huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53386: kernel: Bluetooth: Fix potential use-after-free when clear keys
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Fix potential use-after-free when clear keys

Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in
hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu()
call.

Statement: A use-after-free bug was identified in the Bluetooth stack when clearing link and security keys. The code iterated with list_for_each_entry() and freed items with kfree_rcu(), allowing access to freed memory.
A local user with Bluetooth administration privileges (e.g. able to unpair devices, reset the adapter or manage stored keys) can reliably trigger this bug, causing use-after-free and likely DoS/kernel crash. And the confidential data leakage from freed memory is theoretically possible. Triggering this remotely is difficult — an unauthenticated/unknown device generally cannot force the kernel to clear those local key lists — and would realistically require a device that is already paired/authenticated (or otherwise an exploit chain) to influence the same code paths.

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e87da6a0ac6e631454e7da53a76aa9fe44aaa5dd
CVE-2023-53390: kernel: drivers: base: dd: fix memory leak with using debugfs_lookup()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drivers: base: dd: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.100, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7f1e53f88e8babf293ec052b70aa9d2a3554360c
CVE-2023-53392: kernel: HID: intel-ish-hid: Fix kernel panic during warm reset
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-ish-hid: Fix kernel panic during warm reset

During warm reset device->fw_client is set to NULL. If a bus driver is
registered after this NULL setting and before new firmware clients are
enumerated by ISHTP, kernel panic will result in the function
ishtp_cl_bus_match(). This is because of reference to
device->fw_client->props.protocol_name.

ISH firmware after getting successfully loaded, sends a warm reset
notification to remove all clients from the bus and sets
device->fw_client to NULL. Until kernel v5.15, all enabled ISHTP kernel
module drivers were loaded right after any of the first ISHTP device was
registered, regardless of whether it was a matched or an unmatched
device. This resulted in all drivers getting registered much before the
warm reset notification from ISH.

Starting kernel v5.16, this issue got exposed after the change was
introduced to load only bus drivers for the respective matching devices.
In this scenario, cros_ec_ishtp device and cros_ec_ishtp driver are
registered after the warm reset device fw_client NULL setting.
cros_ec_ishtp driver_register() triggers the callback to
ishtp_cl_bus_match() to match ISHTP driver to the device and causes kernel
panic in guid_equal() when dereferencing fw_client NULL pointer to get
protocol_name.

Statement: A race during ISH warm reset left device->fw_client as NULL while new ISHTP client drivers were being matched, leading to a NULL dereference in ishtp_cl_bus_match() and a kernel panic. Exploitation requires local, high-privilege control over driver registration and device timing. It isn’t remotely triggerable.

Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.25, 6.2.12, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6c8cc40c588f8080a164d88336b1490279e0f1da
CVE-2023-53393: kernel: RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device
Component: kernel
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

An out-of-bounds write vulnerability exists in the linux kernel, such that when mlx5_ib_get_hw_stats() is used forthe  device (port_num = 0),
There is a special handling in order to use the correct counters, but,
port_num is being passed down the stack without any change leading to damage in system availability and integrity.

Statement: A flaw in mlx5_ib_get_hw_stats() allowed port_num=0 (device-level query) to propagate down the stack, where code paths assumed port_num >= 1, leading to a NULL-pointer dereference and kernel oops during stats collection or device registration. The fix normalizes device queries by forcing port_num=1 before accessing per-port data and removes an unused variable. Exploitation requires local, highly privileged access to the RDMA device stack (e.g., devlink/IB admin), and impact is limited to local DoS.

Affected upstream versions: 4.16
Fixed upstream versions: 0, 5.15.87, 6.0.19, 6.1.5, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8d89870d63758363b07ace5c2df82d6bf865f78b
CVE-2023-53394: kernel: net/mlx5e: xsk: Fix crash on regular rq reactivation
Component: kernel
Severity: Moderate
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: xsk: Fix crash on regular rq reactivation

When the regular rq is reactivated after the XSK socket is closed
it could be reading stale cqes which eventually corrupts the rq.
This leads to no more traffic being received on the regular rq and a
crash on the next close or deactivation of the rq.

Kal Cuttler Conely reported this issue as a crash on the release
path when the xdpsock sample program is stopped (killed) and restarted
in sequence while traffic is running.

This patch flushes all cqes when during the rq flush. The cqe flushing
is done in the reset state of the rq. mlx5e_rq_to_ready code is moved
into the flush function to allow for this.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 02a84eb2af6bea7871cd34264fb27f141f005fd9
CVE-2023-53395: kernel: ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer

ACPICA commit 90310989a0790032f5a0140741ff09b545af4bc5

According to the ACPI specification 19.6.134, no argument is required to be passed for ASL Timer instruction. For taking care of no argument, AML_NO_OPERAND_RESOLVE flag is added to ASL Timer instruction opcode.

