Linux Kernel vulnerabilities

CVE-2021-47475 [HIGH] CWE-787 CVE-2021-47475: In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-b In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix transfer-buffer overflows The driver uses endpoint-sized USB transfer buffers but up until recently had no sanity checks on the sizes. Commit e1f13c879a7c ("staging: comedi: check validity of wMaxPacketSize of usb endpoints found") inadvertently fixed NULL-point

CVE-2023-52614 [HIGH] CWE-120 CVE-2023-52614: In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overfl In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overflow in trans_stat_show Fix buffer overflow in trans_stat_show(). Convert simple snprintf to the more secure scnprintf with size of PAGE_SIZE. Add condition checking if we are exceeding PAGE_SIZE and exit early from loop. Also add at the end a warning t

CVE-2022-49111 [HIGH] CWE-416 CVE-2022-49111: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free i In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix use after free in hci_send_acl This fixes the following trace caused by receiving HCI_EV_DISCONN_PHY_LINK_COMPLETE which does call hci_conn_del without first checking if conn->type is in fact AMP_LINK and in case it is do properly cleanup upper layers with hci_disconn_

CVE-2024-50073 [HIGH] CWE-416 CVE-2024-50073: In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Fix use-after-free In the Linux kernel, the following vulnerability has been resolved: tty: n_gsm: Fix use-after-free in gsm_cleanup_mux BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0 drivers/tty/n_gsm.c:3160 [n_gsm] Read of size 8 at addr ffff88815fe99c00 by task poc/3379 CPU: 0 UID: 0 PID: 3379 Comm: poc Not tainted 6.11.0+ #56 Hardware name: VMware, I

CVE-2024-40954 [HIGH] CWE-416 CVE-2024-40954: In the Linux kernel, the following vulnerability has been resolved: net: do not leave a dangling sk In the Linux kernel, the following vulnerability has been resolved: net: do not leave a dangling sk pointer, when socket creation fails It is possible to trigger a use-after-free by: * attaching an fentry probe to __sock_release() and the probe calling the bpf_get_socket_cookie() helper * running traceroute -I 1.1.1.1 on a freshly booted VM A KASAN

CVE-2024-38583 [HIGH] CWE-416 CVE-2024-38583: In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of t In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix use-after-free of timer for log writer thread Patch series "nilfs2: fix log writer related issues". This bug fix series covers three nilfs2 log writer-related issues, including a timer use-after-free issue and potential deadlock issue on unmount, and a potential freeze i

CVE-2025-21753 [HIGH] CWE-416 CVE-2025-21753: In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction When we are trying to join the current transaction and if it's aborted, we read its 'aborted' field after unlocking fs_info->trans_lock and without holding any extra reference count on it. This means that a concu

CVE-2024-50257 [HIGH] CWE-416 CVE-2024-50257: In the Linux kernel, the following vulnerability has been resolved: netfilter: Fix use-after-free i In the Linux kernel, the following vulnerability has been resolved: netfilter: Fix use-after-free in get_info() ip6table_nat module unload has refcnt warning for UAF. call trace is: WARNING: CPU: 1 PID: 379 at kernel/module/main.c:853 module_put+0x6f/0x80 Modules linked in: ip6table_nat(-) CPU: 1 UID: 0 PID: 379 Comm: ip6tables Not tainted 6.12.0-rc

CVE-2024-36979 [HIGH] CWE-416 CVE-2024-36979: In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use- In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: fix vlan use-after-free syzbot reported a suspicious rcu usage[1] in bridge's mst code. While fixing it I noticed that nothing prevents a vlan to be freed while walking the list from the same path (br forward delay timer). Fix the rcu usage and also make sure we are

CVE-2021-47131 [HIGH] CWE-416 CVE-2021-47131: In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix use-after-free aft In the Linux kernel, the following vulnerability has been resolved: net/tls: Fix use-after-free after the TLS device goes down and up When a netdev with active TLS offload goes down, tls_device_down is called to stop the offload and tear down the TLS context. However, the socket stays alive, and it still points to the TLS context, which is now deallo

CVE-2024-57979 [HIGH] CWE-416 CVE-2024-57979: In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a In the Linux kernel, the following vulnerability has been resolved: pps: Fix a use-after-free On a board running ntpd and gpsd, I'm seeing a consistent use-after-free in sys_exit() from gpsd when rebooting: pps pps1: removed ------------[ cut here ]------------ kobject: '(null)' (00000000db4bec24): is not initialized, yet kobject_put() is being calle

CVE-2024-56608 [HIGH] CWE-129 CVE-2024-56608: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bou In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the hpd_source index was used to reference the link_enc_hpd_regs array. This array has a fixed siz

CVE-2024-44987 [HIGH] CWE-416 CVE-2024-44987: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_s In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A similar issue has been fixed in commit a688caa34beb ("ipv6: take rcu lock in rawv6_send_hdr

CVE-2024-43839 [HIGH] CWE-787 CVE-2024-43839: In the Linux kernel, the following vulnerability has been resolved: bna: adjust 'name' buf size of In the Linux kernel, the following vulnerability has been resolved: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures To have enough space to write all possible sprintf() args. Currently 'name' size is 16, but the first '%s' specifier may already need at least 16 characters, since 'bnad->netdev->name' is used there. For '%d' specifiers, a

CVE-2024-39463 [HIGH] CWE-416 CVE-2024-39463: In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around In the Linux kernel, the following vulnerability has been resolved: 9p: add missing locking around taking dentry fid list Fix a use-after-free on dentry's d_fsdata fid list when a thread looks up a fid through dentry while another thread unlinks it: UAF thread: refcount_t: addition on 0; use-after-free. p9_fid_get linux/./include/net/9p/client.h:262

CVE-2021-47328 [HIGH] CWE-416 CVE-2021-47328: In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn use after In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi: Fix conn use after free during resets If we haven't done a unbind target call we can race where iscsi_conn_teardown wakes up the EH thread and then frees the conn while those threads are still accessing the conn ehwait. We can only do one TMF per session so this just mo

CVE-2022-48632 [HIGH] CWE-787 CVE-2022-48632: In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: prevent stack overf In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() memcpy() is called in a loop while 'operation->length' upper bound is not checked and 'data_idx' also increments.

CVE-2024-26754 [HIGH] CWE-416 CVE-2024-26754: In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and nul In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() The gtp_net_ops pernet operations structure for the subsystem must be registered before registering the generic netlink family. Syzkaller hit 'general protection fault in gtp_genl_dump_pdp' bug: general protection fa

CVE-2022-4139 [HIGH] CWE-281 CVE-2022-4139: An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially lea An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system.

CVE-2023-53003 [HIGH] CWE-416 CVE-2023-53003: In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_dri In the Linux kernel, the following vulnerability has been resolved: EDAC/qcom: Do not pass llcc_driv_data as edac_device_ctl_info's pvt_info The memory for llcc_driv_data is allocated by the LLCC driver. But when it is passed as the private driver info to the EDAC core, it will get freed during the qcom_edac driver release. So when the qcom_edac driv