kernel

Vulnerabilities (14,254)

• CVE-2023-52577MedMar 2, 2024
  affected >= 4.14.326, < 4.14.327fixed 4.14.327

  In the Linux kernel, the following vulnerability has been resolved: dccp: fix dccp_v4_err()/dccp_v6_err() again dh->dccph_x is the 9th byte (offset 8) in "struct dccp_hdr", not in the "byte 7" as Jann claimed. We need to make sure the ICMP messages are big enough, using more s

• CVE-2023-52576MedMar 2, 2024
  affected >= 5.13.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: x86/mm, kexec, ima: Use memblock_free_late() from ima_free_kexec_buffer() The code calling ima_free_kexec_buffer() runs long after the memblock allocator has already been torn down, potentially resulting in a u

• CVE-2023-52574HigMar 2, 2024
  affected >= 3.7.0, < 4.14.327fixed 4.14.327

  In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 0010:vlan_dev_hard_he

• CVE-2023-52573MedMar 2, 2024
  affected >= 5.1.0, < 5.4.258fixed 5.4.258

  In the Linux kernel, the following vulnerability has been resolved: net: rds: Fix possible NULL-pointer dereference In rds_rdma_cm_event_handler_cmn() check, if conn pointer exists before dereferencing it as rdma_set_service_type() argument Found by Linux Verification Center (

• CVE-2023-52572HigMar 2, 2024
  affected >= 2.6.16, < 5.4.297fixed 5.4.297

  In the Linux kernel, the following vulnerability has been resolved: cifs: Fix UAF in cifs_demultiplex_thread() There is a UAF when xfstests on cifs: BUG: KASAN: use-after-free in smb2_is_network_name_deleted+0x27/0x160 Read of size 4 at addr ffff88810103fc08 by task cifsd/

• CVE-2023-52571HigMar 2, 2024
  affected < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: power: supply: rk817: Fix node refcount leak Dan Carpenter reports that the Smatch static checker warning has found that there is another refcount leak in the probe function. While of_node_put() was added in on

• CVE-2023-52570MedMar 2, 2024
  affected >= 6.1.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: vfio/mdev: Fix a null-ptr-deref bug for mdev_unregister_parent() Inject fault while probing mdpy.ko, if kstrdup() of create_dir() fails in kobject_add_internal() in kobject_init_and_add() in mdev_type_add() in

• CVE-2023-52569MedMar 2, 2024
  affected >= 6.5.0, < 6.5.6fixed 6.5.6

  In the Linux kernel, the following vulnerability has been resolved: btrfs: remove BUG() after failure to insert delayed dir index item Instead of calling BUG() when we fail to insert a delayed dir index item into the delayed node's tree, we can just release all the resources we

• CVE-2023-52568MedMar 2, 2024
  affected >= 6.0.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race The SGX EPC reclaimer (ksgxd) may reclaim the SECS EPC page for an enclave and set secs.epc_page to NULL. The SECS page is used for EAUG and ELDU in t

• CVE-2023-52567MedMar 2, 2024
  affected < 4.14.327fixed 4.14.327

  In the Linux kernel, the following vulnerability has been resolved: serial: 8250_port: Check IRQ data before use In case the leaf driver wants to use IRQ polling (irq = 0) and IIR register shows that an interrupt happened in the 8250 hardware the IRQ data can be NULL. In such a

• CVE-2023-52566MedMar 2, 2024
  affected >= 2.6.30, < 4.14.327fixed 4.14.327

  In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() In nilfs_gccache_submit_read_data(), brelse(bh) is called to drop the reference count of bh when the call to nilfs_dat_translate() fails.

• CVE-2023-52565HigMar 2, 2024
  affected < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix OOB read If the index provided by the user is bigger than the mask size, we might do an out of bound read.

• CVE-2023-52564MedMar 2, 2024
  affected < 5.10.198fixed 5.10.198

  In the Linux kernel, the following vulnerability has been resolved: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. The commit above is reverted as it did not solve the original issue. gsm_cleanup_mux() tries to fr

• CVE-2023-52563MedMar 2, 2024
  affected < 5.15.134fixed 5.15.134

  In the Linux kernel, the following vulnerability has been resolved: drm/meson: fix memory leak on ->hpd_notify callback The EDID returned by drm_bridge_get_edid() needs to be freed.

• CVE-2023-52562MedMar 2, 2024
  affected >= 6.0.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() After the commit in Fixes:, if a module that created a slab cache does not release all of its allocated objects before destroying the c

• CVE-2023-52561MedMar 2, 2024
  affected >= 5.3.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved Adding a reserved memory region for the framebuffer memory (the splash memory region set up by the bootloader). It fixes a kernel pan

• CVE-2023-52560MedMar 2, 2024
  affected >= 5.16.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak i

• CVE-2023-52559MedMar 2, 2024
  affected >= 5.11.0, < 5.15.136fixed 5.15.136

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid memory allocation in iommu_suspend() The iommu_suspend() syscore suspend callback is invoked with IRQ disabled. Allocating memory with the GFP_KERNEL flag may re-enable IRQs during the suspend

• CVE-2023-52532MedMar 2, 2024
  affected >= 5.13.0, < 6.1.59fixed 6.1.59

  In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type (probably from a newer hardware), still free the SKB, update the queue tail, etc., otherwise the accounting will be wrong. Also, TX errors

• CVE-2023-52531HigMar 2, 2024
  affected >= 3.9.0, < 5.15.135fixed 5.15.135

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data'