt context. Because the spinlock cannot be held safely in that context, this could result in a deadlock or kernel hang, particularly under Real-Time (Preempt-RT) workloads where RCU torture testing surfaced lock dependency warnings.


Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0a22f9c17b1aa2a35b5eedee928f7841595b55cd
CVE-2023-54114: kernel: Linux kernel: Denial of Service due to incorrect network packet processing in NSH module
Component: kernel
Severity: Low
CWE: CWE-253 (Incorrect Check of Function Return Value)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within its Network Service Header (NSH) module. A local attacker could exploit this vulnerability by sending specially crafted network packets, which would cause the system to crash. This issue, a type of Denial of Service (DoS), arises from an incorrect calculation during network packet processing, leading to a critical error in memory management.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 4.14.316, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2f88c8d38ecf5ed0273f99a067246899ba499eb2
CVE-2023-54117: kernel: s390/dcssblk: fix kernel crash with list_add corruption
Component: kernel
Severity: Low
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A kernel crash vulnerability was found in the Linux kernel's s390 dcssblk driver. Missing dax_remove_host() calls in the device removal path, combined with broken error handling in the device add path, cause stale xarray entries and list_add corruption. When a previously used gendisk pointer is reused, the kernel crashes with list corruption during subsequent device operations.

Statement: This flaw affects IBM s390 systems using the dcssblk driver for DCSS (Discontiguous Saved Segments) block devices. The crash occurs after device add/remove cycles when the same gendisk pointer is reused. This is an s390-specific issue and does not affect other architectures.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6489ec0107860345bc57dcde39e63dfb05ac5c11
CVE-2023-54118: kernel: serial: sc16is7xx: setup GPIO controller later in probe
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

serial: sc16is7xx: setup GPIO controller later in probe

The GPIO controller component of the sc16is7xx driver is setup too
early, which can result in a race condition where another device tries
to utilise the GPIO lines before the sc16is7xx device has finished
initialising.

This issue manifests itself as an Oops when the GPIO lines are configured:

    Unable to handle kernel read from unreadable memory at virtual address
    ...
    pc : sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx]
    lr : sc16is7xx_gpio_direction_output+0x4c/0x108 [sc16is7xx]
    ...
    Call trace:
    sc16is7xx_gpio_direction_output+0x68/0x108 [sc16is7xx]
    gpiod_direction_output_raw_commit+0x64/0x318
    gpiod_direction_output+0xb0/0x170
    create_gpio_led+0xec/0x198
    gpio_led_probe+0x16c/0x4f0
    platform_drv_probe+0x5c/0xb0
    really_probe+0xe8/0x448
    driver_probe_device+0xe8/0x138
    __device_attach_driver+0x94/0x118
    bus_for_each_drv+0x8c/0xe0
    __device_attach+0x100/0x1b8
    device_initial_probe+0x28/0x38
    bus_probe_device+0xa4/0xb0
    deferred_probe_work_func+0x90/0xe0
    process_one_work+0x1c4/0x480
    worker_thread+0x54/0x430
    kthread+0x138/0x150
    ret_from_fork+0x10/0x1c

This patch moves the setup of the GPIO controller functions to later in the
probe function, ensuring the sc16is7xx device has already finished
initialising by the time other devices try to make use of the GPIO lines.
The error handling has also been reordered to reflect the new
initialisation order.


Affected upstream versions: 3.16
Fixed upstream versions: 0, 5.10.173, 5.15.100, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 17b96b5c19bec791b433890549e44ca523dc82aa
CVE-2023-54119: kernel: inotify: Avoid reporting event with invalid wd
Component: kernel
Severity: Low
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

A race condition was found in the Linux kernel's inotify subsystem. When inotify_freeing_mark() races with inotify_handle_inode_event(), the event handler may read i_mark->wd after it has been reset to -1. This causes an invalid watch descriptor value of -1 to be reported to userspace applications, potentially confusing inotify listeners.

Statement: This flaw results in incorrect data being delivered to userspace applications via the inotify interface. While applications may become confused by receiving an invalid watch descriptor, this does not cause a kernel crash or memory corruption. The impact is limited to potential misbehavior in userspace file monitoring applications.

