CVE-2023-54111 pinctrl: rockchip: Fix refcount leak in rockchip_pinctrl_parse_groups

In the Linux kernel, the following vulnerability has been resolved: pinctrl: rockchip: Fix refcount leak in rockchippinctrlparsegroups offindnodebyphandle returns a node pointer with refcount incremented, We should use ofnodeput on it when not needed anymore. Add missing ofnodeput to avoid refcou...

CVE-2023-54109

In the Linux kernel, the following vulnerability has been resolved: media: rcarfdp1: Fix refcount leak in probe and remove function rcarfcpget take reference, which should be balanced with rcarfcpput. Add missing rcarfcpput in fdp1remove and the error paths of fdp1probe to fix this. hverkuil:...

CVE-2023-54107

CVE-2023-54107 relates to the Linux kernel blk-cgroup Use-After-Free caused by the parent blkg refcount being dropped before the parent’s pd_free_fn() executes. The issue occurs because __blkg_release() drops the parent refcount in a path that precedes the asynchronous blkg_free_work_fn() where p...

CVE-2023-54097

CVE-2023-54097 (Linux kernel) affects the regulator subsystem, specifically the stm32-pwr regulator driver. The issue is an of_iomap() leak in stm32_pwr_regulator_probe() that can leak the mapped base address if memory allocation or regulator registration fails. The fix replaces of_iomap() with d...

CVE-2023-54094

Technical details about CVE-2023-54094 are not provided in the supplied documents; refer to vendor advisories for full specifics and remediation status; monitor for updates.

CVE-2023-54094

In the Linux kernel, the following vulnerability has been resolved: net: prevent skb corruption on frag list segmentation Ian reported several skb corruptions triggered by rx-gro-list, collecting different oops alike: 62.624003 BUG: kernel NULL pointer dereference, address: 00000000000000c0...

CVE-2023-54084 ALSA: firewire-digi00x: prevent potential use after free

In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-digi00x: prevent potential use after free This code was supposed to return an error code if initstream failed, but it instead freed dg00x-rxstream and returned success. This potentially leads to a use after free...

CVE-2023-54083 phy: tegra: xusb: Clear the driver reference in usb-phy dev

In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Clear the driver reference in usb-phy dev For the dual-role port, it will assign the phy dev to usb-phy dev and use the port dev driver as the dev driver of usb-phy. When we try to destroy the port dev, it will...

CVE-2023-54079

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx: Fix pollinterval handling and races on remove Before this patch bq27xxxbatteryteardown was setting pollinterval = 0 to avoid bq27xxxbatteryupdate requeuing the delayedwork item. There are 2 problems with...

CVE-2022-50782 ext4: fix bug_on in __es_tree_search caused by bad quota inode

In the Linux kernel, the following vulnerability has been resolved: ext4: fix bugon in estreesearch caused by bad quota inode We got a issue as fllows: ================================================================== kernel BUG at fs/ext4/extentsstatus.c:202! invalid opcode: 0000 1 PREEMPT SMP...

CVE-2022-50775

CVE-2022-50775 pertains to the Linux kernel RDMA/hns subsystem. The vulnerability arises from a refcount leak in hns_roce_mmap where rdma_user_mmap_entry_get_pgoff() takes a reference but rdma_user_mmap_entry_put() to release it was missing. The fix adds the missing release call to properly drop ...

CVE-2022-50773

CVE-2022-50773 is a Linux kernel vulnerability affecting ALSA mts64 where a null pointer defer can occur in snd_mts64_interrupt if mts64 is not initialized at interrupt time. The provided exploit trace shows a kernel NULL dereference and a subsequent reboot in an environment testing with CONFIG_P...

CVE-2022-50773

In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: fix possible null-ptr-defer in sndmts64interrupt I got a null-ptr-defer error report when I do the following tests on the qemu platform: make defconfig and CONFIGPARPORT=m, CONFIGPARPORTPC=m, CONFIGSNDMTS64=m Then...

CVE-2022-50771

In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero fqsduration module parameter in a kernel built with CONFIGPREEMPTION=y results in the following splat: BUG: using thiscpuread in...

CVE-2022-50766 btrfs: set generation before calling btrfs_clean_tree_block in btrfs_init_new_buffer

In the Linux kernel, the following vulnerability has been resolved: btrfs: set generation before calling btrfscleantreeblock in btrfsinitnewbuffer syzbot is reporting uninit-value in btrfscleantreeblock 1, for commit bc877d285ca3dba2 "btrfs: Deduplicate extentbuffer init code" missed that...

CVE-2022-50764 ipv6/sit: use DEV_STATS_INC() to avoid data-races

In the Linux kernel, the following vulnerability has been resolved: ipv6/sit: use DEVSTATSINC to avoid data-races syzbot/KCSAN reported that multiple cpus are updating dev-stats.txerror concurrently. This is because sit tunnels are NETIFFLLTX, meaning their ndostartxmit is not protected by a...

CVE-2022-50747

CVE-2022-50747 is a Linux kernel issue in the HFS file system code. The vulnerability stems from an out-of-bounds write in hfs_asc2mac() inside fs/hfs/trans.c when converting filenames, where an oversized input len can drive writes beyond the destination when the destination buffer boundary is re...

CVE-2022-50746 erofs: validate the extent length for uncompressed pclusters

In the Linux kernel, the following vulnerability has been resolved: erofs: validate the extent length for uncompressed pclusters syzkaller reported a KASAN use-after-free: https://syzkaller.appspot.com/bug?extid=2ae90e873e97f1faf6f2 The referenced fuzzed image actually has two issues: - mpa == 0 ...

CVE-2022-50740

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hifusb: fix memory leak of urbs in ath9khifusbdealloctxurbs Syzkaller reports a long-known leak of urbs in ath9khifusbdealloctxurbs. The cause of the leak is that usbgeturb is called but usbfreeurb or usbputurb is no...

CVE-2023-54068

In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to call f2fswaitonpagewriteback in f2fswriterawpages BUGON will be triggered when writing files concurrently, because the same page is writtenback multiple times. 1597 void folioendwritebackstruct folio folio...