xamxte/cve-to-cwe huggingface dataset:
CVE-2023-54227: In the Linux kernel, the following vulnerability has been resolved:  blk-mq: fix tags leak when shrink nr_hw_queues  Although we don't need to realloc set->tags[] when shrink nr_hw_queues, we need to free them. Or these tags will be leaked.  How to reproduce: 1. mount -t configfs configfs /mnt 2. modprobe null_blk nr_devices=0 submit_queues=8 3. mkdir /mnt/nullb/nullb0 4. echo 1 > /mnt/nullb/nullb0/power 5. echo 4 > /mnt/nullb/nullb0/submit_queues 6. rmdir /mnt/nullb/nullb0  In step 4, will alloc 9 tags (8 submit queues and 1 poll queue), then in step 5, new_nr_hw_queues = 5 (4 submit queues and 1 poll queue). At last in step 6, only these 5 tags are freed, the other 4 tags leaked.
CVE-2023-54228: In the Linux kernel, the following vulnerability has been resolved:  regulator: raa215300: Fix resource leak in case of error  The clk_register_clkdev() allocates memory by calling vclkdev_alloc() and this memory is not freed in the error path. Similarly, resources allocated by clk_register_fixed_rate() are not freed in the error path.  Fix these issues by using devm_clk_hw_register_fixed_rate() and devm_clk_hw_register_clkdev().  After this, the static variable clk is not needed. Replace it with  local variable hw in probe() and drop calling clk_unregister_fixed_rate() from raa215300_rtc_unregister_device().
CVE-2023-54230: In the Linux kernel, the following vulnerability has been resolved:  amba: bus: fix refcount leak  commit 5de1540b7bc4 ("drivers/amba: create devices from device tree") increases the refcount of of_node, but not releases it in amba_device_release, so there is refcount leak. By using of_node_put to avoid refcount leak.
CVE-2023-54231: In the Linux kernel, the following vulnerability has been resolved:  net: libwx: fix memory leak in wx_setup_rx_resources  When wx_alloc_page_pool() failed in wx_setup_rx_resources(), it doesn't release DMA buffer. Add dma_free_coherent() in the error path to release the DMA buffer.
CVE-2023-54233: In the Linux kernel, the following vulnerability has been resolved:  ASoC: SOF: avoid a NULL dereference with unsupported widgets  If an IPC4 topology contains an unsupported widget, its .module_info field won't be set, then sof_ipc4_route_setup() will cause a kernel Oops trying to dereference it. Add a check for such cases.
CVE-2023-54234: In the Linux kernel, the following vulnerability has been resolved:  scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization  Commit c1af985d27da ("scsi: mpi3mr: Add Event acknowledgment logic") introduced an array mrioc->evtack_cmds but initialization of the array elements was missed. They are just zero cleared. The function mpi3mr_complete_evt_ack() refers host_tag field of the elements. Due to the zero value of the host_tag field, the function calls clear_bit() for mrico->evtack_cmds_bitmap with wrong bit index. This results in memory access to invalid address and "BUG: KASAN: use-after-free". This BUG was observed at eHBA-9600 firmware update to version 8.3.1.0. To fix it, add the missing initialization of mrioc->evtack_cmds.
CVE-2023-54238: In the Linux kernel, the following vulnerability has been resolved:  mlx5: fix skb leak while fifo resync and push  During ptp resync operation SKBs were poped from the fifo but were never freed neither by napi_consume nor by dev_kfree_skb_any. Add call to napi_consume_skb to properly free SKBs.  Another leak was happening because mlx5e_skb_fifo_has_room() had an error in the check. Comparing free running counters works well unless C promotes the types to something wider than the counter. In this case counters are u16 but the result of the substraction is promouted to int and it causes wrong result (negative value) of the check when producer have already overlapped but consumer haven't yet. Explicit cast to u16 fixes the issue.
