kernel: drm/amdgpu: Fix type of second parameter in odn_edit_dpm_table() callback

A function prototype mismatch was found in the AMD GPU driver's DPM table callbacks. When kCFI Control Flow Integrity is enabled, the mismatched types cause CFI validation failures, potentially crashing the kernel...

kernel: net: hsr: avoid possible NULL deref in skb_clone()

A flaw was found in the Linux kernel’s High-availability Seamless Redundancy HSR network subsystem. When the helper function createstrippedskbhsr returns NULL, the subsequent call to skbclone occurs without validating the returned pointer, leading to a potential NULL pointer dereference. Under...

kernel: scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix possible resource leaks in mpt3sastransportportadd In mpt3sastransportportadd, if sasrphyadd returns error, sasrphyfree needs be called to free the resource allocated in sasenddevicealloc. Otherwise a kernel...

kernel: xhci: Remove device endpoints from bandwidth list when freeing the device

A null pointer/list corruption flaw was found in the Linux kernel USB xHCI host controller code. When the xHCI host is dying or being removed, some device endpoints may remain on the software bandwidth list. Later cleanup deletes entries that were already freed, corrupting the list and crashing t...

kernel: cpufreq: Init completion before kobject_init_and_add()

An initialization order bug was found in the Linux kernel's cpufreq subsystem during policy allocation. A local user can trigger this issue when CPU frequency policy initialization fails after kobject registration but before completion initialization, causing the cleanup path to attempt to use an...

kernel: SUNRPC: double free xprt_ctxt while still in use

A flaw was addressed in the Linux kernel’s SUNRPC implementation affecting deferred RPC request handling. When an RPC request is deferred, the internal rqxprtctxt pointer is moved from the active service request to a deferred request structure. Under certain rare conditions where a request is...

kernel: dmaengine: ptdma: check for null desc before calling pt_cmd_callback

AMD PTDMA Pass-Through DMA engine crashes the kernel when ptissuepending encounters empty descriptor queues. The function blindly invokes ptcmdcallback without verifying that a valid descriptor exists, triggering a NULL pointer dereference. This commonly surfaces during system shutdown on AMD...

kernel: udmabuf: Set ubuf->sg = NULL if the creation of sg table fails

A flaw was found in the Linux kernel’s udmabuf subsystem where the scatter-gather sg pointer was not properly set to NULL if creation of the sg table failed. If userspace attempts to map a dmabuf and the sg table allocation fails e.g., due to memory exhaustion, the kernel later attempts to free a...

kernel: RDMA/core: Make sure "ib_port" is valid when access sysfs node

A NULL pointer dereference flaw was found in the Linux kernel RDMA core's sysfs handling. A local user with access to InfiniBand sysfs nodes can read sysfs attributes while an InfiniBand port is being removed, causing the kernel to dereference a NULL ibport pointer when the port structure has bee...

kernel: net/sched: flower: fix filter idr initialization

A flaw was found in the Linux kernel’s networking traffic control flower classifier. The initialization of the filter IDR was moved too early in the flchange path, allowing concurrent access by multiple users while the structure was still in an inconsistent state. Under certain conditions, this...

kernel: Use after free bug in r592_remove

A use-after-free flaw was found in r592remove in drivers/memstick/host/r592.c in media access in the Linux Kernel. This issue may allow a local attacker to crash the system at device disconnect, possibly leading to a kernel information leak...

Kernel: use-after-free in nfsd4_ssc_setup_dul in fs/nfsd/nfs4proc.c

A use-after-free flaw was found in nfsd4sscsetupdul in fs/nfsd/nfs4proc.c in the NFS filesystem in the Linux Kernel. This issue could allow a local attacker to crash the system or it may lead to a kernel information leak problem...

kernel: dm flakey: fix a crash with invalid table line

A flaw was identified in the device-mapper “dm flakey” target in the Linux kernel where invalid table line input can lead to a NULL pointer dereference. Specifically, when dmsetup is used with a malformed table line such as with the corruptbiobyte target and the argname pointer is NULL, the kerne...

kernel: ASoC: SOF: avoid a NULL dereference with unsupported widgets

A NULL pointer dereference was found in the Sound Open Firmware SOF driver. When a topology contains an unsupported widget type, the moduleinfo field is NULL, and dereferencing it during route setup crashes the kernel...

kernel: drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe

A NULL pointer dereference was found in the IT6505 DisplayPort bridge driver. If an HPD interrupt fires before the DRM bridge registration completes, the driver attempts to access an uninitialized AUX channel, causing a kernel crash...

kernel: wifi: fix potential NULL-ptr deref after clone

A flaw was found in the Linux kernel’s iwlwifi mei driver. When the driver attempts to clone a socket bufferand that operation fails, it may erroneously dereference a NULL pointer, leading to a kernel crash or denial of service. An unprivileged local user may be able to trigger this flaw by...

kernel: drm/i915: Fix system suspend without fbdev being initialized

A NULL pointer dereference was found in the Linux kernel Intel i915 graphics driver's framebuffer device suspend handling. On platforms without display hardware where fbdev is not initialized, a local user with privileges to initiate system suspend can trigger the suspend path, causing the driver...

kernel: drm/i915/perf: add sentinel to xehp_oa_b_counters

A bounds-checking error was found in the Linux kernel Intel i915 graphics driver's performance monitoring subsystem. A local user with access to Intel GPU performance counters can trigger address validation for observability architecture counters on Xe-HP and newer hardware, causing the driver to...

kernel: nvme-tcp: don't access released socket during error recovery

A race condition leading to NULL pointer dereference was found in the Linux kernel NVMe-over-TCP driver's error recovery handling. A local user with privileges to execute NVMe management commands can run the 'nvme list' command while NVMe-over-TCP error recovery work is temporarily failing...

kernel: wifi: ath11k: fix monitor mode bringup crash

A null pointer dereference vulnerability was found in the ath11k wireless driver in the Linux kernel. When an interface is brought up in monitor mode, the driver attempts to extract packet type from RAW monitor ring packets, which lack the expected structure. This causes a kernel crash due to...