Linux Kernel vulnerabilities

CVE-2025-21928 [HIGH] CWE-416 CVE-2025-21928: In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-aft In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experience a random crash a few minutes after the driver is removed. This issue occurs due to improper handling of memory freeing in the ishtp_hid_remove() function. The function currently frees the `d

CVE-2023-53619 [HIGH] CWE-416 CVE-2023-53619: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: Avoid nf_ In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: Avoid nf_ct_helper_hash uses after free If nf_conntrack_init_start() fails (for example due to a register_nf_conntrack_bpf() failure), the nf_conntrack_helper_fini() clean-up path frees the nf_ct_helper_hash map. When built with NF_CONNTRACK=y, further netfilte

CVE-2023-53053 [HIGH] CVE-2023-53053: In the Linux kernel, the following vulnerability has been resolved: erspan: do not use skb_mac_head In the Linux kernel, the following vulnerability has been resolved: erspan: do not use skb_mac_header() in ndo_start_xmit() Drivers should not assume skb_mac_header(skb) == skb->data in their ndo_start_xmit(). Use skb_network_offset() and skb_transport_offset() which better describe what is needed in erspan_fb_xmit() and ip6erspan_tunnel_xmit() syzbot repo

CVE-2024-58003 [HIGH] CWE-787 CVE-2024-58003: In the Linux kernel, the following vulnerability has been resolved: media: i2c: ds90ub9x3: Fix extr In the Linux kernel, the following vulnerability has been resolved: media: i2c: ds90ub9x3: Fix extra fwnode_handle_put() The ub913 and ub953 drivers call fwnode_handle_put(priv->sd.fwnode) as part of their remove process, and if the driver is removed multiple times, eventually leads to put "overflow", possibly causing memory corruption or crash. The

CVE-2024-26620 [HIGH] CWE-787 CVE-2024-26620: In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: always filter ent In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: always filter entire AP matrix The vfio_ap_mdev_filter_matrix function is called whenever a new adapter or domain is assigned to the mdev. The purpose of the function is to update the guest's AP configuration by filtering the matrix of adapters and domains assigned to t

CVE-2023-53340 [HIGH] CWE-129 CVE-2023-53340: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failu In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Collect command failures data only for known commands DEVX can issue a general command, which is not used by mlx5 driver. In case such command is failed, mlx5 is trying to collect the failure data, However, mlx5 doesn't create a storage for this command, since mlx5 doesn't

CVE-2025-21714 [HIGH] CWE-416 CVE-2025-21714: In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP use In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix implicit ODP use after free Prevent double queueing of implicit ODP mr destroy work by using __xa_cmpxchg() to make sure this is the only time we are destroying this specific mr. Without this change, we could try to invalidate this mr twice, which in turn could result

CVE-2025-71238 [HIGH] CWE-415 CVE-2025-71238: In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() c In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix bsg_done() causing double free Kernel panic observed on system, [5353358.825191] BUG: unable to handle page fault for address: ff5f5e897b024000 [5353358.825194] #PF: supervisor write access in kernel mode [5353358.825195] #PF: error_code(0x0002) - not-present page

CVE-2025-38572 [HIGH] CVE-2025-38572: In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets In the Linux kernel, the following vulnerability has been resolved: ipv6: reject malicious packets in ipv6_gso_segment() syzbot was able to craft a packet with very long IPv6 extension headers leading to an overflow of skb->transport_header. This 16bit field has a limited range. Add skb_reset_transport_header_careful() helper and use it from ipv6_gso_segmen

CVE-2025-21923 [HIGH] CWE-416 CVE-2025-21923: In the Linux kernel, the following vulnerability has been resolved: HID: hid-steam: Fix use-after-f In the Linux kernel, the following vulnerability has been resolved: HID: hid-steam: Fix use-after-free when detaching device When a hid-steam device is removed it must clean up the client_hdev used for intercepting hidraw access. This can lead to scheduling deferred work to reattach the input device. Though the cleanup cancels the deferred work, this

CVE-2025-21929 [HIGH] CWE-416 CVE-2025-21929: In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-aft In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() During the `rmmod` operation for the `intel_ishtp_hid` driver, a use-after-free issue can occur in the hid_ishtp_cl_remove() function. The function hid_ishtp_cl_deinit() is called before ishtp_hid_remove(), which c

CVE-2023-53621 [HIGH] CWE-476 CVE-2023-53621: In the Linux kernel, the following vulnerability has been resolved: memcontrol: ensure memcg acquir In the Linux kernel, the following vulnerability has been resolved: memcontrol: ensure memcg acquired by id is properly set up In the eviction recency check, we attempt to retrieve the memcg to which the folio belonged when it was evicted, by the memcg id stored in the shadow entry. However, there is a chance that the retrieved memcg is not the origi

CVE-2025-37923 [HIGH] CWE-787 CVE-2025-37923: In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace In the Linux kernel, the following vulnerability has been resolved: tracing: Fix oob write in trace_seq_to_buffer() syzbot reported this bug: BUG: KASAN: slab-out-of-bounds in trace_seq_to_buffer kernel/trace/trace.c:1830 [inline] BUG: KASAN: slab-out-of-bounds in tracing_splice_read_pipe+0x6be/0xdd0 kernel/trace/trace.c:6822 Write of size 4507 at ad

CVE-2023-53142 [HIGH] CWE-787 CVE-2023-53142: In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") In this refactor, ice_get_module_eeprom() reads the eeprom in blocks of size 8. But the condition that should protect

CVE-2025-22022 [HIGH] CWE-787 CVE-2025-22022: In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Apply the link chain quirk on NEC isoc endpoints Two clearly different specimens of NEC uPD720200 (one with start/stop bug, one without) were seen to cause IOMMU faults after some Missed Service Errors. Faulting address is immediately after a transfer ring segment and patc

CVE-2025-38077 [HIGH] CWE-787 CVE-2025-38077: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() If the 'buf' array received from the user contains an empty string, the 'length' variable will be zero. Accessing the 'buf' array element with index 'length - 1' will result in a buffer overflow. Add a c

CVE-2023-52935 [HIGH] CWE-416 CVE-2023-52935: In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma r In the Linux kernel, the following vulnerability has been resolved: mm/khugepaged: fix ->anon_vma race If an ->anon_vma is attached to the VMA, collapse_and_free_pmd() requires it to be locked. Page table traversal is allowed under any one of the mmap lock, the anon_vma lock (if the VMA is associated with an anon_vma), and the mapping lock (if the V

CVE-2023-53065 [HIGH] CWE-787 CVE-2023-53065: In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix perf_output_begi In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output syzkaller reportes a KASAN issue with stack-out-of-bounds. The call trace is as follows: dump_stack+0x9c/0xd3 print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasa

CVE-2022-49789 [HIGH] CWE-415 CVE-2022-49789: In the Linux kernel, the following vulnerability has been resolved: scsi: zfcp: Fix double free of In the Linux kernel, the following vulnerability has been resolved: scsi: zfcp: Fix double free of FSF request when qdio send fails We used to use the wrong type of integer in 'zfcp_fsf_req_send()' to cache the FSF request ID when sending a new FSF request. This is used in case the sending fails and we need to remove the request from our internal hash

CVE-2022-50050 [HIGH] CWE-787 CVE-2022-50050: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix pote In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() snprintf() returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in the buffer overflow (although it's unrealistic). This patch replaces with a safer vers