huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53182: kernel: Linux kernel: ACPICA undefined behavior due to zero offset to null pointer
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in ACPICA in the Linux kernel. This vulnerability allows for a denial of service via a null pointer dereference.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 4.14.316, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5a2d0dcb47b16f84880a59571eab8a004e3236d7
CVE-2023-53184: kernel: arm64/sme: Set new vector length before reallocating
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arm64/sme: Set new vector length before reallocating

As part of fixing the allocation of the buffer for SVE state when changing
SME vector length we introduced an immediate reallocation of the SVE state,
this is also done when changing the SVE vector length for consistency.
Unfortunately this reallocation is done prior to writing the new vector
length to the task struct, meaning the allocation is done with the old
vector length and can lead to memory corruption due to an undersized buffer
being used.

Move the update of the vector length before the allocation to ensure that
the new vector length is taken into account.

For some reason this isn't triggering any problems when running tests on
the arm64 fixes branch (even after repeated tries) but is triggering
issues very often after merge into mainline.

Statement: This vulnerability is rated as Moderate. It stems from an incorrect ordering of state updates and memory allocation and primarily impacts availability, since it can lead to a kernel panic). The bug can also potentially have effects on confidentiality (though this would require precise control and is highly improbable), and integrity, since it could in theory overwrite adjacent kernel structures.

Affected upstream versions: 6.1.42 < 6.1.43, 6.4.7 < 6.4.8
Fixed upstream versions: 6.1.43, 6.4.8
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 356e711640aea6ed145da9407499388b45264cb4
CVE-2023-53185: kernel: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes

A bad USB device is able to construct a service connection response
message with target endpoint being ENDPOINT0 which is reserved for
HTC_CTRL_RSVD_SVC and should not be modified to be used for any other
services.

Reject such service connection responses.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.


Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 4.14.322, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: db8df00cd6d801b3abdb145201c2bdd1c665f585
CVE-2023-53186: kernel: skbuff: Fix a race between coalescing and releasing SKBs
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

skbuff: Fix a race between coalescing and releasing SKBs

Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment
recycling") allowed coalescing to proceed with non page pool page and page
pool page when @from is cloned, i.e.

to->pp_recycle    --> false
from->pp_recycle  --> true
skb_cloned(from)  --> true

However, it actually requires skb_cloned(@from) to hold true until
coalescing finishes in this situation. If the other cloned SKB is
released while the merging is in process, from_shinfo->nr_frags will be
set to 0 toward the end of the function, causing the increment of frag
page _refcount to be unexpectedly skipped resulting in inconsistent
reference counts. Later when SKB(@to) is released, it frees the page
directly even though the page pool page is still in use, leading to
use-after-free or double-free errors. So it should be prohibited.

The double-free error message below prompted us to investigate:
BUG: Bad page state in process swapper/1  pfn:0e0d1
page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000
index:0x2 pfn:0xe0d1
flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff)
raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000
raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000
page dumped because: nonzero _refcount

CPU: 1 PID: 0 Comm: swapper/1 Tainted: G            E      6.2.0+
Call Trace:
 <IRQ>
dump_stack_lvl+0x32/0x50
bad_page+0x69/0xf0
free_pcp_prepare+0x260/0x2f0
free_unref_page+0x20/0x1c0
skb_release_data+0x10b/0x1a0
napi_consume_skb+0x56/0x150
net_rx_action+0xf0/0x350
? __napi_schedule+0x79/0x90
__do_softirq+0xc8/0x2b1
__irq_exit_rcu+0xb9/0xf0
common_interrupt+0x82/0xa0
</IRQ>
<TASK>
asm_common_interrupt+0x22/0x40
RIP: 0010:default_idle+0xb/0x20

Statement: A race condition in skb_try_coalesce() could lead to use-after-free or double-free when a cloned SKB with page_pool pages is released during coalescing. This results in inconsistent reference counts and potential kernel crashes.
While primarily a denial-of-service issue, exploitation could theoretically be extended to arbitrary code execution, though the complexity of reliably triggering the race is high.
The flaw only affects systems with NIC drivers using the page_pool API, limiting its exposure in practice.
The bug not actual for Red Hat Enterprise Linux 8 (all versions) and actual only for versions of the Red Hat Enterprise Linux 9 before 9.3.

Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.108, 6.1.25, 6.2.12, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 906a6689bb0191ad2a44131a3377006aa098af59
CVE-2023-53192: kernel: Linux kernel: Out-of-bounds write in VXLAN due to incorrect nexthop hash size leading to denial of service
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in the Linux kernel's Virtual Extensible LAN (VXLAN) implementation. An attacker with elevated privileges (CAP_NET_ADMIN) can exploit this vulnerability by configuring the system to accept and forward VXLAN packets. The issue arises from an incorrect nexthop hash size, where a 32-bit hash is used instead of the expected 31-bit hash, leading to negative hash values. This can cause an out-of-bounds write in the nexthop group selection, resulting in a kernel panic and a denial of service (DoS).

Statement: This vulnerability requires elevated privileges (`CAP_NET_ADMIN`) to exploit, since it can only be triggered if the system is configured to accept and forward VXLAN packets.

Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.190, 5.15.126, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c650597647ecb318d02372277bdfd866c6829f78
CVE-2023-53193: kernel: Kernel: Denial of Service in amdgpu driver due to improper interrupt handling
Component: kernel
Severity: Low
CWE: CWE-832 (Unlock of a Resource that is not Locked)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in the Linux kernel's amdgpu graphics driver. A local user with low privileges could exploit this vulnerability due to the improper use of the `amdgpu_irq_put` function within the `gmc_v10_0_hw_fini` component. This flaw leads to a call trace, which can result in a system crash and a Denial of Service (DoS).


Affected upstream versions: 6.1.26 < 6.1.29, 6.2.13 < 6.2.16, 6.3
Fixed upstream versions: 0, 6.1.29, 6.2.16, 6.3.3, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 59e2439111ac2bd24ea0cecf5825cf06684b2c6c
CVE-2023-53196: kernel: usb: dwc3: qcom: Fix potential memory leak
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: dwc3: qcom: Fix potential memory leak

Function dwc3_qcom_probe() allocates memory for resource structure
which is pointed by parent_res pointer. This memory is not
freed. This leads to memory leak. Use stack memory to prevent
memory leak.

Found by Linux Verification Center (linuxtesting.org) with SVACE.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.10.188, 5.15.121, 5.4.251, 6.1.39, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 648a163cff21ea355c8765e882ba8bf66a870a3e
CVE-2023-53197: kernel: USB: uhci: fix memory leak with using debugfs_lookup()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

USB: uhci: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.100, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c6af1dbc99ad37bf67c8703982df4d7f12d256c1
CVE-2023-53202: kernel: PM: domains: fix memory leak with using debugfs_lookup()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

PM: domains: fix memory leak with using debugfs_lookup()

When calling debugfs_lookup() the result must have dput() called on it,
otherwise the memory will leak over time.  To make things simpler, just
call debugfs_lookup_and_remove() instead which handles all of the logic
at once.


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dddc132eb0dca3969f9146ef8feac0aa542aa305
CVE-2023-53204: kernel: af_unix: Fix data-races around user->unix_inflight
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

af_unix: Fix data-races around user->unix_inflight.

user->unix_inflight is changed under spin_lock(unix_gc_lock),
but too_many_unix_fds() reads it locklessly.

Let's annotate the write/read accesses to user->unix_inflight.

