huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53646: kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

A bounds-checking error  was found in the Linux kernel Intel i915 graphics driver's performance monitoring subsystem. A local user with access to Intel GPU performance counters can trigger address validation for observability architecture counters on Xe-HP and newer hardware, causing the driver to read beyond the end of the xehp_oa_b_counters array due to a missing sentinel entry, which results in out-of-bounds memory access and denial of service through kernel crash or undefined behavior.

Statement: The issue arises because the xehp_oa_b_counters register array lacks a terminating sentinel entry (empty record) required by the reg_in_range_table validation function. When userspace interacts with the perf subsystem to configure GPU performance monitoring on affected Intel hardware (Meteor Lake and newer platforms with Xe-HP graphics), the kernel walks the array to validate counter addresses. Without the sentinel, the validation logic reads past the array boundary, accessing arbitrary adjacent kernel memory. KASAN detected a 4-byte out-of-bounds read in xehp_is_valid_b_counter_addr. While this is a memory safety violation, exploitation beyond denial of service is unlikely because the read occurs during validation logic with no direct mechanism to return the out-of-bounds data to userspace. The impact is primarily availability through potential kernel crashes or undefined behavior.

Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 21d92025e80629fd5c25cd6751f8cf38c784dd4a
CVE-2023-53647: kernel: Drivers: hv: vmbus: Don't dereference ACPI root object handle
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel's Hyper-V VMBus driver in the ACPI resource walking logic. A local user can trigger this issue on systems running under hypervisors that do not provide Hyper-V MMIO ranges in the VMBus ACPI device hierarchy, causing the driver to walk up to the ACPI root object and attempt to dereference its all-ones handle. This results in a NULL pointer dereference in the ACPI subsystem, leading to a kernel crash and denial of service during boot.

Statement: The VMBus driver walks the ACPI namespace from the VMBus device upward searching for Hyper-V MMIO resource ranges. When these ranges are not found in the device or its ancestors, the code continues walking until it reaches the ACPI namespace root object, which has a special all-ones handle value. Attempting to use this handle causes the ACPI code to dereference a NULL pointer (from adding an offset to NULL). This occurs with VMBus implementations that don't provide these MMIO ranges, such as QEMU's VMBus emulation. The ranges appear to be optional since Windows guests function without them. The crash occurs during boot when the VMBus driver probes, affecting Linux guests under KVM/QEMU when using Hyper-V paravirtualization interfaces.

Affected upstream versions: 4.3
Fixed upstream versions: 0, 6.1.53, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 96db43aced395844a7abc9a0a5cc702513e3534a
CVE-2023-53648: kernel: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer

smatch error:
sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error:
we previously assumed 'rac97' could be null (see line 2072)

remove redundant assignment, return error if rac97 is NULL.


Affected upstream versions: 2.6.28
Fixed upstream versions: 0, 4.14.322, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 809af7bb4219bdeef0dbb8b2ed700d6516d13fe9
CVE-2023-53649: kernel: perf trace: Really free the evsel->priv area
Component: kernel
Severity: Low
CWE: CWE-771 (Missing Reference to Active Allocated Resource)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's perf trace tool in the event selector cleanup logic. 
A local user can trigger this issue by running perf trace commands, causing the tool to free memory based on an incorrect condition check that inverts the intended logic for non-syscall tracepoints. This results in allocated memory never being freed, leading to resource exhaustion and denial of service through memory depletion.

Statement: The perf trace cleanup code contains inverted logic when freeing the evsel->priv area. Memory is allocated when the tracepoint system is not "syscalls", but the cleanup code only frees when it is "syscalls", creating a mismatch. This means memory allocated for non-syscall tracepoints is never released, causing a permanent leak with each perf trace invocation. The issue was detected using AddressSanitizer during testing and manifests as 40-byte leaks per event selector. While a single perf trace command leaks relatively small amounts of memory, repeated invocations or long-running trace sessions can accumulate significant memory consumption.

Affected upstream versions: 5.14
Fixed upstream versions: 0, 5.15.132, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c3bc668581e71e7c3bc7eb1d647f25f8db222163
CVE-2023-53652: kernel: vdpa: Add features attr to vdpa_nl_policy for nlattr length check
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

vdpa: Add features attr to vdpa_nl_policy for nlattr length check

The vdpa_nl_policy structure is used to validate the nlattr when parsing
the incoming nlmsg. It will ensure the attribute being described produces
a valid nlattr pointer in info->attrs before entering into each handler
in vdpa_nl_ops.

