Linux Kernel vulnerabilities

CVE-2023-52980 [HIGH] CWE-787 CVE-2023-52980: In the Linux kernel, the following vulnerability has been resolved: block: ublk: extending queue_si In the Linux kernel, the following vulnerability has been resolved: block: ublk: extending queue_size to fix overflow When validating drafted SPDK ublk target, in a case that assigning large queue depth to multiqueue ublk device, ublk target would run into a weird incorrect state. During rounds of review and debug, An overflow bug was found in ublk d

CVE-2024-42301 [HIGH] CWE-129 CVE-2024-42301: In the Linux kernel, the following vulnerability has been resolved: dev/parport: fix the array out- In the Linux kernel, the following vulnerability has been resolved: dev/parport: fix the array out-of-bounds risk Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not overflowed. Below is the stack trace I encountered during the actual issue: [ 66.575408s] [p

CVE-2024-36895 [HIGH] CWE-787 CVE-2024-36895: In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: use correct b In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: use correct buffer size when parsing configfs lists This commit fixes uvc gadget support on 32-bit platforms. Commit 0df28607c5cb ("usb: gadget: uvc: Generalise helper functions for reuse") introduced a helper function __uvcg_iter_item_entries() to aid with parsing

CVE-2021-47261 [HIGH] CWE-706 CVE-2021-47261: In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fr In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix initializing CQ fragments buffer The function init_cq_frag_buf() can be called to initialize the current CQ fragments buffer cq->buf, or the temporary cq->resize_buf that is filled during CQ resize operation. However, the offending commit started to use function get_cqe

CVE-2021-47293 [HIGH] CVE-2021-47293: In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: Skip non In the Linux kernel, the following vulnerability has been resolved: net/sched: act_skbmod: Skip non-Ethernet packets Currently tcf_skbmod_act() assumes that packets use Ethernet as their L2 protocol, which is not always the case. As an example, for CAN devices: $ ip link add dev vcan0 type vcan $ ip link set up vcan0 $ tc qdisc add dev vcan0 root handle 1:

CVE-2021-47148 [HIGH] CWE-787 CVE-2021-47148: In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix a buffer over In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context() This function is called from ethtool_set_rxfh() and "*rss_context" comes from the user. Add some bounds checking to prevent memory corruption.

CVE-2024-26608 [HIGH] CWE-125 CVE-2024-26608: In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix global oob in ksmbd_ In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix global oob in ksmbd_nl_policy Similar to a reported issue (check the commit b33fb5b801c6 ("net: qualcomm: rmnet: fix global oob in rmnet_policy"), my local fuzzer finds another global out-of-bounds read for policy ksmbd_nl_policy. See bug trace below: BUG: KASAN: global-o

CVE-2025-21858 [HIGH] CWE-416 CVE-2025-21858: In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in g In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in geneve_find_dev() [0] without repro. geneve_configure() links struct geneve_dev.next to net_generic(net, geneve_net_id)->geneve_list. The net here could differ from dev_net(dev) if IFLA_NET_NS_P

CVE-2024-47751 [HIGH] CWE-120 CVE-2024-47751: In the Linux kernel, the following vulnerability has been resolved: PCI: kirin: Fix buffer overflow In the Linux kernel, the following vulnerability has been resolved: PCI: kirin: Fix buffer overflow in kirin_pcie_parse_port() Within kirin_pcie_parse_port(), the pcie->num_slots is compared to pcie->gpio_id_reset size (MAX_PCI_SLOTS) which is correct and would lead to an overflow. Thus, fix condition to pcie->num_slots + 1 >= MAX_PCI_SLOTS and move

CVE-2024-46782 [HIGH] CWE-416 CVE-2024-46782: In the Linux kernel, the following vulnerability has been resolved: ila: call nf_unregister_net_hoo In the Linux kernel, the following vulnerability has been resolved: ila: call nf_unregister_net_hooks() sooner syzbot found an use-after-free Read in ila_nf_input [1] Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hooks(). It should be done in the reverse way, with a synchronize_rcu(). This is a good match