CVE-2023-54239: In the Linux kernel, the following vulnerability has been resolved:  iommufd: Check for uptr overflow  syzkaller found that setting up a map with a user VA that wraps past zero can trigger WARN_ONs, particularly from pin_user_pages weirdly returning 0 due to invalid arguments.  Prevent creating a pages with a uptr and size that would math overflow.    WARNING: CPU: 0 PID: 518 at drivers/iommu/iommufd/pages.c:793 pfn_reader_user_pin+0x2e6/0x390   Modules linked in:   CPU: 0 PID: 518 Comm: repro Not tainted 6.3.0-rc2-eeac8ede1755+ #1   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014   RIP: 0010:pfn_reader_user_pin+0x2e6/0x390   Code: b1 11 e9 25 fe ff ff e8 28 e4 0f ff 31 ff 48 89 de e8 2e e6 0f ff 48 85 db 74 0a e8 14 e4 0f ff e9 4d ff ff ff e8 0a e4 0f ff <0f> 0b bb f2 ff ff ff e9 3c ff ff ff e8 f9 e3 0f ff ba 01 00 00 00   RSP: 0018:ffffc90000f9fa30 EFLAGS: 00010246   RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff821e2b72   RDX: 0000000000000000 RSI: ffff888014184680 RDI: 0000000000000002   RBP: ffffc90000f9fa78 R08: 00000000000000ff R09: 0000000079de6f4e   R10: ffffc90000f9f790 R11: ffff888014185418 R12: ffffc90000f9fc60   R13: 0000000000000002 R14: ffff888007879800 R15: 0000000000000000   FS:  00007f4227555740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033   CR2: 0000000020000043 CR3: 000000000e748005 CR4: 0000000000770ef0   PKRU: 55555554   Call Trace:    <TASK>    pfn_reader_next+0x14a/0x7b0    ? interval_tree_double_span_iter_update+0x11a/0x140    pfn_reader_first+0x140/0x1b0    iopt_pages_rw_slow+0x71/0x280    ? __this_cpu_preempt_check+0x20/0x30    iopt_pages_rw_access+0x2b2/0x5b0    iommufd_access_rw+0x19f/0x2f0    iommufd_test+0xd11/0x16f0    ? write_comp_data+0x2f/0x90    iommufd_fops_ioctl+0x206/0x330    __x64_sys_ioctl+0x10e/0x160    ? __pfx_iommufd_fops_ioctl+0x10/0x10    do_syscall_64+0x3b/0x90    entry_SYSCALL_64_after_hwframe+0x72/0xdc
CVE-2023-54240: In the Linux kernel, the following vulnerability has been resolved:  net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()  rule_locs is allocated in ethtool_get_rxnfc and the size is determined by rule_cnt from user space. So rule_cnt needs to be check before using rule_locs to avoid NULL pointer dereference.
CVE-2023-54242: In the Linux kernel, the following vulnerability has been resolved:  block, bfq: Fix division by zero error on zero wsum  When the weighted sum is zero the calculation of limit causes a division by zero error. Fix this by continuing to the next level.  This was discovered by running as root:  stress-ng --ioprio 0  Fixes divison by error oops:  [  521.450556] divide error: 0000 [#1] SMP NOPTI [  521.450766] CPU: 2 PID: 2684464 Comm: stress-ng-iopri Not tainted 6.2.1-1280.native #1 [  521.451117] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.1-0-g3208b098f51a-prebuilt.qemu.org 04/01/2014 [  521.451627] RIP: 0010:bfqq_request_over_limit+0x207/0x400 [  521.451875] Code: 01 48 8d 0c c8 74 0b 48 8b 82 98 00 00 00 48 8d 0c c8 8b 85 34 ff ff ff 48 89 ca 41 0f af 41 50 48 d1 ea 48 98 48 01 d0 31 d2 <48> f7 f1 41 39 41 48 89 85 34 ff ff ff 0f 8c 7b 01 00 00 49 8b 44 [  521.452699] RSP: 0018:ffffb1af84eb3948 EFLAGS: 00010046 [  521.452938] RAX: 000000000000003c RBX: 0000000000000000 RCX: 0000000000000000 [  521.453262] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffb1af84eb3978 [  521.453584] RBP: ffffb1af84eb3a30 R08: 0000000000000001 R09: ffff8f88ab8a4ba0 [  521.453905] R10: 0000000000000000 R11: 0000000000000001 R12: ffff8f88ab8a4b18 [  521.454224] R13: ffff8f8699093000 R14: 0000000000000001 R15: ffffb1af84eb3970 [  521.454549] FS:  00005640b6b0b580(0000) GS:ffff8f88b3880000(0000) knlGS:0000000000000000 [  521.454912] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  