huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-52938: kernel: usb: typec: ucsi: Don't attempt to resume the ports before they exist
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: Don't attempt to resume the ports before they exist

This will fix null pointer dereference that was caused by
the driver attempting to resume ports that were not yet
registered.


Affected upstream versions: 6.0.15 < 6.1, 6.1.1 < 6.1.11
Fixed upstream versions: 6.1, 6.1.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fdd11d7136fd070b3a74d6d8799d9eac28a57fc5
CVE-2023-52939: kernel: mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

A flaw was found in the memory management subsystem in the Linux kernel. A NULL pointer dereference can be triggered due to an improper check of the memory cgroup value, resulting in a system crash and a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 9.4 via RHSA-2024:2394 [1].

[1]. https://access.redhat.com/errata/RHSA-2024:2394

Affected upstream versions: 5.4
Fixed upstream versions: 0, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b79ba5953f6fdc5559389ad415620bffc24f024b
CVE-2023-52940: kernel: mm: multi-gen LRU: fix crash during cgroup migration
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm: multi-gen LRU: fix crash during cgroup migration

lru_gen_migrate_mm() assumes lru_gen_add_mm() runs prior to itself.  This
isn't true for the following scenario:

    CPU 1                         CPU 2

  clone()
    cgroup_can_fork()
                                cgroup_procs_write()
    cgroup_post_fork()
                                  task_lock()
                                  lru_gen_migrate_mm()
                                  task_unlock()
    task_lock()
    lru_gen_add_mm()
    task_unlock()

And when the above happens, kernel crashes because of linked list
corruption (mm_struct->lru_gen.list).


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 04448022311cebd30969d3aebdde765f1258b360
CVE-2023-52941: kernel: can: isotp: split tx timer into transmission and timeout
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: isotp: split tx timer into transmission and timeout

The timer for the transmission of isotp PDUs formerly had two functions:
1. send two consecutive frames with a given time gap
2. monitor the timeouts for flow control frames and the echo frames

This led to larger txstate checks and potentially to a problem discovered
by syzbot which enabled the panic_on_warn feature while testing.

The former 'txtimer' function is split into 'txfrtimer' and 'txtimer'
to handle the two above functionalities with separate timer callbacks.

The two simplified timers now run in one-shot mode and make the state
transitions (especially with isotp_rcv_echo) better understandable.


Affected upstream versions: 6.0.9 < 6.1, 6.1
Fixed upstream versions: 0, 6.1, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cae4c9bc35f72af5d4a079bb9d9fd62c4088a411
CVE-2023-52942: kernel: cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()
Component: kernel
Severity: Low
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask()

It was found that the check to see if a partition could use up all
the cpus from the parent cpuset in update_parent_subparts_cpumask()
was incorrect. As a result, it is possible to leave parent with no
effective cpu left even if there are tasks in the parent cpuset. This
can lead to system panic as reported in [1].

Fix this probem by updating the check to fail the enabling the partition
if parent's effective_cpus is a subset of the child's cpus_allowed.

Also record the error code when an error happens in update_prstate()
and add a test case where parent partition and child have the same cpu
list and parent has task. Enabling partition in the child will fail in
this case.

[1] https://www.spinics.net/lists/cgroups/msg36254.html


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a2ab7f2cf5ef8f0c6212a246e681d1fe358cec1f
CVE-2023-52974: kernel: scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-03-27T00:00:00+00:00

A vulnerability was found in the Linux kernel's iscsi tcp drivers. Improper resource allocation management can lead to a use-after-free scenario, triggered when the userspace attempts to access the session host's `ipaddress` attribute while the kernel is performing a session teardown via `iscsi_session_teardown()`.


Affected upstream versions: 2.6.39
Fixed upstream versions: 0, 4.14.306, 4.19.273, 5.10.168, 5.15.93, 5.4.232, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 496af9d3682ed4c28fb734342a09e6cc0c056ea4
CVE-2023-52976: kernel: efi: fix potential NULL deref in efi_mem_reserve_persistent
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

A flaw was found in the EFI module in the Linux kernel. A NULL pointer dereference can be triggered due to a missing check of the return value of the memremap function, causing a crash and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 9.4 via RHSA-2024:2394 [1].

