huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53226: kernel: wifi: mwifiex: Fix OOB and integer underflow when rx packets
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw out of bounds read in the Linux kernel Marvell mwifiex driver was found in the way user sends malicious Wi-Fi packets. A remote user with Wi-Fi connection could use this flaw to crash the system.

Statement: A vulnerability in the Marvell mwifiex driver (mwifiex, Marvell Wi-Fi) allows malformed over-the-air frames to trigger out-of-bounds reads and an integer underflow in the RX path, which can crash the kernel or drop packets. Remote code execution is highly unlikely — the flaw manifests as OOB reads / length miscalculations (leading to OOPS/panic or DoS), not as a controllable arbitrary-write or instruction pointer corruption, so an attacker cannot reliably gain code execution from this bug.
This issue only affects systems running the mwifiex driver; if the system does not use Marvell’s mwifiex module there is no exposure.

Affected upstream versions: 3.7
Fixed upstream versions: 0, 4.14.326, 4.19.295, 5.10.195, 5.15.132, 5.4.257, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f517c97fc129995de77dd06aa5a74f909ebf568f
CVE-2023-53228: kernel: drm/amdgpu: drop redundant sched job cleanup when cs is aborted
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: drop redundant sched job cleanup when cs is aborted

Once command submission failed due to userptr invalidation in
amdgpu_cs_submit, legacy code will perform cleanup of scheduler
job. However, it's not needed at all, as former commit has integrated
job cleanup stuff into amdgpu_job_free. Otherwise, because of double
free, a NULL pointer dereference will occur in such scenario.

Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2457


Affected upstream versions: 6.1.160 < 6.1.167, 6.2
Fixed upstream versions: 0, 6.1.167, 6.2.16, 6.3.3, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cdce1644d85e858c68fb5fa67d78eb1035bf34f4
CVE-2023-53229: kernel: wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

A data corruption issues was observed due to an uninitialized driver private data structures in the Linux kernel's wifi mac80211 subsystem. This could allow a local attacker to crash the system or leak kernel internal information.


Affected upstream versions: 3.14
Fixed upstream versions: 0, 4.14.313, 4.19.281, 5.10.178, 5.15.107, 5.4.241, 6.1.24, 6.2.11, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: db8d32d6b25fdb75c387daee496b96209d477780
CVE-2023-53230: kernel: Kernel: Denial of Service via memory leak in SMB client
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in the Linux kernel's Server Message Block (SMB) client. A local attacker with low privileges could exploit a memory leak in the `cifs_smb3_do_mount()` function. This could lead to a Denial of Service (DoS) due to resource exhaustion.


Affected upstream versions: 5.15.46 < 5.15.128, 5.17.14 < 5.18, 5.18.3 < 5.19, 5.19
Fixed upstream versions: 0, 5.15.128, 5.18, 5.19, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9850867042674361f455ea8901375cff5b800be5
CVE-2023-53232: kernel: mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data

The MT7921 driver no longer uses eeprom.data, but the relevant code has not
been removed completely since
commit 16d98b548365 ("mt76: mt7921: rely on mcu_get_nic_capability").
This could result in potential invalid memory access.

To fix the kernel panic issue in mt7921, it is necessary to avoid accessing
unallocated eeprom.data which can lead to invalid memory access.

Furthermore, it is possible to entirely eliminate the
mt7921_mcu_parse_eeprom function and solely depend on
mt7921_mcu_parse_response to divide the RxD header.

[2.702735] BUG: kernel NULL pointer dereference, address: 0000000000000550
[2.702740] #PF: supervisor write access in kernel mode
[2.702741] #PF: error_code(0x0002) - not-present page
[2.702743] PGD 0 P4D 0
[2.702747] Oops: 0002 [#1] PREEMPT SMP NOPTI
[2.702755] RIP: 0010:mt7921_mcu_parse_response+0x147/0x170 [mt7921_common]
[2.702758] RSP: 0018:ffffae7c00fef828 EFLAGS: 00010286
[2.702760] RAX: ffffa367f57be024 RBX: ffffa367cc7bf500 RCX: 0000000000000000
[2.702762] RDX: 0000000000000550 RSI: 0000000000000000 RDI: ffffa367cc7bf500
[2.702763] RBP: ffffae7c00fef840 R08: ffffa367cb167000 R09: 0000000000000005
[2.702764] R10: 0000000000000000 R11: ffffffffc04702e4 R12: ffffa367e8329f40
[2.702766] R13: 0000000000000000 R14: 0000000000000001 R15: ffffa367e8329f40
[2.702768] FS:  000079ee6cf20c40(0000) GS:ffffa36b2f940000(0000) knlGS:0000000000000000
[2.702769] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[2.702775] CR2: 0000000000000550 CR3: 00000001233c6004 CR4: 0000000000770ee0
[2.702776] PKRU: 55555554
[2.702777] Call Trace:
[2.702782]  mt76_mcu_skb_send_and_get_msg+0xc3/0x11e [mt76 <HASH:1bc4 5>]
[2.702785]  mt7921_run_firmware+0x241/0x853 [mt7921_common <HASH:6a2f 6>]
[2.702789]  mt7921e_mcu_init+0x2b/0x56 [mt7921e <HASH:d290 7>]
[2.702792]  mt7921_register_device+0x2eb/0x5a5 [mt7921_common <HASH:6a2f 6>]
[2.702795]  ? mt7921_irq_tasklet+0x1d4/0x1d4 [mt7921e <HASH:d290 7>]
[2.702797]  mt7921_pci_probe+0x2d6/0x319 [mt7921e <HASH:d290 7>]
[2.702799]  pci_device_probe+0x9f/0x12a


