DEBIAN-CVE-2022-50627

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix monitor mode bringup crash When the interface is brought up in monitor mode, it leads to NULL pointer dereference crash. This crash happens when the packet type is extracted for a SKB. This extraction which is...

DEBIAN-CVE-2022-50614

In the Linux kernel, the following vulnerability has been resolved: misc: pciendpointtest: Fix pciendpointtestcopy,write,read panic The dmamapsingle doesn't permit zero length mapping. It causes a follow panic. A panic was reported on arm64: 60.137988 ------------ cut here ------------ 60.142630...

UBUNTU-CVE-2023-53742

In the Linux kernel, the following vulnerability has been resolved: kcsan: Avoid READONCE in readinstrumentedmemory Haibo Li reported: | Unable to handle kernel paging request at virtual address | ffffff802a0d8d7171 | Mem abort info:o: | ESR = 0x9600002121 | EC = 0x25: DABT current EL, IL = 32...

UBUNTU-CVE-2022-50622

In the Linux kernel, the following vulnerability has been resolved: ext4: fix potential memory leak in ext4fcrecordmodifiedinode As krealloc may return NULL, in this case 'state-fcmodifiedinodes' may not be freed by krealloc, but 'state-fcmodifiedinodes' already set NULL. Then will lead to...

CVE-2023-53768

In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Fix out-of-bounds access when allocating config buffers When allocating the 2D array for handling IRQ type registers in regmapaddirqchipfwnode, the intent is to allocate a matrix with numconfigbases rows and...

CVE-2023-53767 wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kqmidrivereventwork Currently the buffer pointed by event is not freed in case ATH12KFLAGUNREGISTERING bit is set, this causes memory leak. Add a goto skip instead of return, to ensure event...

CVE-2023-53762 Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix UAF in hcidisconnectallsync Use-after-free can occur in hcidisconnectallsync if a connection is deleted by concurrent processing of a controller event. To prevent this the code now tries to iterate over th...

CVE-2023-53761 USB: usbtmc: Fix direction for 0-length ioctl control messages

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver does not check that the direction is...

CVE-2023-53760 scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: mcq: Fix &hwq-cqlock deadlock issue When ufshcderrhandler is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcdhandlemcqcqevents and also in ufsmtkmcqintr. The following...

CVE-2023-53757

The CVE-2023-53757 issue is a Linux kernel vulnerability in irqchip/irq-mvebu-gicp where a refcount leak occurred: of_irq_find_parent() returns a node pointer with an incremented refcount and missing of_node_put() could leak refs if the pointer is not released. A fix was applied to add of_node_pu...

CVE-2023-53751

CVE-2023-53751 affects the Linux kernel CIFS subsystem, specifically TCP_Server_Info::hostname. The vulnerability arises because hostname may be updated during reconnect, and access needs to be protected outside the reconnect path, preventing potential use-after-free bugs. Impact is described as ...

CVE-2023-53743 PCI: Free released resource after coalescing

In the Linux kernel, the following vulnerability has been resolved: PCI: Free released resource after coalescing releaseresource doesn't actually free the resource or resource list entry so free the resource list entry to avoid a leak...

CVE-2022-50629 wifi: rsi: Fix memory leak in rsi_coex_attach()

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: Fix memory leak in rsicoexattach The coexcb needs to be freed when rsicreatekthread failed in rsicoexattach...

CVE-2022-50626

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: fix memory leak in dvbusbadapterinit Syzbot reports a memory leak in "dvbusbadapterinit". The leak is due to not accounting for and freeing current iteration's adapter-priv in case of an error. Currently if an err...

CVE-2022-50617 drm/amdgpu/powerplay/psm: Fix memory leak in power state init

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/powerplay/psm: Fix memory leak in power state init Commit 902bc65de0b3 "drm/amdgpu/powerplay/psm: return an error in power state init" made the power state init function return early in case of failure to get an entry...

CVE-2022-50615

CVE-2022-50615 affects the Linux kernel’s perf/x86/intel/uncore code. The root cause is a reference-count leak in snr_uncore_mmio_map() where pci_get_device() increases the pci_dev reference count and snr_uncore_get_mc_dev() returns a pci_dev with an extra reference. The fix is to call pci_dev_pu...

CVE-2022-50615 perf/x86/intel/uncore: Fix reference count leak in snr_uncore_mmio_map()

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix reference count leak in snruncoremmiomap pcigetdevice will increase the reference count for the returned pcidev, so snruncoregetmcdev will return a pcidev with its reference count increased. We need to...

DEBIAN-CVE-2025-40315

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix epfile null pointer access after ep enable. A race condition occurs when ffsfuncepsenable runs concurrently with ffsdatareset. The ffsdataclear called in ffsdatareset sets ffs-epfiles to NULL before resettin...

DEBIAN-CVE-2025-40301

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: validate skb length for unknown CC opcode In hcicmdcompleteevt, if the command complete event has an unknown opcode, we assume the first byte of the remaining skb-data contains the return status. However,...

UBUNTU-CVE-2025-40319

In the Linux kernel, the following vulnerability has been resolved: bpf: Sync pending IRQ work before freeing ring buffer Fix a race where irqwork can be queued in bpfringbufcommit but the ring buffer is freed before the work executes. In the syzbot reproducer, a BPF program attached to schedswit...