huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53719: kernel: Linux kernel: Resource leak in arc_uart driver can cause denial of service
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-22T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within the arc_uart serial driver. This vulnerability involves a resource leak where memory allocated for hardware interaction is not properly released under certain error conditions. A local attacker with low privileges could exploit this to exhaust system resources, potentially leading to a Denial of Service (DoS).


Affected upstream versions: 3.17
Fixed upstream versions: 0, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3f00df24a5021a6f02c1830a290acd4bceb22a2d
CVE-2023-53722: kernel: md: raid1: fix potential OOB in raid1_remove_disk()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

md: raid1: fix potential OOB in raid1_remove_disk()

If rddev->raid_disk is greater than mddev->raid_disks, there will be
an out-of-bounds in raid1_remove_disk(). We have already found
similar reports as follows:

1) commit d17f744e883b ("md-raid10: fix KASAN warning")
2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5_remove_disk")

Fix this bug by checking whether the "number" variable is
valid.

Statement: Fixes a potential out-of-bounds access in raid1_remove_disk() when rdev->raid_disk exceeds the configured number of RAID1 mirrors, which could dereference beyond conf->mirrors. Practically this can lead to a kernel crash (DoS) during array reconfiguration or disk removal, but it requires root/RAID management privileges to reach this path (e.g., via mdadm), not ordinary I/O or remote traffic. For the CVSS the PR:H because triggering it requires high-privilege md/raid control operations.

Affected upstream versions: 3.3
Fixed upstream versions: 0, 4.14.326, 4.19.295, 5.10.197, 5.15.133, 5.4.257, 6.1.55, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: beedf40f73939f248c81802eda08a2a8148ea13e
CVE-2023-53726: kernel: arm64: csum: Fix OoB access in IP checksum code for negative lengths
Component: kernel
Severity: Moderate
CWE: CWE-839 (Numeric Range Comparison Without Minimum Check)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-10-22T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arm64: csum: Fix OoB access in IP checksum code for negative lengths

Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length
calls") added an early return for zero-length input, syzkaller has
popped up with an example of a _negative_ length which causes an
undefined shift and an out-of-bounds read:

 | BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39
 | Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5975
 |
 | CPU: 0 PID: 5975 Comm: syz-executor412 Not tainted 6.4.0-rc4-syzkaller-g908f31f2a05b #0
 | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
 | Call trace:
 |  dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
 |  show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
 |  __dump_stack lib/dump_stack.c:88 [inline]
 |  dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
 |  print_address_description mm/kasan/report.c:351 [inline]
 |  print_report+0x174/0x514 mm/kasan/report.c:462
 |  kasan_report+0xd4/0x130 mm/kasan/report.c:572
 |  kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
 |  __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31
 |  do_csum+0x44/0x254 arch/arm64/lib/csum.c:39
 |  csum_partial+0x30/0x58 lib/checksum.c:128
 |  gso_make_checksum include/linux/skbuff.h:4928 [inline]
 |  __udp_gso_segment+0xaf4/0x1bc4 net/ipv4/udp_offload.c:332
 |  udp6_ufo_fragment+0x540/0xca0 net/ipv6/udp_offload.c:47
 |  ipv6_gso_segment+0x5cc/0x1760 net/ipv6/ip6_offload.c:119
 |  skb_mac_gso_segment+0x2b4/0x5b0 net/core/gro.c:141
 |  __skb_gso_segment+0x250/0x3d0 net/core/dev.c:3401
 |  skb_gso_segment include/linux/netdevice.h:4859 [inline]
 |  validate_xmit_skb+0x364/0xdbc net/core/dev.c:3659
 |  validate_xmit_skb_list+0x94/0x130 net/core/dev.c:3709
 |  sch_direct_xmit+0xe8/0x548 net/sched/sch_generic.c:327
 |  __dev_xmit_skb net/core/dev.c:3805 [inline]
 |  __dev_queue_xmit+0x147c/0x3318 net/core/dev.c:4210
 |  dev_queue_xmit include/linux/netdevice.h:3085 [inline]
 |  packet_xmit+0x6c/0x318 net/packet/af_packet.c:276
 |  packet_snd net/packet/af_packet.c:3081 [inline]
 |  packet_sendmsg+0x376c/0x4c98 net/packet/af_packet.c:3113
 |  sock_sendmsg_nosec net/socket.c:724 [inline]
 |  sock_sendmsg net/socket.c:747 [inline]
 |  __sys_sendto+0x3b4/0x538 net/socket.c:2144

Extend the early return to reject negative lengths as well, aligning our
implementation with the generic code in lib/checksum.c


Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5a85727239a23de1cc8d93985f1056308128f3e2
CVE-2023-53731: kernel: Kernel: Denial of Service due to a Netlink subsystem deadlock
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-22T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a timing issue, specifically a potential deadlock in the Netlink communication subsystem. This could cause the system to become unresponsive, leading to a Denial of Service (DoS).


