huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53510: kernel: scsi: ufs: core: Fix handling of lrbp->cmd
Component: kernel
Severity: Moderate
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: ufs: core: Fix handling of lrbp->cmd

ufshcd_queuecommand() may be called two times in a row for a SCSI command
before it is completed. Hence make the following changes:

 - In the functions that submit a command, do not check the old value of
   lrbp->cmd nor clear lrbp->cmd in error paths.

 - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd.

See also scsi_send_eh_cmnd().

This commit prevents that the following appears if a command times out:

WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8
Call trace:
 ufshcd_queuecommand+0x6f8/0x9a8
 scsi_send_eh_cmnd+0x2c0/0x960
 scsi_eh_test_devices+0x100/0x314
 scsi_eh_ready_devs+0xd90/0x114c
 scsi_error_handler+0x2b4/0xb70
 kthread+0x16c/0x1e0


Affected upstream versions: 3.12
Fixed upstream versions: 0, 6.1.167, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b6d76d63c6d21d5d26c301a46853a2aee72397d5
CVE-2023-53512: kernel: scsi: mpt3sas: Fix a memory leak
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpt3sas: Fix a memory leak

Add a forgotten kfree().


Affected upstream versions: 4.16
Fixed upstream versions: 0, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 30c7c72b6cf9d8c95f9b219c9d2e4e31b15bebe5
CVE-2023-53513: kernel: nbd: fix incomplete validation of ioctl arg
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw has been found in the Linux kernel’s NBD drivers.The issue stems from incomplete validation of IOCTL arguments passed to the NBD driver. Specifically, oversized or unchecked arguments may lead to a signed integer overflow in __block_write_full_page() and misuse of argument values cast to int in nbd_add_socket().


Affected upstream versions: 4.1
Fixed upstream versions: 0, 5.15.113, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 52851d0c3354b397c11d31dfeb8b2a2fc85a0002
CVE-2023-53517: kernel: Linux kernel: Denial of Service via malicious MTU negotiation in TIPC
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

A flaw was found in the Linux kernel's Transparent Inter-Process Communication (TIPC) protocol. A malicious peer can exploit this by sending a specially crafted Activate message with a very small Maximum Transmission Unit (MTU) value during link MTU negotiation. This can lead to an integer overflow, causing a system crash and resulting in a Denial of Service (DoS).


Affected upstream versions: 4.1
Fixed upstream versions: 0, 5.10.181, 5.15.113, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2bd4ff4ffb92113f8acd04dbaed83269172c24b4
CVE-2023-53519: kernel: media: v4l2-mem2mem: add lock to protect parameter num_rdy
Component: kernel
Severity: Moderate
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

media: v4l2-mem2mem: add lock to protect parameter num_rdy

Getting below error when using KCSAN to check the driver. Adding lock to
protect parameter num_rdy when getting the value with function:
v4l2_m2m_num_src_bufs_ready/v4l2_m2m_num_dst_bufs_ready.

kworker/u16:3: [name:report&]BUG: KCSAN: data-race in v4l2_m2m_buf_queue
kworker/u16:3: [name:report&]

kworker/u16:3: [name:report&]read-write to 0xffffff8105f35b94 of 1 bytes by task 20865 on cpu 7:
kworker/u16:3:  v4l2_m2m_buf_queue+0xd8/0x10c


Affected upstream versions: 2.6.39
Fixed upstream versions: 0, 4.14.324, 4.19.293, 5.10.192, 5.15.128, 5.4.255, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 690dd4780b3f4d755e4e7883e8c3d1b5052f6bf2
CVE-2023-53521: kernel: scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()

A fix for:

BUG: KASAN: slab-out-of-bounds in ses_intf_remove+0x23f/0x270 [ses]
Read of size 8 at addr ffff88a10d32e5d8 by task rmmod/12013

When edev->components is zero, accessing edev->component[0] members is
wrong.


Affected upstream versions: 2.6.25
Fixed upstream versions: 0, 4.14.308, 4.19.276, 5.10.173, 5.15.99, 5.4.235, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 76f7050537476ac062ec23a544fbca8270f2d08b
CVE-2023-53524: kernel: Linux kernel: Integer overflow in iwlwifi debugfs function
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-01T00:00:00+00:00

A flaw was identified in the Linux kernel’s iwlwifi PCIe driver. In the function iwl_write_to_user_buf()—which is invoked by iwl_dbgfs_monitor_data_read()—an attacker could supply a specially crafted count value (e.g., SIZE_MAX). This leads to an integer overflow when calculating the remaining buffer space, potentially resulting in a negative value that is incorrectly used as a length in a subsequent copy_to_user() call, which can result in a heap overflow condition.


Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0ad8dd870aa187d0c21d032bb2c6433559075eec
CVE-2023-53525: kernel: RDMA/cma: Allow UD qp_type to join multicast only
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

RDMA/cma: Allow UD qp_type to join multicast only

As for multicast:
- The SIDR is the only mode that makes sense;
- Besides PS_UDP, other port spaces like PS_IB is also allowed, as it is
  UD compatible. In this case qkey also needs to be set [1].

This patch allows only UD qp_type to join multicast, and set qkey to
default if it's not set, to fix an uninit-value error: the ib->rec.qkey
field is accessed without being initialized.

=====================================================
BUG: KMSAN: uninit-value in cma_set_qkey drivers/infiniband/core/cma.c:510 [inline]
BUG: KMSAN: uninit-value in cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570
 cma_set_qkey drivers/infiniband/core/cma.c:510 [inline]
 cma_make_mc_event+0xb73/0xe00 drivers/infiniband/core/cma.c:4570
 cma_iboe_join_multicast drivers/infiniband/core/cma.c:4782 [inline]
 rdma_join_multicast+0x2b83/0x30a0 drivers/infiniband/core/cma.c:4814
 ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479
 ucma_join_multicast+0x1e3/0x250 drivers/infiniband/core/ucma.c:1546
 ucma_write+0x639/0x6d0 drivers/infiniband/core/ucma.c:1732
 vfs_write+0x8ce/0x2030 fs/read_write.c:588
 ksys_write+0x28c/0x520 fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __ia32_sys_write+0xdb/0x120 fs/read_write.c:652
 do_syscall_32_irqs_on arch/x86/entry/common.c:114 [inline]
 __do_fast_syscall_32+0x96/0xf0 arch/x86/entry/common.c:180
 do_fast_syscall_32+0x34/0x70 arch/x86/entry/common.c:205
 do_SYSENTER_32+0x1b/0x20 arch/x86/entry/common.c:248
 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c

Local variable ib.i created at:
cma_iboe_join_multicast drivers/infiniband/core/cma.c:4737 [inline]
rdma_join_multicast+0x586/0x30a0 drivers/infiniband/core/cma.c:4814
ucma_process_join+0xa76/0xf60 drivers/infiniband/core/ucma.c:1479

CPU: 0 PID: 29874 Comm: syz-executor.3 Not tainted 5.16.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
=====================================================

[1] https://lore.kernel.org/linux-rdma/20220117183832.GD84788@nvidia.com/


Affected upstream versions: 5.8.17 < 5.9, 5.9.2 < 5.10, 5.10
Fixed upstream versions: 0, 5.10, 5.10.178, 5.15.108, 5.9, 6.1.25, 6.2.12, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ae11498851423d6de27aebfe12a5ee85060ab1d5
CVE-2023-53527: kernel: thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

thunderbolt: Fix memory leak in tb_handle_dp_bandwidth_request()

The memory allocated in tb_queue_dp_bandwidth_request() needs to be
released once the request is handled to avoid leaking it.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.4.11, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0752bb32aed2c5dd85821195a507a1079c4835f7
CVE-2023-53530: kernel: scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()
Component: kernel
Severity: Moderate
CWE: CWE-663 (Use of a Non-reentrant Function in a Concurrent Context)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()

The following call trace was observed:

localhost kernel: nvme nvme0: NVME-FC{0}: controller connect complete
localhost kernel: BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u129:4/75092
localhost kernel: nvme nvme0: NVME-FC{0}: new ctrl: NQN "nqn.1992-08.com.netapp:sn.b42d198afb4d11ecad6d00a098d6abfa:subsystem.PR_Channel2022_RH84_subsystem_291"
localhost kernel: caller is qla_nvme_post_cmd+0x216/0x1380 [qla2xxx]
localhost kernel: CPU: 6 PID: 75092 Comm: kworker/u129:4 Kdump: loaded Tainted: G    B   W  OE    --------- ---  5.14.0-70.22.1.el9_0.x86_64+debug #1
localhost kernel: Hardware name: HPE ProLiant XL420 Gen10/ProLiant XL420 Gen10, BIOS U39 01/13/2022
localhost kernel: Workqueue: nvme-wq nvme_async_event_work [nvme_core]
localhost kernel: Call Trace:
localhost kernel: dump_stack_lvl+0x57/0x7d
localhost kernel: check_preemption_disabled+0xc8/0xd0
localhost kernel: qla_nvme_post_cmd+0x216/0x1380 [qla2xxx]

Use raw_smp_processor_id() instead of smp_processor_id().

