kernel: Linux kernel lockd: Denial of Service via uninitialized file lock field in NFSv3

A flaw was found in the Linux kernel's lockd component, which handles file locking. A local user could exploit this vulnerability by interacting with re-exported NFSv3 Network File System version 3 shares. This could cause the kernel to crash, leading to a Denial of Service DoS for the system...

kernel: dm thin: Use last transaction's pmd->root when commit failed

A metadata handling flaw was found in the Linux kernel device-mapper thin provisioning driver. After a failed metadata commit, the in-memory root pointer could reference a mixed set of fresh and stale tree nodes. Subsequent lookups may loop or stall. A local user could use this flaw to cause the...

kernel: Linux kernel ALSA mts64 module: Denial of Service via null pointer dereference

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture mts64 module. A local user can trigger a null pointer dereference in the sndmts64interrupt function by repeatedly loading and unloading the snd-mts64 module. This can lead to a kernel panic, resulting in a Denial of...

kernel: Bluetooth: use hdev->workqueue when queuing hdev->{cmd,ncmd}_timer works

n the Linux kernel’s Bluetooth subsystem there is a flaw in the way Bluetooth HCI work items are queued. Under certain conditions, work associated with command timeouts hdev-cmd,ncmdtimer could be scheduled on the wrong workqueue while the intended workqueue is being drained. This occurs because...

kernel: lockdown bypass using IMA

An authentication bypass flaw was found in the Linux kernel’s IMA policy when a user performs lockdown. This flaw allows a local user to crash or potentially escalate their privileges on the system...

kernel: Recursive locking violation in usb-storage that can cause the kernel to deadlock

An incorrect access control flaw was found in the Linux kernel USB core subsystem. When attaching a malicious usb device, the recursive locking violation in usb-storage can cause the kernel to deadlock. This issue could allow a local user to crash the system...

kernel: Linux kernel (TIPC): Information disclosure via uninitialized memory in tipc_topsrv_kern_subscr

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC protocol. This vulnerability allows a local user to disclose sensitive information due to four uninitialized bytes in the sub.usrhandle field within the tipctopsrvkernsubscr function. When a user issues a setsocko...

QEMU: local privilege escalation via the QEMU Guest Agent on Windows

A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system...

kernel: USB-accessible buffer overflow in brcmfmac

A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can allow a local user to crash the system or escalate their privileges...

kernel: memory corruption in usbmon driver

An out-of-bounds memory write flaw in the Linux kernel’s USB Monitor component was found in how a user with access to the /dev/usbmon can trigger it by an incorrect write to the memory of the usbmon. This flaw allows a local user to crash or potentially escalate their privileges on the system...

kernel: memory leak in l2cap_recv_acldata of the file net/bluetooth/l2cap_core.c

A memory leak flaw was found in the Linux kernel’s L2CAP bluetooth functionality. This issue occurs when a user generates malicious packets, triggering the l2caprecvacldata function. This flaw allows a local or bluetooth connection user to potentially crash the system...

kernel: Double-free in split_2MB_gtt_entry when function intel_gvt_dma_map_guest_page failed

A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intelgvtdmamapguestpage function. This issue could allow a local user to crash the system...

kernel: possible race condition in drivers/tty/tty_buffers.c

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem. The issue occurs in how a user triggers a race condition using ioctls TIOCSPTLCK and TIOCGPTPEER and TIOCSTI and TCXONC with leakage of memory in the flushtoldisc function. This flaw allows a local user to crash the...

kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c

A double-free flaw was found in the Linux kernel's USB2CAN interface implementation. This issue could allow a local user to crash the system...

kernel: network backend may cause Linux netfront to use freed SKBs (XSA-405)

An incomplete cleanup flaw was found in the Linux kernel’s Xen networking XDP eXpress Data Path subsystem. This flaw allows a local user to crash the system...

kernel: mptcp: NULL pointer dereference in subflow traversal at disconnect time

A NULL pointer dereference issue was discovered in the Linux kernel. This issue occurs in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could potentially crash the system, causing a denial of service...

kernel: lockdown bypass using IMA

An authentication bypass flaw was found in the Linux kernel’s IMA policy when a user performs lockdown. This flaw allows a local user to crash or potentially escalate their privileges on the system...

kernel: malicious data for FBIOPUT_VSCREENINFO ioctl may cause OOB write memory

An out-of-bounds write flaw was found in the Linux kernel’s framebuffer-based console driver functionality in the way a user triggers ioctl FBIOPUTVSCREENINFO with malicious data. This flaw allows a local user to crash or potentially escalate their privileges on the system...

AZL-26689 CVE-2023-2513 affecting package kernel for versions less than 5.15.112.1-1

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...

UBUNTU-CVE-2023-2513

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw could allow a privileged local user to cause a system crash or other undefined behaviors...