That is to say, the missing part in vdpa_nl_policy may lead to illegal
nlattr after parsing, which could lead to OOB read just like CVE-2023-3773.

This patch adds the missing nla_policy for vdpa features attr to avoid
such bugs.

Statement: Missing nla_policy for VDPA_ATTR_DEV_FEATURES allowed an unchecked nlattr to pass parsing and be used by handlers, causing an out-of-bounds read. A local actor with CAP_NET_ADMIN could trigger a crash during vDPA netlink operations, impacting availability.

Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 44b508cc96889e61799cc0fc6c00766a54f3ab5a
CVE-2023-53654: kernel: octeontx2-af: Add validation before accessing cgx and lmac
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

A bounds-checking error was found in the Linux kernel Marvell OcteonTX2 network driver's initialization code. On systems with newer CN10K RPM or CN10KB RPM_USX hardware, a local user with privileges to initialize the driver can trigger driver probe, causing the driver to make incorrect assumptions about hardware topology and access Coherent Global Interconnect eXchange blocks and Logical MAC interfaces using invalid array indices, which leads to out-of-bounds memory access and denial of service through kernel panic.

Statement: The driver assumed contiguous CGX/LMAC IDs, so reads/writes to disabled or non-existent LMAC registers could occur during RVU init, leading to a kernel panic.

Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.121, 6.1.39, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e425e2ba933618ee5ec8e4f3eb341efeb6c9ddef
CVE-2023-53657: kernel: ice: Don't tx before switchdev is fully configured
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ice: Don't tx before switchdev is fully configured

There is possibility that ice_eswitch_port_start_xmit might be
called while some resources are still not allocated which might
cause NULL pointer dereference. Fix this by checking if switchdev
configuration was finished.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.55, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5760a72b3060150b587eff3e879648c7470efddd
CVE-2023-53660: kernel: bpf, cpumap: Handle skb as well when clean up ptr_ring
Component: kernel
Severity: Low
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

An incorrect object type handling flaw was found in the Linux kernel's BPF cpumap implementation in the cleanup path. A local user can trigger this issue by running XDP redirect operations in SKB mode with the cpumap, causing the cleanup code to incorrectly treat socket buffers as XDP frames when freeing ptr_ring contents. This results in memory corruption and kernel warnings, leading to denial of service through system instability or crash.

Statement: The cpumap is used for XDP (eXpress Data Path) packet processing and can operate in either native XDP frame mode or SKB (socket buffer) mode. When operating in SKB mode, the ptr_ring contains skb pointers rather than XDP frame pointers. However, the __cpu_map_ring_cleanup function assumes all entries are XDP frames and attempts to free them using xdp_return_frame, which causes type confusion when it encounters skbs. This triggers warnings about incorrect XDP memory types and can cause crashes. The issue manifests when running xdp_redirect_cpu in skb-mode, particularly under stress conditions that cause the kthread to stop prematurely. Triggering requires local access and the ability to load and run XDP programs, which typically requires elevated privileges.

Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.126, 6.1.45, 6.4.10, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b58d34068fd9f96bfc7d389988dfaf9a92a8fe00
CVE-2023-53661: kernel: bnxt: avoid overflow in bnxt_get_nvram_directory()
Component: kernel
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bnxt: avoid overflow in bnxt_get_nvram_directory()

The value of an arithmetic expression is subject
of possible overflow due to a failure to cast operands to a larger data
type before performing arithmetic. Used macro for multiplication instead
operator for avoiding overflow.

Found by Security Code and Linux Verification
Center (linuxtesting.org) with SVACE.


Affected upstream versions: 4.4
Fixed upstream versions: 0, 5.15.113, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d5eaf2a6b077f32a477feb1e9e1c1f60605b460e
CVE-2023-53662: kernel: ext4: fix memory leaks in ext4_fname_{setup_filename,prepare_lookup}
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's ext4 filesystem in the filename casefolding error paths. A local user can trigger this issue by performing directory operations on ext4 filesystems with casefolding enabled when filename setup or lookup operations fail, causing the crypto_buf.name field from the fscrypt_name structure to remain allocated. This results in permanent memory leaks leading to resource exhaustion and denial of service.

