huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53832: kernel: md/raid10: fix null-ptr-deref in raid10_sync_request
Component: kernel
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A null pointer dereference flaw was found in the Linux kernel's RAID10 implementation. When recovery is skipped on a clean array, init_resync() is called but close_sync() is not, leaving conf->have_replacement incorrectly set to 0. If a replacement device is later added and recovery is triggered, repl_bio is not allocated, causing a null pointer dereference when accessed.

Statement: Exploitation requires specific RAID10 array operations including adding replacement devices after skipped recovery cycles. This represents a reliability issue for systems using RAID10 with device replacement workflows.

Affected upstream versions: 3.10
Fixed upstream versions: 0, 4.19.283, 5.10.180, 5.15.111, 5.4.243, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 38d33593260536840b49fd1dcac9aedfd14a9d42
CVE-2023-53833: kernel: drm/i915: Fix NULL ptr deref by checking new_crtc_state
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-12-09T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Intel i915 graphics driver in the Linux kernel. The intel_atomic_get_new_crtc_state() function can return NULL if the CRTC state was not previously obtained via intel_atomic_get_crtc_state(), but the return value was not checked before use. This leads to a kernel crash when display mode changes are performed under certain conditions.

Statement: This is a NULL pointer dereference in the Intel i915 graphics driver that can cause a kernel crash during display configuration changes. The vulnerability requires local access and affects systems with Intel integrated graphics.

Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dbf25cc21beff4fd2e730573845a266504b21bb2
CVE-2023-53842: kernel: ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A resource leak was found in the WCD MBHC v2 audio codec driver in the Linux kernel. MBHC resources are not properly released on component probe failure or removal, causing interrupt request failures and preventing successful reprobing of the codec component. This leads to sound card initialization failures after probe deferrals.

Statement: This issue affects Qualcomm WCD audio codec hardware found in specific ARM-based platforms. Standard x86 server and desktop systems do not include this hardware and are unaffected.

Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.123, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 90ab6446eb522e31421b77bf8f45714f5668f9a3
CVE-2023-53843: kernel: net: openvswitch: reject negative ifindex
Component: kernel
Severity: Moderate
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 5.1 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-12-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: reject negative ifindex

Recent changes in net-next (commit 759ab1edb56c ("net: store netdevs
in an xarray")) refactored the handling of pre-assigned ifindexes
and let syzbot surface a latent problem in ovs. ovs does not validate
ifindex, making it possible to create netdev ports with negative
ifindex values. It's easy to repro with YNL:

$ ./cli.py --spec netlink/specs/ovs_datapath.yaml \
         --do new \
	 --json '{"upcall-pid": 1, "name":"my-dp"}'
$ ./cli.py --spec netlink/specs/ovs_vport.yaml \
	 --do new \
	 --json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'

$ ip link show
-65536: some-port0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000
    link/ether 7a:48:21:ad:0b:fb brd ff:ff:ff:ff:ff:ff
...

Validate the inputs. Now the second command correctly returns:

$ ./cli.py --spec netlink/specs/ovs_vport.yaml \
	 --do new \
	 --json '{"upcall-pid": "00000001", "name": "some-port0", "dp-ifindex":3,"ifindex":4294901760,"type":2}'

lib.ynl.NlError: Netlink error: Numerical result out of range
nl_len = 108 (92) nl_flags = 0x300 nl_type = 2
	error: -34	extack: {'msg': 'integer out of range', 'unknown': [[type:4 len:36] b'\x0c\x00\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00\x0c\x00\x03\x00\xff\xff\xff\x7f\x00\x00\x00\x00\x08\x00\x01\x00\x08\x00\x00\x00'], 'bad-attr': '.ifindex'}

Accept 0 since it used to be silently ignored.


Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c965a58376146dcfdda186819462e8eb3aadef3a
CVE-2023-53844: kernel: drm/ttm: Don't leak a resource on swapout move error
Component: kernel
Severity: Low
CWE: CWE-771 (Missing Reference to Active Allocated Resource)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A resource leak was found in the TTM (Translation Table Manager) memory management subsystem of the Linux kernel's DRM (Direct Rendering Manager). When moving a buffer object to system memory for swapout fails, the allocated resource is not properly freed, leading to gradual memory exhaustion on systems with active GPU workloads.