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 11181b6c8641cd417935b76ea997d0169f2db262
CVE-2023-53233: kernel: Linux kernel: Denial of Service via deadlock in net/smc
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in the Linux kernel's Server Message Block (SMB) over Remote Direct Memory Access (RDMA) (net/smc) module. This vulnerability allows a local user to trigger a deadlock within the system. The deadlock occurs due to a circular locking dependency when specific operations involving `cancel_delayed_work_syn()` are performed. Successful exploitation of this flaw can lead to a system crash, resulting in a Denial of Service (DoS).


Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.176, 5.15.104, 6.1.21, 6.2.8, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9708efad9ba5095b9bb7916e11a135b3bd66c071
CVE-2023-53237: kernel: Linux kernel (amdgpu): Denial of Service via incorrect interrupt handling
Component: kernel
Severity: Low
CWE: CWE-832 (Unlock of a Resource that is not Locked)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in the Linux kernel's AMD GPU (amdgpu) driver. A local attacker with high privileges could trigger an incorrect interrupt handling mechanism within the `gmc_v11_0_hw_fini` function. This issue arises because the host driver attempts to disable an interrupt that is managed by the firmware, leading to a system crash, also known as a call trace, and resulting in a Denial of Service (DoS).


Affected upstream versions: 6.1.26 < 6.1.29, 6.2.13 < 6.2.16, 6.3
Fixed upstream versions: 0, 6.1.29, 6.2.16, 6.3.3, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 02e6cb9b3aeffc6b0e3955f6e0346293e2415cbc
CVE-2023-53241: kernel: nfsd: call op_release, even when op_func returns an error
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nfsd: call op_release, even when op_func returns an error

For ops with "trivial" replies, nfsd4_encode_operation will shortcut
most of the encoding work and skip to just marshalling up the status.
One of the things it skips is calling op_release. This could cause a
memory leak in the layoutget codepath if there is an error at an
inopportune time.

Have the compound processing engine always call op_release, even when
op_func sets an error in op->status. With this change, we also need
nfsd4_block_get_device_info_scsi to set the gd_device pointer to NULL
on error to avoid a double free.


Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.220, 5.15.154, 6.1.24, 6.2.11, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 65a33135e91e6dd661ecdf1194b9d90c49ae3570
CVE-2023-53245: kernel: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: storvsc: Fix handling of virtual Fibre Channel timeouts

Hyper-V provides the ability to connect Fibre Channel LUNs to the host
system and present them in a guest VM as a SCSI device. I/O to the vFC
device is handled by the storvsc driver. The storvsc driver includes a
partial integration with the FC transport implemented in the generic
portion of the Linux SCSI subsystem so that FC attributes can be displayed
in /sys.  However, the partial integration means that some aspects of vFC
don't work properly. Unfortunately, a full and correct integration isn't
practical because of limitations in what Hyper-V provides to the guest.

In particular, in the context of Hyper-V storvsc, the FC transport timeout
function fc_eh_timed_out() causes a kernel panic because it can't find the
rport and dereferences a NULL pointer. The original patch that added the
call from storvsc_eh_timed_out() to fc_eh_timed_out() is faulty in this
regard.

In many cases a timeout is due to a transient condition, so the situation
can be improved by just continuing to wait like with other I/O requests
issued by storvsc, and avoiding the guaranteed panic. For a permanent
failure, continuing to wait may result in a hung thread instead of a panic,
which again may be better.

So fix the panic by removing the storvsc call to fc_eh_timed_out().  This
allows storvsc to keep waiting for a response.  The change has been tested
by users who experienced a panic in fc_eh_timed_out() due to transient
timeouts, and it solves their problem.

In the future we may want to deprecate the vFC functionality in storvsc
since it can't be fully fixed. But it has current users for whom it is
working well enough, so it should probably stay for a while longer.