Statement: The ext4_fname_setup_filename and ext4_fname_prepare_lookup functions handle filename preparation for encrypted and casefolded filesystems. When casefolding operations fail, the error paths return immediately without freeing the crypto_buf.name buffer that was allocated earlier during fscrypt setup. Since these functions are called for every filename operation on casefolded ext4 filesystems, repeated failures can accumulate significant memory leaks.

Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.199, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 98fc9c2cc45cfcb56961a73de3ec69b474063fc0
CVE-2023-53663: kernel: KVM: nSVM: Check instead of asserting on nested TSC scaling support
Component: kernel
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-10-07T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

KVM: nSVM: Check instead of asserting on nested TSC scaling support

Check for nested TSC scaling support on nested SVM VMRUN instead of
asserting that TSC scaling is exposed to L1 if L1's MSR_AMD64_TSC_RATIO
has diverged from KVM's default.  Userspace can trigger the WARN at will
by writing the MSR and then updating guest CPUID to hide the feature
(modifying guest CPUID is allowed anytime before KVM_RUN).  E.g. hacking
KVM's state_test selftest to do

		vcpu_set_msr(vcpu, MSR_AMD64_TSC_RATIO, 0);
		vcpu_clear_cpuid_feature(vcpu, X86_FEATURE_TSCRATEMSR);

after restoring state in a new VM+vCPU yields an endless supply of:

  ------------[ cut here ]------------
  WARNING: CPU: 164 PID: 62565 at arch/x86/kvm/svm/nested.c:699
           nested_vmcb02_prepare_control+0x3d6/0x3f0 [kvm_amd]
  Call Trace:
   <TASK>
   enter_svm_guest_mode+0x114/0x560 [kvm_amd]
   nested_svm_vmrun+0x260/0x330 [kvm_amd]
   vmrun_interception+0x29/0x30 [kvm_amd]
   svm_invoke_exit_handler+0x35/0x100 [kvm_amd]
   svm_handle_exit+0xe7/0x180 [kvm_amd]
   kvm_arch_vcpu_ioctl_run+0x1eab/0x2570 [kvm]
   kvm_vcpu_ioctl+0x4c9/0x5b0 [kvm]
   __se_sys_ioctl+0x7a/0xc0
   __x64_sys_ioctl+0x21/0x30
   do_syscall_64+0x41/0x90
   entry_SYSCALL_64_after_hwframe+0x63/0xcd
  RIP: 0033:0x45ca1b

Note, the nested #VMEXIT path has the same flaw, but needs a different
fix and will be handled separately.


Affected upstream versions: 5.16
Fixed upstream versions: 0, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6c1ecfea1daf6e75c46e295aad99dfbafd878897
CVE-2023-53664: kernel: OPP: Fix potential null ptr dereference in dev_pm_opp_get_required_pstate()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel's OPP (Operating Performance Points) framework in the power state retrieval logic. 
A local user can trigger this issue by invoking power management operations when the OPP pointer is dereferenced to cache the opp_table before checking whether the pointer is valid. This causes the kernel to dereference a NULL or error pointer, resulting in a kernel crash and denial of service.

Statement: The dev_pm_opp_get_required_pstate function attempts to optimize by caching opp->opp_table in a local variable before validating that the opp pointer is non-NULL or not an error value. When the opp pointer is NULL or contains an error code, the dereference on line 230 occurs before the IS_ERR_OR_NULL check on line 232. This violates the principle of checking pointer validity before use and causes an immediate kernel crash when the function is called with invalid input. The issue can occur during power management operations on devices that use the OPP framework for dynamic voltage and frequency scaling.

Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 25130b27e0352acb83e91c467853eb9afad3b644
CVE-2023-53665: kernel: md: don't dereference mddev after export_rdev()
Component: kernel
Severity: Moderate
CWE: CWE-911 (Improper Update of Reference Count)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-07T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel multiple device RAID subsystem's device lifetime management. A local user with privileges to manage MD arrays can trigger concurrent device addition and removal operations via sysfs, causing a race condition where the mddev structure is freed when the last rdev is removed but then dereferenced afterward, which leads to memory corruption and can result in denial of service via kernel crash or potentially privilege escalation through heap manipulation.