Statement: This bug requires graphics hardware using TTM-based drivers (AMD, VMware, etc.) and sustained GPU memory pressure to trigger swap operations. Impact is limited to gradual resource exhaustion under specific workloads.

Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.121, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: af4e0ce2af8a8f0ff3b89702a1e18d8ec2c4a834
CVE-2023-53847: kernel: usb-storage: alauda: Fix uninit-value in alauda_check_media()
Component: kernel
Severity: Low
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

An uninitialized value vulnerability was found in the alauda USB storage driver in the Linux kernel. In alauda_check_media(), the function does not verify that USB transfer operations succeeded before using the received data. If a transfer fails, uninitialized memory may be accessed, leading to undefined behavior. Additionally, alauda_check_media() performs DMA to a stack buffer, which is incorrect behavior.

Statement: This is an uninitialized memory access vulnerability in the alauda USB storage driver. The impact is limited to systems with Alauda-compatible media devices connected via USB.

Affected upstream versions: 2.6.16
Fixed upstream versions: 0, 4.14.323, 4.19.292, 5.10.191, 5.15.127, 5.4.254, 6.1.46, 6.4.11, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 153c3e85873cc3e2f387169783c3a227bad9a95a
CVE-2023-53848: kernel: md/raid5-cache: fix a deadlock in r5l_exit_log()
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A deadlock vulnerability was found in the md RAID5 cache (r5l) subsystem in the Linux kernel. In r5l_exit_log(), flush_work() is called while holding reconfig_mutex, which waits for disable_writeback_work to complete. However, r5c_disable_writeback_async() calls wait_event() which requires conf->log to be NULL, but that only happens after flush_work() returns, creating a deadlock.

Statement: This is a deadlock vulnerability in the RAID5 journaling cache subsystem that can cause system hangs when stopping RAID5 arrays with caching enabled. The impact is limited to systems using RAID5 with write-back caching.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ac9e103f282a7854f3274ef5ff0742fbbe8d7d6b
CVE-2023-53857: kernel: bpf: bpf_sk_storage: Fix invalid wait context lockdep report
Component: kernel
Severity: Low
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A locking context violation was found in the BPF socket local storage implementation in the Linux kernel. The code attempts to allocate memory (via kzalloc) while holding a raw_spin_lock, which is unsafe for PREEMPT_RT kernels. This can cause lockdep warnings and potential issues on real-time kernels where sleeping with raw spinlocks held is not permitted.

Statement: This is a locking context issue in BPF socket local storage that primarily affects PREEMPT_RT kernels. The impact is limited as it mainly causes lockdep warnings and affects only systems with specific BPF program configurations.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 300415caa373a07782fcbc2f8d9429bc2dc27a47
CVE-2023-53858: kernel: tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error
Component: kernel
Severity: Low
CWE: CWE-771 (Missing Reference to Active Allocated Resource)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A memory leak vulnerability was found in the Samsung serial TTY driver in the Linux kernel. In s3c24xx_serial_getclk(), when clk_get_rate() fails, the previously allocated clock resource is not freed, leading to a memory leak. Repeated failures can cause resource exhaustion.

Statement: This is a memory leak in the Samsung serial driver affecting ARM-based Samsung SoC platforms. The impact is limited to Samsung Exynos and S3C/S5P series devices.

Affected upstream versions: 3.3
Fixed upstream versions: 0, 4.14.322, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 755289d67eb9a74ae71bb624902e979c66859444
CVE-2023-53859: kernel: s390/idle: mark arch_cpu_idle() noinstr
Component: kernel
Severity: Low
CWE: CWE-166 (Improper Handling of Missing Special Element)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A kernel warning vulnerability was found in the s390 architecture idle handling in the Linux kernel. The arch_cpu_idle() function was not marked as noinstr (no instrumentation), causing RCU and tracing warnings when ftrace is enabled. This can trigger kernel warnings and potential issues with tracing in idle paths on s390 systems.

Statement: This is an instrumentation marking issue in s390 idle handling that causes kernel warnings. The impact is limited to s390 architecture systems and primarily affects tracing/debugging scenarios.

