libX11: stack exhaustion from infinite recursion in PutSubImage()

A vulnerability was found in libX11 due to an infinite loop within the PutSubImage function. This flaw allows a local user to consume all available system resources and cause a denial of service condition...

libX11: integer overflow in XCreateImage() leading to a heap overflow

A vulnerability was found in libX11 due to an integer overflow within the XCreateImage function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges...

kernel: Linux kernel (ext4): Denial of Service due to inode leak via failed extended attribute creation

A flaw was found in the Linux kernel's ext4 filesystem. A local user can exploit this vulnerability by performing a setxattr operation with an injected fault, specifically when ext4markinodedirty fails within the ext4xattrinodecreate function. This can lead to an inode leak, resulting in filesyst...

kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl

A NULL pointer dereference flaw was found in the Linux kernel’s Bluetooth HCI UART driver. This flaw allows a local user to crash the system...

kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

A use-after-free flaw was found in vcsread in drivers/tty/vt/vcscreen.c in vcscreen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information...

kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write

An out-of-bounds memory write flaw was found in the load/unload module in the Linux kernel's kobject functionality, potentially triggering a race condition in the kobjectgetpath function. This issue may allow a local user to crash the system or potentially escalate their privileges on the system...

kernel: Linux kernel: Denial of Service in RDMA/bnxt_re driver due to race condition during QP destruction

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA bnxtre driver. A local user could exploit a race condition that occurs when a Queue Pair QP is destroyed, but completion queue CQ polling continues. This can lead to a kernel panic, resulting in a Denial of Service DoS on the...

kernel: ip_vti: fix potential slab-use-after-free in decode_session6

A use-after-free flaw was found in the Linux kernel's ipvti IPsec Virtual Tunnel Interface implementation when transmitting IPv6 packets with the SFB qdisc attached. A local user with CAPNETADMIN capability can trigger this issue by configuring an ipvti interface with an SFB qdisc and sending IPv...

kernel: NULL pointer dereference vulnerability in io_uring_show_fdinfo

A null pointer dereference flaw was found in the Linux kernel's iouring functionality. This issue could allow a local user to crash the system...

kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP

A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSETCMDADD and IPSETCMDSWAP can lead to a kernel panic due to the invocation of ipsetput on a wrong set. This issue may allow a local user to crash the system...

kernel: netfilter: nftables: exthdr: fix 4-byte stack OOB write

An out-of-bounds write flaw was found in the Linux kernel’s Netfilter functionality. This flaw allows a local user to crash or potentially escalate their privileges on the system...

kernel: amdgpu: validate offset_in_bo of drm_amdgpu_gem_va

A flaw was found in the AMDGPU graphics driver within the Linux kernel was identified where the offsetinbo parameter in the drmamdgpugemva handler was not sufficiently validated. Under certain conditions, an addition of offsetinbo and mapsize can overflow, resulting in an out-of-bounds access...

kernel: Linux kernel: Denial of Service due to memory leak in IP address deletion

A flaw was found in the Linux kernel. An incorrect handling of the 'lastprim' value within the inetdelifa function during IP address deletion can be triggered by a local user. This memory leak leads to resource exhaustion, potentially causing a Denial of Service DoS on the system...

kernel: drm/amdgpu: drop gfx_v11_0_cp_ecc_error_irq_funcs

A logic error was found in the Linux kernel amdgpu graphics driver's interrupt handling for GFX version 11 hardware. A local user with access to an AMD GPU can trigger a GPU device reset or suspend operation, causing the driver to attempt cleanup of a retired interrupt handler that no longer...

kernel: nf_tables: use-after-free vulnerability in the nft_setelem_catchall_deactivate() function

A double-free flaw was found in how the Linux kernel's NetFilter system marks whether a catch-all element is enabled. A local user could use this flaw to crash the system...

kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier

A flaw was found in sysmembarrier in the Linux kernel in sched/membarrier in how a user calls it at too high of a frequency. This flaw allows a local user to saturate the machine...

kernel: Linux kernel: RDMA/core GID entry leak causes Denial of Service

A flaw was found in the Linux kernel's Remote Direct Memory Access RDMA core component. A local user with low privileges could trigger a Global Identifier GID entry reference leak when an Address Handle AH creation request fails. This resource leak could lead to system instability and a Denial of...

kernel: net/sched: act_ct: fix skb leak and crash on ooo frags

A memory leak flaw and potential kernel crash were found in the Linux kernel’s Conntrack module. This issue occurs when Conntrack is being used by a local user for a specific configuration, and both fragmented packets are received remotely and out of order. This flaw allows a local or remote user...

kernel: ext4: fix WARNING in mb_find_extent

A vulnerability was found in the ext4 filesystem driver in the Linux kernel. This flaw occurs when the system processes a maliciously crafted or corrupted ext4 filesystem image, as the driver fails to properly validate its structural data. A local user with the ability to mount such an image coul...

kernel: ipv4: NULL pointer dereference in ipv4_send_dest_unreach()

A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer skb was assumed to be associated with a device before calling ipoptionscompile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAPNETADMIN privileges t...