CVE-2022-50876

In the Linux kernel, the following vulnerability has been resolved: usb: musb: Fix musbgadget.c rxstate overflow bug The usb function device call musbgadgetqueue adds the passed request to musbep::reqlist,If the request-length musbep-packetsz and isbuffermappedreq return false,the rxstate will co...

CVE-2022-50876

CVE-2022-50876 — Linux kernel USB musb overflow fix . Concrete details in connected docs show the issue occurs in usb: musb: Fix musb_gadget.c rxstate overflow bug when the usb function device queues a request to musb_ep::req_list; if request->length > musb_ep->packet_sz and the buffer i...

CVE-2023-54277 fbdev: udlfb: Fix endpoint check

In the Linux kernel, the following vulnerability has been resolved: fbdev: udlfb: Fix endpoint check The syzbot fuzzer detected a problem in the udlfb driver, caused by an endpoint not having the expected type: usb 1-1: Read EDID byte 0 failed: -71 usb 1-1: Unable to get valid EDID from...

CVE-2023-54270 media: usb: siano: Fix use after free bugs caused by do_submit_urb

In the Linux kernel, the following vulnerability has been resolved: media: usb: siano: Fix use after free bugs caused by dosubmiturb There are UAF bugs caused by dosubmiturb. One of the KASan reports is shown below: 36.403605 BUG: KASAN: use-after-free in workerthread+0x4a2/0x890 36.406105 Read o...

CVE-2023-54266 media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()

In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: m920x: Fix a potential memory leak in m920xi2cxfer 'read' is freed when it is known to be NULL, but not when a read error occurs. Revert the logic to avoid a small leak, should a m920xread call fail...

CVE-2022-50829 wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: Fix use-after-free in ath9khifusbregincb It is possible that skb is freed in ath9khtcrxmsg, then usbsubmiturb fails and we try to free skb again. It causes use-after-free bug. Moreover, if allocskb fails,...

CVE-2022-50829

The CVE-2022-50829 entry concerns the Linux kernel wireless driver ath9k (hif_usb path). The issue is a use-after-free: skb could be freed in ath9k_htc_rx_msg(), then usb_submit_urb() fails and the code attempts to free skb again. There can also be a memory leak if alloc_skb() fails, leaving urb-...

CVE-2022-50829

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: Fix use-after-free in ath9khifusbregincb It is possible that skb is freed in ath9khtcrxmsg, then usbsubmiturb fails and we try to free skb again. It causes use-after-free bug. Moreover, if allocskb fails,...

CVE-2023-54186

CVE-2023-54186 is a Linux kernel vulnerability affecting the USB Type-C altmodes/displayport code. The issue arises from a patch that fixes the negative indexing of the buf array in pin_assignment_show when get_current_pin_assignments returns 0 (no compatible pin assignments). The bug led to a KA...

CVE-2023-54186 usb: typec: altmodes/displayport: fix pin_assignment_show

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pinassignmentshow This patch fixes negative indexing of buf array in pinassignmentshow when getcurrentpinassignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN:...

CVE-2023-54186

In the Linux kernel, the following vulnerability has been resolved: usb: typec: altmodes/displayport: fix pinassignmentshow This patch fixes negative indexing of buf array in pinassignmentshow when getcurrentpinassignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN:...

CVE-2022-50825

CVE-2022-50825 relates to a Linux kernel USB Type-C wusb3801 refcount leak in the wusb3801_probe path. The vulnerability arises from unbalanced of_node_get()/of_node_put() calls, described as a memory leak if wusb3801_hw_init() fails, where fwnode_handle_put() must be invoked to avoid the leak. C...

CVE-2022-50825 usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wusb3801: fix fwnode refcount leak in wusb3801probe I got the following report while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 4, ofnodeget/ofnodeput unbalanced - destroy cset...

CVE-2022-50825

In the Linux kernel, the following vulnerability has been resolved: usb: typec: wusb3801: fix fwnode refcount leak in wusb3801probe I got the following report while doing fault injection test: OF: ERROR: memory leak, expected refcount 1 instead of 4, ofnodeget/ofnodeput unbalanced - destroy cset...

OESA-2025-2884 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 one with start/stop bug, one without were seen to...

Exploit for Improper Access Control in Microsoft

CVE-2025-47962-POC Reproduction process： i686-w64-mingw32-gcc...

PT-2025-54117

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.14.0+ 131...

CVE-2023-54213: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: USB: sisusbvga: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the sisusbvga driver: ------------ cut here ------------ usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 1 PID: 26 at...

CVE-2023-54299: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: typec: bus: verify partner exists in typecaltmodeattention Some usb hubs will negotiate DisplayPort Alt mode with the device but will then negotiate a data role swap after entering the alt mode. The data role swap causes the...

CVE-2023-54270: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: usb: siano: Fix use after free bugs caused by dosubmiturb There are UAF bugs caused by dosubmiturb. One of the KASan reports is shown below: 36.403605 BUG: KASAN: use-after-free in workerthread+0x4a2/0x890 36.406105 Read o...