CVE-2023-54146

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix double-free of elf header buffer After b3e34a47f989 "x86/kexec: fix memory leak of elf header buffer", freeing image-elfheaders in the error path of crashloadsegments is not needed because kimagefilepostloadcleanup...

UBUNTU-CVE-2023-54062

In the Linux kernel, the following vulnerability has been resolved: ext4: fix invalid free tracking in ext4xattrmovetoblock In ext4xattrmovetoblock, the value of the extended attribute which we need to move to an external block may be allocated by kvmalloc if the value is stored in an external...

CVE-2022-50723

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix memory leak in bnxtnvmtest Free the kzalloc'ed buffer before returning in the success path...

CVE-2023-54127 fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()

In the Linux kernel, the following vulnerability has been resolved: fs/jfs: prevent double-free in dbUnmount after failed jfsremount Syzkaller reported the following issue: ================================================================== BUG: KASAN: double-free in slabfree mm/slub.c:3787 inline...

CVE-2025-68747 drm/panthor: Fix UAF on kernel BO VA nodes

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthorvmunmaprange might return an error. We expect the page table to be updated still, and if the MMU is blocked, the rest of the GPU should be blocked too, so no...

CVE-2025-68747

CVE-2025-68747 is the Linux kernel panthor DRM UAF issue on kernel BO VA nodes. The vulnerability occurs when the MMU is down and panthor_vm_unmap_range() may error, potentially leaving va_node in drm_mm and causing UAF when adjacent nodes are removed. The available connected documents indicate a...

CVE-2025-68747 drm/panthor: Fix UAF on kernel BO VA nodes

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix UAF on kernel BO VA nodes If the MMU is down, panthorvmunmaprange might return an error. We expect the page table to be updated still, and if the MMU is blocked, the rest of the GPU should be blocked too, so no...

CVE-2025-68744 bpf: Free special fields when update [lru_,]percpu_hash maps

In the Linux kernel, the following vulnerability has been resolved: bpf: Free special fields when update lru,percpuhash maps As lru,percpuhash maps support BPFKPTRREF,PERCPU, missing calls to 'bpfobjfreefields' in 'pcpucopyvalue' could cause the memory referenced by BPFKPTRREF,PERCPU fields to be...

CVE-2025-68744 bpf: Free special fields when update [lru_,]percpu_hash maps

In the Linux kernel, the following vulnerability has been resolved: bpf: Free special fields when update lru,percpuhash maps As lru,percpuhash maps support BPFKPTRREF,PERCPU, missing calls to 'bpfobjfreefields' in 'pcpucopyvalue' could cause the memory referenced by BPFKPTRREF,PERCPU fields to be...

CVE-2025-68741 scsi: qla2xxx: Fix improper freeing of purex item

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix improper freeing of purex item In qla2xxxprocesspurlsiocb, an item is allocated via qla27xxcopymultiplepkt, which internally calls qla24xxallocpurexitem. The qla24xxallocpurexitem function may return a...

CVE-2023-54042

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix VAS mm use after free The refcount on mm is dropped before the coprocessor is detached...

CVE-2023-54016

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix memory leak in rxdesc and txdesc Currently when ath12kdpccdescinit is called we allocate memory to rxdescs and txdescs. In ath12kdpcccleanup, during descriptor cleanup rxdescs and txdescs memory is not freed. Th...

CVE-2023-53989

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both createmappingnoalloc and updatemappingprot sanity-check their 'virt' parameter, but the check itself doesn't make much sense. The condition used today appears to be a historical accident...

UBUNTU-CVE-2023-54042

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix VAS mm use after free The refcount on mm is dropped before the coprocessor is detached...

CVE-2023-54042

CVE-2023-54042 affects the Linux kernel on powerpc/64s. The issue is a use-after-free involving VAS memory management where the refcount on mm is dropped before detaching the coprocessor, potentially leading to use-after-free conditions. The vulnerability was fixed in the kernel by correcting the...

CVE-2023-54042 powerpc/64s: Fix VAS mm use after free

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix VAS mm use after free The refcount on mm is dropped before the coprocessor is detached...

CVE-2023-54005 binder: fix memory leak in binder_init()

In the Linux kernel, the following vulnerability has been resolved: binder: fix memory leak in binderinit In binderinit, the destruction of binderallocshrinkerinit is not performed in the wrong path, which will cause memory leaks. So this commit introduces binderallocshrinkerexit and calls it in...

CVE-2023-53989 arm64: mm: fix VA-range sanity check

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both createmappingnoalloc and updatemappingprot sanity-check their 'virt' parameter, but the check itself doesn't make much sense. The condition used today appears to be a historical accident...

CVE-2025-68374

In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in mdwakeupthread We attempted to use RCU to protect the pointer 'thread', but directly passed the value when calling mdwakeupthread. This means that the RCU pointer has been acquired before rcureadlock,...

webkitgtk: webkitgtk: Use-after-free due to improper memory management

A flaw was found in webkitgtk where when processing a maliciously crafted web content a use-after-free type of weaknesses may be triggered leading to a remote code execution in the client machine...