BUG: KCSAN: data-race in unix_attach_fds / unix_inflight

write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1:
 unix_inflight+0x157/0x180 net/unix/scm.c:66
 unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123
 unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
 unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
 unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
 unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
 sock_sendmsg_nosec net/socket.c:725 [inline]
 sock_sendmsg+0x148/0x160 net/socket.c:748
 ____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
 ___sys_sendmsg+0xc6/0x140 net/socket.c:2548
 __sys_sendmsg+0x94/0x140 net/socket.c:2577
 __do_sys_sendmsg net/socket.c:2586 [inline]
 __se_sys_sendmsg net/socket.c:2584 [inline]
 __x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

read to 0xffffffff8546f2d0 of 8 bytes by task 44814 on cpu 0:
 too_many_unix_fds net/unix/scm.c:101 [inline]
 unix_attach_fds+0x54/0x1e0 net/unix/scm.c:110
 unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
 unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
 unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
 unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
 sock_sendmsg_nosec net/socket.c:725 [inline]
 sock_sendmsg+0x148/0x160 net/socket.c:748
 ____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
 ___sys_sendmsg+0xc6/0x140 net/socket.c:2548
 __sys_sendmsg+0x94/0x140 net/socket.c:2577
 __do_sys_sendmsg net/socket.c:2586 [inline]
 __se_sys_sendmsg net/socket.c:2584 [inline]
 __x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x6e/0xd8

value changed: 0x000000000000000c -> 0x000000000000000d

Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 44814 Comm: systemd-coredum Not tainted 6.4.0-11989-g6843306689af #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014


Affected upstream versions: 3.2.78 < 3.3, 3.10.96 < 3.11, 3.12.57 < 3.13, 3.14.60 < 3.15, 3.18.27 < 3.19, 4.1.17 < 4.2, 4.3.5 < 4.4, 4.4.1 < 4.5, 4.5
Fixed upstream versions: 0, 3.11, 3.13, 3.15, 3.19, 3.3, 4.14.326, 4.19.295, 4.2, 4.4, 4.5, 5.10.195, 5.15.132, 5.4.257, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: df97b5ea9f3ac9308c3a633524dab382cd59d9e5
CVE-2023-53205: kernel: KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler

We do check for target CPU == -1, but this might change at the time we
are going to use it. Hold the physical target CPU in a local variable to
avoid out-of-bound accesses to the cpu arrays.

Statement: This vulnerability is rated Moderate for Red Hat Enterprise Linux on the s390x architecture. The flaw is a race condition in the KVM s390/diag handler that could lead to out-of-bounds access. Triggering this vulnerability requires precise timing and repeated invocations and will most likely result in a denial-of-service. Confidentiality is not impacted as the bug does not directly expose guest or host memory contents. Availability is also highly unlikely to be impacted, though out-of-bounds access could in theory corrupt the kernel or KVM internal state.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.121, 6.1.39, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a9ccf140a2a03a0ae82be4bdfbdd17bdaea72ff5
CVE-2023-53208: kernel: Linux kernel KVM: Denial of Service in nested SVM due to TSC multiplier manipulation
Component: kernel
Severity: Low
CWE: CWE-670 (Always-Incorrect Control Flow Implementation)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) nested SVM (nSVM) module. A local attacker with low privileges in a nested virtual machine can manipulate the Timestamp Counter (TSC) multiplier and CPUID features. This manipulation can trigger a kernel warning, leading to a Denial of Service (DoS) by crashing the system.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5b2b0535fa7adee7e295fed0a3095082131a8d05
CVE-2023-53209: kernel: wifi: mac80211_hwsim: Fix possible NULL dereference
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211_hwsim: Fix possible NULL dereference

In a call to mac80211_hwsim_select_tx_link() the sta pointer might
be NULL, thus need to check that it is not NULL before accessing it.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d0124848c7940aba73492e282506b32a13f2e30e
CVE-2023-53210: kernel: md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid()

r5l_flush_stripe_to_raid() will check if the list 'flushing_ios' is
empty, and then submit 'flush_bio', however, r5l_log_flush_endio()
is clearing the list first and then clear the bio, which will cause
null-ptr-deref:

T1: submit flush io
raid5d
 handle_active_stripes
  r5l_flush_stripe_to_raid
   // list is empty
   // add 'io_end_ios' to the list
   bio_init
   submit_bio
   // io1

T2: io1 is done
r5l_log_flush_endio
 list_splice_tail_init
 // clear the list
			T3: submit new flush io
			...
			r5l_flush_stripe_to_raid
			 // list is empty
			 // add 'io_end_ios' to the list
			 bio_init
 bio_uninit
 // clear bio->bi_blkg
			 submit_bio
			 // null-ptr-deref

Fix this problem by clearing bio before clearing the list in
r5l_log_flush_endio().


