kernel: Linux kernel: Network subsystem memory leak

A flaw was found in the Linux kernel. This vulnerability allows an attacker to cause a denial of service via a memory leak caused by improper handling of skb socket buffer cloning in the network subsystem...

kernel: mptcp: fix UaF in listener shutdown

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix UaF in listener shutdown As reported by Christoph after having refactored the passive socket initialization, the mptcp listener shutdown path is prone to an UaF issue. BUG: KASAN: use-after-free in...

kernel: nvme-tcp: don't access released socket during error recovery

A race condition leading to NULL pointer dereference was found in the Linux kernel NVMe-over-TCP driver's error recovery handling. A local user with privileges to execute NVMe management commands can run the 'nvme list' command while NVMe-over-TCP error recovery work is temporarily failing...

kernel: wifi: mt76: mt7915: fix memory leak in mt7915_mcu_exit

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix memory leak in mt7915mcuexit Always purge mcu skb queues in mt7915mcuexit routine even if mt7915firmwarestate fails...

kernel: mptcp: stricter state check in mptcp_worker

A vulnerability was identified in the Linux kernel’s implementation of the Multipath TCP protocol handler. Under certain sequences of socket operations e.g., connecting, resetting/fast-closing, and re-listening, the MPTCP worker could be invoked while the associated master socket is in an...

kernel: bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Check for any of tcpbpfprots when cloning a listener A listening socket linked to a sockmap has its skprot overridden. It points to one of the struct proto variants in tcpbpfprots. The variant depends on the socket'...

kernel: wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

A flaw was found in the ath9k USB Wi-Fi driver in the Linux kernel. In certain conditions within the ath9khifusbregincb path, a socket buffer skb may be freed prematurely and then freed again on an error path, leading to a use-after-free condition. Additionally, failure to allocate a new skb can...

kernel: Linux kernel: Memory leak in wilc1000 Wi-Fi driver causes Denial of Service

A flaw was found in the Linux kernel's wilc1000 Wi-Fi driver. A local attacker with low privileges could exploit a memory leak in the wilcmacxmit function, which fails to free a socket buffer skb under certain conditions. This resource exhaustion vulnerability can lead to a Denial of Service DoS ...

kernel: seg6: fix the iif in the IPv6 socket control block

A vulnerability was found in the Linux kernel's seg6 implementation in the seg6dosrhencap function, where the issue arises when an IPv4 packet is encapsulated within an IPv6 segment routing header, causing the receiving interface index to be cleared, leading to potential NULL pointer dereferences...

kernel: xfrm: policy: fix metadata dst->dev xmit null pointer dereference

A flaw was found in the XFRM policy support in the Linux kernel. A NULL pointer dereference can be triggered when a socket buffer is transmitted via an XFRM interface due to a missing check, resulting in a denial of service...

kernel: mlx5: fix possible ptp queue fifo use-after-free

In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possible during re-sync action. WARNONONCE...

kernel: Linux kernel: Denial of Service due to GIC state corruption on NVIDIA T241 platforms

A flaw was found in the Linux kernel. On NVIDIA server platforms utilizing multiple interconnected T241 chips, a local user could trigger a vulnerability in the Generic Interrupt Controller GIC due to incorrect handling of inter-socket data packets. This can corrupt the GIC's internal state,...

avahi: Local DoS by event-busy-loop from writing long lines to /run/avahi-daemon/socket

A flaw was found in avahi. The event used to signal the termination of the client connection on the avahi Unix socket is not correctly handled in the clientwork function, allowing a local attacker to trigger an infinite loop. The highest threat from this vulnerability is to the availability of th...

PT-2025-18871 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.1.4-cloudflare-kasan-2023.1.2 Description: A use-after-free issue has been identified in the Linux kernel, specifically in the veth module. This issue arises when the pskb expand head function is used to expan...

Rocky Linux 9 : pcs (RLSA-2022:6313)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:6313 advisory. - A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS...

Fedora 39 : redis (2023-fd75e4f307)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-fd75e4f307 advisory. Redis 7.2.2 Released Wed 18 Oct 2023 10:33:40 IDT Upgrade urgency SECURITY: See security fixes below. Security fixes CVE-2023-45145 The wrong order ...

SUSE-SU-2023:4376-1 Security update for redis

This update for redis fixes the following issues: - CVE-2023-45145: Fixed a potential permission bypass due to a race condition during UNIX socket creation bsc1216376...

Rocky Linux 8 : spice-vdagent (RLSA-2021:1791)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1791 advisory. - A flaw was found in the way the spice-vdagentd daemon handled file transfers from the host system to the virtual machine. Any unprivileged local guest...

SUSE-SU-2023:4290-1 Security update for redis

This update for redis fixes the following issues: - CVE-2023-45145: Fixed a potential permission bypass due to a race condition during UNIX socket creation bsc1216376...

BIT-2023-45145

Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask2 is used, this creates a race condition that enables, during a short period of time, another process...