linux package
kernel
pkg:linux/kernel
Vulnerabilities (14,254)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-52530 | Hig | 8.8 | >= 4.14.0, < 5.4.285 | 5.4.285 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will | |
| CVE-2023-52529 | Med | 6.0 | >= 5.14.0, < 5.15.135 | 5.15.135 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occurs after a successful usb_alloc_urb() call, usb_free_urb() should be called. | |
| CVE-2023-52528 | Med | 5.5 | >= 2.6.34, < 4.14.327 | 4.14.327 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in sms | |
| CVE-2023-52527 | Med | 5.5 | >= 3.5.0, < 4.14.327 | 4.14.327 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) wh | |
| CVE-2023-52526 | Med | 5.5 | >= 6.1.0, < 6.1.57 | 6.1.57 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled (`-Ededupe`), I found some short-lived temporary | |
| CVE-2023-52525 | Hig | 7.1 | >= 4.14.326, < 4.14.327 | 4.14.327 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc | |
| CVE-2023-52524 | Hig | 7.8 | < 5.4.258 | 5.4.258 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered. | |
| CVE-2023-52523 | Hig | 7.8 | >= 5.13.0, < 5.15.135 | 5.15.135 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets With a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messages sent from one TCP socket (s1) to actually egress from another TCP socket | |
| CVE-2023-52522 | Hig | 8.8 | >= 2.6.37, < 5.4.258 | 5.4.258 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item | |
| CVE-2023-52520 | Med | 5.5 | >= 5.14.0, < 5.15.136 | 5.15.136 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix reference leak If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned which needs to be disposed accordingly using kobject_put(). Move th | |
| CVE-2023-52519 | Hig | 7.1 | >= 5.12.0, < 5.15.135 | 5.15.135 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit The EHL (Elkhart Lake) based platforms provide a OOB (Out of band) service, which allows to wakup device when the system is in S5 (Soft-Off state). Thi | |
| CVE-2023-52518 | Med | 5.5 | >= 5.16.0, < 6.1.57 | 6.1.57 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: Fix leaking content of local_codecs The following memory leak can be observed when the controller supports codecs which are stored in local_codecs list but the elements are never freed: u | |
| CVE-2023-52517 | Hig | 7.8 | >= 5.11.0, < 5.15.134 | 5.15.134 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain Previously the transfer complete IRQ immediately drained to RX FIFO to read any data remaining in FIFO to the RX buffer. This behaviour | |
| CVE-2023-52516 | Med | 5.5 | >= 5.0.0, < 5.10.198 | 5.10.198 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock __dma_entry_alloc_check_leak() calls into printk -> serial console output (qcom geni) and grabs port->lock under free_entries_lock sp | |
| CVE-2023-52515 | Cri | 9.8 | >= 3.7.0, < 5.10.199 | 5.10.199 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call s | |
| CVE-2023-52513 | Hig | 7.5 | >= 5.3.0, < 5.4.258 | 5.4.258 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix connection failure handling In case immediate MPA request processing fails, the newly created endpoint unlinks the listening endpoint and is ready to be dropped. This special case was not handled | |
| CVE-2023-52512 | Med | 5.5 | >= 5.18.0, < 6.1.59 | 6.1.59 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: wpcm450: fix out of bounds write Write into 'pctrl->gpio_bank' happens before the check for GPIO index validity, so out of bounds write may happen. Found by Linux Verification Center (linuxte | |
| CVE-2023-52511 | Med | 5.3 | >= 5.11.0, < 5.15.134 | 5.15.134 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: spi: sun6i: reduce DMA RX transfer width to single byte Through empirical testing it has been determined that sometimes RX SPI transfers with DMA enabled return corrupted data. This is down to single or even mu | |
| CVE-2023-52510 | Hig | 7.8 | >= 4.12.0, < 4.14.328 | 4.14.328 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: Fix a potential UAF in ca8210_probe If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca | |
| CVE-2023-52509 | Hig | 7.8 | >= 4.2.0, < 5.4.259 | 5.4.259 | Mar 2, 2024 | In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like b |
- affected >= 4.14.0, < 5.4.285fixed 5.4.285
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will
- affected >= 5.14.0, < 5.15.135fixed 5.15.135
In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occurs after a successful usb_alloc_urb() call, usb_free_urb() should be called.