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 711fb92606208a8626b785da4f9f23d648a5b6c8
CVE-2023-53211: kernel: Linux kernel: Memory leak in driver core location can lead to denial of service
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in the Linux kernel. This memory leak vulnerability exists in the driver core location component, where the `acpi_pld_info` structure is not properly freed upon allocation failure. A local attacker could exploit this flaw to cause a denial of service (DoS) due to resource exhaustion.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8fe72b8f59f63ca776bb8a4fcd2f406057a9fc90
CVE-2023-53220: kernel: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()

In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach az6007_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.

Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")


Affected upstream versions: 3.4
Fixed upstream versions: 0, 4.14.326, 4.19.295, 5.10.197, 5.15.133, 5.4.257, 6.1.55, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c6763fefa267f6e62595a6ac1f57815d99fc90b7
CVE-2023-53221: kernel: bpf: Fix memleak due to fentry attach failure
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bpf: Fix memleak due to fentry attach failure

If it fails to attach fentry, the allocated bpf trampoline image will be
left in the system. That can be verified by checking /proc/kallsyms.

This meamleak can be verified by a simple bpf program as follows:

  SEC("fentry/trap_init")
  int fentry_run()
  {
      return 0;
  }

It will fail to attach trap_init because this function is freed after
kernel init, and then we can find the trampoline image is left in the
system by checking /proc/kallsyms.

  $ tail /proc/kallsyms
  ffffffffc0613000 t bpf_trampoline_6442453466_1  [bpf]
  ffffffffc06c3000 t bpf_trampoline_6442453466_1  [bpf]

  $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'"
  [2522] FUNC 'trap_init' type_id=119 linkage=static

  $ echo $((6442453466 & 0x7fffffff))
  2522

Note that there are two left bpf trampoline images, that is because the
libbpf will fallback to raw tracepoint if -EINVAL is returned.


Affected upstream versions: 5.10.28 < 5.11, 5.11.11 < 5.12, 5.12
Fixed upstream versions: 0, 5.11, 5.12, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 20109ddd5bea2c24d790debf5d02584ef24c3f5e
CVE-2023-53224: kernel: ext4: Fix function prototype mismatch for ext4_feat_ktype
Component: kernel
Severity: Moderate
CWE: CWE-628 (Function Call with Incorrectly Specified Arguments)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ext4: Fix function prototype mismatch for ext4_feat_ktype

With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed.

ext4_feat_ktype was setting the "release" handler to "kfree", which
doesn't have a matching function prototype. Add a simple wrapper
with the correct prototype.

This was found as a result of Clang's new -Wcast-function-type-strict
flag, which is more sensitive than the simpler -Wcast-function-type,
which only checks for type width mismatches.

Note that this code is only reached when ext4 is a loadable module and
it is being unloaded:

 CFI failure at kobject_put+0xbb/0x1b0 (target: kfree+0x0/0x180; expected type: 0x7c4aa698)
 ...
 RIP: 0010:kobject_put+0xbb/0x1b0
 ...
 Call Trace:
  <TASK>
  ext4_exit_sysfs+0x14/0x60 [ext4]
  cleanup_module+0x67/0xedb [ext4]


Affected upstream versions: 4.16
Fixed upstream versions: 0, 4.19.274, 5.10.170, 5.15.96, 5.4.233, 6.1.14, 6.2.1, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2b69cdd9f9a7f596e3dd31f05f9852940d177924