4583 matches found
kernel: RDMA/rxe: Fix mr->map double free
A double-free vulnerability was found in the Linux kernel RDMA RXE soft-RoCE driver's memory region handling. A local user with access to RDMA userspace verbs can register a memory region with parameters that cause initialization to fail, triggering error handling code that frees the mr-map...
kernel: wifi: ath11k: fix monitor mode bringup crash
A null pointer dereference vulnerability was found in the ath11k wireless driver in the Linux kernel. When an interface is brought up in monitor mode, the driver attempts to extract packet type from RAW monitor ring packets, which lack the expected structure. This causes a kernel crash due to...
kernel: net/sched: flower: fix filter idr initialization
A flaw was found in the Linux kernel’s networking traffic control flower classifier. The initialization of the filter IDR was moved too early in the flchange path, allowing concurrent access by multiple users while the structure was still in an inconsistent state. Under certain conditions, this...
kernel: dm flakey: fix a crash with invalid table line
A flaw was identified in the device-mapper “dm flakey” target in the Linux kernel where invalid table line input can lead to a NULL pointer dereference. Specifically, when dmsetup is used with a malformed table line such as with the corruptbiobyte target and the argname pointer is NULL, the kerne...
kernel: udmabuf: Set ubuf->sg = NULL if the creation of sg table fails
A flaw was found in the Linux kernel’s udmabuf subsystem where the scatter-gather sg pointer was not properly set to NULL if creation of the sg table failed. If userspace attempts to map a dmabuf and the sg table allocation fails e.g., due to memory exhaustion, the kernel later attempts to free a...
kernel: drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback
A function prototype mismatch was found in the AMD GPU driver's DPM table callbacks. When kCFI Control Flow Integrity is enabled, the mismatched types cause CFI validation failures, potentially crashing the kernel...
kernel: drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe
A NULL pointer dereference was found in the IT6505 DisplayPort bridge driver. If an HPD interrupt fires before the DRM bridge registration completes, the driver attempts to access an uninitialized AUX channel, causing a kernel crash...
kernel: wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write backtrace
A vulnerability was discovered in the Intel wireless iwlwifi driver in the Linux kernel that could lead to a buffer overflow in the Driver Virtualization Module key handling code. When processing a received TKIP key that includes MIC rx/tx components, the driver did not adequately limit the amoun...
Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c
A use-after-free flaw was found in nfsd4sscsetupdul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem...
kernel: Use after free bug in r592_remove
A use-after-free flaw was found in r592remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This issue may allow a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak...
kernel: ASoC: SOF: avoid a NULL dereference with unsupported widgets
A NULL pointer dereference was found in the Sound Open Firmware SOF driver. When a topology contains an unsupported widget type, the moduleinfo field is NULL, and dereferencing it during route setup crashes the kernel...
kernel: RDMA/core: Make sure "ib_port" is valid when access sysfs node
A NULL pointer dereference flaw was found in the Linux kernel RDMA core's sysfs handling. A local user with access to InfiniBand sysfs nodes can read sysfs attributes while an InfiniBand port is being removed, causing the kernel to dereference a NULL ibport pointer when the port structure has bee...
kernel: Kernel: NULL pointer dereference in Intel GVT-g debugfs during device removal
A flaw was found in the Linux kernel's Intel GVT-g Graphics Virtualization Technology debugfs component. When a device is removed through unbinding, the intelgvtdebugfsclean function may attempt to access a debugfs root that has already been deallocated, leading to a NULL pointer dereference. A...
kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters
A bounds-checking error was found in the Linux kernel Intel i915 graphics driver's performance monitoring subsystem. A local user with access to Intel GPU performance counters can trigger address validation for observability architecture counters on Xe-HP and newer hardware, causing the driver to...
kernel: dmaengine: ptdma: check for null desc before calling pt_cmd_callback
AMD PTDMA Pass-Through DMA engine crashes the kernel when ptissuepending encounters empty descriptor queues. The function blindly invokes ptcmdcallback without verifying that a valid descriptor exists, triggering a NULL pointer dereference. This commonly surfaces during system shutdown on AMD...
kernel: scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix possible resource leaks in mpt3sastransportportadd In mpt3sastransportportadd, if sasrphyadd returns error, sasrphyfree needs be called to free the resource allocated in sasenddevicealloc. Otherwise a kernel...
PT-2025-18878 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A kernel crash can occur during reboot when an adapter is in recovery mode. This issue arises because the i40e init recovery mode function is called when the driver detects firmware in...
PT-2025-18843 · Linux +3 · Linux Kernel +3
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A vulnerability in the Linux kernel has been resolved, related to the net/mlx5 module. The issue occurs when the vport's mc, uc, and multicast rules are not deleted in the teardown pat...
PT-2025-18556 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.1.0-rc1+ 174 Description: A vulnerability in the Linux kernel has been resolved, specifically in the scsi transport sas module. The issue occurs when transport add device fails in sas phy add, causing the kern...
PT-2023-9711 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a racing condition between the ufshcd mcq abort function and the Interrupt Service Routine ISR in the Linux kernel's UFS Universal Flash Storage component. When...