521.455170] CR2: 00007ffcbcae4e38 CR3: 00000002e46de001 CR4: 0000000000770ee0 [  521.455491] PKRU: 55555554 [  521.455619] Call Trace: [  521.455736]  <TASK> [  521.455837]  ? bfq_request_merge+0x3a/0xc0 [  521.456027]  ? elv_merge+0x115/0x140 [  521.456191]  bfq_limit_depth+0xc8/0x240 [  521.456366]  __blk_mq_alloc_requests+0x21a/0x2c0 [  521.456577]  blk_mq_submit_bio+0x23c/0x6c0 [  521.456766]  __submit_bio+0xb8/0x140 [  521.457236]  submit_bio_noacct_nocheck+0x212/0x300 [  521.457748]  submit_bio_noacct+0x1a6/0x580 [  521.458220]  submit_bio+0x43/0x80 [  521.458660]  ext4_io_submit+0x23/0x80 [  521.459116]  ext4_do_writepages+0x40a/0xd00 [  521.459596]  ext4_writepages+0x65/0x100 [  521.460050]  do_writepages+0xb7/0x1c0 [  521.460492]  __filemap_fdatawrite_range+0xa6/0x100 [  521.460979]  file_write_and_wait_range+0xbf/0x140 [  521.461452]  ext4_sync_file+0x105/0x340 [  521.461882]  __x64_sys_fsync+0x67/0x100 [  521.462305]  ? syscall_exit_to_user_mode+0x2c/0x1c0 [  521.462768]  do_syscall_64+0x3b/0xc0 [  521.463165]  entry_SYSCALL_64_after_hwframe+0x5a/0xc4 [  521.463621] RIP: 0033:0x5640b6c56590 [  521.464006] Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 80 3d 71 70 0e 00 00 74 17 b8 4a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c
CVE-2023-54243: In the Linux kernel, the following vulnerability has been resolved:  netfilter: ebtables: fix table blob use-after-free  We are not allowed to return an error at this point. Looking at the code it looks like ret is always 0 at this point, but its not.  t = find_table_lock(net, repl->name, &ret, &ebt_mutex);  ... this can return a valid table, with ret != 0.  This bug causes update of table->private with the new blob, but then frees the blob right away in the caller.  Syzbot report:  BUG: KASAN: vmalloc-out-of-bounds in __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168 Read of size 4 at addr ffffc90005425000 by task kworker/u4:4/74 Workqueue: netns cleanup_net Call Trace:  kasan_report+0xbf/0x1f0 mm/kasan/report.c:517  __ebt_unregister_table+0xc00/0xcd0 net/bridge/netfilter/ebtables.c:1168  ebt_unregister_table+0x35/0x40 net/bridge/netfilter/ebtables.c:1372  ops_exit_list+0xb0/0x170 net/core/net_namespace.c:169  cleanup_net+0x4ee/0xb10 net/core/net_namespace.c:613 ...  ip(6)tables appears to be ok (ret should be 0 at this point) but make this more obvious.
CVE-2023-54244: In the Linux kernel, the following vulnerability has been resolved:  ACPI: EC: Fix oops when removing custom query handlers  When removing custom query handlers, the handler might still be used inside the EC query workqueue, causing a kernel oops if the module holding the callback function was already unloaded.  Fix this by flushing the EC query workqueue when removing custom query handlers.  Tested on a Acer Travelmate 4002WLMi
CVE-2023-54245: In the Linux kernel, the following vulnerability has been resolved:  ASoC: codecs: tx-macro: Fix for KASAN: slab-out-of-bounds  When we run syzkaller we get below Out of Bound.     "KASAN: slab-out-of-bounds Read in regcache_flat_read"      Below is the backtrace of the issue:      dump_backtrace+0x0/0x4c8     show_stack+0x34/0x44     dump_stack_lvl+0xd8/0x118     print_address_description+0x30/0x2d8     kasan_report+0x158/0x198     __asan_report_load4_noabort+0x44/0x50     regcache_flat_read+0x10c/0x110     regcache_read+0xf4/0x180     _regmap_read+0xc4/0x278     _regmap_update_bits+0x130/0x290     regmap_update_bits_base+0xc0/0x15c     snd_soc_component_update_bits+0xa8/0x22c     snd_soc_component_write_field+0x68/0xd4     tx_macro_digital_mute+0xec/0x140      Actually There is no need to have decimator with 32 bits.     By limiting the variable with short type u8 issue is resolved.