Affected upstream versions: 4.13
Fixed upstream versions: 0, 4.14.323, 4.19.292, 5.10.191, 5.15.127, 5.4.254, 6.1.46, 6.4.11, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cd87f4df9865a53807001ed12c0f0420b14ececd
CVE-2023-53246: kernel: cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL

When compiled with CONFIG_CIFS_DFS_UPCALL disabled, cifs_dfs_d_automount
is NULL. cifs.ko logic for mapping CIFS_FATTR_DFS_REFERRAL attributes to
S_AUTOMOUNT and corresponding dentry flags is retained regardless of
CONFIG_CIFS_DFS_UPCALL, leading to a NULL pointer dereference in
VFS follow_automount() when traversing a DFS referral link:
  BUG: kernel NULL pointer dereference, address: 0000000000000000
  ...
  Call Trace:
   <TASK>
   __traverse_mounts+0xb5/0x220
   ? cifs_revalidate_mapping+0x65/0xc0 [cifs]
   step_into+0x195/0x610
   ? lookup_fast+0xe2/0xf0
   path_lookupat+0x64/0x140
   filename_lookup+0xc2/0x140
   ? __create_object+0x299/0x380
   ? kmem_cache_alloc+0x119/0x220
   ? user_path_at_empty+0x31/0x50
   user_path_at_empty+0x31/0x50
   __x64_sys_chdir+0x2a/0xd0
   ? exit_to_user_mode_prepare+0xca/0x100
   do_syscall_64+0x42/0x90
   entry_SYSCALL_64_after_hwframe+0x72/0xdc

This fix adds an inline cifs_dfs_d_automount() {return -EREMOTE} handler
when CONFIG_CIFS_DFS_UPCALL is disabled. An alternative would be to
avoid flagging S_AUTOMOUNT, etc. without CONFIG_CIFS_DFS_UPCALL. This
approach was chosen as it provides more control over the error path.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.177, 5.15.106, 6.1.23, 6.2.10, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 26a32a212bc540f4773cd6af8cf73e967d72569c
CVE-2023-53248: kernel: drm/amdgpu: install stub fence into potential unused fence pointers
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: install stub fence into potential unused fence pointers

When using cpu to update page tables, vm update fences are unused.
Install stub fence into these fence pointers instead of NULL
to avoid NULL dereference when calling dma_fence_wait() on them.


Affected upstream versions: 4.2
Fixed upstream versions: 0, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 78b25110eb8c6990f7f5096bc0136c12a2b4cc99
CVE-2023-53249: kernel: clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe

Use devm_of_iomap() instead of of_iomap() to automatically handle
the unused ioremap region.

If any error occurs, regions allocated by kzalloc() will leak,
but using devm_kzalloc() instead will automatically free the memory
using devm_kfree().


Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.188, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 294321349bd3b0680847fc2bbe66b9ab3e522fea
CVE-2023-53254: kernel: cacheinfo: Fix shared_cpu_map to handle shared caches at different levels
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cacheinfo: Fix shared_cpu_map to handle shared caches at different levels

The cacheinfo sets up the shared_cpu_map by checking whether the caches
with the same index are shared between CPUs. However, this will trigger
slab-out-of-bounds access if the CPUs do not have the same cache hierarchy.
Another problem is the mismatched shared_cpu_map when the shared cache does
not have the same index between CPUs.

CPU0	I	D	L3
index	0	1	2	x
	^	^	^	^
index	0	1	2	3
CPU1	I	D	L2	L3

This patch checks each cache is shared with all caches on other CPUs.


Affected upstream versions: 3.19
Fixed upstream versions: 0, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2f588d0345d69a35e451077afed428fd057a5e34
CVE-2023-53256: kernel: Linux kernel: Denial of Service in ARM FF-A due to duplicate device names during logical partition registration.
Component: kernel
Severity: Low
CWE: CWE-694 (Use of Multiple Resources with Duplicate Identifier)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

A flaw was found in the Linux kernel's ARM Firmware Framework for Arm (FF-A) component. This vulnerability occurs when the system attempts to register multiple logical partitions within a physical partition. Due to an issue in how device names are generated, duplicate names can be created, preventing the successful registration of additional partitions. This can lead to a denial of service, impacting the system's ability to manage and utilize logical partitions.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.114, 6.1.31, 6.3.5, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c2f65991097a62efbdb2bed3c06fc86b08c9593b
CVE-2023-53257: kernel: wifi: mac80211: check S1G action frame size
Component: kernel
Severity: Moderate
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: check S1G action frame size

Before checking the action code, check that it even
exists in the frame.

