huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-53997: kernel: thermal: of: fix double-free on unregistration
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's thermal subsystem. A double-free vulnerability occurs during thermal zone device unregistration when using device tree (OF) bindings. The thermal_of_zone_register() function leaks the original tzp structure and double-frees the internal copy, which can lead to memory corruption or a kernel crash.

Statement: This vulnerability occurs during thermal zone unregistration, which typically happens during driver removal or system shutdown. The double-free requires triggering the unregistration path, and exploitation for anything beyond denial of service is highly unlikely. Systems not using device tree thermal zones are unaffected.

Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.4.8, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: adce49089412a9ae28f5c666e0bb12fbcd86b3f7
CVE-2023-53999: kernel: Linux kernel: Denial of Service due to memory leak in mlx5e driver
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. This memory leak vulnerability occurs when a flow rule, forwarding packets from an internal port over a tunnel, is split and extra post-action rules are added. The int_port object's reference count is incremented but never decremented, leading to the object not being freed. This can result in a denial of service (DoS) due to memory exhaustion.


Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.4.11, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bc1918bac0f30e3f551ef5649b53062917db55fa
CVE-2023-54003: kernel: Linux kernel: RDMA/core GID entry leak causes Denial of Service
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) core component. A local user with low privileges could trigger a Global Identifier (GID) entry reference leak when an Address Handle (AH) creation request fails. This resource leak could lead to system instability and a Denial of Service (DoS).


Affected upstream versions: 4.19
Fixed upstream versions: 0, 5.10.178, 5.15.108, 5.4.241, 6.1.25, 6.2.12, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9c46c49ad3ffe84121715d392b5a0a94f9f10669
CVE-2023-54004: kernel: Linux kernel UDPLITE: Denial of Service via null pointer dereference
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's UDPLITE (UDP-Lite) implementation. A local user can exploit a null pointer dereference in the `__sk_mem_raise_allocated()` function by using the `IPPROTO_UDPLITE` protocol. This vulnerability can lead to a system crash, resulting in a denial of service (DoS).


Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.19.284, 5.10.181, 5.15.114, 5.4.244, 6.1.31, 6.3.5, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: cc56de054d828935aa37734b479f82fa34b5f9bd
CVE-2023-54006: kernel: af_unix: Fix data-race around unix_tot_inflight
Component: kernel
Severity: Low
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A data race condition was found in the Linux kernel's AF_UNIX socket implementation. The unix_tot_inflight variable is modified under spin_lock(unix_gc_lock) but read without synchronization in unix_release_sock(). This was detected by KCSAN (Kernel Concurrency Sanitizer). The fix adds READ_ONCE() to ensure proper atomic reading of the shared variable.

Statement: This is a theoretical data race found by KCSAN that affects the unix_tot_inflight counter in AF_UNIX socket garbage collection. The race involves a concurrent read during socket release while another thread modifies the counter. While technically a data race, the practical impact is minimal since the counter is used for heuristic checks, not critical decisions. The fix adds proper memory ordering annotations.

Affected upstream versions: 2.6.24
Fixed upstream versions: 0, 4.14.326, 4.19.295, 5.10.195, 5.15.132, 5.4.257, 6.1.54, 6.5.4, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 31b46d5e7c4e295bd112960614a66a177a057dca
CVE-2023-54008: kernel: virtio_vdpa: build affinity masks conditionally
Component: kernel
Severity: Low
CWE: CWE-839 (Numeric Range Comparison Without Minimum Check)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's virtio vDPA driver. When the number of device queues exceeds the number of CPUs, the create_affinity_masks() function triggers a kernel warning in group_cpus_evenly(). This occurs because the affinity logic assumes CPUs are not fewer than queue groups, which doesn't hold for high-queue-count network devices.

Statement: This issue triggers a kernel warning (WARN_ON), not a crash. It affects virtio vDPA devices, particularly network devices with many queues on systems with fewer CPUs. The warning is a debug assertion and does not compromise system stability or security in production kernels with panic_on_warn disabled.