CVE-2023-54248: In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: Add check for kmemdup  Since the kmemdup may return NULL pointer, it should be better to add check for the return value in order to avoid NULL pointer dereference.
CVE-2023-54249: In the Linux kernel, the following vulnerability has been resolved:  bus: mhi: ep: Only send -ENOTCONN status if client driver is available  For the STOP and RESET commands, only send the channel disconnect status -ENOTCONN if client driver is available. Otherwise, it will result in null pointer dereference.
CVE-2023-54250: In the Linux kernel, the following vulnerability has been resolved:  ksmbd: avoid out of bounds access in decode_preauth_ctxt()  Confirm that the accessed pneg_ctxt->HashAlgorithms address sits within the SMB request boundary; deassemble_neg_contexts() only checks that the eight byte smb2_neg_context header + (client controlled) DataLength are within the packet boundary, which is insufficient.  Checking for sizeof(struct smb2_preauth_neg_context) is overkill given that the type currently assumes SMB311_SALT_SIZE bytes of trailing Salt.
CVE-2023-54252: In the Linux kernel, the following vulnerability has been resolved:  platform/x86: think-lmi: Fix memory leaks when parsing ThinkStation WMI strings  My previous commit introduced a memory leak where the item allocated from tlmi_setting was not freed. This commit also renames it to avoid confusion with the similarly name variable in the same function.
CVE-2023-54254: In the Linux kernel, the following vulnerability has been resolved:  drm/ttm: Don't leak a resource on eviction error  On eviction errors other than -EMULTIHOP we were leaking a resource. Fix.  v2: - Avoid yet another goto (Andi Shyti)
CVE-2023-54258: In the Linux kernel, the following vulnerability has been resolved:  cifs: fix potential oops in cifs_oplock_break  With deferred close we can have closes that race with lease breaks, and so with the current checks for whether to send the lease response, oplock_response(), this can mean that an unmount (kill_sb) can occur just before we were checking if the tcon->ses is valid.  See below:  [Fri Aug  4 04:12:50 2023] RIP: 0010:cifs_oplock_break+0x1f7/0x5b0 [cifs] [Fri Aug  4 04:12:50 2023] Code: 7d a8 48 8b 7d c0 c0 e9 02 48 89 45 b8 41 89 cf e8 3e f5 ff ff 4c 89 f7 41 83 e7 01 e8 82 b3 03 f2 49 8b 45 50 48 85 c0 74 5e <48> 83 78 60 00 74 57 45 84 ff 75 52 48 8b 43 98 48 83 eb 68 48 39 [Fri Aug  4 04:12:50 2023] RSP: 0018:ffffb30607ddbdf8 EFLAGS: 00010206 [Fri Aug  4 04:12:50 2023] RAX: 632d223d32612022 RBX: ffff97136944b1e0 RCX: 0000000080100009 [Fri Aug  4 04:12:50 2023] RDX: 0000000000000001 RSI: 0000000080100009 RDI: ffff97136944b188 [Fri Aug  4 04:12:50 2023] RBP: ffffb30607ddbe58 R08: 0000000000000001 R09: ffffffffc08e0900 [Fri Aug  4 04:12:50 2023] R10: 0000000000000001 R11: 000000000000000f R12: ffff97136944b138 [Fri Aug  4 04:12:50 2023] R13: ffff97149147c000 R14: ffff97136944b188 R15: 0000000000000000 [Fri Aug  4 04:12:50 2023] FS:  0000000000000000(0000) GS:ffff9714f7c00000(0000) knlGS:0000000000000000 [Fri Aug  4 04:12:50 2023] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [Fri Aug  4 04:12:50 2023] CR2: 00007fd8de9c7590 CR3: 000000011228e000 CR4: 0000000000350ef0 [Fri Aug  4 04:12:50 2023] Call Trace: [Fri Aug  4 04:12:50 2023]  <TASK> [Fri Aug  4 04:12:50 2023]  process_one_work+0x225/0x3d0 [Fri Aug  4 04:12:50 2023]  worker_thread+0x4d/0x3e0 [Fri Aug  4 04:12:50 2023]  ? process_one_work+0x3d0/0x3d0 [Fri Aug  4 04:12:50 2023]  kthread+0x12a/0x150 [Fri Aug  4 04:12:50 2023]  ? set_kthread_struct+0x50/0x50 [Fri Aug  4 04:12:50 2023]  ret_from_fork+0x22/0x30 [Fri Aug  4 04:12:50 2023]  </TASK>  To fix this change the ordering of the checks before sending the oplock_response to first check if the openFileList is empty.
