CVE-2023-53528

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If createqp does not fully succeed it is possible for qp cleanup code to attempt to drain the send or recv work queues before the queues have been created causing a seg fault. This patch...

CVE-2023-53459

In the Linux kernel, the following vulnerability has been resolved: HID: mcp-2221: prevent UAF in delayed work If the device is plugged/unplugged without giving time for mcpinitwork to complete, we might kick in the devm free code path and thus have unavailable struct mcp2221 while in delayed wor...

CVE-2022-50441

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Lag, fix failure to cancel delayed bond work Commit 0d4e8ed139d8 "net/mlx5: Lag, avoid lockdep warnings" accidentally removed a call to cancel delayed bond work thus it may cause queued delay to expire and fall on an...

UBUNTU-CVE-2023-53459

In the Linux kernel, the following vulnerability has been resolved: HID: mcp-2221: prevent UAF in delayed work If the device is plugged/unplugged without giving time for mcpinitwork to complete, we might kick in the devm free code path and thus have unavailable struct mcp2221 while in delayed wor...

UBUNTU-CVE-2023-53528

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If createqp does not fully succeed it is possible for qp cleanup code to attempt to drain the send or recv work queues before the queues have been created causing a seg fault. This patch...

UBUNTU-CVE-2022-50426

In the Linux kernel, the following vulnerability has been resolved: remoteproc: imxdsprproc: Add mutex protection for workqueue The workqueue may execute late even after remoteproc is stopped or stopping, some resources rpmsg device and endpoint have been released in rprocstopsubdevices, then...

UBUNTU-CVE-2022-50441

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Lag, fix failure to cancel delayed bond work Commit 0d4e8ed139d8 "net/mlx5: Lag, avoid lockdep warnings" accidentally removed a call to cancel delayed bond work thus it may cause queued delay to expire and fall on an...

CVE-2023-53530 scsi: qla2xxx: Use raw_smp_processor_id() instead of smp_processor_id()

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use rawsmpprocessorid instead of smpprocessorid The following call trace was observed: localhost kernel: nvme nvme0: NVME-FC0: controller connect complete localhost kernel: BUG: using smpprocessorid in preemptible...

CVE-2023-53530

CVE-2023-53530 details a Linux kernel issue in the qla2xxx SCSI driver: code path using smp_processor_id() in preemptible work leads to a bug trace. The patch replaces smp_processor_id() with raw_smp_processor_id() and updates driver scheduling to queue_work() (instead of queue_work_on()) to avoi...

CVE-2023-53528

CVE-2023-53528 affects the Linux kernel RDMA/rxe subsystem. The vulnerability arises from an unsafe drain-work-queue path in qp cleanup when create_qp does not fully complete; cleanup could attempt to drain send/recv queues before the queues exist, leading to a segfault. The fixed patch adds a gu...

CVE-2023-53528 RDMA/rxe: Fix unsafe drain work queue code

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If createqp does not fully succeed it is possible for qp cleanup code to attempt to drain the send or recv work queues before the queues have been created causing a seg fault. This patch...

CVE-2023-53528 RDMA/rxe: Fix unsafe drain work queue code

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix unsafe drain work queue code If createqp does not fully succeed it is possible for qp cleanup code to attempt to drain the send or recv work queues before the queues have been created causing a seg fault. This patch...

CVE-2023-53488 IB/hfi1: Fix possible panic during hotplug remove

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix possible panic during hotplug remove During hotplug remove it is possible that the update counters work might be pending, and may run after memory has been freed. Cancel the update counters work before freeing memory...

CVE-2023-53475 usb: xhci: tegra: fix sleep in atomic call

In the Linux kernel, the following vulnerability has been resolved: usb: xhci: tegra: fix sleep in atomic call When we set the dual-role port to Host mode, we observed the following splat: 167.057718 BUG: sleeping function called from invalid context at include/linux/sched/mm.h:229 167.057872...

CVE-2023-53459 HID: mcp-2221: prevent UAF in delayed work

In the Linux kernel, the following vulnerability has been resolved: HID: mcp-2221: prevent UAF in delayed work If the device is plugged/unplugged without giving time for mcpinitwork to complete, we might kick in the devm free code path and thus have unavailable struct mcp2221 while in delayed wor...

CVE-2023-53459

CVE-2023-53459 relates to the Linux kernel vulnerability HID: mcp-2221, which can cause a use-after-free in delayed work if a device is unplugged before mcp_init_work() completes. The issue is addressed by cancel_delayed_work_sync, which prevents the delayed_work item from requeueing. Affected co...

CVE-2023-53459 HID: mcp-2221: prevent UAF in delayed work

In the Linux kernel, the following vulnerability has been resolved: HID: mcp-2221: prevent UAF in delayed work If the device is plugged/unplugged without giving time for mcpinitwork to complete, we might kick in the devm free code path and thus have unavailable struct mcp2221 while in delayed wor...

CVE-2022-50441 net/mlx5: Lag, fix failure to cancel delayed bond work

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Lag, fix failure to cancel delayed bond work Commit 0d4e8ed139d8 "net/mlx5: Lag, avoid lockdep warnings" accidentally removed a call to cancel delayed bond work thus it may cause queued delay to expire and fall on an...

CVE-2022-50441

CVE-2022-50441 details (Linux kernel, net/mlx5): A bug introduced by commit 0d4e8ed139d8 removed a call to cancel_delayed_work_sync(), which could cause a queued delay to expire on an already destroyed workqueue, potentially leading to a kernel NULL pointer dereference. The fix restores cancel_de...

CVE-2022-50441 net/mlx5: Lag, fix failure to cancel delayed bond work

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Lag, fix failure to cancel delayed bond work Commit 0d4e8ed139d8 "net/mlx5: Lag, avoid lockdep warnings" accidentally removed a call to cancel delayed bond work thus it may cause queued delay to expire and fall on an...