[1]. https://access.redhat.com/errata/RHSA-2024:2394

Affected upstream versions: 5.1.16 < 5.2, 5.2
Fixed upstream versions: 0, 5.10.168, 5.15.93, 5.2, 5.4.232, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d92a25627bcdf264183670da73c9a60c0bac327e
CVE-2023-52977: kernel: net: openvswitch: fix flow memory leak in ovs_flow_cmd_new
Component: kernel
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: fix flow memory leak in ovs_flow_cmd_new

Syzkaller reports a memory leak of new_flow in ovs_flow_cmd_new() as it is
not freed when an allocation of a key fails.

BUG: memory leak
unreferenced object 0xffff888116668000 (size 632):
  comm "syz-executor231", pid 1090, jiffies 4294844701 (age 18.871s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000defa3494>] kmem_cache_zalloc include/linux/slab.h:654 [inline]
    [<00000000defa3494>] ovs_flow_alloc+0x19/0x180 net/openvswitch/flow_table.c:77
    [<00000000c67d8873>] ovs_flow_cmd_new+0x1de/0xd40 net/openvswitch/datapath.c:957
    [<0000000010a539a8>] genl_family_rcv_msg_doit+0x22d/0x330 net/netlink/genetlink.c:739
    [<00000000dff3302d>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
    [<00000000dff3302d>] genl_rcv_msg+0x328/0x590 net/netlink/genetlink.c:800
    [<000000000286dd87>] netlink_rcv_skb+0x153/0x430 net/netlink/af_netlink.c:2515
    [<0000000061fed410>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:811
    [<000000009dc0f111>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
    [<000000009dc0f111>] netlink_unicast+0x545/0x7f0 net/netlink/af_netlink.c:1339
    [<000000004a5ee816>] netlink_sendmsg+0x8e7/0xde0 net/netlink/af_netlink.c:1934
    [<00000000482b476f>] sock_sendmsg_nosec net/socket.c:651 [inline]
    [<00000000482b476f>] sock_sendmsg+0x152/0x190 net/socket.c:671
    [<00000000698574ba>] ____sys_sendmsg+0x70a/0x870 net/socket.c:2356
    [<00000000d28d9e11>] ___sys_sendmsg+0xf3/0x170 net/socket.c:2410
    [<0000000083ba9120>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
    [<00000000c00628f8>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
    [<000000004abfdcf4>] entry_SYSCALL_64_after_hwframe+0x61/0xc6

To fix this the patch rearranges the goto labels to reflect the order of
object allocations and adds appropriate goto statements on the error
paths.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.


Affected upstream versions: 4.9.337 < 4.10, 6.0.16 < 6.1, 4.14.303 < 4.14.306, 4.19.270 < 4.19.273, 5.4.229 < 5.4.232, 5.10.163 < 5.10.168, 5.15.86 < 5.15.93, 6.1.2 < 6.1.11
Fixed upstream versions: 4.10, 4.14.306, 4.19.273, 5.10.168, 5.15.93, 5.4.232, 6.1, 6.1.11
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1ac653cf886cdfc082708c82dc6ac6115cebd2ee
CVE-2023-52981: kernel: drm/i915: Fix request ref counting during error capture & debugfs dump
Component: kernel
Severity: Low
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix request ref counting during error capture & debugfs dump

When GuC support was added to error capture, the reference counting
around the request object was broken. Fix it up.

The context based search manages the spinlocking around the search
internally. So it needs to grab the reference count internally as
well. The execlist only request based search relies on external
locking, so it needs an external reference count but within the
spinlock not outside it.

The only other caller of the context based search is the code for
dumping engine state to debugfs. That code wasn't previously getting
an explicit reference at all as it does everything while holding the
execlist specific spinlock. So, that needs updaing as well as that
spinlock doesn't help when using GuC submission. Rather than trying to
conditionally get/put depending on submission model, just change it to
always do the get/put.

v2: Explicitly document adding an extra blank line in some dense code
(Andy Shevchenko). Fix multiple potential null pointer derefs in case
of no request found (some spotted by Tvrtko, but there was more!).
Also fix a leaked request in case of !started and another in
__guc_reset_context now that intel_context_find_active_request is
actually reference counting the returned request.
v3: Add a _get suffix to intel_context_find_active_request now that it
grabs a reference (Daniele).
v4: Split the intel_guc_find_hung_context change to a separate patch
and rename intel_context_find_active_request_get to
intel_context_get_active_request (Tvrtko).
v5: s/locking/reference counting/ in commit message (Tvrtko)

(cherry picked from commit 3700e353781e27f1bc7222f51f2cc36cbeb9b4ec)


Affected upstream versions: 5.15
Fixed upstream versions: 0, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9467397f417dd7b5d0db91452f0474e79716a527
CVE-2023-52984: kernel: net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

A flaw was found in the dp83822 module in the Linux kernel. A private data pointer is only initialized by the DP83822 PHY. It is left uninitialized by other smaller models, allowing a NULL pointer dereference to be triggered due to missing checks when interrupts are being configured, causing a crash and resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 9.4 via RHSA-2024:2394 [1].