CVE-2023-54261: In the Linux kernel, the following vulnerability has been resolved:  drm/amdkfd: Add missing gfx11 MQD manager callbacks  mqd_stride function was introduced in commit 2f77b9a242a2 ("drm/amdkfd: Update MQD management on multi XCC setup") but not assigned for gfx11. Fixes a NULL dereference in debugfs.
CVE-2023-54264: In the Linux kernel, the following vulnerability has been resolved:  fs/sysv: Null check to prevent null-ptr-deref bug  sb_getblk(inode->i_sb, parent) return a null ptr and taking lock on that leads to the null-ptr-deref bug.
CVE-2023-54265: In the Linux kernel, the following vulnerability has been resolved:  ipv6: Fix an uninit variable access bug in __ip6_make_skb()  Syzbot reported a bug as following:  ===================================================== BUG: KMSAN: uninit-value in arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] BUG: KMSAN: uninit-value in arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] BUG: KMSAN: uninit-value in atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] BUG: KMSAN: uninit-value in __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956  arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline]  arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline]  atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline]  __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956  ip6_finish_skb include/net/ipv6.h:1122 [inline]  ip6_push_pending_frames+0x10e/0x550 net/ipv6/ip6_output.c:1987  rawv6_push_pending_frames+0xb12/0xb90 net/ipv6/raw.c:579  rawv6_sendmsg+0x297e/0x2e60 net/ipv6/raw.c:922  inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827  sock_sendmsg_nosec net/socket.c:714 [inline]  sock_sendmsg net/socket.c:734 [inline]  ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476  ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530  __sys_sendmsg net/socket.c:2559 [inline]  __do_sys_sendmsg net/socket.c:2568 [inline]  __se_sys_sendmsg net/socket.c:2566 [inline]  __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x63/0xcd  Uninit was created at:  slab_post_alloc_hook mm/slab.h:766 [inline]  slab_alloc_node mm/slub.c:3452 [inline]  __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491  __do_kmalloc_node mm/slab_common.c:967 [inline]  __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988  kmalloc_reserve net/core/skbuff.c:492 [inline]  __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565  alloc_skb include/linux/skbuff.h:1270 [inline]  __ip6_append_data+0x51c1/0x6bb0 net/ipv6/ip6_output.c:1684  ip6_append_data+0x411/0x580 net/ipv6/ip6_output.c:1854  rawv6_sendmsg+0x2882/0x2e60 net/ipv6/raw.c:915  inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827  sock_sendmsg_nosec net/socket.c:714 [inline]  sock_sendmsg net/socket.c:734 [inline]  ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476  ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530  __sys_sendmsg net/socket.c:2559 [inline]  __do_sys_sendmsg net/socket.c:2568 [inline]  __se_sys_sendmsg net/socket.c:2566 [inline]  __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566  do_syscall_x64 arch/x86/entry/common.c:50 [inline]  do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80  entry_SYSCALL_64_after_hwframe+0x63/0xcd  It is because icmp6hdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp6_hdr(skb)->icmp6_type directly will trigger the uninit variable access bug.  Use a local variable icmp6_type to carry the correct value in different scenarios.
CVE-2023-54266: In the Linux kernel, the following vulnerability has been resolved:  media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()  'read' is freed when it is known to be NULL, but not when a read error occurs.  Revert the logic to avoid a small leak, should a m920x_read() call fail.