- affected >= 2.6.34, < 4.14.327fixed 4.14.327
In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in sms
- affected >= 3.5.0, < 4.14.327fixed 4.14.327
In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) wh
- affected >= 6.1.0, < 6.1.57fixed 6.1.57
In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled (`-Ededupe`), I found some short-lived temporary
- affected >= 4.14.326, < 4.14.327fixed 4.14.327
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc
- affected < 5.4.258fixed 5.4.258
In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered.
- affected >= 5.13.0, < 5.15.135fixed 5.15.135
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets With a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messages sent from one TCP socket (s1) to actually egress from another TCP socket
- affected >= 2.6.37, < 5.4.258fixed 5.4.258
In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item
- affected >= 5.14.0, < 5.15.136fixed 5.15.136
In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix reference leak If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned which needs to be disposed accordingly using kobject_put(). Move th
- affected >= 5.12.0, < 5.15.135fixed 5.15.135
In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit The EHL (Elkhart Lake) based platforms provide a OOB (Out of band) service, which allows to wakup device when the system is in S5 (Soft-Off state). Thi
- affected >= 5.16.0, < 6.1.57fixed 6.1.57
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: Fix leaking content of local_codecs The following memory leak can be observed when the controller supports codecs which are stored in local_codecs list but the elements are never freed: u
- affected >= 5.11.0, < 5.15.134fixed 5.15.134
In the Linux kernel, the following vulnerability has been resolved: spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain Previously the transfer complete IRQ immediately drained to RX FIFO to read any data remaining in FIFO to the RX buffer. This behaviour
- affected >= 5.0.0, < 5.10.198fixed 5.10.198
In the Linux kernel, the following vulnerability has been resolved: dma-debug: don't call __dma_entry_alloc_check_leak() under free_entries_lock __dma_entry_alloc_check_leak() calls into printk -> serial console output (qcom geni) and grabs port->lock under free_entries_lock sp
- affected >= 3.7.0, < 5.10.199fixed 5.10.199
In the Linux kernel, the following vulnerability has been resolved: RDMA/srp: Do not call scsi_done() from srp_abort() After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call s
- affected >= 5.3.0, < 5.4.258fixed 5.4.258
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix connection failure handling In case immediate MPA request processing fails, the newly created endpoint unlinks the listening endpoint and is ready to be dropped. This special case was not handled
- affected >= 5.18.0, < 6.1.59fixed 6.1.59
In the Linux kernel, the following vulnerability has been resolved: pinctrl: nuvoton: wpcm450: fix out of bounds write Write into 'pctrl->gpio_bank' happens before the check for GPIO index validity, so out of bounds write may happen. Found by Linux Verification Center (linuxte
- affected >= 5.11.0, < 5.15.134fixed 5.15.134
In the Linux kernel, the following vulnerability has been resolved: spi: sun6i: reduce DMA RX transfer width to single byte Through empirical testing it has been determined that sometimes RX SPI transfers with DMA enabled return corrupted data. This is down to single or even mu
- affected >= 4.12.0, < 4.14.328fixed 4.14.328
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: Fix a potential UAF in ca8210_probe If of_clk_add_provider() fails in ca8210_register_ext_clock(), it calls clk_unregister() to release priv->clk and returns an error. However, the caller ca
- affected >= 4.2.0, < 5.4.259fixed 5.4.259
In the Linux kernel, the following vulnerability has been resolved: ravb: Fix use-after-free issue in ravb_tx_timeout_work() The ravb_stop() should call cancel_work_sync(). Otherwise, ravb_tx_timeout_work() is possible to use the freed priv after ravb_remove() was called like b
Page 708 of 713