[1]. https://access.redhat.com/errata/RHSA-2024:2394

Affected upstream versions: 5.10
Fixed upstream versions: 0, 5.10.168, 5.15.93, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 362a2f5531dc0e5b0b5b3e3a541000dbffa75461
CVE-2023-52985: kernel: arm64: dts: imx8mm-verdin: Do not power down eth-phy
Component: kernel
Severity: Moderate
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

arm64: dts: imx8mm-verdin: Do not power down eth-phy

Currently if suspending using either freeze or memory state, the fec
driver tries to power down the phy which leads to crash of the kernel
and non-responsible kernel with the following call trace:

[   24.839889 ] Call trace:
[   24.839892 ]  phy_error+0x18/0x60
[   24.839898 ]  kszphy_handle_interrupt+0x6c/0x80
[   24.839903 ]  phy_interrupt+0x20/0x2c
[   24.839909 ]  irq_thread_fn+0x30/0xa0
[   24.839919 ]  irq_thread+0x178/0x2c0
[   24.839925 ]  kthread+0x154/0x160
[   24.839932 ]  ret_from_fork+0x10/0x20

Since there is currently no functionality in the phy subsystem to power
down phys let's just disable the feature of powering-down the ethernet
phy.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.11, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0bdd5a7b517f16fdffc444be6516c45788548d08
CVE-2023-52991: kernel: net: fix NULL pointer in skb_segment_list
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

A flaw was found in the Linux kernel's net subsystem. A NULL pointer dereference can be triggered when a specific sequence of network events occurs due to an improper check, resulting in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.9 and 9.3 via RHSA-2023:7077 [1] and RHSA-2023:6583 [2], respectively.

[1]. https://access.redhat.com/errata/RHSA-2023:7077

[2]. https://access.redhat.com/errata/RHSA-2023:6583

Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.167, 5.15.92, 6.1.10, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6446369fb9f083ce032448c5047da08e298b22e6
CVE-2023-52993: kernel: x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/i8259: Mark legacy PIC interrupts with IRQ_LEVEL

Baoquan reported that after triggering a crash the subsequent crash-kernel
fails to boot about half of the time. It triggers a NULL pointer
dereference in the periodic tick code.

This happens because the legacy timer interrupt (IRQ0) is resent in
software which happens in soft interrupt (tasklet) context. In this context
get_irq_regs() returns NULL which leads to the NULL pointer dereference.

The reason for the resend is a spurious APIC interrupt on the IRQ0 vector
which is captured and leads to a resend when the legacy timer interrupt is
enabled. This is wrong because the legacy PIC interrupts are level
triggered and therefore should never be resent in software, but nothing
ever sets the IRQ_LEVEL flag on those interrupts, so the core code does not
know about their trigger type.

Ensure that IRQ_LEVEL is set when the legacy PCI interrupts are set up.


Affected upstream versions: 2.6.18
Fixed upstream versions: 0, 4.14.305, 4.19.272, 5.10.166, 5.15.91, 5.4.231, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 744fe9be9665227335539b7a77ece8d9ff62b6c0
CVE-2023-52997: kernel: ipv4: prevent potential spectre v1 gadget in ip_metrics_convert()
Component: kernel
Severity: Moderate
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-03-27T00:00:00+00:00

A vulnerability was found in the Linux kernel's `ip_metrics_convert()` function, where improper handling of user input can potentially leak kernel memory via side channels. This issue is caused by the use of `@type`, a user-controlled input, which is an array within this function. If a CPU speculatively executes instructions past the conditional branch before the branch condition is resolved, the line `metrics[type - 1] = val`  may be evaluated. A situation where `type` is out-of-bounds could lead to improper kernel memory access.