Affected upstream versions: 4.19.297 < 4.20, 5.9
Fixed upstream versions: 0, 4.20, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 49aa49952116b8fd56bfb1e8c69bce179f49bece
CVE-2023-53860: kernel: dm: don't attempt to queue IO under RCU protection
Component: kernel
Severity: Moderate
CWE: CWE-663 (Use of a Non-reentrant Function in a Concurrent Context)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A sleep-in-atomic-context bug was found in the Device Mapper subsystem in the Linux kernel. When processing REQ_NOWAIT requests, dm incorrectly submits I/O while holding an RCU read lock, assuming that REQ_NOWAIT means no scheduling can occur. However, mempool_alloc() and other allocation functions may still sleep, leading to sleeping function calls from invalid contexts. This can cause kernel warnings or crashes.

Statement: This is a sleeping-in-atomic-context bug in Device Mapper that can cause kernel warnings and potential issues when using O_DIRECT with RWF_NOWAIT flags on dm devices. The vulnerability requires local access and specific I/O patterns to trigger.

Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.55, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d7b2abd87d1fcdb47811f90090a363e7ca15cb14
CVE-2023-53861: kernel: ext4: correct grp validation in ext4_mb_good_group
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the ext4 filesystem in the Linux kernel. In ext4_mb_good_group(), the group corruption check accesses the grp structure memory before verifying that grp is not NULL. If grp is NULL, this leads to a kernel crash. The fix adds a NULL check before performing the corruption check.

Statement: This is a NULL pointer dereference in ext4's multiblock allocator that can cause a kernel crash. The vulnerability requires specific filesystem conditions to trigger and affects systems using ext4.

Affected upstream versions: 5.10.181 < 5.10.195, 5.15.113 < 5.15.132, 6.1.30 < 6.1.53, 6.3.4 < 6.4, 6.4
Fixed upstream versions: 0, 5.10.195, 5.15.132, 6.1.53, 6.4, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 245759d987b617d183061db6ab8886ebb5cc78e9
CVE-2023-53863: kernel: netlink: do not hard code device address lenth in fdb dumps
Component: kernel
Severity: Low
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A kernel information leak vulnerability was found in the netlink FDB (Forwarding Database) dump functionality in the Linux kernel. The code incorrectly hard-codes ETH_ALEN (6 bytes) for device addresses, but some network devices have shorter addresses (e.g., 4 bytes). When dumping FDB entries for such devices, uninitialized kernel memory is copied to userspace, potentially leaking sensitive information.

Statement: This is an information leak vulnerability in netlink FDB dumps affecting devices with non-standard address lengths. The impact is limited as it requires local access and affects only specific network device configurations.

Affected upstream versions: 3.5
Fixed upstream versions: 0, 4.14.322, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 61d1bf3c34bf5fe936c50d1a4bc460babcc85e88
CVE-2023-53866: kernel: ASoC: soc-compress: Reposition and add pcm_mutex
Component: kernel
Severity: Low
CWE: CWE-820 (Missing Synchronization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-09T00:00:00+00:00

A locking issue was found in the ASoC (ALSA SoC) compressed audio subsystem in the Linux kernel. When DPCM (Dynamic PCM) compressed streams are started, several functions access resources without properly holding the card->pcm_mutex lock. This triggers lock assertion warnings and can cause kernel panics if panic_on_warn is enabled.

Statement: This is a locking issue in the ASoC compressed audio subsystem that causes warnings and potential panics. The impact is primarily on systems using compressed audio with DPCM routing and panic_on_warn enabled.

Affected upstream versions: 5.17
Fixed upstream versions: 0, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9a9942cbdb7c3f41452f7bc4a9ff9f0b45eb3651
CVE-2023-53867: kernel: ceph: fix potential use-after-free bug when trimming caps
Component: kernel
Severity: Low
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's Ceph filesystem client. When iterating over session caps in ceph_iterate_session_caps(), the session->s_cap_lock is released temporarily, allowing another thread to remove the cap. If the cap is freed while the iteration continues, subsequent callback functions access stale memory, causing a use-after-free condition and potential kernel crash.

Statement: This flaw affects systems using CephFS (Ceph filesystem) mounts. The race condition occurs during cap trimming operations when multiple threads interact with the same Ceph session. Exploitation requires concurrent operations on CephFS mounts, making it timing-dependent but potentially triggerable under normal workloads with multiple processes accessing the same filesystem.