Statement: Exploitable by an RF-adjacent attacker via malformed 802.11ah (S1G) action frames. No local privileges required. Impact is limited to potential denial-of-service from a kernel crash. Not applicable where 802.11ah/S1G is not in use.
Fixed starting from the Red Hat Enterprise Linux 9.4.

Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.133, 6.1.55, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fedd9377dd9c71a950d432fbe1628eebfbed70a1
CVE-2023-53258: kernel: drm/amd/display: Fix possible underflow for displays with large vblank
Component: kernel
Severity: Moderate
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amd/display: Fix possible underflow for displays with large vblank

[Why]
Underflow observed when using a display with a large vblank region
and low refresh rate

[How]
Simplify calculation of vblank_nom

Increase value for VBlankNomDefaultUS to 800us


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.43, 6.4.8, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d5741133e6e2f304b40ca1da0e16f62af06f4d22
CVE-2023-53260: kernel: ovl: fix null pointer dereference in ovl_permission()
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix null pointer dereference in ovl_permission()

Following process:
          P1                     P2
 path_lookupat
  link_path_walk
   inode_permission
    ovl_permission
      ovl_i_path_real(inode, &realpath)
        path->dentry = ovl_i_dentry_upper(inode)
                          drop_cache
			   __dentry_kill(ovl_dentry)
		            iput(ovl_inode)
		             ovl_destroy_inode(ovl_inode)
		              dput(oi->__upperdentry)
		               dentry_kill(upperdentry)
		                dentry_unlink_inode
				 upperdentry->d_inode = NULL
      realinode = d_inode(realpath.dentry) // return NULL
      inode_permission(realinode)
       inode->i_sb  // NULL pointer dereference
, will trigger an null pointer dereference at realinode:
  [  335.664979] BUG: kernel NULL pointer dereference,
                 address: 0000000000000002
  [  335.668032] CPU: 0 PID: 2592 Comm: ls Not tainted 6.3.0
  [  335.669956] RIP: 0010:inode_permission+0x33/0x2c0
  [  335.678939] Call Trace:
  [  335.679165]  <TASK>
  [  335.679371]  ovl_permission+0xde/0x320
  [  335.679723]  inode_permission+0x15e/0x2c0
  [  335.680090]  link_path_walk+0x115/0x550
  [  335.680771]  path_lookupat.isra.0+0xb2/0x200
  [  335.681170]  filename_lookup+0xda/0x240
  [  335.681922]  vfs_statx+0xa6/0x1f0
  [  335.682233]  vfs_fstatat+0x7b/0xb0

Fetch a reproducer in [Link].

Use the helper ovl_i_path_realinode() to get realinode and then do
non-nullptr checking.


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.43, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 53dd2ca2c02fdcfe3aad2345091d371063f97d17
CVE-2023-53261: kernel: coresight: Fix memory leak in acpi_buffer->pointer
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-15T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

coresight: Fix memory leak in acpi_buffer->pointer

There are memory leaks reported by kmemleak:
...
unreferenced object 0xffff00213c141000 (size 1024):
  comm "systemd-udevd", pid 2123, jiffies 4294909467 (age 6062.160s)
  hex dump (first 32 bytes):
    04 00 00 00 02 00 00 00 18 10 14 3c 21 00 ff ff  ...........<!...
    00 00 00 00 00 00 00 00 03 00 00 00 10 00 00 00  ................
  backtrace:
    [<000000004b7c9001>] __kmem_cache_alloc_node+0x2f8/0x348
    [<00000000b0fc7ceb>] __kmalloc+0x58/0x108
    [<0000000064ff4695>] acpi_os_allocate+0x2c/0x68
    [<000000007d57d116>] acpi_ut_initialize_buffer+0x54/0xe0
    [<0000000024583908>] acpi_evaluate_object+0x388/0x438
    [<0000000017b2e72b>] acpi_evaluate_object_typed+0xe8/0x240
    [<000000005df0eac2>] coresight_get_platform_data+0x1b4/0x988 [coresight]
...

The ACPI buffer memory (buf.pointer) should be freed. But the buffer
is also used after returning from acpi_get_dsd_graph().
Move the temporary variables buf to acpi_coresight_parse_graph(),
and free it before the function return to prevent memory leak.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d1b60e7c9fee34eaedf1fc4e0471f75b33f83a4a
CVE-2023-53263: kernel: drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create
Component: kernel
Severity: Moderate
CWE: CWE-763 (Release of Invalid Pointer or Reference)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-09-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create

We can't simply free the connector after calling drm_connector_init on it.
We need to clean up the drm side first.

It might not fix all regressions from commit 2b5d1c29f6c4
("drm/nouveau/disp: PIOR DP uses GPIO for HPD, not PMGR AUX interrupts"),
but at least it fixes a memory corruption in error handling related to
that commit.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3f27451c9f29d5ed00232968680c7838a44dcac7