huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-54206: kernel: net/sched: flower: fix filter idr initialization
Component: kernel
Severity: Moderate
CWE: CWE-368 (Context Switching Race Condition)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel’s networking traffic control flower classifier. The initialization of the filter IDR was moved too early in the fl_change() path, allowing concurrent access by multiple users while the structure was still in an inconsistent state. Under certain conditions, this race condition can lead to unexpected behavior including a NULL pointer dereference and kernel crash


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.3.3, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 253a3a324e0ebc2825de76a0f5f17b8383b2023d
CVE-2023-54214: kernel: Bluetooth: L2CAP: Fix potential user-after-free
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free flaw was identified in the Linux kernel’s Bluetooth L2CAP implementation. In certain conditions, when allocating a socket buffer via alloc_skb, the kernel may release and later reacquire the channel lock; if the channel is disconnected in the meantime, a subsequent reference to the freed buffer may occur, potentially resulting in a use-after-free condition.


Affected upstream versions: 3.5
Fixed upstream versions: 0, 4.14.308, 4.19.276, 5.10.173, 5.15.99, 5.4.235, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b2fde8cb2a25125111f2144604e0e7c0ebcc4bba
CVE-2023-54215: kernel: virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory leak was found in the virtio-vdpa driver. The cpumask allocated by create_affinity_masks() is not freed before the function returns, causing a small memory leak each time virtqueues are set up.

Statement: This leak occurs during virtio-vdpa device initialization, primarily in virtualization environments using vDPA. The leaked memory is small per occurrence but could accumulate with repeated device operations.

Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fa450621efab58121fe8e57f7a7b80fee6e0bae1
CVE-2023-54216: kernel: net/mlx5e: TC, Fix using eswitch mapping in nic mode
Component: kernel
Severity: Moderate
CWE: CWE-676 (Use of Potentially Dangerous Function)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel net/mlx5e Ethernet driver’s traffic control handling code. Under certain configurations when operating in NIC mode, the driver erroneously uses the eswitch object mapping pool, which is not initialized in that mode. This can lead to an invalid mapping reference and related kernel trace conditions, potentially causing network driver instability or denial of service. An unprivileged local user with access to configure traffic control on an affected system may be able to trigger this condition


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.3.6, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4150441c010dec36abc389828e2e4758bd8ad4b3
CVE-2023-54221: kernel: clk: imx93: fix memory leak and missing unwind goto in imx93_clocks_probe
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory leak was found in the Linux kernel's i.MX93 clock driver. The imx93_clocks_probe() function returns directly without unregistering hardware clocks or freeing allocated memory when errors occur. The fix converts allocations to use device-managed APIs (devm_kzalloc, devm_of_iomap) and adds proper error handling goto paths.

Statement: This flaw affects only NXP i.MX93 SoC platforms and manifests during clock driver probe failures. The memory leak occurs only in error paths during driver initialization, not during normal operation. Given the limited platform scope and requirement for probe failures, the practical security impact is minimal.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 280a5ff665e12d1e0c54c20cedc9c5008aa686a5
CVE-2023-54227: kernel: blk-mq: fix tags leak when shrink nr_hw_queues
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's block multi-queue (blk-mq) subsystem. When the number of hardware queues is reduced via the submit_queues parameter, the tags associated with the removed queues are not freed, causing a memory leak. This occurs because shrinking nr_hw_queues does not deallocate the tags for queues that are no longer needed.

Statement: Exploitation requires administrative access to configfs and the ability to create and modify null_blk devices. The memory leak manifests only when actively reducing hardware queues on block devices, which is not a typical runtime operation, limiting the practical impact of this flaw.

Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c0ef7493e68b8896806a2f598fcffbaa97333405
CVE-2023-54229: kernel: wifi: fix registration of 6Ghz-only phy without the full channel range
Component: kernel
Severity: Moderate
CWE: CWE-823 (Use of Out-of-range Pointer Offset)
CVSS v3: 4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel ath11k Wi-Fi driver’s channel range validation logic. When registering a 6 GHz-only physical device whose board data does not allow a specific 7.115 GHz channel, the driver incorrectly handles the channel range, causing the phy to fail registration. This condition generates warnings in the kernel log and results in the wireless interface failing to initialize for affected hardware configurations.


Affected upstream versions: 5.9
Fixed upstream versions: 0, 5.10.188, 5.15.150, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 532f8bac60419eb28158770470b9bb655de207c8
CVE-2023-54230: kernel: amba: bus: fix refcount leak
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A reference count leak was found in the ARM AMBA bus driver. When AMBA devices are created from device tree, the of_node reference count is incremented but never decremented in amba_device_release(), causing gradual memory leaks.

Statement: This primarily affects ARM/ARM64 systems using AMBA peripherals. The leak is small per device and accumulates slowly over device add/remove cycles. Normal system operation without frequent device changes is minimally impacted.

Affected upstream versions: 3.1
Fixed upstream versions: 0, 4.14.326, 4.19.295, 5.10.195, 5.15.132, 5.4.257, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 94e398df32e850f26828690ee62f7441979583cc
CVE-2023-54233: kernel: ASoC: SOF: avoid a NULL dereference with unsupported widgets
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference was found in the Sound Open Firmware (SOF) driver. When a topology contains an unsupported widget type, the module_info field is NULL, and dereferencing it during route setup crashes the kernel.

Statement: This requires loading a malformed or incompatible audio topology file. Normal audio operation with supported hardware and topologies is unaffected. Custom topology development or testing scenarios are primarily at risk.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.2.11, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 170818974e9732506195c6302743856cc8bdfd6f
CVE-2023-54234: kernel: scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization
Component: kernel
Severity: Low
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free vulnerability was found in the MPI3MR SCSI driver. The evtack_cmds array is not properly initialized, causing invalid memory access via clear_bit() with incorrect bit indices during event acknowledgment.

Statement: This affects systems with Broadcom MPI3MR SCSI controllers (eHBA-9600 series). The bug was observed during firmware updates and requires specific hardware to trigger.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4e0dfdb48a824deac3dfbc67fb856ef2aee13529
CVE-2023-54235: kernel: PCI/DOE: Fix destroy_work_on_stack() race
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A race condition flaw was found in the Linux kernel's PCI Data Object Exchange (DOE) implementation. The destroy_work_on_stack() function is called after signaling completion, creating a race where the work struct can go out of scope before being destroyed. This triggers debug object warnings when CONFIG_DEBUG_OBJECTS is enabled.

Statement: This manifests as a debug object warning rather than a functional failure. The race is only visible when kernel debug options are enabled. Production kernels without CONFIG_DEBUG_OBJECTS will not see any symptoms, though the underlying race still exists.

Affected upstream versions: 6.1.24 < 6.1.53, 6.2.11 < 6.3, 6.3
Fixed upstream versions: 0, 6.1.53, 6.3, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d96799ee3b78962c80e4b6653734f488f999ca09
CVE-2023-54237: kernel: net/smc: fix potential panic dues to unprotected smc_llc_srv_add_link()
Component: kernel
Severity: Low
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A race condition was found in the SMC (Shared Memory Communications) networking subsystem. The smc_llc_srv_add_link() function lacks proper locking, allowing concurrent link additions that can corrupt link group state and crash the kernel.

Statement: This affects systems using SMC for RDMA-based network communication. The race requires concurrent link group operations, typically occurring under high SMC connection load on enterprise systems with InfiniBand or RoCE adapters.

Affected upstream versions: 5.8
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f2f46de98c11d41ac8d22765f47ba54ce5480a5b
CVE-2023-54238: kernel: Linux kernel: Denial of Service in mlx5 driver due to memory leaks
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's mlx5 driver. During a Precision Time Protocol (PTP) resynchronization operation, socket buffers (SKBs) were not properly freed, leading to a memory leak. Additionally, an error in the mlx5e_skb_fifo_has_room() function's counter check could cause further resource leaks. A local attacker with low privileges could exploit these memory and resource leaks to cause a Denial of Service (DoS).