Affected upstream versions: 4.3
Fixed upstream versions: 0, 4.19.272, 5.10.166, 5.15.91, 5.4.231, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ef050cf5fb70d995a0d03244e25179b7c66a924a
CVE-2023-52999: kernel: net: fix UaF in netns ops registration error path
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-03-27T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel in the `ops_init()` function, where improper error handling can result in an out-of-bounds error. This issue occurs if the function `net_assign_generic()` fails and the error-handling code attempts to clean up a pointer that was never properly initialized.


Affected upstream versions: 4.19.264 < 4.19.272, 5.4.223 < 5.4.231, 5.10.153 < 5.10.166, 5.15.77 < 5.15.91, 6.0.7 < 6.1, 6.1
Fixed upstream versions: 0, 4.19.272, 5.10.166, 5.15.91, 5.4.231, 6.1, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad0dfe9bcf0d78e699c7efb64c90ed062dc48bea
CVE-2023-53002: kernel: drm/i915: Fix a memory leak with reused mmap_offset
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/i915: Fix a memory leak with reused mmap_offset

drm_vma_node_allow() and drm_vma_node_revoke() should be called in
balanced pairs. We call drm_vma_node_allow() once per-file everytime a
user calls mmap_offset, but only call drm_vma_node_revoke once per-file
on each mmap_offset. As the mmap_offset is reused by the client, the
per-file vm_count may remain non-zero and the rbtree leaked.

Call drm_vma_node_allow_once() instead to prevent that memory leak.


Affected upstream versions: 5.7
Fixed upstream versions: 0, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0bdc4b4ba7206c452ee81c82fa66e39d0e1780fb
CVE-2023-53004: kernel: ovl: fix tmpfile leak
Component: kernel
Severity: Low
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ovl: fix tmpfile leak

Missed an error cleanup.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: caa0ea92503f8afa1941f6ac899e5c4e3f6ec8bb
CVE-2023-53009: kernel: drm/amdkfd: Add sync after creating vram bo
Component: kernel
Severity: Low
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdkfd: Add sync after creating vram bo

There will be data corruption on vram allocated by svm
if the initialization is not complete and application is
writting on the memory. Adding sync to wait for the
initialization completion is to resolve this issue.


Affected upstream versions: 5.14
Fixed upstream versions: 0, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 92af2d3b57a1afdfdcafb1c6a07ffd89cf3e98fb
CVE-2023-53010: kernel: bnxt: Do not read past the end of test names
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

A flaw was found in the bnxt_en module in the Linux kernel. An out-of-bounds read can occur due to an incorrect concatenation of test names, causing a system crash that results in a denial of service.

Statement: This issue has been fixed in Red Hat Enterprise Linux 8.9 and 9.3 via RHSA-2023:7077 [1] and RHSA-2023:6583 [2], respectively.

The bnxt_en module as shipped in Red Hat Enterprise Linux 10 is not affected by this vulnerability because the vulnerable code is not present.

[1]. https://access.redhat.com/errata/RHSA-2023:7077

[2]. https://access.redhat.com/errata/RHSA-2023:6583

Affected upstream versions: 4.12
Fixed upstream versions: 0, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cefa85480ac99c0bef5a09daadb48d65fc28e279
CVE-2023-53013: kernel: ptdma: pt_core_execute_cmd() should use spinlock
Component: kernel
Severity: Low
CWE: CWE-667 (Improper Locking)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ptdma: pt_core_execute_cmd() should use spinlock

The interrupt handler (pt_core_irq_handler()) of the ptdma
driver can be called from interrupt context. The code flow
in this function can lead down to pt_core_execute_cmd() which
will attempt to grab a mutex, which is not appropriate in
interrupt context and ultimately leads to a kernel panic.
The fix here changes this mutex to a spinlock, which has
been verified to resolve the issue.


Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.91, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ed0d8f731e0bf1bb12a7a37698ac613db20e2794
CVE-2023-53015: kernel: HID: betop: check shape of output reports
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-27T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

HID: betop: check shape of output reports

betopff_init() only checks the total sum of the report counts for each
report field to be at least 4, but hid_betopff_play() expects 4 report
fields.
A device advertising an output report with one field and 4 report counts
would pass the check but crash the kernel with a NULL pointer dereference
in hid_betopff_play().


Affected upstream versions: 4.0
Fixed upstream versions: 0, 4.14.305, 4.19.272, 5.10.166, 5.15.91, 5.4.231, 6.1.9, 6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dbab4dba400d6ea9a9697fbbd287adbf7db1dac4