huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-54153: kernel: ext4: turn quotas off if mount failed after enabling quotas
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: turn quotas off if mount failed after enabling quotas

Yi found during a review of the patch "ext4: don't BUG on inconsistent
journal feature" that when ext4_mark_recovery_complete() returns an error
value, the error handling path does not turn off the enabled quotas,
which triggers the following kmemleak:

================================================================
unreferenced object 0xffff8cf68678e7c0 (size 64):
comm "mount", pid 746, jiffies 4294871231 (age 11.540s)
hex dump (first 32 bytes):
00 90 ef 82 f6 8c ff ff 00 00 00 00 41 01 00 00  ............A...
c7 00 00 00 bd 00 00 00 0a 00 00 00 48 00 00 00  ............H...
backtrace:
[<00000000c561ef24>] __kmem_cache_alloc_node+0x4d4/0x880
[<00000000d4e621d7>] kmalloc_trace+0x39/0x140
[<00000000837eee74>] v2_read_file_info+0x18a/0x3a0
[<0000000088f6c877>] dquot_load_quota_sb+0x2ed/0x770
[<00000000340a4782>] dquot_load_quota_inode+0xc6/0x1c0
[<0000000089a18bd5>] ext4_enable_quotas+0x17e/0x3a0 [ext4]
[<000000003a0268fa>] __ext4_fill_super+0x3448/0x3910 [ext4]
[<00000000b0f2a8a8>] ext4_fill_super+0x13d/0x340 [ext4]
[<000000004a9489c4>] get_tree_bdev+0x1dc/0x370
[<000000006e723bf1>] ext4_get_tree+0x1d/0x30 [ext4]
[<00000000c7cb663d>] vfs_get_tree+0x31/0x160
[<00000000320e1bed>] do_new_mount+0x1d5/0x480
[<00000000c074654c>] path_mount+0x22e/0xbe0
[<0000000003e97a8e>] do_mount+0x95/0xc0
[<000000002f3d3736>] __x64_sys_mount+0xc4/0x160
[<0000000027d2140c>] do_syscall_64+0x3f/0x90
================================================================

To solve this problem, we add a "failed_mount10" tag, and call
ext4_quota_off_umount() in this tag to release the enabled qoutas.


Affected upstream versions: 4.14.196 < 4.15, 4.19.143 < 4.20, 5.4.62 < 5.5, 5.8.6 < 5.9, 5.9
Fixed upstream versions: 0, 4.15, 4.20, 5.15.121, 5.5, 5.9, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c327b83c59ee938792a0300df646efac39c7d6a7
CVE-2023-54154: kernel: Linux kernel: Denial of Service due to memory leak in target_cmd_counter
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in SCSI subsystem of the Linux kernel. A local attacker with low privileges could exploit a memory leak within the `target_cmd_counter` structure. This issue, a type of resource management error, can lead to a Denial of Service (DoS) by gradually consuming system memory.


Affected upstream versions: 6.1.28 < 6.1.55, 6.2.15 < 6.3, 6.3.2 < 6.4, 6.4
Fixed upstream versions: 0, 6.1.55, 6.3, 6.4, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1cd41d1669bcbc5052afa897f85608a62ff3fb30
CVE-2023-54155: kernel: Linux kernel: Denial of service in network core via incorrect frame size handling
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. The `bpf_xdp_adjust_tail()` function, which is part of the network core, contains an unnecessary check for the `frame_sz` parameter. A local attacker with high privileges could exploit this vulnerability by providing a malformed `frame_sz` value, potentially leading to a system crash or unresponsiveness, resulting in a denial of service (DoS).


Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.127, 6.1.46, 6.4.11, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a09c258cfa77d3ba0a7acc555c73eb6b005c4bd8
CVE-2023-54156: kernel: sfc: fix crash when reading stats while NIC is resetting
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was identified in the sfc network driver within the Linux kernel where a NULL pointer dereference may occur when reading network statistics during a NIC reset. Specifically, the function efx_net_stats() (used as .ndo_get_stats64 for ethtool) can be invoked while the NIC’s internal data structures have already been torn down. In such a situation, nic_data->mc_stats may be NULL, leading to an unprotected dereference and a kernel crash (BUG) when accessing this pointer. The root cause is the lack of protection against accessing stale or freed data during concurrent operations involving NIC reset and statistics queries.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cb1aa7cc562cab6a87ea33574c8c65f2d2fd7aeb
CVE-2023-54160: kernel: firmware: arm_sdei: Fix sleep from invalid context BUG
Component: kernel
Severity: Low
CWE: CWE-663 (Use of a Non-reentrant Function in a Concurrent Context)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

firmware: arm_sdei: Fix sleep from invalid context BUG

Running a preempt-rt (v6.2-rc3-rt1) based kernel on an Ampere Altra
triggers:

  BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:46
  in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 24, name: cpuhp/0
  preempt_count: 0, expected: 0
  RCU nest depth: 0, expected: 0
  3 locks held by cpuhp/0/24:
    #0: ffffda30217c70d0 (cpu_hotplug_lock){++++}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
    #1: ffffda30217c7120 (cpuhp_state-up){+.+.}-{0:0}, at: cpuhp_thread_fun+0x5c/0x248
    #2: ffffda3021c711f0 (sdei_list_lock){....}-{3:3}, at: sdei_cpuhp_up+0x3c/0x130
  irq event stamp: 36
  hardirqs last  enabled at (35): [<ffffda301e85b7bc>] finish_task_switch+0xb4/0x2b0
  hardirqs last disabled at (36): [<ffffda301e812fec>] cpuhp_thread_fun+0x21c/0x248
  softirqs last  enabled at (0): [<ffffda301e80b184>] copy_process+0x63c/0x1ac0
  softirqs last disabled at (0): [<0000000000000000>] 0x0
  CPU: 0 PID: 24 Comm: cpuhp/0 Not tainted 5.19.0-rc3-rt5-[...]
  Hardware name: WIWYNN Mt.Jade Server [...]
  Call trace:
    dump_backtrace+0x114/0x120
    show_stack+0x20/0x70
    dump_stack_lvl+0x9c/0xd8
    dump_stack+0x18/0x34
    __might_resched+0x188/0x228
    rt_spin_lock+0x70/0x120
    sdei_cpuhp_up+0x3c/0x130
    cpuhp_invoke_callback+0x250/0xf08
    cpuhp_thread_fun+0x120/0x248
    smpboot_thread_fn+0x280/0x320
    kthread+0x130/0x140
    ret_from_fork+0x10/0x20

sdei_cpuhp_up() is called in the STARTING hotplug section,
which runs with interrupts disabled. Use a CPUHP_AP_ONLINE_DYN entry
instead to execute the cpuhp cb later, with preemption enabled.

SDEI originally got its own cpuhp slot to allow interacting
with perf. It got superseded by pNMI and this early slot is not
relevant anymore. [1]

Some SDEI calls (e.g. SDEI_1_0_FN_SDEI_PE_MASK) take actions on the
calling CPU. It is checked that preemption is disabled for them.
_ONLINE cpuhp cb are executed in the 'per CPU hotplug thread'.
Preemption is enabled in those threads, but their cpumask is limited
to 1 CPU.
Move 'WARN_ON_ONCE(preemptible())' statements so that SDEI cpuhp cb
don't trigger them.

Also add a check for the SDEI_1_0_FN_SDEI_PRIVATE_RESET SDEI call
which acts on the calling CPU.

[1]:
https://lore.kernel.org/all/5813b8c5-ae3e-87fd-fccc-94c9cd08816d@arm.com/


Affected upstream versions: 4.16
Fixed upstream versions: 0, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 59842a9ba27d5390ae5bf3233a92cad3a26d495c
CVE-2023-54165: kernel: zsmalloc: move LRU update from zs_map_object() to zs_malloc()
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel zsmalloc memory allocator. Under certain memory pressure and reclaim conditions, zsmalloc updated its LRU lists in an unsafe context, which could lead to list corruption due to a race between object mapping and allocation paths. A local user able to trigger specific memory allocation patterns could cause a kernel crash or denial of service.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.3.5, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e95adf7486f2cb5f1bb303113ca30460951923e9
CVE-2023-54166: kernel: igc: Fix Kernel Panic during ndo_tx_timeout callback
Component: kernel
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A race condition was identified in the Intel “igc” network driver in the Linux kernel. Under specific heavy traffic and timing scenarios, such as when the transmit queue times out (ndo_tx_timeout) and the adapter reset path is invoked concurrently with device teardown or reinitialization, the driver may mishandle transmit queue and interrupt state. This can result in unexpected kernel behavior including a kernel panic.


