kernel

Vulnerabilities (15,762)

• CVE-2023-52564MedMar 2, 2024
  affected < 5.10.198fixed 5.10.198

  In the Linux kernel, the following vulnerability has been resolved: Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" This reverts commit 9b9c8195f3f0d74a826077fc1c01b9ee74907239. The commit above is reverted as it did not solve the original issue. gsm_cleanup_mux() tries to fr

• CVE-2023-52563MedMar 2, 2024
  affected < 5.15.134fixed 5.15.134

  In the Linux kernel, the following vulnerability has been resolved: drm/meson: fix memory leak on ->hpd_notify callback The EDID returned by drm_bridge_get_edid() needs to be freed.

• CVE-2023-52562MedMar 2, 2024
  affected >= 6.0.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: mm/slab_common: fix slab_caches list corruption after kmem_cache_destroy() After the commit in Fixes:, if a module that created a slab cache does not release all of its allocated objects before destroying the c

• CVE-2023-52561MedMar 2, 2024
  affected >= 5.3.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved Adding a reserved memory region for the framebuffer memory (the splash memory region set up by the bootloader). It fixes a kernel pan

• CVE-2023-52560MedMar 2, 2024
  affected >= 5.16.0, < 6.1.56fixed 6.1.56

  In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() When CONFIG_DAMON_VADDR_KUNIT_TEST=y and making CONFIG_DEBUG_KMEMLEAK=y and CONFIG_DEBUG_KMEMLEAK_AUTO_SCAN=y, the below memory leak i

• CVE-2023-52559MedMar 2, 2024
  affected >= 5.11.0, < 5.15.136fixed 5.15.136

  In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid memory allocation in iommu_suspend() The iommu_suspend() syscore suspend callback is invoked with IRQ disabled. Allocating memory with the GFP_KERNEL flag may re-enable IRQs during the suspend

• CVE-2023-52532MedMar 2, 2024
  affected >= 5.13.0, < 6.1.59fixed 6.1.59

  In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix TX CQE error handling For an unknown TX CQE error type (probably from a newer hardware), still free the SKB, update the queue tail, etc., otherwise the accounting will be wrong. Also, TX errors

• CVE-2023-52531HigMar 2, 2024
  affected >= 3.9.0, < 5.15.135fixed 5.15.135

  In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: Fix a memory corruption issue A few lines above, space is kzalloc()'ed for: sizeof(struct iwl_nvm_data) + sizeof(struct ieee80211_channel) + sizeof(struct ieee80211_rate) 'mvm->nvm_data'

• CVE-2023-52530HigMar 2, 2024
  affected >= 4.14.0, < 5.4.285fixed 5.4.285

  In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gtk_rekey_add() will

• CVE-2023-52529MedMar 2, 2024
  affected >= 5.14.0, < 5.15.135fixed 5.15.135

  In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occurs after a successful usb_alloc_urb() call, usb_free_urb() should be called.

• CVE-2023-52528MedMar 2, 2024
  affected >= 2.6.34, < 4.14.327fixed 4.14.327

  In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg syzbot reported the following uninit-value access issue: ===================================================== BUG: KMSAN: uninit-value in sms

• CVE-2023-52527MedMar 2, 2024
  affected >= 3.5.0, < 4.14.327fixed 4.14.327

  In the Linux kernel, the following vulnerability has been resolved: ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() Including the transhdrlen in length is a problem when the packet is partially filled (e.g. something like send(MSG_MORE) happened previously) wh

• CVE-2023-52526MedMar 2, 2024
  affected >= 6.1.0, < 6.1.57fixed 6.1.57

  In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled (`-Ededupe`), I found some short-lived temporary

• CVE-2023-52525HigMar 2, 2024
  affected >= 4.14.326, < 4.14.327fixed 4.14.327

  In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet Only skip the code path trying to access the rfc1042 headers when the buffer is too small, so the driver can still process packets without rfc

• CVE-2023-52524HigMar 2, 2024
  affected < 5.4.258fixed 5.4.258

  In the Linux kernel, the following vulnerability has been resolved: net: nfc: llcp: Add lock when modifying device list The device list needs its associated lock held when modifying it, or the list could become corrupted, as syzbot discovered.

• CVE-2023-52523HigMar 2, 2024
  affected >= 5.13.0, < 5.15.135fixed 5.15.135

  In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets With a SOCKMAP/SOCKHASH map and an sk_msg program user can steer messages sent from one TCP socket (s1) to actually egress from another TCP socket

• CVE-2023-52522HigMar 2, 2024
  affected >= 2.6.37, < 5.4.258fixed 5.4.258

  In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an RCU protected item

• CVE-2023-52520MedMar 2, 2024
  affected >= 5.14.0, < 5.15.136fixed 5.15.136

  In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Fix reference leak If a duplicate attribute is found using kset_find_obj(), a reference to that attribute is returned which needs to be disposed accordingly using kobject_put(). Move th

• CVE-2023-52519HigMar 2, 2024
  affected >= 5.12.0, < 5.15.135fixed 5.15.135

  In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit The EHL (Elkhart Lake) based platforms provide a OOB (Out of band) service, which allows to wakup device when the system is in S5 (Soft-Off state). Thi

• CVE-2023-52518MedMar 2, 2024
  affected >= 5.16.0, < 6.1.57fixed 6.1.57

  In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_codec: Fix leaking content of local_codecs The following memory leak can be observed when the controller supports codecs which are stored in local_codecs list but the elements are never freed: u