linux package
kernel
pkg:linux/kernel
Vulnerabilities (1,755)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-54211 | — | >= 4.7.0, < 4.14.322 | 4.14.322 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in trace_buffered_event_disable() Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_e | ||
| CVE-2023-54210 | — | >= 6.0.0, < 6.1.42 | 6.1.42 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() KASAN reports that there's a use-after-free in hci_remove_adv_monitor(). Trawling through the disassembly, you can see that the comp | ||
| CVE-2023-54209 | — | >= 5.19.0, < 6.1.39 | 6.1.39 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: block: fix blktrace debugfs entries leakage Commit 99d055b4fd4b ("block: remove per-disk debugfs files in blk_unregister_queue") moves blk_trace_shutdown() from blk_release_queue() to blk_unregister_queue(), th | ||
| CVE-2023-54208 | — | >= 5.4.0, < 5.4.235 | 5.4.235 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: media: ov5675: Fix memleak in ov5675_init_controls() There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock device: AssertionError: unreferenced object 0xffff888107362160 (size 16): comm "pyth | ||
| CVE-2023-54206 | — | >= 6.3.0, < 6.3.3 | 6.3.3 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: fix filter idr initialization The cited commit moved idr initialization too early in fl_change() which allows concurrent users to access the filter that is still being initialized and is in i | ||
| CVE-2023-54205 | — | >= 5.2.0, < 5.4.235 | 5.4.235 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_n | ||
| CVE-2023-54204 | — | >= 6.2.0, < 6.4.12 | 6.4.12 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: mmc: sunplus: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, 1. the memory allocated in mmc_alloc_host() will be leaked 2. null-ptr-deref will happen wh | ||
| CVE-2023-54203 | — | >= 5.15.105, < 5.15.145 | 5.15.145 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2 | ||
| CVE-2023-54202 | — | >= 4.14.0, < 5.15.108 | 5.15.108 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the | ||
| CVE-2023-54201 | — | >= 5.7.0, < 6.1.53 | 6.1.53 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request the device to destr | ||
| CVE-2023-54200 | — | >= 5.15.0, < 5.15.113 | 5.15.113 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always release netdev hooks from notifier This reverts "netfilter: nf_tables: skip netdev events generated on netns removal". The problem is that when a veth device is released, the veth | ||
| CVE-2023-54199 | — | >= 5.9.0, < 5.10.173 | 5.10.173 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() Fix the below kernel panic due to null pointer access: [ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 000000000000 | ||
| CVE-2023-54198 | — | >= 2.6.28, < 4.14.308 | 4.14.308 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid | ||
| CVE-2023-54197 | — | < 4.14.315 | 4.14.315 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. This patch introduces a possible null-ptr-def problem. R | ||
| CVE-2023-54196 | — | >= 5.15.0, < 5.15.113 | 5.15.113 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode' Syzbot found the following issue: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000016 Mem abort info: ESR = 0x000000 | ||
| CVE-2023-54195 | — | >= 6.2.0, < 6.2.16 | 6.2.16 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix timeout of a call that hasn't yet been granted a channel afs_make_call() calls rxrpc_kernel_begin_call() to begin a call (which may get stalled in the background waiting for a connection to become av | ||
| CVE-2023-54194 | — | >= 5.7.0, < 5.10.190 | 5.10.190 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree The call stack shown below is a scenario in the Linux 4.19 kernel. Allocating memory failed where exfat fs use kmalloc_array due to system memory | ||
| CVE-2023-54193 | — | >= 5.3.0, < 5.4.243 | 5.4.243 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: remove block_cb from driver_list before freeing Error handler of tcf_block_bind() frees the whole bo->cb_list on error. However, by that time the flow_block_cb instances are already in the d | ||
| CVE-2023-54192 | — | < 6.1.29 | 6.1.29 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix null pointer panic in tracepoint in __replace_atomic_write_block We got a kernel panic if old_addr is NULL. https://bugzilla.kernel.org/show_bug.cgi?id=217266 BUG: kernel NULL pointer dereference, a | ||
| CVE-2023-54191 | — | >= 6.2.0, < 6.2.3 | 6.2.3 | Dec 30, 2025 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit Always purge mcu skb queues in mt7996_mcu_exit routine even if mt7996_firmware_state fails. |
- CVE-2023-54211Dec 30, 2025affected >= 4.7.0, < 4.14.322fixed 4.14.322
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix warning in trace_buffered_event_disable() Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_e
- CVE-2023-54210Dec 30, 2025affected >= 6.0.0, < 6.1.42fixed 6.1.42
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_sync: Avoid use-after-free in dbg for hci_remove_adv_monitor() KASAN reports that there's a use-after-free in hci_remove_adv_monitor(). Trawling through the disassembly, you can see that the comp
- CVE-2023-54209Dec 30, 2025affected >= 5.19.0, < 6.1.39fixed 6.1.39
