CVE-2023-54146

CVE-2023-54146 (Linux kernel) affects the x86/kexec path and concerns a double-free of the elf header buffer. The connected advisories confirm the issue was resolved by removing an unnecessary vfree() in the crash_load_segments error path, with kimage_file_post_load_cleanup() handling cleanup. No...

CVE-2023-54146 x86/kexec: Fix double-free of elf header buffer

In the Linux kernel, the following vulnerability has been resolved: x86/kexec: Fix double-free of elf header buffer After b3e34a47f989 "x86/kexec: fix memory leak of elf header buffer", freeing image-elfheaders in the error path of crashloadsegments is not needed because kimagefilepostloadcleanup...

CVE-2023-54127 fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()

In the Linux kernel, the following vulnerability has been resolved: fs/jfs: prevent double-free in dbUnmount after failed jfsremount Syzkaller reported the following issue: ================================================================== BUG: KASAN: double-free in slabfree mm/slub.c:3787 inline...

CVE-2023-54127

The CVE-2023-54127 issue concerns the Linux kernel JFS file system. A double-free can occur in the dbUnmount path after a failed jfs_remount, triggered via the slab allocator during KASAN reporting. Specifically, the description notes that JFS_SBI(ipbmap->i_sb)->bmap wasn’t set to NULL afte...

CVE-2023-54127 fs/jfs: prevent double-free in dbUnmount() after failed jfs_remount()

In the Linux kernel, the following vulnerability has been resolved: fs/jfs: prevent double-free in dbUnmount after failed jfsremount Syzkaller reported the following issue: ================================================================== BUG: KASAN: double-free in slabfree mm/slub.c:3787 inline...

CVE-2022-50755 udf: Avoid double brelse() in udf_rename()

In the Linux kernel, the following vulnerability has been resolved: udf: Avoid double brelse in udfrename syzbot reported a warning like below 1: VFS: brelse: Trying to free free buffer WARNING: CPU: 2 PID: 7301 at fs/buffer.c:1145 brelse+0x67/0xa0 ... Call Trace: invalidatebhlru+0x99/0x150...

CVE-2022-50755

CVE-2022-50755 (udf: Avoid double brelse() in udf_rename()) is a Linux kernel issue where udf_find_entry() may cause brelse() to be called twice (by both udf_find_entry() and udf_rename()), unbalancing the buffer_head reference count. The patch resolves this by not calling brelse() in udf_rename(...

EUVD-2025-205095

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree scenario when calling adddelayedrefhead. This could happen if the record was reported...

CVE-2023-54043 iommufd: Do not add the same hwpt to the ioas->hwpt_list twice

In the Linux kernel, the following vulnerability has been resolved: iommufd: Do not add the same hwpt to the ioas-hwptlist twice The hwpt is added to the hwptlist only during its creation, it is never added again. This hunk is some missed leftover from rework. Adding it twice will corrupt the...

CVE-2025-68359

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree scenario when calling adddelayedrefhead. This could happen if the record was reported...

CVE-2023-54035

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix underflow in chain reference counter Set element addition error path decrements reference counter on chains twice: once on element release and again via nftdatarelease. Then, d6b478666ffa "netfilter:...

CVE-2023-53997

In the Linux kernel, the following vulnerability has been resolved: thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 "thermal/core: Alloc-copy-free the thermal zone parameters structure", thermalzonedeviceregister allocates a copy of the tzp argument and frees it when...

CVE-2023-54035

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix underflow in chain reference counter Set element addition error path decrements reference counter on chains twice: once on element release and again via nftdatarelease. Then, d6b478666ffa "netfilter:...

CVE-2025-68359

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of qgroup record after failure to add delayed ref head In the previous code it was possible to incur into a double kfree scenario when calling adddelayedrefhead. This could happen if the record was reported...

CVE-2023-53997

In the Linux kernel, the following vulnerability has been resolved: thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 "thermal/core: Alloc-copy-free the thermal zone parameters structure", thermalzonedeviceregister allocates a copy of the tzp argument and frees it when...

UBUNTU-CVE-2023-53997

In the Linux kernel, the following vulnerability has been resolved: thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 "thermal/core: Alloc-copy-free the thermal zone parameters structure", thermalzonedeviceregister allocates a copy of the tzp argument and frees it when...

CVE-2023-53997 thermal: of: fix double-free on unregistration

In the Linux kernel, the following vulnerability has been resolved: thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 "thermal/core: Alloc-copy-free the thermal zone parameters structure", thermalzonedeviceregister allocates a copy of the tzp argument and frees it when...

CVE-2023-53997

CVE-2023-53997 relates to the Linux kernel thermal subsystem. The issue arose from the sequence in which tzp (thermal zone parameters) is allocated and freed during registration and unregistration. After the patch introduced by commit 3d439b1a2ad3 (thermal/core: Alloc-copy-free the thermal zone p...

CVE-2023-53997 thermal: of: fix double-free on unregistration

In the Linux kernel, the following vulnerability has been resolved: thermal: of: fix double-free on unregistration Since commit 3d439b1a2ad3 "thermal/core: Alloc-copy-free the thermal zone parameters structure", thermalzonedeviceregister allocates a copy of the tzp argument and frees it when...

CVE-2025-68367

In the Linux kernel, the following vulnerability has been resolved: macintosh/machid: fix race condition in machidtoggleemumouse The following warning appears when running syzkaller, and this issue also exists in the mainline code. ------------ cut here ------------ listadd double add:...