CVE-2022-48867 [HIGH] CWE-416 CVE-2022-48867: In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Prevent use af In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Prevent use after free on completion memory On driver unload any pending descriptors are flushed at the time the interrupt is freed: idxd_dmaengine_drv_remove() -> drv_disable_wq() -> idxd_wq_free_irq() -> idxd_flush_pending_descs(). If there are any descriptors pre

CVE-2022-48674 [HIGH] CWE-416 CVE-2022-48674: In the Linux kernel, the following vulnerability has been resolved: erofs: fix pcluster use-after-f In the Linux kernel, the following vulnerability has been resolved: erofs: fix pcluster use-after-free on UP platforms During stress testing with CONFIG_SMP disabled, KASAN reports as below: BUG: KASAN: use-after-free in __mutex_lock+0xe5/0xc30 Read of size 8 at addr ffff8881094223f8 by task stress/7789 CPU: 0 PID: 7789 Comm: stress Not tainted 6.0

CVE-2021-47268 [HIGH] CVE-2021-47268: In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: cancel vdm an In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: cancel vdm and state machine hrtimer when unregister tcpm port A pending hrtimer may expire after the kthread_worker of tcpm port is destroyed, see below kernel dump when do module unload, fix it by cancel the 2 hrtimers. [ 111.517018] Unable to handle kernel paging reques

CVE-2024-26724 [HIGH] CWE-416 CVE-2024-26724: In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DPLL, Fix possible us In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DPLL, Fix possible use after free after delayed work timer triggers I managed to hit following use after free warning recently: [ 2169.711665] ================================================================== [ 2169.714009] BUG: KASAN: slab-use-after-free in __run_timers.

CVE-2023-52483 [HIGH] CWE-416 CVE-2023-52483: In the Linux kernel, the following vulnerability has been resolved: mctp: perform route lookups und In the Linux kernel, the following vulnerability has been resolved: mctp: perform route lookups under a RCU read-side lock Our current route lookups (mctp_route_lookup and mctp_route_lookup_null) traverse the net's route list without the RCU read lock held. This means the route lookup is subject to preemption, resulting in an potential grace period e

CVE-2024-50155 [HIGH] CVE-2024-50155: In the Linux kernel, the following vulnerability has been resolved: netdevsim: use cond_resched() i In the Linux kernel, the following vulnerability has been resolved: netdevsim: use cond_resched() in nsim_dev_trap_report_work() I am still seeing many syzbot reports hinting that syzbot might fool nsim_dev_trap_report_work() with hundreds of ports [1] Lets use cond_resched(), and system_unbound_wq instead of implicit system_wq. [1] INFO: task syz-executor

CVE-2025-21687 [HIGH] CWE-125 CVE-2025-21687: In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are passed from user space and not checked, only offset is capped to 40 bits, which can be used to read/write out of bounds of the device.

CVE-2024-47719 [HIGH] CWE-787 CVE-2024-47719: In the Linux kernel, the following vulnerability has been resolved: iommufd: Protect against overfl In the Linux kernel, the following vulnerability has been resolved: iommufd: Protect against overflow of ALIGN() during iova allocation Userspace can supply an iova and uptr such that the target iova alignment becomes really big and ALIGN() overflows which corrupts the selected area range during allocation. CONFIG_IOMMUFD_TEST can detect this: WARNI

CVE-2022-48998 [HIGH] CWE-787 CVE-2022-48998: In the Linux kernel, the following vulnerability has been resolved: powerpc/bpf/32: Fix Oops on tai In the Linux kernel, the following vulnerability has been resolved: powerpc/bpf/32: Fix Oops on tail call tests test_bpf tail call tests end up as: test_bpf: #0 Tail call leaf jited:1 85 PASS test_bpf: #1 Tail call 2 jited:1 111 PASS test_bpf: #2 Tail call 3 jited:1 145 PASS test_bpf: #3 Tail call 4 jited:1 170 PASS test_bpf: #4 Tail call load/store

CVE-2024-42302 [HIGH] CWE-416 CVE-2024-42302: In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_handler() awaits readiness of the secondary bus below the Downstream Port where the DPC event