Affected upstream versions: 5.15.94 < 5.15.124, 6.1.12 < 6.1.43, 6.2
Fixed upstream versions: 0, 5.15.124, 6.1.43, 6.4.8, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: feba294c454a51bb1e80dd2ff038e335f07ae481
CVE-2023-54169: kernel: net/mlx5e: fix memory leak in mlx5e_ptp_open
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel net/mlx5e Ethernet driver’s mlx5e_ptp_open function. When memory allocation via kvzalloc_node() or kvzalloc() fails, previously allocated resources (c or cparams) were not properly freed, leading to a memory leak in the error path. An unprivileged local user interacting with the networking subsystem might trigger this condition, causing gradual memory consumption.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.121, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4892e1e548b5bd6524c1c89df06e4849df26fc20
CVE-2023-54170: kernel: keys: Fix linking a duplicate key to a keyring's assoc_array
Component: kernel
Severity: Low
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A race condition was found in the Linux kernel's keyring subsystem. When concurrent DNS queries resolve the same hostname, a duplicate index key can be created in the keyring's assoc_array. The assoc_array implementation has a BUG_ON() check that detects this invalid state, causing a kernel crash. This is particularly triggered during CIFS server name resolution.

Statement: This flaw can occur during normal system operation when multiple concurrent DNS resolutions happen for the same hostname. Systems using CIFS/SMB mounts with hostname-based server specifications are more susceptible. The race window is small but the impact is a kernel crash when triggered.

Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.188, 5.15.123, 5.4.253, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 65bd66a794bfa059375ec834885bb610d75c0182
CVE-2023-54172: kernel: x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction
Component: kernel
Severity: Low
CWE: CWE-166 (Improper Handling of Missing Special Element)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A compatibility issue was found between Linux and Hyper-V when Indirect Branch Tracking (IBT) is enabled. The Hyper-V hypercall page lacks the required ENDBR64 instruction, causing all hypercalls to fail with an exception and panic the guest.

Statement: This affects only Hyper-V guests with IBT-capable hardware and specific VM configuration versions. The kernel fix works around the Hyper-V bug by disabling IBT when the hypercall page is incompatible, allowing the VM to boot without IBT protection.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 98cccbd0a19a161971bc7f7feb10577adc62c400
CVE-2023-54173: kernel: bpf: Disable preemption in bpf_event_output
Component: kernel
Severity: Low
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A race condition was found in the BPF event output mechanism. When preemption is enabled during bpf_event_output(), two tasks can access the same perf_sample_data buffer concurrently, leading to data corruption and kernel crashes.

Statement: Triggering this requires running BPF programs attached to cgroups that use bpf_event_output() under specific preemption timing. This primarily affects systems using Cilium or similar BPF-heavy networking stacks with high load.

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.190, 5.15.126, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3048cb0dc0cc9dc74ed93690dffef00733bcad5b
CVE-2023-54179: kernel: scsi: qla2xxx: Array index may go out of bound
Component: kernel
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel qla2xxx SCSI driver. A static analysis tool reported that the array vha->host_str, sized to hold 16 characters, could be indexed with values outside its valid range, potentially leading to out-of-bounds writes. The root cause was the use of sprintf() without enforcing proper bounds checks. An unprivileged local user with access to trigger the affected driver logic may be able to cause a kernel crash or hang, resulting in a denial of service.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.19.291, 5.10.188, 5.15.121, 5.4.253, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e697f466bf61280b7e996c9ea096d7ec371c31ea
CVE-2023-54184: kernel: scsi: target: iscsit: Free cmds before session free
Component: kernel
Severity: Low
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's iSCSI target subsystem. When the Time2Retain timer expires and an iSCSI session is being cleaned up, commands from recovery entries are freed after the session has already been closed. This leads to a NULL pointer dereference or use-after-free when attempting to release command resources.

Statement: This flaw affects systems running iSCSI target services and can be triggered when session recovery timers expire. An attacker with network access to the iSCSI target could potentially cause a denial of service by manipulating session states, though practical exploitation requires specific timing conditions.

Affected upstream versions: 3.12
Fixed upstream versions: 0, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 89f5055f9b0b57c7e7f02e32df95ef401f809b71
CVE-2023-54186: kernel: usb: typec: altmodes/displayport: fix pin_assignment_show
Component: kernel
Severity: Low
CWE: CWE-823 (Use of Out-of-range Pointer Offset)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

An out-of-bounds array access was found in the USB Type-C DisplayPort altmode driver. When no compatible pin assignments are found, the code performs negative array indexing, causing a use-after-free or out-of-bounds read.