Statement: The issue arises because of incorrect object lifetime management in the MD RAID device removal path. The mddev->kobject reference is primarily held through rdev->kobject references. When export_rdev() removes the last remaining device from an array, the mddev structure can be freed as its reference count drops to zero. However, the code path in rdev_attr_store() continues to use the mddev pointer after calling export_rdev(), leading to a use-after-free condition. This can be triggered by racing concurrent writes to sysfs: one thread continuously adds devices via /sys/block/md0/md/new_dev while another removes them via /sys/block/md0/md/dev-<device>/state. The race window is narrow, occurring at very low frequency even under stress testing, which justifies the high attack complexity. The general protection fault shows the freed memory contains the SLAB poison pattern (0x6b6b6b6b6b6b6bcb), confirming use-after-free. While use-after-free vulnerabilities are known memory corruption primitives that can enable privilege escalation through careful heap manipulation, successful exploitation requires both timing the race precisely and controlling heap layout, making this significantly more complex than a straightforward memory safety violation.

Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ad430ad0669d2757377373390d68e1454fc7a344
CVE-2023-53666: kernel: Linux kernel: Denial of Service in ASoC wcd938x codec due to improper error handling
Component: kernel
Severity: Moderate
CWE: CWE-392 (Missing Report of Error Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-07T00:00:00+00:00

A flaw was found in the Linux kernel's ASoC wcd938x codec component. This vulnerability stems from improper error handling during the initialization of the Multi-Band Headset Controller (MBHC). A local attacker with low privileges could exploit this by triggering a specific sequence of events, leading to an incorrect pointer dereference. This might result in a Denial of Service (DoS), corruption of system memory, or the disclosure of sensitive information.

Statement: This vulnerability does not affect RHEL 8, nor does it affect releases later than RHEL 9.3.

Affected upstream versions: 5.15
Fixed upstream versions: 0, 5.15.123, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5a34d252052b5da743ef82591c860fc947384d4e
CVE-2023-53673: kernel: Bluetooth: hci_event: call disconnect callback before deleting conn
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-07T00:00:00+00:00

A flaw was found in the Linux kernel in which a callback is not called when a Bluetooth peripheral is disconnected. This flaw leads to a use-after-free, which an attacker could use to escalate their privileges, corrupt system memory, or otherwise cause a denial of service.

Statement: This flaw has been fixed in RHEL versions 9.4 and later.

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.15.200, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1ecf6dc2676ead4b927c50b1be0851fa4d756574
CVE-2023-53674: kernel: clk: Fix memory leak in devm_clk_notifier_register()
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T00:00:00+00:00

A resource-management flaw was found in the Linux kernel Common Clock Framework. The device-managed clock notifier registration function failed to register its allocated resource, preventing cleanup on device detach. 
A local user repeatedly binding and unbinding devices could cause memory leaks and eventual denial of service.

Statement: The device-managed notifier helper allocated memory but did not register it with the device’s resource list, leaving it unreleased at teardown. The fix registers the resource through the device manager so it is automatically freed when the device is removed.

Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.121, 6.1.39, 6.3.13, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: a326cf0107b197e649bbaa2a2b1355894826ce32
CVE-2023-53675: kernel: scsi: ses: Fix possible desc_ptr out-of-bounds accesses
Component: kernel
Severity: Moderate
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-07T00:00:00+00:00

A bounds-checking flaw was found in the Linux kernel Small Computer System Interface Enclosure Services driver in the way descriptor pointers are validated while processing enclosure data. Missing checks could allow an out-of-bounds access during parsing. 
A local user could use this flaw to crash the system while enclosure data is processed, resulting in a denial of service.

Statement: The ses_enclosure_data_process() routine did not sufficiently validate descriptor pointer positions before dereferencing them, which could allow the parser to read beyond the buffer when a device or crafted input reports malformed enclosure pages. The fix adds strict pointer and length checks to avoid out-of-bounds accesses.

Affected upstream versions: 2.6.25
Fixed upstream versions: 0, 4.14.308, 4.19.276, 5.10.173, 5.15.99, 5.4.235, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 72021ae61a2bc6ca73cd593e255a10ed5f5dc5e7