Affected upstream versions: 6.4
Fixed upstream versions: 0, 6.4.16, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5f2592243ccd5bb5341f59be409ccfdd586841f3
CVE-2023-54010: kernel: Linux kernel: Denial of Service via null pointer dereference in ACPI
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Advanced Configuration and Power Interface (ACPI) component. This vulnerability occurs when a memory allocation function fails, leading to a null pointer dereference. A local attacker with low privileges could exploit this to cause the system to crash, resulting in a Denial of Service (DoS).


Affected upstream versions: 4.4
Fixed upstream versions: 0, 4.14.316, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: c9fcb2cfcbd4d7018d9f659f5b670f5b727d1968
CVE-2023-54011: kernel: scsi: mpi3mr: Fix an issue found by KASAN
Component: kernel
Severity: Low
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's mpi3mr SCSI driver for Broadcom MPI3 HBA controllers. The driver writes 64 bytes when only 32 bytes should be written, causing an out-of-bounds write detected by KASAN. This memory corruption could lead to system instability or a kernel crash.

Statement: This vulnerability affects systems with Broadcom MPI3 MegaRAID or HBA controllers using the mpi3mr driver. The out-of-bounds write is limited to a specific operation within the driver. Systems without this hardware are not affected.

Affected upstream versions: 6.1
Fixed upstream versions: 0, 6.1.18, 6.2.5, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: abfe73c16b295f2213e9bfc0a1df232056032448
CVE-2023-54014: kernel: scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
Component: kernel
Severity: Low
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()

Klocwork reported warning of rport maybe NULL and will be dereferenced.
rport returned by call to fc_bsg_to_rport() could be NULL and dereferenced.

Check valid rport returned by fc_bsg_to_rport().


Affected upstream versions: 4.10
Fixed upstream versions: 0, 4.14.322, 4.19.291, 5.10.188, 5.15.121, 5.4.251, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f35bd94b4e11c41de90cd0fa72c9062e8196822f
CVE-2023-54015: kernel: net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device
Component: kernel
Severity: Moderate
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H)
Public date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device

In case devcom allocation is failed, mlx5 is always freeing the priv.
However, this priv might have been allocated by a different thread,
and freeing it might lead to use-after-free bugs.
Fix it by freeing the priv only in case it was allocated by the
running thread.


Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.181, 5.15.114, 5.4.244, 6.1.31, 6.3.5, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3dfc1004d9afbf689087ae1eafd88f55481984c7
CVE-2023-54016: kernel: Linux kernel: Memory leak in ath12k Wi-Fi driver can lead to denial of service
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's ath12k Wi-Fi driver. This memory leak vulnerability occurs because the driver allocates memory for receive and transmit descriptors during initialization but fails to free this memory during cleanup. A local attacker could exploit this by repeatedly triggering the allocation and cleanup process, potentially leading to a denial of service (DoS) due to memory exhaustion.


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.5.5, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e16be2d34883eecfe7fd888fcdb76c7a5db5d187
CVE-2023-54019: kernel: sched/psi: use kernfs polling functions for PSI trigger polling
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's PSI (Pressure Stall Information) trigger handling for cgroups. When a cgroup is removed while a process is polling its PSI trigger file, the trigger's waitqueue is destroyed via psi_trigger_destroy() while the polling process still holds a reference. The subsequent poll_freewait() accesses the freed waitqueue head, causing a use-after-free crash.

Statement: This flaw affects systems using cgroup PSI monitoring with poll() or select() on PSI trigger files. The race occurs when a cgroup is removed (rmdir) while another process is actively polling for PSI events on that cgroup. This is a lifecycle mismatch between the PSI trigger and the associated file descriptor. A previous fix addressed epoll() but left synchronous poll() vulnerable.