Affected upstream versions: 2.6.31
Fixed upstream versions: 0, 5.10.180, 5.15.112, 5.4.243, 6.1.29, 6.2.16, 6.3.3, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8fb33166aed888769ea63d6af49515893f8a1f14
CVE-2023-54120: kernel: Linux kernel Bluetooth: Denial of Service via race condition in hidp_session_thread
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth subsystem. A race condition in the `hidp_session_thread` can lead to a use-after-free vulnerability. This occurs when a timer is active while its deletion function is called, causing memory to be accessed after it has been freed. A local attacker could exploit this to trigger a kernel panic, resulting in a Denial of Service (DoS) to the system.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.14.313, 4.19.281, 5.10.178, 5.15.108, 5.4.241, 6.1.25, 6.2.12, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 152f47bd6b995e0e98c85672f6d19894bc287ef2
CVE-2023-54123: kernel: Kernel: Denial of Service due to memory leak in RAID10 functionality
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. This vulnerability, a memory leak, occurs within the RAID10 functionality when handling certain error conditions. A local attacker with low privileges could exploit this by triggering the specific error path, potentially leading to a denial of service (DoS) due to system resource exhaustion.


Affected upstream versions: 4.12
Fixed upstream versions: 0, 4.19.283, 5.10.180, 5.15.111, 5.4.243, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 133008af833b4f2e021d2c294c29c70364a3f0ba
CVE-2023-54131: kernel: Linux kernel rt2x00 Wi-Fi driver: Denial of Service via memory leak during device removal
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's rt2x00 Wi-Fi driver. A local user could exploit this vulnerability when a rt2x00 device is removed, as its associated channel surveys are not properly freed. This leads to a memory leak, which could result in a Denial of Service (DoS) due to resource exhaustion, making the system unavailable to legitimate users.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: eb77c0c0a17c53d83b5fe8e46490fb0a7ed9e6af
CVE-2023-54135: kernel: maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()
Component: kernel
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()

Check the write offset end bounds before using it as the offset into the
pivot array.  This avoids a possible out-of-bounds access on the pivot
array if the write extends to the last slot in the node, in which case the
node maximum should be used as the end pivot.

akpm: this doesn't affect any current callers, but new users of mapletree
may encounter this problem if backported into earlier kernels, so let's
fix it in -stable kernels in case of this.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.37, 6.3.11, 6.4.1, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4e2ad53ababeaac44d71162650984abfe783960c
CVE-2023-54136: kernel: serial: sprd: Fix DMA buffer leak issue
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the serial: sprd driver in the Linux kernel where a DMA buffer allocated during driver probe was not released when _probe() returned failure. This results in a memory leak that, under repeated probe failure conditions, could cause elevated kernel memory usage and potential resource exhaustion


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.195, 5.15.132, 5.4.257, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c65be6ad55e5e45f8c4e40e1d8d7fe0e21b26e77
CVE-2023-54137: kernel: Linux kernel: Information disclosure in VFIO Type1 module via uninitialized stack memory
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Virtual Function I/O (VFIO) Type1 module. This vulnerability allows a local user to expose uninitialized kernel stack memory to userspace, leading to information disclosure. The flaw occurs because a specific data structure, vfio_iommu_type1_info_cap_migration, contains an uninitialized memory region that is copied to userspace.


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad83d83dd891244de0d07678b257dc976db7c132
CVE-2023-54141: kernel: wifi: ath11k: Add missing hw_ops->get_ring_selector() for IPQ5018
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was discovered in the ath11k wireless driver in the Linux kernel where the hardware operations structure for the IPQ5018 platform did not include a hw_ops->get_ring_selector callback. When network traffic is being sent after clients have connected, this missing function pointer may be dereferenced, causing a NULL pointer exception and a kernel backtrace or crash.


Affected upstream versions: 6.1.175 < 6.2, 6.3
Fixed upstream versions: 0, 6.2, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d1992d72a359732f143cc962917104d193705da7
CVE-2023-54144: kernel: drm/amdkfd: Fix kernel warning during topology setup
Component: kernel
Severity: Low
CWE: CWE-909 (Missing Initialization of Resource)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Fix kernel warning during topology setup

This patch fixes the following kernel warning seen during
driver load by correctly initializing the p2plink attr before
creating the sysfs file:

[  +0.002865] ------------[ cut here ]------------
[  +0.002327] kobject: '(null)' (0000000056260cfb): is not initialized, yet kobject_put() is being called.
[  +0.004780] WARNING: CPU: 32 PID: 1006 at lib/kobject.c:718 kobject_put+0xaa/0x1c0
[  +0.001361] Call Trace:
[  +0.001234]  <TASK>
[  +0.001067]  kfd_remove_sysfs_node_entry+0x24a/0x2d0 [amdgpu]
[  +0.003147]  kfd_topology_update_sysfs+0x3d/0x750 [amdgpu]
[  +0.002890]  kfd_topology_add_device+0xbd7/0xc70 [amdgpu]
[  +0.002844]  ? lock_release+0x13c/0x2e0
[  +0.001936]  ? smu_cmn_send_smc_msg_with_param+0x1e8/0x2d0 [amdgpu]
[  +0.003313]  ? amdgpu_dpm_get_mclk+0x54/0x60 [amdgpu]
[  +0.002703]  kgd2kfd_device_init.cold+0x39f/0x4ed [amdgpu]
[  +0.002930]  amdgpu_amdkfd_device_init+0x13d/0x1f0 [amdgpu]
[  +0.002944]  amdgpu_device_init.cold+0x1464/0x17b4 [amdgpu]
[  +0.002970]  ? pci_bus_read_config_word+0x43/0x80
[  +0.002380]  amdgpu_driver_load_kms+0x15/0x100 [amdgpu]
[  +0.002744]  amdgpu_pci_probe+0x147/0x370 [amdgpu]
[  +0.002522]  local_pci_probe+0x40/0x80
[  +0.001896]  work_for_cpu_fn+0x10/0x20
[  +0.001892]  process_one_work+0x26e/0x5a0
[  +0.002029]  worker_thread+0x1fd/0x3e0
[  +0.001890]  ? process_one_work+0x5a0/0x5a0
[  +0.002115]  kthread+0xea/0x110
[  +0.001618]  ? kthread_complete_and_exit+0x20/0x20
[  +0.002422]  ret_from_fork+0x1f/0x30
[  +0.001808]  </TASK>
[  +0.001103] irq event stamp: 59837
[  +0.001718] hardirqs last  enabled at (59849): [<ffffffffb30fab12>] __up_console_sem+0x52/0x60
[  +0.004414] hardirqs last disabled at (59860): [<ffffffffb30faaf7>] __up_console_sem+0x37/0x60
[  +0.004414] softirqs last  enabled at (59654): [<ffffffffb307d9c7>] irq_exit_rcu+0xd7/0x130
[  +0.004205] softirqs last disabled at (59649): [<ffffffffb307d9c7>] irq_exit_rcu+0xd7/0x130
[  +0.004203] ---[ end trace 0000000000000000 ]---


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.0.19, 6.1.5, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2d5a6742a242091292cc0a2b607be701a45d0c4e
CVE-2023-54145: kernel: Linux kernel: BPF verifier log truncation via crafted user input
Component: kernel
Severity: Low
CWE: CWE-410 (Insufficient Resource Pool)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) verifier log. A local user can exploit this by providing excessively long BPF Type Format (BTF) names or BTF.ext source code line strings. This can lead to the truncation of a single verifier log line, potentially obscuring important debugging information. While the kernel code continues to function correctly, this issue represents a minor denial of service affecting the logging mechanism.


Affected upstream versions: 4.15
Fixed upstream versions: 0, 6.1.107, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 40c88c429a598006f91ad7a2b89856cd50b3a008
CVE-2023-54146: kernel: x86/kexec: Fix double-free of elf header buffer
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/kexec: Fix double-free of elf header buffer

After

  b3e34a47f989 ("x86/kexec: fix memory leak of elf header buffer"),

freeing image->elf_headers in the error path of crash_load_segments()
is not needed because kimage_file_post_load_cleanup() will take
care of that later. And not clearing it could result in a double-free.

Drop the superfluous vfree() call at the error path of
crash_load_segments().


Affected upstream versions: 5.15.46 < 5.15.87, 5.17.14 < 5.18, 5.18.3 < 5.19, 5.19
Fixed upstream versions: 0, 5.15.87, 5.18, 5.19, 6.0.19, 6.1.5, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4c71a552b97fb4f46eb300224434fe56fcf4f254
CVE-2023-54148: kernel: net/mlx5e: Move representor neigh cleanup to profile cleanup_tx
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was identified in the Linux kernel’s Mellanox mlx5 Ethernet driver (net/mlx5e) related to the cleanup order of neighbour information when handling offloaded IP tunnel encapsulation rules in ECMP (Equal-Cost Multipath) mode. In certain scenarios — such as unloading the eswitch device while an offloaded ECMP rule is still active — the representor neighbour data for the peer uplink may be cleaned up prematurely in the profile->disable callback before the intended profile->cleanup_tx callback. This premature cleanup can result in a use-after-free condition when subsequent code attempts to access the freed neighbour data, potentially leading to kernel faults


Affected upstream versions: 6.1.31 < 6.1.45, 6.3.5 < 6.4, 6.4
Fixed upstream versions: 0, 6.1.45, 6.4, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d628ba98eb1637acce44001e04c718d8dbb1f7ce
CVE-2023-54152: kernel: Linux kernel (CAN J1939): Denial of Service via deadlock
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local user with low privileges could exploit a deadlock vulnerability in the Controller Area Network (CAN) bus J1939 protocol implementation. This occurs when specific data transfer and error queue handling events coincide with a network interface going down. Successful exploitation can lead to a Denial of Service (DoS), rendering the system unresponsive.


Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.106, 6.1.23, 6.2.10, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8a581b71cf686b4cd1a85c9c2dfc2fb88382c3b4