When ASL timer instruction interpreted by ACPI interpreter, getting error. After adding AML_NO_OPERAND_RESOLVE flag to ASL Timer instruction opcode, issue is not observed.

=============================================================
UBSAN: array-index-out-of-bounds in acpica/dswexec.c:401:12 index -1 is out of range for type 'union acpi_operand_object *[9]'
CPU: 37 PID: 1678 Comm: cat Not tainted
6.0.0-dev-th500-6.0.y-1+bcf8c46459e407-generic-64k
HW name: NVIDIA BIOS v1.1.1-d7acbfc-dirty 12/19/2022 Call trace:
 dump_backtrace+0xe0/0x130
 show_stack+0x20/0x60
 dump_stack_lvl+0x68/0x84
 dump_stack+0x18/0x34
 ubsan_epilogue+0x10/0x50
 __ubsan_handle_out_of_bounds+0x80/0x90
 acpi_ds_exec_end_op+0x1bc/0x6d8
 acpi_ps_parse_loop+0x57c/0x618
 acpi_ps_parse_aml+0x1e0/0x4b4
 acpi_ps_execute_method+0x24c/0x2b8
 acpi_ns_evaluate+0x3a8/0x4bc
 acpi_evaluate_object+0x15c/0x37c
 acpi_evaluate_integer+0x54/0x15c
 show_power+0x8c/0x12c [acpi_power_meter]


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.14.326, 4.19.295, 5.10.197, 5.15.133, 5.4.257, 6.1.55, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2f2a5905303ae230b5159fcd8cdcd5b3e7ad5e2d
CVE-2023-53397: kernel: modpost: fix off by one in is_executable_section()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-09-18T00:00:00+00:00

A flaw was exist's in the Linux kernel’s module-post processing component, in the function is_executable_section(). Due to an off-by-one error (using > instead of >=), the code may perform an out-of-bounds array access.


Affected upstream versions: 4.1
Fixed upstream versions: 0, 4.14.322, 5.10.188, 5.15.121, 5.4.251, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7ee557590bac154d324de446d1cd0444988bd511
CVE-2023-53398: kernel: mlx5: fix possible ptp queue fifo use-after-free
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mlx5: fix possible ptp queue fifo use-after-free

Fifo indexes are not checked during pop operations and it leads to
potential use-after-free when poping from empty queue. Such case was
possible during re-sync action. WARN_ON_ONCE covers future cases.

There were out-of-order cqe spotted which lead to drain of the queue and
use-after-free because of lack of fifo pointers check. Special check and
counter are added to avoid resync operation if SKB could not exist in the
fifo because of OOO cqe (skb_id must be between consumer and producer
index).

Statement: This vulnerability is present in part of the network driver that runs when a system is configured to use special hardware time-stamping features. To enable these features, a user must have elevated privileges (ex. `CAP_NET_ADMIN`) to control the hardware itself and trigger the bug.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 52e6e7a0bc04c85012a9251c7cf2d444a77eb966
CVE-2023-53400: kernel: Linux kernel: ALSA HDA denial of service via array overflow
Component: kernel
Severity: Low
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) High Definition Audio (HDA) component. A local user could exploit this vulnerability by providing specially crafted 9.1 surround channel names, leading to an array overflow in the get_line_out_pfx() function. This can cause a system crash, resulting in a denial of service.


Affected upstream versions: 3.9
Fixed upstream versions: 0, 4.14.316, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 082dcd51667b29097500c824c37f24da997a6a8a
CVE-2023-53401: kernel: mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required()
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-09-18T00:00:00+00:00

A null pointer dereference exists in the linux kernel such that in obj_stock_flush_required():stock->cached_objcg can be reset between the check and dereference, resulting in damage to the availability of the system.

Statement: A race in the memcg/objcg accounting allowed stock->cached_objcg to change between check and use, leading to a NULL pointer dereference and kernel crash under concurrency. The fix uses READ_ONCE/WRITE_ONCE for all accesses to cached_objcg, eliminating the data race observed by KCSAN. Impact is a local kernel DoS

Affected upstream versions: 5.9
Fixed upstream versions: 0, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 33d9490b27e5d8da4444aefd714a4f50189db978
CVE-2023-53402: kernel: kernel/printk/index.c: fix memory leak with using debugfs_lookup()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

kernel/printk/index.c: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.


Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.100, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2e07fa2e30d48d24a791483774a3d4b76769e0cf
CVE-2023-53409: kernel: drivers: base: component: fix memory leak with using debugfs_lookup()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drivers: base: component: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.100, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 09709a49283f79184c998d6dafcc01590e4d654d
CVE-2023-53410: kernel: USB: ULPI: fix memory leak with using debugfs_lookup()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: ULPI: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dcbe69f4f743a938344b32e60531ea55355e0c08
CVE-2023-53415: kernel: USB: dwc3: fix memory leak with using debugfs_lookup()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: dwc3: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.

