CVE-2022-50741

In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Disable useless interrupt to avoid kernel panic There is a hardware bug that the interrupt STMBUFHALF may be triggered after or when disable interrupt. It may led to unexpected kernel panic. And interrupt...

CVE-2023-54159

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu-lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it m...

UBUNTU-CVE-2023-54086

In the Linux kernel, the following vulnerability has been resolved: bpf: Add preemptcountsub,add into btf id deny list The recursion check in bpfprogenter and bpfprogexit leave preemptcountsub,add unprotected. When attaching trampoline to them we get panic as follows, 867.843050 BUG: TASK stack...

UBUNTU-CVE-2023-54140

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix WARNING in markbufferdirty due to discarded buffer reuse A syzbot stress test using a corrupted disk image reported that markbufferdirty called from nilfsmarkinodedirty or nilfspalloccommitallocentry may output a kern...

CVE-2023-54129

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmactypeid, etc. Kernel derives lmactype based on lmactypeid received from...

UBUNTU-CVE-2023-54129

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmactypeid, etc. Kernel derives lmactype based on lmactypeid received from...

CVE-2023-54159 usb: mtu3: fix kernel panic at qmu transfer done irq handler

In the Linux kernel, the following vulnerability has been resolved: usb: mtu3: fix kernel panic at qmu transfer done irq handler When handle qmu transfer irq, it will unlock @mtu-lock before give back request, if another thread handle disconnect event at the same time, and try to disable ep, it m...

CVE-2023-54140

CVE-2023-54140 affects the Linux kernel nilfs2 subsystem. A bug in mark_buffer_dirty() could emit a kernel warning when buffers are reused from local structures and then discarded by nilfs_clear_dirty_page(), potentially triggering a panic if panic_on_warn is enabled. The issue was reported via s...

CVE-2023-54140 nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix WARNING in markbufferdirty due to discarded buffer reuse A syzbot stress test using a corrupted disk image reported that markbufferdirty called from nilfsmarkinodedirty or nilfspalloccommitallocentry may output a kern...

CVE-2023-54129 octeontx2-af: Add validation for lmac type

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmactypeid, etc. Kernel derives lmactype based on lmactypeid received from...

CVE-2023-54129 octeontx2-af: Add validation for lmac type

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Add validation for lmac type Upon physical link change, firmware reports to the kernel about the change along with the details like speed, lmactypeid, etc. Kernel derives lmactype based on lmactypeid received from...

CVE-2023-54129

CVE-2023-54129 concerns the Linux kernel driver for Marvell octeontx2-af (cgx.c). When a physical link changes, firmware reports lmac_type_id to the kernel, which derives lmac_type from it. In some cases, firmware could return an invalid lmac_type_id, triggering a kernel Oops. The public records ...

CVE-2023-54120 Bluetooth: Fix race condition in hidp_session_thread

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix race condition in hidpsessionthread There is a potential race condition in hidpsessionthread that may lead to use-after-free. For instance, the timer is active while hidpdeltimer is called in hidpsessionthread. Aft...

CVE-2023-54114 net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()

In the Linux kernel, the following vulnerability has been resolved: net: nsh: Use correct macoffset to unwind gso skb in nshgsosegment As the call trace shows, skbpanic was caused by wrong skb-macheader in nshgsosegment: invalid opcode: 0000 1 PREEMPT SMP KASAN PTI CPU: 3 PID: 2737 Comm: syz Not...

CVE-2023-54114

CVE-2023-54114 — Linux kernel (net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment()) A Linux kernel vulnerability arises in nsh_gso_segment() where the mac_header is restored using an incorrect mac_offset, derived from the network_header difference (nhoff). The root cause is th...

CVE-2023-54090 ixgbe: Fix panic during XDP_TX with > 64 CPUs

In the Linux kernel, the following vulnerability has been resolved: ixgbe: Fix panic during XDPTX with 64 CPUs Commit 4fe815850bdc "ixgbe: let the xdpdrv work with more than 64 cpus" adds support to allow XDP programs to run on systems with more than 64 CPUs by locking the XDP TX rings and indexi...

CVE-2023-54090

CVE-2023-54090 affects the Linux kernel ixgbe XDP path on systems with more than 64 CPUs. Root cause: ixgbe_determine_xdp_q_idx could return cpu instead of cpu % IXGBE_MAX_XDP_QS, leading to an array-index-out-of-bounds in ixgbe.h and a kernel panic (and potential NULL dereference) when XDP_TX ru...

CVE-2023-54090 ixgbe: Fix panic during XDP_TX with > 64 CPUs

In the Linux kernel, the following vulnerability has been resolved: ixgbe: Fix panic during XDPTX with 64 CPUs Commit 4fe815850bdc "ixgbe: let the xdpdrv work with more than 64 cpus" adds support to allow XDP programs to run on systems with more than 64 CPUs by locking the XDP TX rings and indexi...

CVE-2023-54086 bpf: Add preempt_count_{sub,add} into btf id deny list

In the Linux kernel, the following vulnerability has been resolved: bpf: Add preemptcountsub,add into btf id deny list The recursion check in bpfprogenter and bpfprogexit leave preemptcountsub,add unprotected. When attaching trampoline to them we get panic as follows, 867.843050 BUG: TASK stack...

CVE-2022-50768 scsi: smartpqi: Correct device removal for multi-actuator devices

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Correct device removal for multi-actuator devices Correct device count for multi-actuator drives which can cause kernel panics...