In the Linux kernel, the following vulnerability has been resolved: block: fix blktrace debugfs entries leakage Commit 99d055b4fd4b ("block: remove per-disk debugfs files in blk_unregister_queue") moves blk_trace_shutdown() from blk_release_queue() to blk_unregister_queue(), th
- CVE-2023-54208Dec 30, 2025affected >= 5.4.0, < 5.4.235fixed 5.4.235
In the Linux kernel, the following vulnerability has been resolved: media: ov5675: Fix memleak in ov5675_init_controls() There is a kmemleak when testing the media/i2c/ov5675.c with bpf mock device: AssertionError: unreferenced object 0xffff888107362160 (size 16): comm "pyth
- CVE-2023-54206Dec 30, 2025affected >= 6.3.0, < 6.3.3fixed 6.3.3
In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: fix filter idr initialization The cited commit moved idr initialization too early in fl_change() which allows concurrent users to access the filter that is still being initialized and is in i
- CVE-2023-54205Dec 30, 2025affected >= 5.2.0, < 5.4.235fixed 5.4.235
In the Linux kernel, the following vulnerability has been resolved: pinctrl: stm32: Fix refcount leak in stm32_pctrl_get_irq_domain of_irq_find_parent() returns a node pointer with refcount incremented, We should use of_node_put() on it when not needed anymore. Add missing of_n
- CVE-2023-54204Dec 30, 2025affected >= 6.2.0, < 6.4.12fixed 6.4.12
In the Linux kernel, the following vulnerability has been resolved: mmc: sunplus: fix return value check of mmc_add_host() mmc_add_host() may return error, if we ignore its return value, 1. the memory allocated in mmc_alloc_host() will be leaked 2. null-ptr-deref will happen wh
- CVE-2023-54203Dec 30, 2025affected >= 5.15.105, < 5.15.145fixed 5.15.145
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in init_smb2_rsp_hdr When smb1 mount fails, KASAN detect slab-out-of-bounds in init_smb2_rsp_hdr like the following one. For smb1 negotiate(56bytes) , init_smb2_rsp_hdr() for smb2
- CVE-2023-54202Dec 30, 2025affected >= 4.14.0, < 5.15.108fixed 5.15.108
In the Linux kernel, the following vulnerability has been resolved: drm/i915: fix race condition UAF in i915_perf_add_config_ioctl Userspace can guess the id value and try to race oa_config object creation with config remove, resulting in a use-after-free if we dereference the
- CVE-2023-54201Dec 30, 2025affected >= 5.7.0, < 6.1.53fixed 6.1.53
In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request the device to destr
- CVE-2023-54200Dec 30, 2025affected >= 5.15.0, < 5.15.113fixed 5.15.113
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: always release netdev hooks from notifier This reverts "netfilter: nf_tables: skip netdev events generated on netns removal". The problem is that when a veth device is released, the veth
- CVE-2023-54199Dec 30, 2025affected >= 5.9.0, < 5.10.173fixed 5.10.173
In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: Fix null ptr access in adreno_gpu_cleanup() Fix the below kernel panic due to null pointer access: [ 18.504431] Unable to handle kernel NULL pointer dereference at virtual address 000000000000
- CVE-2023-54198Dec 30, 2025affected >= 2.6.28, < 4.14.308fixed 4.14.308
In the Linux kernel, the following vulnerability has been resolved: tty: fix out-of-bounds access in tty_driver_lookup_tty() When specifying an invalid console= device like console=tty3270, tty_driver_lookup_tty() returns the tty struct without checking whether index is a valid
- CVE-2023-54197Dec 30, 2025affected < 4.14.315fixed 4.14.315
In the Linux kernel, the following vulnerability has been resolved: Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" This reverts commit 1e9ac114c4428fdb7ff4635b45d4f46017e8916f. This patch introduces a possible null-ptr-def problem. R
- CVE-2023-54196Dec 30, 2025affected >= 5.15.0, < 5.15.113fixed 5.15.113
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode' Syzbot found the following issue: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000016 Mem abort info: ESR = 0x000000
- CVE-2023-54195Dec 30, 2025affected >= 6.2.0, < 6.2.16fixed 6.2.16
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix timeout of a call that hasn't yet been granted a channel afs_make_call() calls rxrpc_kernel_begin_call() to begin a call (which may get stalled in the background waiting for a connection to become av
- CVE-2023-54194Dec 30, 2025affected >= 5.7.0, < 5.10.190fixed 5.10.190
In the Linux kernel, the following vulnerability has been resolved: exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree The call stack shown below is a scenario in the Linux 4.19 kernel. Allocating memory failed where exfat fs use kmalloc_array due to system memory
- CVE-2023-54193Dec 30, 2025affected >= 5.3.0, < 5.4.243fixed 5.4.243
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: remove block_cb from driver_list before freeing Error handler of tcf_block_bind() frees the whole bo->cb_list on error. However, by that time the flow_block_cb instances are already in the d
- CVE-2023-54192Dec 30, 2025affected < 6.1.29fixed 6.1.29
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix null pointer panic in tracepoint in __replace_atomic_write_block We got a kernel panic if old_addr is NULL. https://bugzilla.kernel.org/show_bug.cgi?id=217266 BUG: kernel NULL pointer dereference, a
- CVE-2023-54191Dec 30, 2025affected >= 6.2.0, < 6.2.3fixed 6.2.3
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: fix memory leak in mt7996_mcu_exit Always purge mcu skb queues in mt7996_mcu_exit routine even if mt7996_firmware_state fails.
Page 27 of 88