Note, the root dentry for the debugfs directory for the device needs to
be saved so we don't have to keep looking it up, which required a bit
more refactoring to properly create and remove it when needed.


Affected upstream versions: 4.19.196 < 4.20, 5.4.128 < 5.5, 5.10.46 < 5.11, 5.12.13 < 5.13, 5.13
Fixed upstream versions: 0, 4.20, 5.11, 5.13, 5.15.100, 5.5, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cf52c320cf74245ce1c12b0bd48f77b87d77fbc9
CVE-2023-53421: kernel: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()

When blkg_alloc() is called to allocate a blkcg_gq structure
with the associated blkg_iostat_set's, there are 2 fields within
blkg_iostat_set that requires proper initialization - blkg & sync.
The former field was introduced by commit 3b8cc6298724 ("blk-cgroup:
Optimize blkcg_rstat_flush()") while the later one was introduced by
commit f73316482977 ("blk-cgroup: reimplement basic IO stats using
cgroup rstat").

Unfortunately those fields in the blkg_iostat_set's are not properly
re-initialized when they are cleared in v1's blkcg_reset_stats(). This
can lead to a kernel panic due to NULL pointer access of the blkg
pointer. The missing initialization of sync is less problematic and
can be a problem in a debug kernel due to missing lockdep initialization.

Fix these problems by re-initializing them after memory clearing.

Statement: The bug stems from clearing per-CPU blkg_iostat_set structures in blkcg_reset_stats() without re-initializing required fields (blkg pointer and sync stats), leading to a possible NULL dereference and kernel panic when stats are accessed later. Triggering this requires privileged access to the blk-cgroup interface (e.g., resetting stats), so it’s not remotely exploitable. Impact is a local DoS.

Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.258, 5.15.199, 6.1.162, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 58c135513562698f222a58ba07dbdfcfb268aa0d
CVE-2023-53422: kernel: wifi: iwlwifi: fw: fix memory leak in debugfs
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: fw: fix memory leak in debugfs

Fix a memory leak that occurs when reading the fw_info
file all the way, since we return NULL indicating no
more data, but don't free the status tracking object.

Statement: A memory leak in iwlwifi’s debugfs fw_info reader caused the per-read iterator state to never be freed at end-of-file. The fix frees the state object when the iterator returns NULL. Impact is limited to privileged local users reading debugfs.

Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 89496d6cff297c88fe0286a440c380ceb172da2b
CVE-2023-53426: kernel: Linux kernel: Denial of Service in xsk_diag due to use-after-free during socket cleanup
Component: kernel
Severity: Low
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

A flaw was found in the Linux kernel's xsk_diag interface. This vulnerability, a use-after-free error, occurs when the xsk_diag interface is used after a socket has been unbound from its device, such as during socket closure or device removal. A local attacker could exploit this flaw to cause a system crash, leading to a Denial of Service (DoS).


Affected upstream versions: 5.15.33 < 5.15.132, 5.16.19 < 5.17, 5.17.2 < 5.18, 5.18
Fixed upstream versions: 0, 5.15.132, 5.17, 5.18, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5979985f2d6b565b6cf0f79a62670a2855c0e96c
CVE-2023-53430: kernel: wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mt76: dma: fix memory leak running mt76_dma_tx_cleanup

Fix device unregister memory leak and alway cleanup all configured
rx queues in mt76_dma_tx_cleanup routine.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 604990fee0a6d608a6cca179ae474f2a1c6add8a
CVE-2023-53437: kernel: media: uvcvideo: Handle cameras with invalid descriptors
Component: kernel
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 4.6 (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: uvcvideo: Handle cameras with invalid descriptors

If the source entity does not contain any pads, do not create a link.

Statement: This patch addresses a potential invalid memory access in the UVC (USB Video Class) subsystem when handling malformed or incomplete camera descriptors. Previously, a missing or invalid source entity without pads could cause link creation to fail with undefined behavior.

Affected upstream versions: 4.14.224 < 4.14.308, 4.19.179 < 4.19.276, 5.4.103 < 5.4.235, 5.10.21 < 5.10.173, 4.4.260 < 4.5, 4.9.260 < 4.10, 5.11.4 < 5.12, 5.12
Fixed upstream versions: 0, 4.10, 4.14.308, 4.19.276, 4.5, 5.10.173, 5.12, 5.15.100, 5.4.235, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c8f4a424af5879baefb0fb8a8a09b09ea1779483
CVE-2023-53442: kernel: ice: Block switchdev mode when ADQ is active and vice versa
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: Block switchdev mode when ADQ is active and vice versa

ADQ and switchdev are not supported simultaneously. Enabling both at the
same time can result in nullptr dereference.

To prevent this, check if ADQ is active when changing devlink mode to
switchdev mode, and check if switchdev is active when enabling ADQ.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1c82d1b736ce85e77fd4da05eca6f1f4a52a2bc3