Affected upstream versions: 4.14.237 < 4.14.322, 4.19.195 < 4.19.291, 5.4.126 < 5.4.251, 5.10.44 < 5.10.188, 4.4.273 < 4.5, 4.9.273 < 4.10, 5.12.11 < 5.13, 5.13
Fixed upstream versions: 0, 4.10, 4.14.322, 4.19.291, 4.5, 5.10.188, 5.13, 5.15.121, 5.4.251, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c09e8e3f7fd432984bf5422302b093d2371dfc48
CVE-2023-53743: kernel: Linux kernel: Denial of Service due to PCI resource leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel's Peripheral Component Interconnect (PCI) subsystem. A local attacker with low privileges could exploit a vulnerability where the `release_resource()` function fails to free the resource list entry after coalescing. This resource leak could lead to a system crash, resulting in a Denial of Service (DoS).


Affected upstream versions: 6.1.40 < 6.1.53, 6.4.5 < 6.4.16, 5.15.181 < 5.16, 6.5
Fixed upstream versions: 0, 5.16, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4443f3695d581ad1a55f2ef59259dcd0c52402b3
CVE-2023-53744: kernel: soc: ti: pm33xx: Fix refcount leak in am33xx_pm_probe
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

The TI AM33xx power management driver in the Linux kernel fails to release reference counts acquired via wkup_m3_ipc_get() when errors occur during probe. Since the corresponding wkup_m3_ipc_put() call is missing from error paths, repeated probe failures gradually exhaust kernel resources.

Statement: This affects TI AM335x/AM437x SoC platforms running the pm33xx driver. The bug manifests only under error conditions during power management initialization, making real-world impact unlikely for most deployments.

Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 08310f810975c8c9e17c6ffb99fdb76a84e8adb7
CVE-2023-53746: kernel: s390/vfio-ap: fix memory leak in vfio_ap device driver
Component: kernel
Severity: Low
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

In the s390 VFIO-AP driver, memory allocated for the vfio_matrix_dev structure is never released during device cleanup. The release callback incorrectly uses dev_get_drvdata() to locate the object, but since it was never stored there, the function returns NULL and kfree() silently accepts it. The correct approach requires container_of() to retrieve the enclosing structure.

Statement: This leak occurs exclusively on IBM s390 mainframe systems using VFIO passthrough for cryptographic adapters. Systems not utilizing AP device virtualization remain unaffected.

Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.177, 5.15.106, 5.4.240, 6.1.23, 6.2.10, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5195de1d5f66b276683240a896783f7f43c4f664
CVE-2023-53747: kernel: Linux kernel: Denial of Service via use-after-free in vc_screen
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel. A local user can exploit a use-after-free (UAF) vulnerability in the `vc_screen` component. This occurs because a pointer to the `vc_data` structure is not reloaded after a console unlock operation, leading to the use of freed memory. Successful exploitation of this flaw can result in a denial of service, making the system unavailable.


Affected upstream versions: 2.6.38
Fixed upstream versions: 0, 4.14.327, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 934de9a9b659785fed3e820bc0c813a460c71fea
CVE-2023-53751: kernel: Linux kernel (CIFS): Use-after-free vulnerability allows data integrity compromise and denial of service
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel's Common Internet File System (CIFS) component. This use-after-free vulnerability occurs due to improper handling of server hostname information during connection re-establishment. An attacker on an adjacent network could exploit this, potentially leading to a compromise of data integrity or a denial of service.

Statement: This MODERATE impact use-after-free flaw in the Linux kernel's CIFS component. An attacker on an adjacent network could exploit this vulnerability during connection re-establishment, potentially leading to data integrity compromise or a denial of service.

Affected upstream versions: 5.0
Fixed upstream versions: 0, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 64d62ac6d6514cba1305bd08e271ec1843bdd612
CVE-2023-53753: kernel: drm/amd/display: fix mapping to non-allocated address
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

An out-of-bounds array access was found in the AMD display driver in the Linux kernel. The driver allocates GPIO registers using incorrect bounds, leading to access of non-allocated memory addresses. This could cause kernel memory corruption or crashes during display initialization.

Statement: Exploitation requires an AMD GPU with the affected display controller code path. The out-of-bounds access occurs during driver initialization rather than through user-controlled input, limiting attack surface.

