CVE-2023-52851 IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF In the unlikely event that workqueue allocation fails and returns NULL in mlx5mkeycacheinit, delete the call to mlx5rumrresourcecleanup which frees th...

CVE-2023-52837

In CVE-2023-52837, the Linux kernel fixed a use-after-free in nbd_open triggered when a disk is opened after nbd_put() because disk->private_data could still reference freed memory. The fix adds a dedicated ->free_disk hook that frees the private data as part of disk cleanup (blk_cleanup_di...

CVE-2023-52837 nbd: fix uaf in nbd_open

In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbdopen Commit 4af5f2e03013 "nbd: use blkmqallocdisk and blkcleanupdisk" cleans up disk by blkcleanupdisk and it won't set disk-privatedata as NULL as before. UAF may be triggered in nbdopen if someone tries to op...

CVE-2023-52837 nbd: fix uaf in nbd_open

In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbdopen Commit 4af5f2e03013 "nbd: use blkmqallocdisk and blkcleanupdisk" cleans up disk by blkcleanupdisk and it won't set disk-privatedata as NULL as before. UAF may be triggered in nbdopen if someone tries to op...

CVE-2023-52837

In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbdopen Commit 4af5f2e03013 "nbd: use blkmqallocdisk and blkcleanupdisk" cleans up disk by blkcleanupdisk and it won't set disk-privatedata as NULL as before. UAF may be triggered in nbdopen if someone tries to op...

CVE-2023-52801 iommufd: Fix missing update of domains_itree after splitting iopt_area

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domainsitree after splitting ioptarea In ioptareasplit, if the original ioptarea has filled a domain and is linked to domainsitree, pagesnodes have to be properly reinserted. Otherwise the...

CVE-2023-52801

CVE-2023-52801 concerns the Linux kernel iommufd code. In iopt_area_split(), if the original iopt_area had filled a domain and is linked to domains_itree, pages_nodes must be reintegrated; otherwise domains_itree becomes corrupted and leads to use-after-free. The vulnerability is resolved by ensu...

CVE-2023-52801 iommufd: Fix missing update of domains_itree after splitting iopt_area

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domainsitree after splitting ioptarea In ioptareasplit, if the original ioptarea has filled a domain and is linked to domainsitree, pagesnodes have to be properly reinserted. Otherwise the...

CVE-2023-52801

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix missing update of domainsitree after splitting ioptarea In ioptareasplit, if the original ioptarea has filled a domain and is linked to domainsitree, pagesnodes have to be properly reinserted. Otherwise the...

CVE-2023-52751 smb: client: fix use-after-free in smb2_query_info_compound()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2queryinfocompound The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options...

CVE-2023-52751

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2queryinfocompound The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options...

CVE-2023-52751 smb: client: fix use-after-free in smb2_query_info_compound()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in smb2queryinfocompound The following UAF was triggered when running fstests generic/072 with KASAN enabled against Windows Server 2022 and mount options...

CVE-2023-52741 cifs: Fix use-after-free in rdata->read_into_pages()

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix use-after-free in rdata-readintopages When the network status is unstable, use-after-free may occur when read data from the server. BUG: KASAN: use-after-free in readpagesfillpages+0x14c/0x7e0 Call Trace:...

CVE-2021-47338

In the Linux kernel, the following vulnerability has been resolved: fbmem: Do not delete the mode that is still in use The execution of fbdeletevideomode is not based on the result of the previous fbconmodedeleted. As a result, the mode is directly deleted, regardless of whether it is still in us...

CVE-2021-47342

In the Linux kernel, the following vulnerability has been resolved: ext4: fix possible UAF when remounting r/o a mmp-protected file system After commit 618f003199c6 "ext4: fix memory leak in ext4fillsuper", after the file system is remounted read-only, there is a race where the kmmpd thread can...

CVE-2021-47311

In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emacremove adpt is netdev private data and it cannot be used after freenetdev call. Using adpt after freenetdev can cause UAF bug. Fix it by moving freenetdev at the end of the function...

CVE-2021-47306

In the Linux kernel, the following vulnerability has been resolved: net: fddi: fix UAF in fzaprobe fp is netdev private data and it cannot be used after freenetdev call. Using fp after freenetdev can cause UAF bug. Fix it by moving freenetdev after error message. TURBOchannel adapter"...

CVE-2021-47310

In the Linux kernel, the following vulnerability has been resolved: net: ti: fix UAF in tlanremoveone priv is netdev private data and it cannot be used after freenetdev call. Using priv after freenetdev can cause UAF bug. Fix it by moving freenetdev at the end of the function...

CVE-2021-47311

In the Linux kernel, the following vulnerability has been resolved: net: qcom/emac: fix UAF in emacremove adpt is netdev private data and it cannot be used after freenetdev call. Using adpt after freenetdev can cause UAF bug. Fix it by moving freenetdev at the end of the function...

CVE-2021-47310

In the Linux kernel, the following vulnerability has been resolved: net: ti: fix UAF in tlanremoveone priv is netdev private data and it cannot be used after freenetdev call. Using priv after freenetdev can cause UAF bug. Fix it by moving freenetdev at the end of the function...