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 234cffda95e1049f58e8ec136ef105c633f0ed19
CVE-2023-54242: kernel: block, bfq: Fix division by zero error on zero wsum
Component: kernel
Severity: Low
CWE: CWE-369 (Divide By Zero)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A division by zero error was found in the BFQ I/O scheduler. When the weighted sum of I/O priorities becomes zero, the limit calculation divides by zero, causing a kernel crash.

Statement: Triggering this requires root privileges to manipulate I/O priorities in specific ways using tools like stress-ng. Standard workloads do not create zero-weighted-sum conditions in the BFQ scheduler.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1655cfc85250a224b0d9486c8136baeea33b9b5c
CVE-2023-54244: kernel: ACPI: EC: Fix oops when removing custom query handlers
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's ACPI Embedded Controller (EC) subsystem. When removing custom query handlers, a kernel oops can occur if the handler is still being executed in the EC query workqueue while the module containing the callback function is being unloaded. The fix ensures the workqueue is flushed before handler removal.

Statement: This bug requires a race condition between module unloading and EC query handler execution, which typically involves administrative operations. Since triggering the oops depends on specific timing during module removal, the attack surface is limited to privileged local users performing driver management tasks.

Affected upstream versions: 2.6.32.6 < 2.6.33, 2.6.33
Fixed upstream versions: 0, 2.6.33, 4.14.316, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 130e3eac51912f2c866e7d035992ede25f8feac0
CVE-2023-54246: kernel: rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle()
Component: kernel
Severity: Low
CWE: CWE-628 (Function Call with Incorrectly Specified Arguments)
CVSS v3: 2.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A hung task warning issue was found in the RCU scaling test module. When the holdoff parameter exceeds hung_task_timeout_secs, the kernel logs a hung task warning for the rcu_scale_writer kthread.

Statement: This affects only the rcuscale test module, which is not loaded in production systems. The warning occurs only with specific module parameters during RCU performance testing and does not impact normal kernel operation.

Affected upstream versions: 4.7
Fixed upstream versions: 0, 5.10.197, 5.15.133, 6.1.55, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 55887adc76e19aec9763186e2c1d0a3481d20e96
CVE-2023-54251: kernel: net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was addressed in the Linux kernel’s traffic scheduling (TAPRIO) subsystem. The code that handles the TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME attribute did not enforce an upper bound on this value, which could allow excessively large cycle time inputs to be processed. Under certain conditions, this can lead to an integer overflow or wraparound in the scheduling logic. As a result, the kernel may behave unexpectedly and could be made to crash, resulting in a denial of service condition on affected systems.


Affected upstream versions: 5.3
Fixed upstream versions: 0, 5.15.126, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f04f6d9b3b060f7e11219a65a76da65f1489e391
CVE-2023-54254: kernel: Kernel: Denial of Service via resource leak in drm/ttm
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's Direct Rendering Manager (DRM) subsystem, specifically within the TTM (Translation Table Manager) component. A local attacker with low privileges could exploit this vulnerability due to a resource leak that occurs during certain eviction errors. This could lead to a denial of service (DoS) condition, making the system unavailable.


Affected upstream versions: 5.14.6 < 5.15, 5.15
Fixed upstream versions: 0, 5.15, 5.15.124, 6.1.43, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7738335d73d0686ec8995e0448e5d1b48cffb2a4
CVE-2023-54259: kernel: soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A reference count underflow flaw was found in the Linux kernel's SoundWire bus driver. When pm_runtime_resume_and_get() returns an error (-EACCES), the code continues execution and calls pm_runtime_put() at the end, even though the usage count was never incremented. This causes a usage count underflow in the runtime power management subsystem.