Also use queue_work() across the driver instead of queue_work_on() thus
avoiding usage of smp_processor_id() when CONFIG_DEBUG_PREEMPT is enabled.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1a541999f31fcb10ea50eba2a563e6c451fd5c7d
CVE-2023-53531: kernel: null_blk: fix poll request timeout handling
Component: kernel
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

null_blk: fix poll request timeout handling

When doing io_uring benchmark on /dev/nullb0, it's easy to crash the
kernel if poll requests timeout triggered, as reported by David. [1]

BUG: kernel NULL pointer dereference, address: 0000000000000008
Workqueue: kblockd blk_mq_timeout_work
RIP: 0010:null_timeout_rq+0x4e/0x91
Call Trace:
 ? null_timeout_rq+0x4e/0x91
 blk_mq_handle_expired+0x31/0x4b
 bt_iter+0x68/0x84
 ? bt_tags_iter+0x81/0x81
 __sbitmap_for_each_set.constprop.0+0xb0/0xf2
 ? __blk_mq_complete_request_remote+0xf/0xf
 bt_for_each+0x46/0x64
 ? __blk_mq_complete_request_remote+0xf/0xf
 ? percpu_ref_get_many+0xc/0x2a
 blk_mq_queue_tag_busy_iter+0x14d/0x18e
 blk_mq_timeout_work+0x95/0x127
 process_one_work+0x185/0x263
 worker_thread+0x1b5/0x227

This is indeed a race problem between null_timeout_rq() and null_poll().

null_poll()				null_timeout_rq()
  spin_lock(&nq->poll_lock)
  list_splice_init(&nq->poll_list, &list)
  spin_unlock(&nq->poll_lock)

  while (!list_empty(&list))
    req = list_first_entry()
    list_del_init()
    ...
    blk_mq_add_to_batch()
    // req->rq_next = NULL
					spin_lock(&nq->poll_lock)

					// rq->queuelist->next == NULL
					list_del_init(&rq->queuelist)

					spin_unlock(&nq->poll_lock)

Fix these problems by setting requests state to MQ_RQ_COMPLETE under
nq->poll_lock protection, in which null_timeout_rq() can safely detect
this race and early return.

Note this patch just fix the kernel panic when request timeout happen.

[1] https://lore.kernel.org/all/3893581.1691785261@warthog.procyon.org.uk/


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a0b4a0666beacfe8add9c71d8922475541dbae73
CVE-2023-53532: kernel: wifi: ath11k: fix deinitialization of firmware resources
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath11k: fix deinitialization of firmware resources

Currently, in ath11k_ahb_fw_resources_init(), iommu domain
mapping is done only for the chipsets having fixed firmware
memory. Also, for such chipsets, mapping is done only if it
does not have TrustZone support.

During deinitialization, only if TrustZone support is not there,
iommu is unmapped back. However, for non fixed firmware memory
chipsets, TrustZone support is not there and this makes the
condition check to true and it tries to unmap the memory which
was not mapped during initialization.

This leads to the following trace -

[   83.198790] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008
[   83.259537] Modules linked in: ath11k_ahb ath11k qmi_helpers
.. snip ..
[   83.280286] pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   83.287228] pc : __iommu_unmap+0x30/0x140
[   83.293907] lr : iommu_unmap+0x5c/0xa4
[   83.298072] sp : ffff80000b3abad0
.. snip ..
[   83.369175] Call trace:
[   83.376282]  __iommu_unmap+0x30/0x140
[   83.378541]  iommu_unmap+0x5c/0xa4
[   83.382360]  ath11k_ahb_fw_resource_deinit.part.12+0x2c/0xac [ath11k_ahb]
[   83.385666]  ath11k_ahb_free_resources+0x140/0x17c [ath11k_ahb]
[   83.392521]  ath11k_ahb_shutdown+0x34/0x40 [ath11k_ahb]
[   83.398248]  platform_shutdown+0x20/0x2c
[   83.403455]  device_shutdown+0x16c/0x1c4
[   83.407621]  kernel_restart_prepare+0x34/0x3c
[   83.411529]  kernel_restart+0x14/0x74
[   83.415781]  __do_sys_reboot+0x1c4/0x22c
[   83.419427]  __arm64_sys_reboot+0x1c/0x24
[   83.423420]  invoke_syscall+0x44/0xfc
[   83.427326]  el0_svc_common.constprop.3+0xac/0xe8
[   83.430974]  do_el0_svc+0xa0/0xa8
[   83.435659]  el0_svc+0x1c/0x44
[   83.438957]  el0t_64_sync_handler+0x60/0x144
[   83.441910]  el0t_64_sync+0x15c/0x160
[   83.446343] Code: aa0103f4 f9400001 f90027a1 d2800001 (f94006a0)
[   83.449903] ---[ end trace 0000000000000000 ]---

This can be reproduced by probing an AHB chipset which is not
having a fixed memory region. During reboot (or rmmod) trace
can be seen.

