huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-54267: kernel: powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
Component: kernel
Severity: Low
CWE: CWE-663 (Use of a Non-reentrant Function in a Concurrent Context)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A debug warning issue was found in PowerPC pseries code. When DEBUG_PREEMPT is enabled, accessing lppaca_shared_proc() triggers spurious preemption warnings because it uses smp_processor_id() in preemptible context.

Statement: This only produces warnings when CONFIG_DEBUG_PREEMPT is enabled, which is a debug configuration not used in production kernels. The warning itself is harmless as the code logic is correct regardless of which CPU's lppaca is accessed.

Affected upstream versions: 3.12
Fixed upstream versions: 0, 5.10.195, 5.15.132, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 953c54dfdc5d3eb7243ed902b50acb5ea1db4355
CVE-2023-54268: kernel: debugobjects: Don't wake up kswapd from fill_pool()
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A locking issue was found in the Linux kernel's debugobjects subsystem. The fill_pool() function uses GFP_ATOMIC allocation flags, which attempt to wake up kswapd and acquire kswapd_wait::lock. Since fill_pool() may be called with arbitrary locks already held, this can trigger lockdep warnings about potential deadlocks.

Statement: This is primarily a lockdep warning identified by syzbot rather than an exploitable vulnerability. The issue represents a theoretical lock ordering problem in the debugobjects infrastructure that could potentially cause deadlocks under specific conditions, but no practical exploitation path has been demonstrated.

Affected upstream versions: 2.6.26
Fixed upstream versions: 0, 5.10.181, 5.15.114, 5.4.244, 6.1.31, 6.3.5, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: be646802b3dc408c4dc72a3ac32c3f4a0282414d
CVE-2023-54269: kernel: SUNRPC: double free xprt_ctxt while still in use
Component: kernel
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was addressed in the Linux kernel’s SUNRPC implementation affecting deferred RPC request handling. When an RPC request is deferred, the internal rq_xprt_ctxt pointer is moved from the active service request to a deferred request structure. Under certain rare conditions where a request is deferred multiple times, the old context pointer is not cleared before reuse. This can lead to the context being freed twice while still referenced, causing memory corruption and likely resulting in a kernel oops/crash


Affected upstream versions: 5.15.35 < 5.15.113, 5.17.4 < 5.18, 5.18
Fixed upstream versions: 0, 5.15.113, 5.18, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7851771789e87108a92697194105ef0c9307dc5e
CVE-2023-54270: kernel: media: usb: siano: Fix use after free bugs caused by do_submit_urb
Component: kernel
Severity: Low
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 4.3 (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's Siano USB driver for digital TV receivers. In do_submit_urb(), memory allocated during smsusb_probe() can be freed by smsusb_term_device() while URB work items are still referencing it. This leads to a use-after-free condition when worker threads access the freed memory.

Statement: Exploiting this flaw requires physical access to connect a malicious or malfunctioning Siano USB device. The UAF occurs during device probing, which is controlled by physical device insertion. While UAF bugs can be severe, the physical access requirement substantially reduces the attack surface.

Affected upstream versions: 4.6
Fixed upstream versions: 0, 4.14.308, 4.19.276, 5.10.173, 5.15.99, 5.4.235, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c379272ea9c2ee36f0a1327b0fb8889c975093f7
CVE-2023-54271: kernel: Linux kernel: Denial of Service via NULL pointer dereference in blk-cgroup
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's block cgroup (blk-cgroup) component. A local attacker could exploit a race condition in the `blkcg_activate_policy()` function, where block group policy data (`blkg_policy_data`) is installed before it is fully initialized. This allows another function, `ioc_weight_write()`, to access uninitialized data, leading to a NULL pointer dereference and causing a system crash, resulting in a Denial of Service (DoS).


Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.15.210, 6.1.176, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: da6cc648c1f570290af1ddbe6b7ca3d91b1d6db9
CVE-2023-54274: kernel: RDMA/srpt: Add a check for valid 'mad_agent' pointer
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was addressed in the Linux kernel’s RDMA SRPT (SCSI RDMA Protocol Target) subsystem. When unregistering a MAD (Management Datagram) agent, the SRPT module previously performed a non-NULL check on the mad_agent pointer before invoking ib_unregister_mad_agent(). Under rare timing conditions—specifically, concurrent execution of srpt_add_one() and srpt_remove_one()—mad_agent may hold an error value that passes the non-NULL test. This can lead to a NULL pointer dereference and kernel crash when the RoCE driver unregisters an ib_device


Affected upstream versions: 3.3
Fixed upstream versions: 0, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8ec6acdb9b6a80eeb13e778dfedb5d72a88f14fe
CVE-2023-54275: kernel: Linux kernel: Memory leak in ath11k Wi-Fi driver leads to Denial of Service
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's ath11k Wi-Fi driver. This memory leak vulnerability occurs when the ath11k_peer_find() function fails to properly release cryptographic resources. An attacker on the adjacent network with low privileges could exploit this, leading to a gradual reduction in available memory. This can ultimately cause a Denial of Service (DoS) on the affected system.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 137963e3b95776f1d57c62f249a93fe47e019a22
CVE-2023-54278: kernel: s390/vmem: split pages when debug pagealloc is enabled
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-30T00:00:00+00:00

In the Linux kernel’s s390/vmem subsystem, a flaw exists in the handling of virtual memory area initialization when debug pagealloc is enabled. Under certain conditions, the kernel may access memory after it has been freed or mishandled during early boot or subsystem initialization, resulting in a use-after-free condition that can cause an early kernel crash or undefined behavior on affected s390 systems.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 601e467e29a960f7ab7ec4075afc6a68c3532a65
CVE-2023-54283: kernel: bpf: Address KCSAN report on bpf_lru_list
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A data race was found in the BPF LRU list implementation. Concurrent access to node->ref without proper memory barriers triggers KCSAN warnings, though the race is benign as the reference value does not need to be precise.

Statement: This is a benign data race reported by KCSAN (Kernel Concurrency Sanitizer). The fix improves code correctness by using READ_ONCE/WRITE_ONCE but the original behavior was functionally acceptable for this use case.

Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.14.322, 4.19.291, 5.10.188, 5.15.150, 5.4.251, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6eaef1b1d8720053eb1b6e7a3ff8b2ff0716bb90
CVE-2023-54286: kernel: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
Component: kernel
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-30T00:00:00+00:00

A vulnerability was discovered in the Intel wireless iwlwifi driver in the Linux kernel that could lead to a buffer overflow in the Driver Virtualization Module key handling code. When processing a received TKIP key that includes MIC rx/tx components, the driver did not adequately limit the amount of key data copied into the fixed-length iwl_keyinfo.key field, potentially causing a field-spanning write and kernel backtrace (crash).


Affected upstream versions: 3.1
Fixed upstream versions: 0, 4.14.316, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 76b5ea43ad2fb4f726ddfaff839430a706e7d7c2
CVE-2023-54289: kernel: scsi: qedf: Fix NULL dereference in error handling
Component: kernel
Severity: Low
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference was found in the QLogic qedf FCoE driver. In the error handling path of qedf_alloc_global_queues(), calling qedf_free_global_queues() when nothing was allocated causes a crash.

Statement: This affects systems with QLogic FCoE adapters. The crash occurs only on allocation failure error paths during driver initialization, which requires memory pressure or other resource constraints.

Affected upstream versions: 4.11
Fixed upstream versions: 0, 5.10.188, 5.15.121, 5.4.251, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 961c8370c5f7e80a267680476e1bcff34bffe71a
CVE-2023-54291: kernel: vduse: fix NULL pointer dereference
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's VDUSE (vDPA Device in Userspace) subsystem. The vduse_vdpa_set_vq_affinity() callback can be invoked with a NULL cpu_mask value when deleting a vduse device. The code attempts to copy from this NULL pointer, causing a kernel crash during device removal.