Affected upstream versions: 2.6.34
Fixed upstream versions: 0, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2b2515b8095cf2149bef44383a99d5b5677f1831
CVE-2023-53989: kernel: arm64: mm: fix VA-range sanity check
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A logic flaw was found in the Linux kernel's arm64 memory management subsystem. The virtual address range sanity check in create_mapping_noalloc() and update_mapping_prot() uses an incorrect condition that only excludes the KASAN shadow region and module region, rather than properly validating addresses translated via TTBR1. This check was the result of historical code changes that inadvertently introduced an erroneous condition.

Statement: This is a code correctness fix for arm64 architecture that addresses an incorrect sanity check condition. The flawed check does not create an exploitable vulnerability in practice, as the affected code paths are used during kernel initialization and memory mapping operations that require privileged access. The fix simplifies the logic to properly validate kernel address ranges.

Affected upstream versions: 5.4
Fixed upstream versions: 0, 5.10.188, 5.15.150, 5.4.251, 6.1.175, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9d8d3df71516ec3236d8d93ff029d251377ba4b1
CVE-2023-53990: kernel: SMB3: Add missing locks to protect deferred close file list
Component: kernel
Severity: Low
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

SMB3: Add missing locks to protect deferred close file list

cifs_del_deferred_close function has a critical section which modifies
the deferred close file list. We must acquire deferred_lock before
calling cifs_del_deferred_close function.


Affected upstream versions: 5.15.63 < 5.15.111, 5.19.4 < 5.20, 6.0
Fixed upstream versions: 0, 5.15.111, 5.20, 6.1.28, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0f87e18203bd30f71eb1a65259e28e291b6cc43a
CVE-2023-53992: kernel: wifi: cfg80211: ocb: don't leave if not joined
Component: kernel
Severity: Low
CWE: CWE-841 (Improper Enforcement of Behavioral Workflow)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's cfg80211 wireless subsystem. When handling OCB (Outside the Context of a BSS) mode, the kernel may attempt to leave an OCB network even when not joined, which could cause driver confusion or unexpected behavior. This is a logic error in state management.

Statement: This is a minor logic fix in the WiFi cfg80211 subsystem for OCB mode, which is used in vehicular networking (802.11p/DSRC). The issue does not cause a crash but could lead to confusing driver behavior. Most systems do not use OCB mode, significantly limiting the impact.

Affected upstream versions: 3.19
Fixed upstream versions: 0, 6.1.55, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d7b0fe3487d203c04ee1bda91a63bd4dd398c350
CVE-2023-53993: kernel: Kernel: Denial of Service due to memory leak in PCI/DOE
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a memory leak vulnerability in the PCI-e Data Object Exchange (PCI/DOE) subsystem. This occurs when a PCI/DOE task completes, but its associated work structure is not properly destroyed, leading to a continuous accumulation of memory. This can result in a Denial of Service (DoS) due to resource exhaustion.


Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.24, 6.2.11, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2a0e0f4773fe8032fb17e56f897bee32ce3cdc2b
CVE-2023-53995: kernel: Linux kernel: Denial of Service due to memory leak in IP address deletion
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. An incorrect handling of the 'last_prim' value within the __inet_del_ifa() function during IP address deletion can be triggered by a local user. This memory leak leads to resource exhaustion, potentially causing a Denial of Service (DoS) on the system.


Affected upstream versions: 2.6.15
Fixed upstream versions: 0, 5.10.195, 5.15.132, 5.4.257, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5624f26a3574500ce23929cb2c9976a0dec9920a
CVE-2023-53996: kernel: x86/sev: Make enc_dec_hypercall() accept a size instead of npages
Component: kernel
Severity: Moderate
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

x86/sev: Make enc_dec_hypercall() accept a size instead of npages

enc_dec_hypercall() accepted a page count instead of a size, which
forced its callers to round up. As a result, non-page aligned
vaddrs caused pages to be spuriously marked as decrypted via the
encryption status hypercall, which in turn caused consistent
corruption of pages during live migration. Live migration requires
accurate encryption status information to avoid migrating pages
from the wrong perspective.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ba50e7773a99a109a1ea6f753b766a080d3b21cc