CVE-2025-68750 usb: potential integer overflow in usbg_make_tpg()

In the Linux kernel, the following vulnerability has been resolved: usb: potential integer overflow in usbgmaketpg The variable tpgt in usbgmaketpg is defined as unsigned long and is assigned to tpgt-tporttpgt, which is defined as u16. This may cause an integer overflow when tpgt is greater than...

EUVD-2023-60366

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx: Fix pollinterval handling and races on remove Before this patch bq27xxxbatteryteardown was setting pollinterval = 0 to avoid bq27xxxbatteryupdate requeuing the delayedwork item. There are 2 problems with...

EUVD-2023-60282

In the Linux kernel, the following vulnerability has been resolved: spmi: Add a check for remove callback when removing a SPMI driver When removing a SPMI driver, there can be a crash due to NULL pointer dereference if it does not have a remove callback defined. This is one such call trace observ...

EUVD-2022-55799

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Avoid UBSAN error on truesectorsperclst syzbot reported UBSAN error as below: 76.901829 T6677 ================================================================================ 76.903908 T6677 UBSAN: shift-out-of-bounds i...

CVE-2023-54137

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: fix capmigration information leak Fix an information leak where an uninitialized hole in struct vfioiommutype1infocapmigration on the stack is exposed to userspace. The definition of struct...

UBUNTU-CVE-2023-54122

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add check for cstate As kzalloc may fail and return NULL pointer, it should be better to check cstate in order to avoid the NULL pointer dereference in drmatomichelpercrtcreset. Patchwork:...

UBUNTU-CVE-2023-54126

In the Linux kernel, the following vulnerability has been resolved: crypto: safexcel - Cleanup ring IRQ workqueues on load failure A failure loading the safexcel driver results in the following warning on boot, because the IRQ affinity has not been correctly cleaned up. Ensure we clean up the...

UBUNTU-CVE-2023-54072

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential data race at PCM memory allocation helpers The PCM memory allocation helpers have a sanity check against too many buffer allocations. However, the check is performed without a proper lock and the allocati...

CVE-2023-54137 vfio/type1: fix cap_migration information leak

In the Linux kernel, the following vulnerability has been resolved: vfio/type1: fix capmigration information leak Fix an information leak where an uninitialized hole in struct vfioiommutype1infocapmigration on the stack is exposed to userspace. The definition of struct...

CVE-2023-54121 btrfs: fix incorrect splitting in btrfs_drop_extent_map_range

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix incorrect splitting in btrfsdropextentmaprange In production we were seeing a variety of WARNON's in the extentmap code, specifically in btrfsdropextentmaprange when we have to call addextentmapping for our second spli...

CVE-2023-54084

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-digi00x: prevent potential use after free This code was supposed to return an error code if initstream failed, but it instead freed dg00x-rxstream and returned success. This potentially leads to a use after free...

CVE-2023-54060 iommufd: Set end correctly when doing batch carry

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set end correctly when doing batch carry Even though the test suite covers this it somehow became obscured that this wasn't working. The test iommufdioas.mockdomain.accessdomaindestory would blow up rarely. end should be...

CVE-2023-54040

CVE-2023-54040 : Linux kernel issue in the ice driver where faulty FDIR fallback logic can cause memory leaks or inconsistent state. If ice_vc_fdir_set_irq_ctx fails, the fdir entry might not be removed; if ice_vc_fdir_write_fltr fails, fdir IRQ context data may not be cleared. Patches refine fai...

CVE-2023-54001 staging: r8712: Fix memory leak in _r8712_init_xmit_priv()

In the Linux kernel, the following vulnerability has been resolved: staging: r8712: Fix memory leak in r8712initxmitpriv In the above mentioned routine, memory is allocated in several places. If the first succeeds and a later one fails, the routine will leak memory. This patch fixes commit...

CVE-2023-54001 staging: r8712: Fix memory leak in _r8712_init_xmit_priv()

In the Linux kernel, the following vulnerability has been resolved: staging: r8712: Fix memory leak in r8712initxmitpriv In the above mentioned routine, memory is allocated in several places. If the first succeeds and a later one fails, the routine will leak memory. This patch fixes commit...

CVE-2023-53991 drm/msm/dpu: Disallow unallocated resources to be returned

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Disallow unallocated resources to be returned In the event that the topology requests resources that have not been created by the system because they are typically not represented in dpumdsscfg ^1, the resources in...

CVE-2023-53989 arm64: mm: fix VA-range sanity check

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both createmappingnoalloc and updatemappingprot sanity-check their 'virt' parameter, but the check itself doesn't make much sense. The condition used today appears to be a historical accident...

CVE-2023-53988

Summary (CVE-2023-53988): The Linux kernel ntfs3 driver fixes a slab-out-of-bounds read in hdr_delete_de(). The bug is triggered when processing the INDEX_HDR in fs/ntfs3, where the index header validity check was missing, allowing potential out-of-bounds access if the metadata is corrupted or ma...

CVE-2023-53867 ceph: fix potential use-after-free bug when trimming caps

In the Linux kernel, the following vulnerability has been resolved: ceph: fix potential use-after-free bug when trimming caps When trimming the caps and just after the 'session-scaplock' is released in cephiteratesessioncaps the cap maybe removed by another thread, and when using the stale cap...

CVE-2022-50709 wifi: ath9k: avoid uninit memory read in ath9k_htc_rx_msg()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: avoid uninit memory read in ath9khtcrxmsg syzbot is reporting uninit value at ath9khtcrxmsg 1, for ioctlUSBRAWIOCTLEPWRITE can call ath9khifusbrxstream with pktlen = 0 but ath9khifusbrxstream uses devallocskbpktlen +...