Statement: This flaw affects systems using VDUSE for userspace-backed vDPA devices, typically in virtualization environments. The crash occurs during device deletion operations, which generally require administrative privileges. While the bug causes a denial of service, exploitation is limited to users with permissions to manage vDPA devices.

Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f9d46429de2a251e1e4962e1bf86c344d6336562
CVE-2023-54292: kernel: RDMA/irdma: Fix data race on CQP request done
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A race condition was identified in the RDMA/irdma subsystem of the Linux kernel affecting how completion queue pair (CQP) requests are processed. The cqp_request->request_done memory location is accessed without appropriate synchronization in the irdma_handle_cqp_op function while it is concurrently updated in irdma_cqp_ce_handler. Kernel Concurrency Sanitizer can detect this unsafe access pattern, which may lead to unpredictable behavior, kernel warnings, or system instability


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.124, 6.1.43, 6.4.8, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c5b5dbcbf91f769b8eb25f88e32a1522f920f37a
CVE-2023-54294: kernel: md/raid10: fix memleak of md thread
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory leak was found in the MD RAID10 driver. When raid10_run() fails after setup_conf() succeeds but before mddev->thread is set, the conf->thread is not freed, leaking kernel thread resources.

Statement: This leak occurs only when RAID10 array assembly fails at a specific point. The impact is limited to systems attempting to assemble RAID10 arrays that fail for other reasons during the run phase.

Affected upstream versions: 4.16
Fixed upstream versions: 0, 4.19.283, 5.10.180, 5.15.111, 5.4.243, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: abf4d67060c8f63caff096e5fca1564bfef1e5d4
CVE-2023-54296: kernel: KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration
Component: kernel
Severity: Low
CWE: CWE-386 (Symbolic Name not Mapping to Correct Object)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's KVM SVM implementation for AMD SEV-ES. During intrahost VM migration, KVM incorrectly retrieves source vCPUs from the destination VM instead of the source VM. This causes the VMSA (Virtual Machine Save Area) pointer to remain NULL, leading to a host kernel crash when the VM is destroyed or during subsequent vCPU operations.

Statement: This bug affects AMD systems using SEV-ES (Secure Encrypted Virtualization - Encrypted State) with VM migration capabilities. The flaw can crash the host kernel from a guest operation, representing a guest-to-host denial of service. However, exploitation requires the ability to perform SEV-ES VM migrations, which typically needs elevated privileges.

Affected upstream versions: 5.18.8 < 5.19, 5.19
Fixed upstream versions: 0, 5.19, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5c18ace750e4d4d58d7da02d1c669bf21c824158
CVE-2023-54298: kernel: thermal: intel: quark_dts: fix error pointer dereference
Component: kernel
Severity: Low
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

An error pointer dereference was found in the Intel Quark thermal driver. When alloc_soc_dts() fails and returns an error pointer, attempting to free it causes a kernel crash.

Statement: This affects Intel Quark SoC platforms only, which are embedded/IoT devices not commonly found in enterprise environments. The crash occurs only on allocation failure during thermal subsystem initialization.

Affected upstream versions: 4.2
Fixed upstream versions: 0, 4.14.308, 4.19.276, 5.10.173, 5.15.100, 5.4.235, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0b366c6a42e2e2bc67af8d1130b68f3bfa31c80e
CVE-2023-54299: kernel: usb: typec: bus: verify partner exists in typec_altmode_attention
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel's USB Type-C subsystem. When certain USB hubs perform a data role swap after entering DisplayPort Alt Mode, all alternate modes are unregistered. If the hub continues sending Attention messages afterward, the typec_altmode_attention() function dereferences a NULL partner pointer, causing a kernel crash.

Statement: This requires specific USB hub hardware that performs data role swaps after entering alt mode. The issue is triggered by physical USB device behavior rather than software attack. Systems without USB-C with DisplayPort Alt Mode capability are unaffected.

