UBUNTU-CVE-2023-54109

In the Linux kernel, the following vulnerability has been resolved: media: rcarfdp1: Fix refcount leak in probe and remove function rcarfcpget take reference, which should be balanced with rcarfcpput. Add missing rcarfcpput in fdp1remove and the error paths of fdp1probe to fix this. hverkuil:...

CVE-2023-54117 s390/dcssblk: fix kernel crash with list_add corruption

In the Linux kernel, the following vulnerability has been resolved: s390/dcssblk: fix kernel crash with listadd corruption Commit fb08a1908cb1 "dax: simplify the daxdevice gendisk association" introduced new logic for gendisk association, requiring drivers to explicitly call daxaddhost and...

CVE-2023-54117

CVE-2023-54117 affects the Linux kernel (s390/dcssblk) and is resolved by a patch that fixes list_add corruption causing kernel crashes during device add/remove cycles. The root cause was missing dax_remove_host() calls in dcssblk and an error-path handling issue that could leave a stale xarray e...

CVE-2023-54117 s390/dcssblk: fix kernel crash with list_add corruption

In the Linux kernel, the following vulnerability has been resolved: s390/dcssblk: fix kernel crash with listadd corruption Commit fb08a1908cb1 "dax: simplify the daxdevice gendisk association" introduced new logic for gendisk association, requiring drivers to explicitly call daxaddhost and...

CVE-2023-54109

CVE-2023-54109 affects the Linux kernel in media: rcar_fdp1. The vulnerability was due to a refcount leak: rcar_fcp_get() references were not balanced with rcar_fcp_put() in fdp1_probe error paths and in fdp1_remove. The fix adds the missing rcar_fcp_put() calls to balance references, addressing ...

CVE-2023-54109 media: rcar_fdp1: Fix refcount leak in probe and remove function

In the Linux kernel, the following vulnerability has been resolved: media: rcarfdp1: Fix refcount leak in probe and remove function rcarfcpget take reference, which should be balanced with rcarfcpput. Add missing rcarfcpput in fdp1remove and the error paths of fdp1probe to fix this. hverkuil:...

CVE-2023-54109 media: rcar_fdp1: Fix refcount leak in probe and remove function

In the Linux kernel, the following vulnerability has been resolved: media: rcarfdp1: Fix refcount leak in probe and remove function rcarfcpget take reference, which should be balanced with rcarfcpput. Add missing rcarfcpput in fdp1remove and the error paths of fdp1probe to fix this. hverkuil:...

CVE-2023-54103 media: mtk-jpeg: Fix use after free bug due to uncanceled work

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to uncanceled work In mtkjpegprobe, &jpeg-jobtimeoutwork is bound with mtkjpegjobtimeoutwork. Then mtkjpegdecdevicerun and mtkjpegencdevicerun may be called to start the work. If we...

CVE-2023-54100

CVE-2023-54100 is described in connected Astra Linux advisory as a Linux kernel use-after-free in the SCSI qedi driver, specifically in qedi_remove(). The advisory notes that during driver removal, recovery work and board disable work scheduled by qedi_probe() are not finished before cleanup, all...

CVE-2023-54100 scsi: qedi: Fix use after free bug in qedi_remove()

In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix use after free bug in qediremove In qediprobe we call qediprobe which initializes &qedi-recoverywork with qedirecoveryhandler and &qedi-boarddisablework with qediboarddisablework. When qedischedulerecoveryhandler ...

CVE-2023-54100 scsi: qedi: Fix use after free bug in qedi_remove()

In the Linux kernel, the following vulnerability has been resolved: scsi: qedi: Fix use after free bug in qediremove In qediprobe we call qediprobe which initializes &qedi-recoverywork with qedirecoveryhandler and &qedi-boarddisablework with qediboarddisablework. When qedischedulerecoveryhandler ...

CVE-2023-54078 media: max9286: Free control handler

In the Linux kernel, the following vulnerability has been resolved: media: max9286: Free control handler The control handler is leaked in some probe-time error paths, as well as in the remove path. Fix it...

CVE-2023-54079 power: supply: bq27xxx: Fix poll_interval handling and races on remove

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx: Fix pollinterval handling and races on remove Before this patch bq27xxxbatteryteardown was setting pollinterval = 0 to avoid bq27xxxbatteryupdate requeuing the delayedwork item. There are 2 problems with...

CVE-2023-54058 firmware: arm_ffa: Check if ffa_driver remove is present before executing

In the Linux kernel, the following vulnerability has been resolved: firmware: armffa: Check if ffadriver remove is present before executing Currently ffadrv-remove is called unconditionally from ffadeviceremove. Since the driver registration doesn't check for it and allows it to be registered...

CVE-2023-54053

CVE-2023-54053 is a Linux kernel issue affecting the iwlwifi PCIe path, causing a NULL pointer dereference during device removal after a failed iwl_pci_probe(). The vulnerability is described in connected vendor advisories as a fix for a crash when removing a device while its transmission structu...

CVE-2023-54044 spmi: Add a check for remove callback when removing a SPMI driver

In the Linux kernel, the following vulnerability has been resolved: spmi: Add a check for remove callback when removing a SPMI driver When removing a SPMI driver, there can be a crash due to NULL pointer dereference if it does not have a remove callback defined. This is one such call trace observ...

CVE-2023-54044 spmi: Add a check for remove callback when removing a SPMI driver

In the Linux kernel, the following vulnerability has been resolved: spmi: Add a check for remove callback when removing a SPMI driver When removing a SPMI driver, there can be a crash due to NULL pointer dereference if it does not have a remove callback defined. This is one such call trace observ...

CVE-2023-54044

Technical details about CVE-2023-54044 (Linux spmi remove callback crash) are not publicly provided in the supplied documents; monitor for updates.

CVE-2022-50714

CVE-2022-50714 involves a Linux kernel driver issue in wifi mt76/mt7921e. The crash occurs during insmod/rmmod stress testing due to a missing mt76_dev in mt7921_pci_remove(), with the drvdata not guaranteed ready when probe() finishes. The result is a KASAN user-memory-access write (8 bytes) dur...

CVE-2025-68743 mshv: Fix create memory region overlap check

In the Linux kernel, the following vulnerability has been resolved: mshv: Fix create memory region overlap check The current check is incorrect; it only checks if the beginning or end of a region is within an existing region. This doesn't account for userspace specifying a region that begins befo...