3047 matches found
kernel: wifi: ath12k: Decrement TID on RX peer frag setup error handling
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12kdprxpeerfragsetup. This could lead to out-of-bounds access in peer-rxtid...
ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
...
CVE-2023-53553
CVE-2023-53553 is a Linux kernel issue tied to Hyper-V HID handling. The vulnerability arises from a fortify memcpy-related codepath in HID Hyper-V (mousevsc_on_receive) where a __write_overflow_field warning could be triggered, prompting a patch to rework the code to avoid the warning. Connected...
CVE-2023-53553 HID: hyperv: avoid struct memcpy overrun warning
In the Linux kernel, the following vulnerability has been resolved: HID: hyperv: avoid struct memcpy overrun warning A previous patch addressed the fortified memcpy warning for most builds, but I still see this one with gcc-9: In file included from include/linux/string.h:254, from...
CVE-2022-50483
CVE-2022-50483 concerns a Linux kernel issue in the net: enetc path where, on XDP redirects, a page reference counting race could leak pages. The root cause: enetc_flip_rx_buff() could be executed before xdp_do_redirect() completes, causing page refcounts to reach 2 (or 0 on some paths) and enabl...
CVE-2022-50483 net: enetc: avoid buffer leaks on xdp_do_redirect() failure
In the Linux kernel, the following vulnerability has been resolved: net: enetc: avoid buffer leaks on xdpdoredirect failure Before enetccleanrxringxdp calls xdpdoredirect, each software BD in the RX ring between index origi and i can have one of 2 refcount values on its page. We are the owner of...
CVE-2025-39942
In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remainingdatalength respects maxfragmentedrecvsize This is inspired by the check for dataoffset + datalength...
AZL-68139 CVE-2025-39942 affecting package kernel for versions less than 6.6.112.1-1
In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remainingdatalength respects maxfragmentedrecvsize This is inspired by the check for dataoffset + datalength...
AZL-75336 CVE-2025-39942 affecting package kernel 5.15.200.1-1
In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remainingdatalength respects maxfragmentedrecvsize This is inspired by the check for dataoffset + datalength...
AZL-75296 CVE-2025-39948 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The iceputrxmbuf function handles calling iceputrxbuf for each buffer in the current frame. This function was introduced as part of handling multi-buffer XDP support in the ice driver...
UBUNTU-CVE-2025-39943
In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: validate dataoffset and datalength field of smbdirectdatatransfer If dataoffset and datalength of smbdirectdatatransfer struct are invalid, out of bounds issue could happen. This patch validate dataoffset and...
CVE-2025-39948 ice: fix Rx page leak on multi-buffer frames
In the Linux kernel, the following vulnerability has been resolved: ice: fix Rx page leak on multi-buffer frames The iceputrxmbuf function handles calling iceputrxbuf for each buffer in the current frame. This function was introduced as part of handling multi-buffer XDP support in the ice driver...
CVE-2025-39948
The CVE-2025-39948 entry concerns the Linux kernel ice driver. The root cause was a descriptor handling bug in ice_put_rx_mbuf() for multi-buffer/XDP frames: if a descriptor had size 0, those buffers were skipped, so ice_put_rx_buf() wasn’t called, leaving a stale page in the rx ring and potentia...
CVE-2025-39942
The CVE-2025-39942 entry concerns the Linux kernel ksmbd smbdirect path. Affected area: the data length check path that computes remaining_data_length; the fix ensures remaining_data_length respects max_fragmented_recv_size (in addition to the existing data_offset + data_length validation). This ...
CVE-2025-39942 ksmbd: smbdirect: verify remaining_data_length respects max_fragmented_recv_size
In the Linux kernel, the following vulnerability has been resolved: ksmbd: smbdirect: verify remainingdatalength respects maxfragmentedrecvsize This is inspired by the check for dataoffset + datalength...
PT-2025-40670
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a flaw within the enetc network driver related to buffer management during XDP redirect operations. Specifically, the issue arises from improper handling of...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from not properly freeing Rx pages when processing multi-buffer frames, which could lead to a memory leak...
PT-2025-40644
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel ice driver contains a flaw in the ice put rx mbuf function that can lead to a memory leak when handling multi-buffer frames. Specifically, if the hardware posts a...