CVE-2023-54269: In the Linux kernel, the following vulnerability has been resolved:  SUNRPC: double free xprt_ctxt while still in use  When an RPC request is deferred, the rq_xprt_ctxt pointer is moved out of the svc_rqst into the svc_deferred_req. When the deferred request is revisited, the pointer is copied into the new svc_rqst - and also remains in the svc_deferred_req.  In the (rare?) case that the request is deferred a second time, the old svc_deferred_req is reused - it still has all the correct content. However in that case the rq_xprt_ctxt pointer is NOT cleared so that when xpo_release_xprt is called, the ctxt is freed (UDP) or possible added to a free list (RDMA). When the deferred request is revisited for a second time, it will reference this ctxt which may be invalid, and the free the object a second time which is likely to oops.  So change svc_defer() to *always* clear rq_xprt_ctxt, and assert that the value is now stored in the svc_deferred_req.
CVE-2023-54272: In the Linux kernel, the following vulnerability has been resolved:  fs/ntfs3: Fix a possible null-pointer dereference in ni_clear()  In a previous commit c1006bd13146, ni->mi.mrec in ni_write_inode() could be NULL, and thus a NULL check is added for this variable.  However, in the same call stack, ni->mi.mrec can be also dereferenced in ni_clear():  ntfs_evict_inode(inode)   ni_write_inode(inode, ...)     ni = ntfs_i(inode);     is_rec_inuse(ni->mi.mrec) -> Add a NULL check by previous commit   ni_clear(ntfs_i(inode))     is_rec_inuse(ni->mi.mrec) -> No check  Thus, a possible null-pointer dereference may exist in ni_clear(). To fix it, a NULL check is added in this function.
CVE-2023-54273: In the Linux kernel, the following vulnerability has been resolved:  xfrm: Fix leak of dev tracker  At the stage of direction checks, the netdev reference tracker is already initialized, but released with wrong *_put() call.
CVE-2023-54274: In the Linux kernel, the following vulnerability has been resolved:  RDMA/srpt: Add a check for valid 'mad_agent' pointer  When unregistering MAD agent, srpt module has a non-null check for 'mad_agent' pointer before invoking ib_unregister_mad_agent(). This check can pass if 'mad_agent' variable holds an error value. The 'mad_agent' can have an error value for a short window when srpt_add_one() and srpt_remove_one() is executed simultaneously.  In srpt module, added a valid pointer check for 'sport->mad_agent' before unregistering MAD agent.  This issue can hit when RoCE driver unregisters ib_device  Stack Trace: ------------ BUG: kernel NULL pointer dereference, address: 000000000000004d PGD 145003067 P4D 145003067 PUD 2324fe067 PMD 0 Oops: 0002 [#1] PREEMPT SMP NOPTI CPU: 10 PID: 4459 Comm: kworker/u80:0 Kdump: loaded Tainted: P Hardware name: Dell Inc. PowerEdge R640/06NR82, BIOS 2.5.4 01/13/2020 Workqueue: bnxt_re bnxt_re_task [bnxt_re] RIP: 0010:_raw_spin_lock_irqsave+0x19/0x40 Call Trace:   ib_unregister_mad_agent+0x46/0x2f0 [ib_core]   IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready   ? __schedule+0x20b/0x560   srpt_unregister_mad_agent+0x93/0xd0 [ib_srpt]   srpt_remove_one+0x20/0x150 [ib_srpt]   remove_client_context+0x88/0xd0 [ib_core]   bond0: (slave p2p1): link status definitely up, 100000 Mbps full duplex   disable_device+0x8a/0x160 [ib_core]   bond0: active interface up!   ? kernfs_name_hash+0x12/0x80  (NULL device *): Bonding Info Received: rdev: 000000006c0b8247   __ib_unregister_device+0x42/0xb0 [ib_core]  (NULL device *):         Master: mode: 4 num_slaves:2   ib_unregister_device+0x22/0x30 [ib_core]  (NULL device *):         Slave: id: 105069936 name:p2p1 link:0 state:0   bnxt_re_stopqps_and_ib_uninit+0x83/0x90 [bnxt_re]   bnxt_re_alloc_lag+0x12e/0x4e0 [bnxt_re]
CVE-2023-54275: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup  crypto_alloc_shash() allocates resources, which should be released by crypto_free_shash(). When ath11k_peer_find() fails, there has memory leak. Add missing crypto_free_shash() to fix this.