CVE Database

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump() When CONFIG_DEV_COREDUMP=n, hci_devcd_append() returns -EOPNOTSUPP without freeing its …

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel In send_cancel(), pending mesh_tx objects are removed …

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xsk_map_gen_lookup xsk_map_gen_lookup() loads a u32 key and compares it …

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an …

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_u32: fix manual hash table handle IDR aliasing A u32 hash table created with …

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After do_check() returns, the verifier runs several instruction rewrite …

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe() regsafe() maps packet pointer IDs between states …

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. …

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HW_DEAD after worker is done flow_offload_work_del() sets NF_FLOW_HW_DEAD before the work handler …

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier We must serialize the release notifier and …

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update If list_for_each_entry() exits without hitting a …

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure flow_offload_alloc() returns NULL when the conntrack entry …

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and …

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure If register_netdev() fails for one …

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnl_lock for the ioctl self test An offline self test that brings …

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx …

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue …

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset num_napi when the napi vectors are freed fbn->num_napi is the count of …

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox When tearing down the FW …

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctp_assoc_update_retran_path() can loop forever when every remaining transport, …

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other …

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catc_rx_done() catc_rx_done() walks a multi-packet URB, …

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpf_crypto_ctx_create() is a kfunc whose second argument …

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget hfsc_classify() applies the "filter …

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drm_gem_handle_create() fails virtio_gpu_gem_create() owns the reference taken by virtio_gpu_object_create(). On …

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl() virtio_gpu_resource_create_ioctl() calls drm_gem_object_release() on the drm_gem_handle_create() error path instead …

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl() virtio_gpu_resource_create_blob_ioctl() calls drm_gem_object_release() on both the virtio_gpu_resource_assign_uuid() and drm_gem_handle_create() …

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtio_gpu_vram_create() errors virtio_gpu_vram_create() frees the object with a bare …

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was …

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpn_bind is published through peer->bind with RCU, …

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind->local in …

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds …

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel_pcie: validate device-supplied DMA indices In btintel_pcie_msix_rx_handle(), the driver processes RX completion descriptors (urbd1) …

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame() While rfcomm_recv_frame() verifies that skb->len is at …

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() bpf_get_spi() computes (-off - 1) / BPF_REG_SIZE using C …

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6_insert_exception() for dying fib6_info. Before the cited commit, fib6_nh_flush_exceptions() always set from->exception_bucket_flushed = …

In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the …

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6_route_output_flags(), ip6_rt_put_flags(), and ip6_dst_check() detect an uncached route …

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to …

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3_get_invariants() can register an MDIO bus and …

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debug_info_copy() When debug_register_static() fails, it clears areas, active_pages and …

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emac_tx_mem_map() writes TX_DESC_0_OWN into the ring …

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skb_pointer_if_linear() function checks whether a memory region …

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_sock context code generation Currently, the ctx access code reads the rx_queue_mapping field …

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTR_TO_PACKET registers' …

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc sock_map_alloc() only rejects max_entries == 0 and …

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for iso_resource_auto client resource The todo member of iso_resource_auto structure represents …

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before mod_timer() in timer handlers Take the association or transport …

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes roundup_pow_of_two() is undefined for zero. ethtool permits a …

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in em_text_dump() em_text_dump() allocates struct tcf_em_text on the stack without …