CVE-2023-54234 scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix missing mrioc-evtackcmds initialization Commit c1af985d27da "scsi: mpi3mr: Add Event acknowledgment logic" introduced an array mrioc-evtackcmds but initialization of the array elements was missed. They are just...

CVE-2023-54229 wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range Because of what seems to be a typo, a 6Ghz-only phy for which the BDF does not allow the 7115Mhz channel will fail to register: WARNING: CPU: 2 PID: 1...

CVE-2023-54218 net: Fix load-tearing on sk->sk_stamp in sock_recv_cmsgs().

In the Linux kernel, the following vulnerability has been resolved: net: Fix load-tearing on sk-skstamp in sockrecvcmsgs. KCSAN found a data race in sockrecvcmsgs where the read access to sk-skstamp needs READONCE. BUG: KCSAN: data-race in packetrecvmsg / packetrecvmsg write marked to...

CVE-2023-54215 virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()

In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa: Fix cpumask memory leak in virtiovdpafindvqs Free the cpumask allocated by createaffinitymasks before returning from the function...

CVE-2023-54215 virtio-vdpa: Fix cpumask memory leak in virtio_vdpa_find_vqs()

In the Linux kernel, the following vulnerability has been resolved: virtio-vdpa: Fix cpumask memory leak in virtiovdpafindvqs Free the cpumask allocated by createaffinitymasks before returning from the function...

CVE-2023-54209 block: fix blktrace debugfs entries leakage

In the Linux kernel, the following vulnerability has been resolved: block: fix blktrace debugfs entries leakage Commit 99d055b4fd4b "block: remove per-disk debugfs files in blkunregisterqueue" moves blktraceshutdown from blkreleasequeue to blkunregisterqueue, this is safe if blktrace is created...

CVE-2023-54205

In the Linux kernel, CVE-2023-54205 is addressed in the pinctrl: stm32 subsystem. The root cause was a refcount leak in stm32_pctrl_get_irq_domain where of_irq_find_parent() returns a node pointer with an incremented refcount. The patch adds a missing of_node_put() to release the reference when i...

CVE-2022-50847 drm/bridge: it6505: Initialize AUX channel in it6505_i2c_probe

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: it6505: Initialize AUX channel in it6505i2cprobe During device boot, the HPD interrupt could be triggered before the DRM subsystem registers it6505 as a DRM bridge. In such cases, the driver tries to access AUX channe...

CVE-2022-50841 fs/ntfs3: Add overflow check for attribute size

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add overflow check for attribute size The offset addition could overflow and pass the used size check given an attribute with very large size e.g., 0xffffff7f while parsing MFT attributes. This could lead to out-of-boun...

CVE-2023-54201 RDMA/efa: Fix wrong resources deallocation order

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Fix wrong resources deallocation order When trying to destroy QP or CQ, we first decrease the refcount and potentially free memory regions allocated for the object and then request the device to destroy the object. If t...

CVE-2023-54196 fs/ntfs3: Fix NULL pointer dereference in 'ni_write_inode'

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix NULL pointer dereference in 'niwriteinode' Syzbot found the following issue: Unable to handle kernel NULL pointer dereference at virtual address 0000000000000016 Mem abort info: ESR = 0x0000000096000006 EC = 0x25:...

CVE-2023-54187

CVE-2023-54187 concerns the Linux kernel with a fix for potential corruption when moving a directory in F2FS; the issue also affects ext4_rename, which can cause a crash as shown by xfstests/generic/707. Connected sources indicate patches/commits addressing the root cause in F2FS and related ext4...

CVE-2023-54174 vfio: Fix NULL pointer dereference caused by uninitialized group->iommufd

In the Linux kernel, the following vulnerability has been resolved: vfio: Fix NULL pointer dereference caused by uninitialized group-iommufd group-iommufd is not initialized for the iommufdctxput 20018.331541 BUG: kernel NULL pointer dereference, address: 0000000000000000 20018.377508 RIP:...

CVE-2022-50827 scsi: lpfc: Fix memory leak in lpfc_create_port()

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfccreateport Commit 5e633302ace1 "scsi: lpfc: vmid: Add support for VMID in mailbox command" introduced allocations for the VMID resources in lpfccreateport after the call to scsihostalloc. Upon...

CVE-2022-50827 scsi: lpfc: Fix memory leak in lpfc_create_port()

In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix memory leak in lpfccreateport Commit 5e633302ace1 "scsi: lpfc: vmid: Add support for VMID in mailbox command" introduced allocations for the VMID resources in lpfccreateport after the call to scsihostalloc. Upon...

CVE-2022-50826 ipu3-imgu: Fix NULL pointer dereference in imgu_subdev_set_selection()

In the Linux kernel, the following vulnerability has been resolved: ipu3-imgu: Fix NULL pointer dereference in imgusubdevsetselection Calling v4l2subdevgettrycrop and v4l2subdevgettrycompose with a subdev state of NULL leads to a NULL pointer dereference. This can currently happen in...

CVE-2022-50819 udmabuf: Set ubuf->sg = NULL if the creation of sg table fails

In the Linux kernel, the following vulnerability has been resolved: udmabuf: Set ubuf-sg = NULL if the creation of sg table fails When userspace tries to map the dmabuf and if for some reason e.g. OOM the creation of the sg table fails, ubuf-sg needs to be set to NULL. Otherwise, when the userspa...

CVE-2022-50818 scsi: pm8001: Fix running_req for internal abort commands

In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix runningreq for internal abort commands Disabling the remote phy for a SATA disk causes a hang: root@none$ more /sys/class/sasphy/phy-0:0:8/targetportprotocols sata root@none$ echo 0...

CVE-2022-50816

CVE-2022-50816 affects the Linux kernel IPv6 tunneling MTU handling. Root cause: a layer could set dev->mtu to an underflowed value due to insufficient sanitization when updating MTU for ip6_gre/ip6_tnl/ipip6 tunnels. Impact described in the sources includes potential invalid skb handling and ...

CVE-2022-50811

CVE-2022-50811 concerns the Linux kernel erofs code. The connected sources confirm a concrete fix: when z_erofs_get_extent_compressedlen() fails, there is a missing unmap that could allow leakage of meta buffers. The remediation is a kernel patch implemented in the erofs path to ensure proper unm...