Statement: This affects systems with SoundWire audio hardware. The underflow can cause power management state inconsistencies but typically does not crash the system. The issue occurs only in specific error scenarios during device power state transitions.

Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 4e5e9da139c007dfc397a159093b4c4187ee67fa
CVE-2023-54260: kernel: cifs: Fix lost destroy smbd connection when MR allocate failed
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's CIFS SMB Direct implementation. When memory region (MR) allocation fails during SMB Direct connection setup, the smbd_destroy() function returns early without cleaning up the connection info structure, resulting in a memory leak.

Statement: This leak occurs only during SMB Direct connection failures, specifically when RDMA memory region allocation fails. Systems not using SMB Direct (RDMA-based CIFS) are unaffected. The leaked memory is per-failed-connection and does not accumulate during normal operation.

Affected upstream versions: 4.16
Fixed upstream versions: 0, 4.19.276, 5.10.173, 5.15.99, 5.4.235, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d303e25887127364a6765eaf7ac68aa2bac518a9
CVE-2023-54261: kernel: drm/amdkfd: Add missing gfx11 MQD manager callbacks
Component: kernel
Severity: Low
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A NULL pointer dereference was found in the AMD KFD driver for GFX11 GPUs. The mqd_stride callback was not assigned for GFX11 hardware, causing crashes when accessing the MQD debugfs interface.

Statement: This affects systems with AMD RDNA3 (GFX11) GPUs when reading debugfs entries. Normal GPU operation without debugfs access is unaffected. The crash requires debugfs mounted and accessible.

Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 399b73d6b7720a9eae68a333193b53ed4f432fe5
CVE-2023-54262: kernel: net/mlx5e: Don't clone flow post action attributes second time
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-12-30T00:00:00+00:00

A use-after-free flaw was discovered in the Linux kernel’s mlx5e networking driver. The code erroneously cloned flow post action attributes a second time in mlx5e_tc_post_act_add() despite an earlier clone in mlx5e_clone_flow_attr_for_post_act(). This second clone is not properly updated during neighbor update operations, which can lead to use-after-free memory access when the stale attribute copy is dereferenced.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c382b693ffcb1f1ebf60d76ab9dedfe9ea13eedf
CVE-2023-54263: kernel: drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP
Component: kernel
Severity: Moderate
CWE: CWE-909 (Missing Initialization of Resource)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Public date: 2025-12-30T00:00:00+00:00

A flaw was found in the Linux kernel's nouveau graphics driver for NVIDIA GPUs. The hpd_irq_lock spinlock is not initialized for PIOR (Parallel Interface Output Resource) DisplayPort connectors. This missing initialization causes a kernel oops on systems with ANX9805 DP encoders when hotplug detection operations access the uninitialized lock.

Statement: This issue affects a narrow subset of systems: those with NVIDIA graphics cards using the nouveau driver combined with ANX9805 DisplayPort encoder hardware. Most users will not encounter this bug as it requires specific external DP encoder hardware. The crash occurs during display hotplug events on affected systems.

Affected upstream versions: 5.10
Fixed upstream versions: 0, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 92d48ce21645267c574268678131cd2b648dad0f
CVE-2023-54265: kernel: ipv6: Fix an uninit variable access bug in __ip6_make_skb()
Component: kernel
Severity: Moderate
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-30T00:00:00+00:00

A flaw was identified in the Linux kernel’s IPv6 networking code in the function __ip6_make_skb(). Under certain conditions—such as when using raw IPv6 sockets and processing ICMPv6 headers—the code may access an uninitialized variable because the expected header data is not guaranteed to reside in the linear portion of the socket buffer (skb). This can lead to unpredictable behavior, including potential kernel instability or crash


Affected upstream versions: 2.6.24
Fixed upstream versions: 0, 4.14.313, 4.19.281, 5.10.178, 5.15.107, 5.4.241, 6.1.24, 6.2.11, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 165370522cc48127da564a08584a7391e6341908