Affected upstream versions: 5.2
Fixed upstream versions: 0, 6.1.42, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 92cc0153324b6ae8577a39f5bf2cd83c9a34ea6a
CVE-2023-54021: kernel: ext4: set goal start correctly in ext4_mb_normalize_request
Component: kernel
Severity: Low
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's ext4 filesystem block allocator. In ext4_mb_normalize_request(), the goal start was being set incorrectly (ac_f_ex instead of ac_g_ex), and boundary validation was missing. Without proper range checking, an underflow in ar->pright - size could pass an invalid value to ext4_get_group_no_and_offset(), triggering a BUG_ON assertion and crashing the kernel.

Statement: This flaw affects ext4 filesystems during block allocation operations. The incorrect variable assignment and missing bounds check can cause a kernel crash when specific allocation patterns trigger the underflow condition. The issue manifests during normal filesystem operations like file creation or extension, making it potentially triggerable by regular users writing to ext4 filesystems.

Affected upstream versions: 2.6.25
Fixed upstream versions: 0, 4.14.316, 4.19.284, 5.10.181, 5.15.113, 5.4.244, 6.1.30, 6.3.4, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2479bb6cbdb4d56b807bbe5229e3e26a6f1f4530
CVE-2023-54022: kernel: Linux kernel ALSA USB audio: Denial of Service due to memory leaks in MIDI 2.0 / UMP device handling
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) USB audio driver. This vulnerability, related to improper memory management when handling MIDI 2.0 / Universal MIDI Packet (UMP) devices, could lead to memory leaks. A local attacker with low privileges could exploit this flaw by triggering specific allocation and initialization errors. This could result in a Denial of Service (DoS) due to resource exhaustion.


Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: f819b343aa95d24d5f7d6e06660c7f62591abc5f
CVE-2023-54026: kernel: opp: Fix use-after-free in lazy_opp_tables after probe deferral
Component: kernel
Severity: Low
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's OPP (Operating Performance Points) subsystem. When probe deferral occurs due to unavailable interconnect paths, the OPP table is freed but not removed from the global lazy_opp_tables list. This leads to a use-after-free when the required-opps provider is later added and iterates over the freed table, causing a kernel crash.

Statement: This vulnerability affects systems using device tree OPP tables with required-opps dependencies and interconnect paths. The issue occurs during driver probe deferral, a transient condition during boot. Once the system is fully booted, the race window closes. The impact is limited to denial of service during system initialization.

Affected upstream versions: 5.12
Fixed upstream versions: 0, 5.15.121, 6.1.40, 6.4.5, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 39a0e723d3502f6dc4c603f57ebe8dc7bcc4a4bc
CVE-2023-54028: kernel: Linux kernel: Denial of Service vulnerability in RDMA/rxe component
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Remote Direct Memory Access (RDMA) subsystem, specifically within the rxe component. A local user could trigger a kernel panic by causing an error during the setup of a Queue Pair (QP) in rxe_create_qp(). This occurs when the system attempts to clean up resources by accessing an uninitialized spinlock, leading to a Denial of Service (DoS).


Affected upstream versions: 4.8
Fixed upstream versions: 0, 6.1.32, 6.2.15, 6.3.2, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3236221bb8e4de8e3d0c8385f634064fb26b8e38
CVE-2023-54030: kernel: io_uring/net: don't overflow multishot recv
Component: kernel
Severity: Low
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's io_uring subsystem. When using multishot receive operations, completion queue entries (CQEs) can overflow without proper limits. This can lead to excessive memory consumption, performance degradation, and in worst cases, an out-of-memory (OOM) condition for the affected task.

Statement: This vulnerability allows a local user to exhaust memory resources through io_uring multishot receive operations. While this can cause denial of service via OOM, the impact is limited to the user's own task and does not directly affect system-wide stability. Exploitation requires intentional misuse of the io_uring API by a local user.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.5.3, 6.6
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1e2db9837be7d24a2a74eb3f3906d0872bee8907
CVE-2023-54031: kernel: vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check
Component: kernel
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

An out-of-bounds read vulnerability was found in the Linux kernel's vDPA (virtio Data Path Acceleration) netlink interface. The vdpa_nl_policy structure was missing the nla_policy entry for the queue index attribute. Without proper validation, parsing netlink messages with this attribute could result in an invalid nlattr pointer, leading to out-of-bounds memory reads similar to CVE-2023-3773.

