CVE-2023-53490 mptcp: fix disconnect vs accept race

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix disconnect vs accept race Despite commit 0ad529d9fd2b "mptcp: fix possible divide by zero in recvmsg", the mptcp protocol is still prone to a race between disconnect or shutdown and accept. The root cause is that the...

CVE-2023-53489

CVE-2023-53489 affects the Linux kernel memory handling for UDP sockets with TX timestamps and zerocopy skbs. The issue is a memory leak: clones of skbs and their ubuf references can keep a socket refcnt and skb references in the error/clock path, causing leaked sk, sock and skb when close() is c...

CVE-2022-50467 scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFT_ID

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix null ndlp ptr dereference in abnormal exit path for GFTID An error case exit from lpfccmplctcmdgftid results in a call to lpfcnlpput with a null pointer to a nodelist structure. Changed lpfccmplctcmdgftid to...

CVE-2022-50459 scsi: iscsi: iscsi_tcp: Fix null-ptr-deref while calling getpeername()

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: iscsitcp: Fix null-ptr-deref while calling getpeername Fix a NULL pointer crash that occurs when we are freeing the socket at the same time we access it via sysfs. The problem is that: 1. iscsiswtcpconngetparam and...

CVE-2022-50451

CVE-2022-50451 involves a memory leak in the Linux kernel’s ntfs3 module, specifically in the ntfs_fill_super() error path. The provided documents consistently describe a bug where an unreferenced kmemleak object is leaked during mounting, traced to the error handling path of ntfs_fill_super(). T...

CVE-2022-50449 clk: samsung: Fix memory leak in _samsung_clk_register_pll()

In the Linux kernel, the following vulnerability has been resolved: clk: samsung: Fix memory leak in samsungclkregisterpll If clkregister fails, @pll-ratetable may have allocated memory by kmemdup, so it needs to be freed, otherwise will cause memory leak issue, this patch fixes it...

CVE-2022-50446 ARC: mm: fix leakage of memory allocated for PTE

In the Linux kernel, the following vulnerability has been resolved: ARC: mm: fix leakage of memory allocated for PTE Since commit d9820ff "ARC: mm: switch pgtablet back to struct page " a memory leakage problem occurs. Memory allocated for page table entries not released during process terminatio...

CVE-2022-50446 ARC: mm: fix leakage of memory allocated for PTE

In the Linux kernel, the following vulnerability has been resolved: ARC: mm: fix leakage of memory allocated for PTE Since commit d9820ff "ARC: mm: switch pgtablet back to struct page " a memory leakage problem occurs. Memory allocated for page table entries not released during process terminatio...

CVE-2023-53482 iommu: Fix error unwind in iommu_group_alloc()

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix error unwind in iommugroupalloc If either iommugroupgratefile fails then the iommugroup is leaked. Destroy it on these error paths. Found by kselftest/iommu/iommufdfailnth...

CVE-2023-53476

CVE-2023-53476 affects the Linux kernel’s RDMA/cxgb4 code path (c4iw_fill_res_cm_id_entry). The issue arises when epcp is re-assigned; re-testing epcp->state == LISTEN after reassignment can dereference NULL listen_ep or ep, leading to a NULL pointer dereference. The vulnerability is triggered...

CVE-2023-53475 usb: xhci: tegra: fix sleep in atomic call

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: tegra: fix sleep in atomic call When we set the dual-role port to Host mode, we observed the following splat: 167.057718 BUG: sleeping function called from invalid context at include/linux/sched/mm.h:229 167.057872...

CVE-2023-53468

Summary of CVE-2023-53468 : In the Linux kernel, the ubifs memory leak is fixed in the alloc_wbufs() path. The issue was triggered when ubifs_wbuf_init() returns an error inside the loop, causing wbuf->buf and wbuf->inodes that were already allocated to remain unfreed. The fix adds an error...

CVE-2023-53468 ubifs: Fix memory leak in alloc_wbufs()

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memory leak in allocwbufs kmemleak reported a sequence of memory leaks, and show them as following: unreferenced object 0xffff8881575f8400 size 1024: comm "mount", pid 19625, jiffies 4297119604 age 20.383s hex dump fir...

CVE-2023-53465 soundwire: qcom: fix storing port config out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: soundwire: qcom: fix storing port config out-of-bounds The 'qcomswrmctrl-pconfig' has size of QCOMSDWMAXPORTS 14, however we index it starting from 1, not 0, to match real port numbers. This can lead to writing port config past...

CVE-2023-53466

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix memory leak in mt7915mcuexit Always purge mcu skb queues in mt7915mcuexit routine even if mt7915firmwarestate fails...

CVE-2023-53462 hsr: Fix uninit-value access in fill_frame_info()

In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in fillframeinfo Syzbot reports the following uninit-value access problem. ===================================================== BUG: KMSAN: uninit-value in fillframeinfo net/hsr/hsrforward.c:601 inli...

CVE-2023-53455

CVE-2023-53455 concerns the Linux kernel DRM vc4 deadlock: vc4_hdmi_reset_link() returning -EDEADLK may deadlock in the locking context. The accepted fix is to drop held locks and back off using drm_modeset_backoff(), per the cited kernel DRM-KMS guidance. The vulnerability entry provides example...

CVE-2023-53454 HID: multitouch: Correct devm device reference for hidinput input_dev name

In the Linux kernel, the following vulnerability has been resolved: HID: multitouch: Correct devm device reference for hidinput inputdev name Reference the HID device rather than the input device for the devm allocation of the inputdev name. Referencing the inputdev would lead to a use-after-free...

CVE-2023-53452 wifi: rtw89: fix potential race condition between napi_init and napi_enable

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: fix potential race condition between napiinit and napienable A race condition can happen if netdev is registered, but NAPI isn't initialized yet, and meanwhile user space starts the netdev that will enable NAPI. Then...

CVE-2022-50444 clk: tegra20: Fix refcount leak in tegra20_clock_init

In the Linux kernel, the following vulnerability has been resolved: clk: tegra20: Fix refcount leak in tegra20clockinit offindmatchingnode returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...