CVE-2022-49555

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Use deltimersync before freeing While looking at a crash report on a timer list being corrupted, which usually happens when a timer is freed while still active. This is commonly triggered by code calling deltim...

CVE-2022-49399

CVE-2022-49399 affects the Linux kernel tty driver for the goldfish port. In goldfish_tty_probe(), the port created by tty_port_init() can leak resources if error paths don’t destroy it; in goldfish_tty_remove(), the port must also be destroyed. The fix is to call tty_port_destroy() to release th...

CVE-2022-49220

CVE-2022-49220 affects the Linux kernel in the dax subsystem. The issue occurs when inodes are not flushed before destroying dax_cache, triggered by loading and unloading the nd_pmem modules. The root cause is in dax_fs_exit() not flushing inodes prior to cache destruction, which can lead to obje...

CVE-2022-49220

In the Linux kernel, the following vulnerability has been resolved: dax: make sure inodes are flushed before destroy cache A bug can be triggered by following command $ modprobe ndpmem && modprobe -r ndpmem 10.060014 BUG daxcache Not tainted: Objects remaining in daxcache on kmemcacheshutdown...

CVE-2022-49204 bpf, sockmap: Fix more uncharged while msg has more_data

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix more uncharged while msg has moredata In tcpbpfsendverdict, if msg has more data after tcpbpfsendmsgredir: tcpbpfsendverdict tosend = msg-sg.size //msg-sg.size = 22220 case SKREDIRECT: skmsgreturn //uncharged...

CVE-2022-49149 rxrpc: Fix call timer start racing with call destruction

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call timer start racing with call destruction The rxrpccall struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq...

CVE-2022-49149 rxrpc: Fix call timer start racing with call destruction

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call timer start racing with call destruction The rxrpccall struct has a timer used to handle various timed events relating to a call. This timer can get started from the packet input routines that are run in softirq...

CVE-2022-49149

The CVE-2022-49149 issue affects the Linux kernel rxrpc subsystem where a timer for a call could be started while the call is being destroyed (softirq context with only the RCU read lock). This race could cause the timer (already stopped) to be restarted and, later, the timer dispatcher may oops ...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from dax not flushing inodes before destroying the cache, which could lead to object residue...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: virtio/vsock: Fixed the acceptqueue memory leak Since the final stages of socket destruction may be delayed, it is possible that virtiotransportrecvlisten will be called after the acceptqueue has been flushed, but before the...

UBUNTU-CVE-2025-21675

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clear port select structure when fail to create Clear the port select structure on error so no stale values left after definers are destroyed. That's because the mlx5lagdestroydefiners always try to destroy all lag...

CVE-2025-21678

In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtpnewlink links the device to a list in devnetdev instead of srcnet, where a udp tunnel socket is created. Even when srcnet is removed, the device stays alive on...

CVE-2025-21677 pfcp: Destroy device along with udp socket's netns dismantle.

In the Linux kernel, the following vulnerability has been resolved: pfcp: Destroy device along with udp socket's netns dismantle. pfcpnewlink links the device to a list in devnetdev instead of net, where a udp tunnel socket is created. Even when net is removed, the device stays alive on devnetdev...

s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()

...

SUSE CVE-2024-57935

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dipctx during destroying QP If it fails to modify QP to RTR, dipctx will not be attached. And during detroying QP, the invalid dipctx pointer will be accessed...

CVE-2024-57935

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dipctx during destroying QP If it fails to modify QP to RTR, dipctx will not be attached. And during detroying QP, the invalid dipctx pointer will be accessed...

CVE-2024-57935

In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dipctx during destroying QP If it fails to modify QP to RTR, dipctx will not be attached. And during detroying QP, the invalid dipctx pointer will be accessed...

CVE-2024-57935

The CVE-ID describes a Linux kernel flaw in RDMA/hns: when destroying a QP, an invalid dip_ctx pointer could be accessed if the QP could not be modified to RTR, due to the dip_ctx not being attached. This is a local-attack surface with potential kernel access to cause a denial of service or crash...

CVE-2024-49569

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce adminq before destroy it Kernel will hang on destroy adminq while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: "nvme" 0 ff61d23de260fb78 schedule at...

SUSE CVE-2024-56644

In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6negativeadvice when this function is executed for an expired IPv6 route located in the exception table. There are several conditions that must ...