kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free

A use-after-free vulnerability was found in the Linux kernel Intel i915 graphics driver's GuC virtual engine request handling. A local user with access to GPU rendering can create requests on GuC virtual engines and trap references via syncfile or dmabuf, causing fence release operations to acces...

SUSE CVE-2025-71162

In the Linux kernel, the following vulnerability has been resolved: dmaengine: tegra-adma: Fix use-after-free A use-after-free bug exists in the Tegra ADMA driver when audio streams are terminated, particularly during XRUN conditions. The issue occurs when the DMA buffer is freed by...

kernel: drm/i915: mark requests for GuC virtual engines to avoid use-after-free

A use-after-free vulnerability was found in the Linux kernel Intel i915 graphics driver's GuC virtual engine request handling. A local user with access to GPU rendering can create requests on GuC virtual engines and trap references via syncfile or dmabuf, causing fence release operations to acces...

ROS-20260119-7382

A vulnerability in the omapinitlcddma function of the lcddma.c component of the Linux kernel is related to buffer copying without input validation. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004442)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004442 advisory. In iondmabufendcpuaccess and related functions of ion.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of...

Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-004149)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004149 advisory. A memory leak in the fastrpcdmabufattach function in drivers/misc/fastrpc.c in the Linux kernel before 5.3.9 allows attackers to cause a denial of service memory...

CVE-2019-2345

Race condition while accessing DMA buffer in jpeg driver in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 712 / SD 710...

CVE-2023-54231

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix memory leak in wxsetuprxresources When wxallocpagepool failed in wxsetuprxresources, it doesn't release DMA buffer. Add dmafreecoherent in the error path to release the DMA buffer...

CVE-2023-54231

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix memory leak in wxsetuprxresources When wxallocpagepool failed in wxsetuprxresources, it doesn't release DMA buffer. Add dmafreecoherent in the error path to release the DMA buffer...

UBUNTU-CVE-2023-54231

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix memory leak in wxsetuprxresources When wxallocpagepool failed in wxsetuprxresources, it doesn't release DMA buffer. Add dmafreecoherent in the error path to release the DMA buffer...

CVE-2022-50819

In the Linux kernel, the following vulnerability has been resolved: udmabuf: Set ubuf-sg = NULL if the creation of sg table fails When userspace tries to map the dmabuf and if for some reason e.g. OOM the creation of the sg table fails, ubuf-sg needs to be set to NULL. Otherwise, when the userspa...

CVE-2023-54231

CVE-2023-54231 affects the Linux kernel component handling the libwx RX path. The vulnerability arises in wx_setup_rx_resources: if wx_alloc_page_pool() fails, the code path does not release the allocated DMA buffer, causing a memory leak. The fix adds a dma_free_coherent() call in the error path...

CVE-2023-54231 net: libwx: fix memory leak in wx_setup_rx_resources

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix memory leak in wxsetuprxresources When wxallocpagepool failed in wxsetuprxresources, it doesn't release DMA buffer. Add dmafreecoherent in the error path to release the DMA buffer...

CVE-2022-50819 udmabuf: Set ubuf->sg = NULL if the creation of sg table fails

In the Linux kernel, the following vulnerability has been resolved: udmabuf: Set ubuf-sg = NULL if the creation of sg table fails When userspace tries to map the dmabuf and if for some reason e.g. OOM the creation of the sg table fails, ubuf-sg needs to be set to NULL. Otherwise, when the userspa...

SUSE CVE-2022-50700

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has...

SUSE CVE-2023-54136

In the Linux kernel, the following vulnerability has been resolved: serial: sprd: Fix DMA buffer leak issue Release DMA buffer when probe returns failure to avoid memory leak...

UBUNTU-CVE-2023-54136

In the Linux kernel, the following vulnerability has been resolved: serial: sprd: Fix DMA buffer leak issue Release DMA buffer when probe returns failure to avoid memory leak...

CVE-2023-54136

CVE-2023-54136 concerns a memory leak in the Linux kernel’s serial driver for sprd when _probe() returns failure. The fix releases the DMA buffer to avoid leaks. Connected Astra Linux entry confirms the same vulnerability and the fix across kernel lines (linux-5.10, linux-5.15, linux-6.1). The im...

CVE-2022-50700

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has...

CVE-2022-50700 wifi: ath10k: Delay the unmapping of the buffer

In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: Delay the unmapping of the buffer On WCN3990, we are seeing a rare scenario where copy engine hardware is sending a copy complete interrupt to the host driver while still processing the buffer that the driver has...