Statement: This is triggered by reading the pin_assignment sysfs file on USB-C DisplayPort altmode devices when no valid assignments exist. Exploitation requires physical access to a USB-C port and interaction with sysfs.

Affected upstream versions: 4.19
Fixed upstream versions: 0, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2
CVE-2023-54191: kernel: Linux kernel: Memory leak in mt76 Wi-Fi driver leads to Denial of Service
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's mt76 Wi-Fi driver. A memory leak occurs when the `mt7996_mcu_exit` routine fails to properly clear memory queues if the `mt7996_firmware_state` encounters an issue. This vulnerability could allow a local attacker with low privileges to cause a Denial of Service (DoS) by consuming system memory.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b539d35e13e5d6b3dca76271261106b2356aa64c
CVE-2023-54194: kernel: exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree
Component: kernel
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory allocation failure was found in the exFAT filesystem driver. When system memory is fragmented, kmalloc_array() can fail to allocate contiguous memory for the bitmap, preventing USB drives from being mounted.

Statement: This is an availability issue affecting exFAT filesystem mounting under memory pressure. The fix uses kvmalloc_array() which falls back to vmalloc when contiguous memory is unavailable. No security boundary is crossed.

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.190, 5.15.126, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 79d16a84ea41272dfcb0c00f9798ddd0edd8098d
CVE-2023-54197: kernel: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work"
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A regression was found in the Linux kernel's Bluetooth btsdio driver. A previous commit (1e9ac114c442) intended to fix a use-after-free bug introduced a potential NULL pointer dereference problem. This commit reverts that change since the original issue was properly fixed by a separate commit (73f7b171b7c0) that addressed the race condition correctly.

Statement: This is a revert of a problematic fix that introduced a NULL pointer dereference. The underlying use-after-free issue was already resolved by a different, correct fix. Systems with Bluetooth SDIO devices could potentially experience a kernel crash from the NULL pointer dereference until this revert is applied.

Affected upstream versions: 4.14.312 < 4.14.315, 4.19.280 < 4.19.283, 5.4.240 < 5.4.243, 5.10.177 < 5.10.180, 5.15.105 < 5.15.111, 6.1.22 < 6.1.28, 6.2.9 < 6.2.15, 6.3
Fixed upstream versions: 0, 4.14.315, 4.19.283, 5.10.180, 5.15.111, 5.4.243, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3b4ed52009723f7dfca7a8ca95163bfb441bfb76
CVE-2023-54198: kernel: tty: fix out-of-bounds access in tty_driver_lookup_tty()
Component: kernel
Severity: Low
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

An out-of-bounds access was found in the TTY subsystem. When an invalid console device is specified on the kernel command line (e.g., console=tty3270), the driver lookup returns a TTY struct with an invalid index, causing a crash during boot.

Statement: This requires specifying an invalid console= parameter on the kernel command line. Only users with physical access or boot configuration access can trigger this. Normal system operation without such parameters is unaffected.

Affected upstream versions: 2.6.28
Fixed upstream versions: 0, 4.14.308, 4.19.276, 5.10.173, 5.15.100, 5.4.235, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3df6f492f500a16c231f07ccc6f6ed1302caddf9
CVE-2023-54201: kernel: RDMA/efa: Fix wrong resources deallocation order
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/efa: Fix wrong resources deallocation order

When trying to destroy QP or CQ, we first decrease the refcount and
potentially free memory regions allocated for the object and then
request the device to destroy the object. If the device fails, the
object isn't fully destroyed so the user/IB core can try to destroy the
object again which will lead to underflow when trying to decrease an
already zeroed refcount.

Deallocate resources in reverse order of allocating them to safely free
them.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cf38960386f3cc4abf395e556af915e4babcafd2
CVE-2023-54202: kernel: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free vulnerability was found in the Intel i915 GPU driver's performance monitoring subsystem. A race condition between adding and removing OA configurations allows dereferencing a freed object.

Statement: Exploitation requires Intel GPU hardware and the ability to issue i915 perf ioctls, which typically needs render node access. The race window is narrow, making reliable exploitation difficult.

Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.15.108, 6.1.24, 6.2.11, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6eeb1cba4c9dc47656ea328afa34953c28783d8c