Statement: This flaw affects systems using vDPA for virtio device acceleration, typically in virtualization environments. The missing netlink attribute validation allows crafted netlink messages to cause OOB reads. Exploitation requires the ability to send netlink messages to the vDPA subsystem, which typically requires CAP_NET_ADMIN privileges or root access.

Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.47, 6.4.12, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8ad9bc25cbdcec72e7ca43dd8281decb69ea9a70
CVE-2023-54033: kernel: kernel: Denial of Service via memory leak in LRU hash maps
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could exploit a memory leak vulnerability in the Least Recently Used (LRU) and LRU_PERCPU hash maps. This occurs when the kernel allocates a new element during a map update but fails to release it if the hash table bucket cannot be locked. Repeated exploitation of this flaw can lead to resource exhaustion, resulting in a permanent Denial of Service (DoS).


Affected upstream versions: 5.11
Fixed upstream versions: 0, 5.15.115, 6.1.31, 6.3.5, 6.4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 79ea1a12fb9a8275b6e19d4ca625dd872dedcbb9
CVE-2023-54035: kernel: netfilter: nf_tables: fix underflow in chain reference counter
Component: kernel
Severity: Low
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter nf_tables component. During set element addition, an error path incorrectly decrements the chain reference counter twice. This reference count underflow could potentially lead to a use-after-free condition when the chain is subsequently freed while still in use.

Statement: Exploiting this vulnerability requires CAP_NET_ADMIN capability to manipulate nf_tables rules and trigger the specific error path during set element addition. The bug occurs in error handling, meaning normal successful operations are unaffected. The complexity of reliably triggering the use-after-free limits practical exploitability.

Affected upstream versions: 4.19.316 < 4.20, 5.4.262 < 5.5, 5.10.188 < 5.11, 5.15.121 < 5.16, 6.3.10 < 6.4, 6.4
Fixed upstream versions: 0, 4.20, 5.11, 5.16, 5.5, 6.4, 6.4.4, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b068314fd8ce751a7f906e55bb90f3551815f1a0
CVE-2023-54036: kernel: Linux kernel: Denial of Service due to memory leak in rtl8xxxu Wi-Fi driver
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Wi-Fi driver for certain Realtek chips. This vulnerability allows a local attacker to cause a system to run out of memory, leading to a Denial of Service (DoS). The issue occurs because the driver does not correctly free memory associated with Card-to-Host (C2H) messages, which are generated during normal operation, especially with active Bluetooth connections or Wi-Fi transmission rate changes. This continuous memory consumption can eventually make the system unstable or unresponsive.


Affected upstream versions: 5.5
Fixed upstream versions: 0, 5.10.173, 5.15.99, 6.1.16, 6.2.3, 6.3
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 430f9f9bec53a75f9ccc53e156a66f13fc098b83
CVE-2023-54037: kernel: Linux kernel: Denial of Service in ice driver via ethtool reload
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's ice driver. A local attacker with low privileges could trigger a null pointer dereference by calling the ethtool utility during a driver reload operation when the Virtual Station Interface (VSI) is not properly configured. This can lead to a system crash, resulting in a Denial of Service (DoS).


Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ca03b327224ed6be2d07f42ee6ee1cdd586cfd5b
CVE-2023-54038: kernel: Linux kernel: Denial of Service in Bluetooth HCI connection handling
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-24T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) connection handling. A local user could exploit this vulnerability when the `hci_connect_sco` function returns a NULL pointer instead of an error pointer when no link is present. This improper handling of exceptional conditions leads to a NULL pointer dereference, which can result in a system crash and a Denial of Service (DoS).


Affected upstream versions: 6.3.8 < 6.4, 6.4
Fixed upstream versions: 0, 6.4, 6.4.7, 6.5
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 357ab53c83a5322437fa434e9a9e3e0bafe6b383