CVE-2023-54084 ALSA: firewire-digi00x: prevent potential use after free

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-digi00x: prevent potential use after free This code was supposed to return an error code if initstream failed, but it instead freed dg00x-rxstream and returned success. This potentially leads to a use after free...

CVE-2023-54083 phy: tegra: xusb: Clear the driver reference in usb-phy dev

In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Clear the driver reference in usb-phy dev For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy. When we try to destroy the port dev, it will...

CVE-2023-54079

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx: Fix pollinterval handling and races on remove Before this patch bq27xxxbatteryteardown was setting pollinterval = 0 to avoid bq27xxxbatteryupdate requeuing the delayedwork item. There are 2 problems with...

CVE-2022-50782 ext4: fix bug_on in __es_tree_search caused by bad quota inode

In the Linux kernel, the following vulnerability has been resolved: ext4: fix bugon in estreesearch caused by bad quota inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extentsstatus.c:202! invalid opcode: 0000 1 PREEMPT SMP...

CVE-2022-50775

CVE-2022-50775 pertains to the Linux kernel RDMA/hns subsystem. The vulnerability arises from a refcount leak in hns_roce_mmap where rdma_user_mmap_entry_get_pgoff() takes a reference but rdma_user_mmap_entry_put() to release it was missing. The fix adds the missing release call to properly drop ...

CVE-2022-50773

CVE-2022-50773 is a Linux kernel vulnerability affecting ALSA mts64 where a null pointer defer can occur in snd_mts64_interrupt if mts64 is not initialized at interrupt time. The provided exploit trace shows a kernel NULL dereference and a subsequent reboot in an environment testing with CONFIG_P...

CVE-2022-50773

In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: fix possible null-ptr-defer in sndmts64interrupt I got a null-ptr-defer error report when I do the following tests on the qemu platform: make defconfig and CONFIGPARPORT=m, CONFIGPARPORTPC=m, CONFIGSNDMTS64=m Then...

CVE-2022-50771

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following splat: BUG: using thiscpuread in...

CVE-2022-50766 btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer

In the Linux kernel, the following vulnerability has been resolved: btrfs: set generation before calling btrfscleantreeblock in btrfsinitnewbuffer syzbot is reporting uninit-value in btrfscleantreeblock 1, for commit bc877d285ca3dba2 "btrfs: Deduplicate extentbuffer init code" missed that...

CVE-2022-50764 ipv6/sit: use DEV_STATS_INC() to avoid data-races

In the Linux kernel, the following vulnerability has been resolved: ipv6/sit: use DEVSTATSINC to avoid data-races syzbot/KCSAN reported that multiple cpus are updating dev-stats.txerror concurrently. This is because sit tunnels are NETIFFLLTX, meaning their ndostartxmit is not protected by a...

CVE-2022-50747

CVE-2022-50747 is a Linux kernel issue in the HFS file system code. The vulnerability stems from an out-of-bounds write in hfs_asc2mac() inside fs/hfs/trans.c when converting filenames, where an oversized input len can drive writes beyond the destination when the destination buffer boundary is re...

CVE-2022-50746 erofs: validate the extent length for uncompressed pclusters

In the Linux kernel, the following vulnerability has been resolved: erofs: validate the extent length for uncompressed pclusters syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed image actually has two issues: - mpa == 0 ...

CVE-2022-50740

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: fix memory leak of urbs in ath9khifusbdealloctxurbs Syzkaller reports a long-known leak of urbs in ath9khifusbdealloctxurbs. The cause of the leak is that usbgeturb is called but usbfreeurb or usbputurb is no...

CVE-2023-54068

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to call f2fswaitonpagewriteback in f2fswriterawpages BUGON will be triggered when writing files concurrently, because the same page is writtenback multiple times. 1597 void folioendwritebackstruct folio folio...

CVE-2023-54065

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: fix out-of-bounds access The probe function sets priv-chipdata to void priv + sizeofpriv with the expectation that priv has enough trailing space. However, only realtek-smi actually allocated this chipdata spac...

CVE-2023-54051

In the Linux kernel, the following vulnerability has been resolved: net: do not allow gsosize to be set to GSOBYFRAGS One missing check in virtionethdrtoskb allowed syzbot to crash kernels again 1 Do not allow gsosize to be set to GSOBYFRAGS 0xffff, because this magic value is used by the kernel....

CVE-2023-54050

In the Linux kernel, the following vulnerability has been resolved: ubifs: Fix memleak when insertoldidx failed Following process will cause a memleak for copied up znode: dirtycowznode zn = copyznodec, znode; err = insertoldidxc, zbr-lnum, zbr-offs; if unlikelyerr return ERRPTRerr; // No one...

CVE-2023-54046

In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Handle EBUSY correctly As it is essiv only handles the special return value of EINPROGERSS, which means that in all other cases it will free data related to the request. However, as the caller of essiv may specify...

CVE-2023-54043 iommufd: Do not add the same hwpt to the ioas->hwpt_list twice

In the Linux kernel, the following vulnerability has been resolved: iommufd: Do not add the same hwpt to the ioas-hwptlist twice The hwpt is added to the hwptlist only during its creation, it is never added again. This hunk is some missed leftover from rework. Adding it twice will corrupt the...

CVE-2022-50735

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: do not run mt76ustatusworker if the device is not running Fix the following NULL pointer dereference avoiding to run mt76ustatusworker thread if the device is not running yet. KASAN: null-ptr-deref in range...