CVE-2022-50455

CVE-2022-50455 entry is rejected/not used per the Initial Description.

CVE-2023-53477 ipv6: Add lwtunnel encap size of all siblings in nexthop calculation

In the Linux kernel, the following vulnerability has been resolved: ipv6: Add lwtunnel encap size of all siblings in nexthop calculation In function rt6nlmsgsize, the length of nexthop is calculated by multipling the nexthop length of fib6info and the number of siblings. However if the fib6info h...

CVE-2023-53456 scsi: qla4xxx: Add length check when parsing nlattrs

In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Add length check when parsing nlattrs There are three places that qla4xxx parses nlattrs: - qla4xxxsetchapentry - qla4xxxifacesetparam - qla4xxxsysfsddbsetparam and each of them directly converts the nlattr to...

CVE-2023-53456 scsi: qla4xxx: Add length check when parsing nlattrs

In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Add length check when parsing nlattrs There are three places that qla4xxx parses nlattrs: - qla4xxxsetchapentry - qla4xxxifacesetparam - qla4xxxsysfsddbsetparam and each of them directly converts the nlattr to...

CVE-2023-53456

During CVE-2023-53456, the Linux kernel scsi/qla4xxx nlattrs parsing lacked length validation in three code paths: qla4xxx_set_chap_entry(), qla4xxx_iface_set_param(), and qla4xxx_sysfs_ddb_set_param(). This could allow out-of-bounds reads and leak heap data. The fix adds a nla_len check and retu...

CVE-2022-50442 fs/ntfs3: Validate buffer length while parsing index

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate buffer length while parsing index indxread is called when we have some NTFS directory operations that need more information from the index buffers. This adds a sanity check to make sure the returned index buffe...

CVE-2022-50442 fs/ntfs3: Validate buffer length while parsing index

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate buffer length while parsing index indxread is called when we have some NTFS directory operations that need more information from the index buffers. This adds a sanity check to make sure the returned index buffe...

CVE-2022-50442

The CVE-2022-50442 entry describes a Linux kernel NTFS3 issue where indx_read did not sufficiently validate index buffer length during parsing, enabling a potential out-of-bounds memory access (observed as a slab-out-of-bounds read under KASAN). The vulnerability is tied to NTFS directory operati...

CVE-2025-39928

In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the xfer length to 'rtl9300i2cconfigxfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not...

CVE-2025-39898

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

UBUNTU-CVE-2025-39928

In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the xfer length to 'rtl9300i2cconfigxfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not...

CVE-2025-39928 i2c: rtl9300: ensure data length is within supported range

In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the xfer length to 'rtl9300i2cconfigxfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not...

CVE-2025-39928

CVE-2025-39928 concerns the Linux kernel rtl9300 I2C driver. The issue arises in rtl9300_i2c_config_xfer where transfer length validation was missing, allowing a data length of 0 to be processed. The hardware supports data lengths 1–16 (N+1 with 4 DATA_WIDTH bits), so a zero length can underflow ...

CVE-2025-39928 i2c: rtl9300: ensure data length is within supported range

In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the xfer length to 'rtl9300i2cconfigxfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not...

CVE-2025-39928

In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the xfer length to 'rtl9300i2cconfigxfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not...

CVE-2025-39928 i2c: rtl9300: ensure data length is within supported range

In the Linux kernel, the following vulnerability has been resolved: i2c: rtl9300: ensure data length is within supported range Add an explicit check for the xfer length to 'rtl9300i2cconfigxfer' to ensure the data length isn't within the supported range. In particular a data length of 0 is not...

CVE-2025-39917 bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds dynptr write in bpfcryptocrypt Stanislav reported that in bpfcryptocrypt the destination dynptr's size is not validated to be at least as large as the source dynptr's size before calling into the crypto...

CVE-2025-39898

...

Moderate: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

kernel: usb: dwc3: gadget: check that event count does not exceed event buffer length

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: check that event count does not exceed event buffer length The event count is read from register DWC3GEVNTCOUNT. There is a check for the count being zero, but not for exceeding the event buffer length. Check...