Fix this issue by adding a condition check on firmware fixed memory
hw_param as done in the counter initialization function.

Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.7.0.1-01744-QCAHKSWPL_SILICONZ-1


Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0324300dce3412d4737b4ec5898d0188495a7caa
CVE-2023-53536: kernel: blk-crypto: make blk_crypto_evict_key() more robust
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-04T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel block layer crypto key management. When blk_crypto_evict_key() fails due to a key still being in-use or keyslot eviction failure during inode eviction, the function returns an error but leaves the key linked in keyslot management structures, causing the caller to free the blk_crypto_key structure regardless of the error, which results in a use-after-free when other code later accesses the freed key and can lead to memory corruption and denial of service.

Statement: The issue arises because of a mismatch between blk_crypto_evict_key()'s error handling and its callers' expectations. When evicting encryption keys during inode eviction or similar contexts, if blk_crypto_evict_key() detects that a key is still in-use or if the hardware keyslot_evict operation fails, it returns an error while leaving the key linked into the keyslot management lists and trees. However, callers like inode eviction treat failure as non-fatal and proceed to free the blk_crypto_key memory regardless of the return value, since in these contexts failure is not an option. This creates a window where the management structures contain pointers to freed memory. When blk_crypto_reprogram_all_keys() or other functions later traverse these structures, they dereference freed memory, causing use-after-free conditions.

Affected upstream versions: 5.8
Fixed upstream versions: 0, 5.10.180, 5.15.111, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 701a8220762ff90615dc91d3543f789391b63298
CVE-2023-53539: kernel: RDMA/rxe: Fix incomplete state save in rxe_requester
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-04T00:00:00+00:00

An incorrect state restoration flaw was found in the Linux kernel's RDMA rxe (soft-RoCE) driver in the requester packet transmission logic. 
A local user with access to RDMA devices can trigger this issue when network layer packet drops occur during RDMA send operations, causing the work queue element state to be incompletely saved and restored. This results in data corruption in resent packets, leading to denial of service or potential data integrity issues.

Statement: The vulnerability occurs when rxe_requester attempts to retransmit a packet after receiving -EAGAIN from the IP layer. The code saves work queue element state to enable retransmission, but fails to preserve the DMA structure that tracks scatter-gather list processing. Additionally, the state snapshot happens after packet construction has already modified the DMA fields. When heavy network stress causes packet drops—particularly when a fast sender communicates with a slow receiver across multiple queue pairs—the incomplete restoration causes retransmitted packets to carry corrupted payload data.

Affected upstream versions: 4.8
Fixed upstream versions: 0, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 70518f3aaf5a059b691867d7d2d46b999319656a
CVE-2023-53544: kernel: cpufreq: davinci: Fix clk use after free
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: davinci: Fix clk use after free

The remove function first frees the clks and only then calls
cpufreq_unregister_driver(). If one of the cpufreq callbacks is called
just before cpufreq_unregister_driver() is run, the freed clks might be
used.


Affected upstream versions: 2.6.33
Fixed upstream versions: 0, 4.14.308, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 66b3bbe6fbd8dd410868e5b53ac3944a934b9310
CVE-2023-53545: kernel: drm/amdgpu: unmap and remove csa_va properly
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-04T00:00:00+00:00

A locking violation was found in the Linux kernel's AMD GPU driver in the context save area cleanup path. 
A local user can trigger this issue when closing GPU contexts, causing the driver to unmap and remove virtual memory mappings without first reserving the root page directory buffer object. This violates kernel locking rules and triggers lockdep warnings, potentially leading to system instability and denial of service.

Statement: AMD GPUs use a context save area (CSA) to preserve GPU state across context switches. When a process closes its GPU file descriptor, the cleanup code needs to unmap the CSA virtual address and remove it from the GPU's virtual memory system. The amdgpu_vm_bo_del function—which handles this unmapping—requires that the root page directory BO be reserved (locked) before it can safely modify the VM structure. However, the cleanup path in amdgpu_driver_postclose_kms was calling this function without holding the required lock. This creates a race condition window where concurrent GPU operations could be accessing the same VM structures. Lockdep immediately catches this violation and emits warnings. While the immediate symptom is warning messages, the underlying race could cause memory corruption or use-after-free conditions.

Affected upstream versions: 4.2
Fixed upstream versions: 0, 5.15.209, 6.1.167, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1bc35e637a81dac5f5155e83a277c26708c4d4d7
CVE-2023-53546: kernel: net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx

when mlx5_cmd_exec failed in mlx5dr_cmd_create_reformat_ctx, the memory
pointed by 'in' is not released, which will cause memory leak. Move memory
release after mlx5_cmd_exec.


Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.190, 5.15.126, 5.4.253, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 800d8c96bf997da5eb76ccf8d88795c4231c83fb