kernel: net/sched: sch_fq: fix integer overflow of "credit"

An integer overflow flaw was found in the Linux kernel network fair-queueing scheduler in the way the initial per-flow credit is set. If a configuration provides an excessively large initial quantum, the credit value can overflow to a negative number, leading to excessive scheduling and soft...

kernel: block, bfq: fix possible uaf for 'bfqq->bic'

In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix possible uaf for 'bfqq-bic' Our test report a uaf for 'bfqq-bic' in 5.10: ================================================================== BUG: KASAN: use-after-free in bfqselectqueue+0x378/0xa30 CPU: 6 PID:...

kernel: virtio-blk: Avoid use-after-free on suspend/resume

In the Linux kernel, the following vulnerability has been resolved: virtio-blk: Avoid use-after-free on suspend/resume hctx-userdata is set to vq in virtblkinithctx. However, vq is freed on suspend and reallocated on resume. So, hctx-userdata is invalid after resume, and it will cause...

kernel: watch_queue: Actually free the watch

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Actually free the watch freewatch does everything barring actually freeing the watch object. Fix this by adding the missing kfree. kmemleak produces a report something like the following. Note that as an address can b...

kernel: watch_queue: Fix NULL dereference in error cleanup

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix NULL dereference in error cleanup In watchqueuesetsize, the error cleanup code doesn't take account of the fact that freepage can't handle a NULL pointer when trying to free up buffer pages that did get allocated...

kernel: blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none

In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix NULL dereference on q-elevator in blkmqelvswitchnone After grabbing q-sysfslock, q-elevator may become NULL because of elevator switch. Fix the NULL dereference on q-elevator by checking it with lock...

kernel: null_blk: Always check queue mode setting from configfs

A missing validation flaw was found in the Linux kernel nullblk driver's configuration handling. A local user with access to configfs can configure a nullblk device with queuemode set to 1 legacy I/O path, which is no longer supported, causing the driver to proceed without proper validation and...

kernel: Linux kernel: Denial of Service due to deadlock in Universal Flash Storage driver

A flaw was found in the Linux kernel. A local attacker with low privileges could exploit a deadlock vulnerability in the Universal Flash Storage UFS host controller driver ufshcd. This occurs when the error handler and a Command Queue CQ event interrupt attempt to acquire the same lock...

kernel: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp

In the Linux kernel, the following vulnerability has been resolved: tcp/udp: Fix memleaks of sk and zerocopy skbs with TX timestamp. syzkaller reported 0 memory leaks of an UDP socket and ZEROCOPY skbs. We can reproduce the problem with these sequences: sk = socketAFINET, SOCKDGRAM, 0...

kernel: virtio_net: Fix error unwinding of XDP initialization

In the Linux kernel, the following vulnerability has been resolved: virtionet: Fix error unwinding of XDP initialization When initializing XDP in virtnetopen, some rq xdp initialization may hit an error causing net device open failed. However, previous rqs have already initialized XDP and enabled...

kernel: blk-cgroup: hold queue_lock when removing blkg->q_node

A locking flaw was found in the Linux kernel's block cgroup subsystem. When removing blkg-qnode from q-blkglist in blkgfreeworkfn, the code fails to hold queuelock. This missing lock allows concurrent access from blkgdestroyall, leading to list corruption and potential hard lockups...

kernel: mlx5: fix possible ptp queue fifo use-after-free

In the Linux kernel, the following vulnerability has been resolved: mlx5: fix possible ptp queue fifo use-after-free Fifo indexes are not checked during pop operations and it leads to potential use-after-free when poping from empty queue. Such case was possible during re-sync action. WARNONONCE...

kernel: ice: xsk: disable txq irq before flushing hw

In the Linux kernel, the following vulnerability has been resolved: ice: xsk: disable txq irq before flushing hw iceqpdis intends to stop a given queue pair that is a target of xsk pool attach/detach. One of the steps is to disable interrupts on these queues. It currently is broken in a way that...

PT-2025-41079

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter conntrack component where the timeout value of an unconfirmed conntrack is handled incorrectly. When setting the timeout via the ctnetlink change timeout...

PT-2025-13371

Name of the Vulnerable Software and Affected Versions Linux Kernel affected versions not specified Description A use-after-free issue in the nfsd4 ssc setup dul function has been identified. This occurs when signal pending returns true, causing schedule timeout to not be executed and leaving the...

PT-2025-8278

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data-race issue in the Linux kernel has been identified, specifically in the unix dgram peer wake me function. The unix dgram poll function calls unix dgram peer wake me without holdin...

Rocky Linux 8 : qt5-qtbase and qt5-qtwebsockets (RLSA-2020:4690)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4690 advisory. - Qt through 5.14 allows an exponential XML entity expansion attack via a crafted SVG document that is mishandled in QXmlStreamReader, a related issue t...

SUSE CVE-2023-39017

quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessageJob.execute. This vulnerability is exploited via passing an unchecked argument. NOTE: this is disputed by multiple parties because it is not plausible that...

BIT-2023-39325

A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a ne...

Arena Simulation Buffer Overflow Code Execution

The vulnerability of the Arena Simulation software for modeling and automating discrete events is related to the possibility of buffer overflow attacks. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...