Affected upstream versions: 4.19
Fixed upstream versions: 0, 5.10.195, 5.15.132, 5.4.257, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5f71716772b88cbe0e1788f6a38d7871aff2120b
CVE-2023-54300: kernel: wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx
Component: kernel
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was identified in the Linux kernel’s ath9k wireless driver where the receiver packet handling code did not correctly validate the length of incoming SKBs before accessing subsequent fields expected to be present. In certain malformed packet conditions (e.g., pkt_len set too small), the driver could reference uninitialized memory when attempting to parse expected control data, leading to unpredictable behavior including kernel warnings or crashes.


Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 4.14.322, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0bc12e41af4e3ae1f0efecc377f0514459df0707
CVE-2023-54301: kernel: serial: 8250_bcm7271: fix leak in `brcmuart_probe`
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A resource leak flaw was found in the Broadcom BCM7271 serial driver. In the brcmuart_probe() function, the baud_mux_clk clock is prepared and enabled but not released in error paths, causing a clock resource leak when driver probe fails.

Statement: This affects only Broadcom BCM7271 platforms using the 8250_bcm7271 serial driver. The leak occurs only during failed probe operations, not during normal runtime. Standard x86 systems and most ARM platforms are unaffected.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.113, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5258395e67fee6929fb8e50c8239f8de51b8cb2d
CVE-2023-54302: kernel: RDMA/irdma: Fix data race on CQP completion stats
Component: kernel
Severity: Moderate
CWE: CWE-667 (Improper Locking)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

The Linux kernel contains a race condition vulnerability in its RDMA/irdma subsystem, where completion queue pair (CQP) completion statistics are read concurrently without adequate synchronization while being updated on another CPU. Under certain workloads, a lack of atomic operations and improper locking can lead to data inconsistency and unpredictable kernel behavior due to torn reads/writes and compiler optimization effects. This could potentially be exploited by a local user to trigger a kernel crash or denial of service (DoS) condition


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.124, 6.1.43, 6.4.8, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bf0f9f65b7fe36ea9d2e23263dcefc90255d7b1f
CVE-2023-54303: kernel: bpf: Disable preemption in bpf_perf_event_output
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's BPF subsystem. The bpf_perf_event_output() function relies on disabled preemption for nesting protection, but when called from uprobes context via bpf_prog_run_array_sleepable(), preemption remains enabled. This allows task preemption during protected sections, leading to buffer corruption when two tasks share the same perf_sample_data buffer, causing kernel crashes.

Statement: This issue requires BPF programs attached to uprobes that use bpf_perf_event_output(). The flaw can cause kernel crashes when specific preemption timing occurs, but exploiting it for more than denial of service would require precise control over kernel scheduling. Loading BPF programs typically requires CAP_BPF or CAP_SYS_ADMIN capabilities.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3654ed5daf492463c3faa434c7000d45c2da2ace
CVE-2023-54308: kernel: ALSA: ymfpci: Create card with device-managed snd_devm_card_new()
Component: kernel
Severity: Low
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's ALSA ymfpci sound driver. During a previous refactoring commit that removed snd_card_ymfpci_remove(), the snd_card_new() call was not updated to snd_devm_card_new(). This omission means snd_card_free() is never called during module unload, leading to a kernel oops when userspace attempts to access the sound device after module removal.

Statement: This affects systems with Yamaha YMF724/740/744/754 PCI sound cards using the ymfpci driver. The crash occurs only after the module is unloaded and a subsequent access attempt is made to the sound device. Standard system operation without module unloading is unaffected, limiting the impact to administrative driver management scenarios.

Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.106, 6.1.23, 6.2.10, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 95642872c466030240199ba796a40771c493ed0c
CVE-2023-54312: kernel: samples/bpf: Fix buffer overflow in tcp_basertt
Component: kernel
Severity: Low
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A buffer overflow was found in the BPF sample code tcp_basertt. Incorrect buffer size calculation could cause out-of-bounds writes when copying string data.

Statement: This is in samples/bpf code which is not compiled or included in production kernels. It serves only as example code for BPF developers. Production systems are unaffected.

Affected upstream versions: 4.15
Fixed upstream versions: 0, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cf7514fedc25675e68b74941df28a883951e70fd