Affected upstream versions: 4.15
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8ce8a443ddd9002861a4ee8a7e33a0c02717422f
CVE-2023-53755: kernel: dmaengine: ptdma: check for null desc before calling pt_cmd_callback
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

AMD PTDMA (Pass-Through DMA) engine crashes the kernel when pt_issue_pending() encounters empty descriptor queues. The function blindly invokes pt_cmd_callback() without verifying that a valid descriptor exists, triggering a NULL pointer dereference. This commonly surfaces during system shutdown on AMD platforms after the DMA engine has been active.

Statement: Systems with AMD processors utilizing PTDMA are vulnerable to kernel panics during specific shutdown sequences. The timing-dependent nature of this bug reduces reproducibility in normal operation.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8ae2113702613207efc05453bc9a3df2b992bf45
CVE-2023-53756: kernel: KVM: VMX: Fix crash due to uninitialized current_vmcs
Component: kernel
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

KVM: VMX: Fix crash due to uninitialized current_vmcs

KVM enables 'Enlightened VMCS' and 'Enlightened MSR Bitmap' when running as
a nested hypervisor on top of Hyper-V. When MSR bitmap is updated,
evmcs_touch_msr_bitmap function uses current_vmcs per-cpu variable to mark
that the msr bitmap was changed.

vmx_vcpu_create() modifies the msr bitmap via vmx_disable_intercept_for_msr
-> vmx_msr_bitmap_l01_changed which in the end calls this function. The
function checks for current_vmcs if it is null but the check is
insufficient because current_vmcs is not initialized. Because of this, the
code might incorrectly write to the structure pointed by current_vmcs value
left by another task. Preemption is not disabled, the current task can be
preempted and moved to another CPU while current_vmcs is accessed multiple
times from evmcs_touch_msr_bitmap() which leads to crash.

The manipulation of MSR bitmaps by callers happens only for vmcs01 so the
solution is to use vmx->vmcs01.vmcs instead of current_vmcs.

  BUG: kernel NULL pointer dereference, address: 0000000000000338
  PGD 4e1775067 P4D 0
  Oops: 0002 [#1] PREEMPT SMP NOPTI
  ...
  RIP: 0010:vmx_msr_bitmap_l01_changed+0x39/0x50 [kvm_intel]
  ...
  Call Trace:
   vmx_disable_intercept_for_msr+0x36/0x260 [kvm_intel]
   vmx_vcpu_create+0xe6/0x540 [kvm_intel]
   kvm_arch_vcpu_create+0x1d1/0x2e0 [kvm]
   kvm_vm_ioctl_create_vcpu+0x178/0x430 [kvm]
   kvm_vm_ioctl+0x53f/0x790 [kvm]
   __x64_sys_ioctl+0x8a/0xc0
   do_syscall_64+0x5c/0x90
   entry_SYSCALL_64_after_hwframe+0x63/0xcd


Affected upstream versions: 4.18
Fixed upstream versions: 0, 5.10.175, 5.15.103, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6baebcecf09acd19e2bab1c2911dcdba5d48a1dc
CVE-2023-53761: kernel: USB: usbtmc: Fix direction for 0-length ioctl control messages
Component: kernel
Severity: Moderate
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel’s USB Test and Measurement Class (usbtmc) driver. The driver did not properly validate the direction bit when handling ioctl calls for control messages with a length of zero. Under these circumstances, an incorrect direction can be submitted, leading to mismatches between the expected control direction and the bRequestType field.


Affected upstream versions: 4.20
Fixed upstream versions: 0, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7cef7681aa7719ff585dd06113a061ab2def7da0
CVE-2023-53762: kernel: Linux kernel Bluetooth: Denial of Service due to use-after-free in connection handling
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth subsystem. A use-after-free (UAF) vulnerability exists in the `hci_disconnect_all_sync` function. This can occur if a Bluetooth connection is deleted while a controller event is being processed concurrently. A local attacker could potentially exploit this flaw to trigger a system crash, leading to a Denial of Service.


Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a30c074f0b5b7f909a15c978fbc96a29e2f94e42
CVE-2023-53764: kernel: wifi: ath12k: Handle lock during peer_id find
Component: kernel
Severity: Moderate
CWE: CWE-414 (Missing Lock Check)
CVSS v3: 5.9 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-12-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: Handle lock during peer_id find

ath12k_peer_find_by_id() requires that the caller hold the
ab->base_lock. Currently the WBM error path does not hold
the lock and calling that function, leads to the
following lockdep_assert()in QCN9274:

[105162.160893] ------------[ cut here ]------------
[105162.160916] WARNING: CPU: 3 PID: 0 at drivers/net/wireless/ath/ath12k/peer.c:71 ath12k_peer_find_by_id+0x52/0x60 [ath12k]
[105162.160933] Modules linked in: ath12k(O) qrtr_mhi qrtr mac80211 cfg80211 mhi qmi_helpers libarc4 nvme nvme_core [last unloaded: ath12k(O)]
[105162.160967] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G        W  O       6.1.0-rc2+ #3
[105162.160972] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0056.2019.0506.1527 05/06/2019
[105162.160977] RIP: 0010:ath12k_peer_find_by_id+0x52/0x60 [ath12k]
[105162.160990] Code: 07 eb 0f 39 68 24 74 0a 48 8b 00 48 39 f8 75 f3 31 c0 5b 5d c3 48 8d bf b0 f2 00 00 be ff ff ff ff e8 22 20 c4 e2 85 c0 75 bf <0f> 0b eb bb 66 2e 0f 1f 84 00 00 00 00 00 41 54 4c 8d a7 98 f2 00
[105162.160996] RSP: 0018:ffffa223001acc60 EFLAGS: 00010246
[105162.161003] RAX: 0000000000000000 RBX: ffff9f0573940000 RCX: 0000000000000000
[105162.161008] RDX: 0000000000000001 RSI: ffffffffa3951c8e RDI: ffffffffa39a96d7
[105162.161013] RBP: 000000000000000a R08: 0000000000000000 R09: 0000000000000000
[105162.161017] R10: ffffa223001acb40 R11: ffffffffa3d57c60 R12: ffff9f057394f2e0
[105162.161022] R13: ffff9f0573940000 R14: ffff9f04ecd659c0 R15: ffff9f04d5a9b040
[105162.161026] FS:  0000000000000000(0000) GS:ffff9f0575600000(0000) knlGS:0000000000000000
[105162.161031] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[105162.161036] CR2: 00001d5c8277a008 CR3: 00000001e6224006 CR4: 00000000003706e0
[105162.161041] Call Trace:
[105162.161046]  <IRQ>
[105162.161051]  ath12k_dp_rx_process_wbm_err+0x6da/0xaf0 [ath12k]
[105162.161072]  ? ath12k_dp_rx_process_err+0x80e/0x15a0 [ath12k]
[105162.161084]  ? __lock_acquire+0x4ca/0x1a60
[105162.161104]  ath12k_dp_service_srng+0x263/0x310 [ath12k]
[105162.161120]  ath12k_pci_ext_grp_napi_poll+0x1c/0x70 [ath12k]
[105162.161133]  __napi_poll+0x22/0x260
[105162.161141]  net_rx_action+0x2f8/0x380
[105162.161153]  __do_softirq+0xd0/0x4c9
[105162.161162]  irq_exit_rcu+0x88/0xe0
[105162.161169]  common_interrupt+0xa5/0xc0
[105162.161174]  </IRQ>
[105162.161179]  <TASK>
[105162.161184]  asm_common_interrupt+0x22/0x40

Handle spin lock/unlock in WBM error path to hold the necessary lock
expected by ath12k_peer_find_by_id().

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-03171-QCAHKSWPL_SILICONZ-1


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9faf7c696610a348ca94a224d55c946b19b3279d
CVE-2023-53765: kernel: dm cache: free background tracker's queued work in btracker_destroy
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A memory leak was found in the device-mapper cache target in the Linux kernel. The btracker_destroy() function fails to free queued work items from the background tracker before destroying the slab cache. This triggers a BUG when kmem_cache_shutdown() finds objects still remaining.

Statement: The vulnerability manifests during dm-cache device teardown, causing a kernel BUG rather than silent memory corruption. Systems using LVM caching or dm-cache directly are potentially affected during cache device removal.

Affected upstream versions: 4.12
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 673a3af21d5e3ed769f3eaed0c888244290a3506
CVE-2023-53767: kernel: Linux kernel: Denial of Service via memory leak in ath12k Wi-Fi driver
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. A local user could exploit a memory leak in the `ath12k_qmi_driver_event_work()` function. This occurs when the `ATH12K_FLAG_UNREGISTERING` bit is set, preventing the proper freeing of allocated memory. This memory leak can lead to a denial of service (DoS) on the system.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a87f59041a7f77b4bdab05cea60ac6adc69dc5d2
CVE-2023-53768: kernel: regmap-irq: Fix out-of-bounds access when allocating config buffers
Component: kernel
Severity: Low
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-08T00:00:00+00:00

An off-by-one style bug exists in regmap_add_irq_chip_fwnode() where the allocation loop uses num_config_regs instead of num_config_bases as its termination condition. When num_config_regs exceeds num_config_bases, memory beyond the allocated row pointer array gets overwritten. KASAN caught this corruption manifesting as crashes on Qualcomm db845c hardware.

Statement: Devices using regmap-irq with specific IRQ type register configurations are susceptible. The bug requires a particular relationship between config_bases and config_regs counts, limiting exposure to certain hardware platforms.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b1a726ad33e585e3d9fa70712df31ae105e4532c