CVSS: 5.5EPSS: %CPEs: 3EXPL: 0CVE-2023-53144 – erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms
https://notcve.org/view.php?id=CVE-2023-53144
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms As the call trace shown, the root cause is kunmap incorrect pages: BUG: kernel NULL pointer dereference, address: 00000000 CPU: 1 PID: 40 Comm: kworker/u5:0 Not tainted 6.2.0-rc5 #4 Workqueue: erofs_worker z_erofs_decompressqueue_work EIP: z_erofs_lzma_decompress+0x34b/0x8ac z_erofs_decompress+0x12/0x14 z_erofs_decompress_queue+0x7e7/0xb1c z_erofs_decompressqueue_work+0x32/0x60 pr... • https://git.kernel.org/stable/c/622ceaddb7649ca328832f50ba1400af778d75fa •
CVSS: 5.5EPSS: %CPEs: 8EXPL: 0CVE-2023-53143 – ext4: fix another off-by-one fsmap error on 1k block filesystems
https://notcve.org/view.php?id=CVE-2023-53143
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ext4: fix another off-by-one fsmap error on 1k block filesystems Apparently syzbot figured out that issuing this FSMAP call: struct fsmap_head cmd = { .fmh_count = ...; .fmh_keys = { { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, { .fmr_device = /* ext4 dev */, .fmr_physical = 0, }, }, ... }; ret = ioctl(fd, FS_IOC_GETFSMAP, &cmd); Produces this crash if the underlying filesystem is a 1k-block ext4 filesystem: kernel BUG at fs/ext4/e... • https://git.kernel.org/stable/c/4a4956249dac0b9b0027949907bff0cd1a9b57fa •
CVSS: 5.7EPSS: %CPEs: 4EXPL: 0CVE-2023-53142 – ice: copy last block omitted in ice_get_module_eeprom()
https://notcve.org/view.php?id=CVE-2023-53142
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ice: copy last block omitted in ice_get_module_eeprom() ice_get_module_eeprom() is broken since commit e9c9692c8a81 ("ice: Reimplement module reads used by ethtool") In this refactor, ice_get_module_eeprom() reads the eeprom in blocks of size 8. But the condition that should protect the buffer overflow ignores the last block. The last block always contains zeros. Bug uncovered by ethtool upstream commit 9538f384b535 ("netlink: eeprom: Defer... • https://git.kernel.org/stable/c/e9c9692c8a81aacf0854f68ab54dc182f8be38e8 •
CVSS: 6.3EPSS: %CPEs: 8EXPL: 0CVE-2023-53141 – ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
https://notcve.org/view.php?id=CVE-2023-53141
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping() ila_xlat_nl_cmd_get_mapping() generates an empty skb, triggerring a recent sanity check [1]. Instead, return an error code, so that user space can get it. [1] skb_assert_len WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 skb_assert_len include/linux/skbuff.h:2527 [inline] WARNING: CPU: 0 PID: 5923 at include/linux/skbuff.h:2527 __dev_queue_xmit+0x1bc0/0x3488 net/... • https://git.kernel.org/stable/c/7f00feaf107645d95a6d87e99b4d141ac0a08efd •
CVSS: 5.5EPSS: %CPEs: 7EXPL: 0CVE-2023-53140 – scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
https://notcve.org/view.php?id=CVE-2023-53140
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: scsi: core: Remove the /proc/scsi/${proc_name} directory earlier Remove the /proc/scsi/${proc_name} directory earlier to fix a race condition between unloading and reloading kernel modules. This fixes a bug introduced in 2009 by commit 77c019768f06 ("[SCSI] fix /proc memory leak in the SCSI core"). Fix the following kernel warning: proc_dir_entry 'scsi/scsi_debug' already registered WARNING: CPU: 19 PID: 27986 at fs/proc/generic.c:376 proc_... • https://git.kernel.org/stable/c/77c019768f0607c36e25bec11ce3e1eabef09277 •
CVSS: 7.1EPSS: %CPEs: 8EXPL: 0CVE-2023-53139 – nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
https://notcve.org/view.php?id=CVE-2023-53139
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause out-of-bounds write in device_property_read_u8_array later. In the Linux kernel, the following vulnerability has been resolved: nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties devm_kmalloc_array may fails, *fw_vsc_cfg might be null and cause out-of-bounds ... • https://git.kernel.org/stable/c/a06347c04c13e380afce0c9816df51f00b83faf1 •
CVSS: 7.1EPSS: %CPEs: 8EXPL: 0CVE-2023-53138 – net: caif: Fix use-after-free in cfusbl_device_notify()
https://notcve.org/view.php?id=CVE-2023-53138
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net: caif: Fix use-after-free in cfusbl_device_notify() syzbot reported use-after-free in cfusbl_device_notify() [1]. This causes a stack trace like below: BUG: KASAN: use-after-free in cfusbl_device_notify+0x7c9/0x870 net/caif/caif_usb.c:138 Read of size 8 at addr ffff88807ac4e6f0 by task kworker/u4:6/1214 CPU: 0 PID: 1214 Comm: kworker/u4:6 Not tainted 5.19.0-rc3-syzkaller-00146-g92f20ff72066 #0 Hardware name: Google Google Compute Engine... • https://git.kernel.org/stable/c/7ad65bf68d705b445ef10b77ab50dab22be185ee •
CVSS: 5.5EPSS: %CPEs: 6EXPL: 0CVE-2023-53137 – ext4: Fix possible corruption when moving a directory
https://notcve.org/view.php?id=CVE-2023-53137
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ext4: Fix possible corruption when moving a directory When we are renaming a directory to a different directory, we need to update '..' entry in the moved directory. However nothing prevents moved directory from being modified and even converted from the inline format to the normal format. When such race happens the rename code gets confused and we crash. Fix the problem by locking the moved directory. In the Linux kernel, the following vul... • https://git.kernel.org/stable/c/32f7f22c0b52e8189fef83986b16dc7abe95f2c4 •
CVSS: 5.6EPSS: %CPEs: 4EXPL: 0CVE-2023-53136 – af_unix: fix struct pid leaks in OOB support
https://notcve.org/view.php?id=CVE-2023-53136
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: af_unix: fix struct pid leaks in OOB support syzbot reported struct pid leak [1]. Issue is that queue_oob() calls maybe_add_creds() which potentially holds a reference on a pid. But skb->destructor is not set (either directly or by calling unix_scm_to_skb()) This means that subsequent kfree_skb() or consume_skb() would leak this reference. In this fix, I chose to fully support scm even for the OOB message. [1] BUG: memory leak unreferenced ... • https://git.kernel.org/stable/c/314001f0bf927015e459c9d387d62a231fe93af3 •
CVSS: 7.1EPSS: %CPEs: 6EXPL: 0CVE-2023-53135 – riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
https://notcve.org/view.php?id=CVE-2023-53135
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode When CONFIG_FRAME_POINTER is unset, the stack unwinding function walk_stackframe randomly reads the stack and then, when KASAN is enabled, it can lead to the following backtrace: [ 0.000000] ================================================================== [ 0.000000] BUG: KASAN: stack-out-of-bounds in walk_stackframe+0xa6/0x11a [ 0.000000] Read of size 8 at addr ffffffff81807c... • https://git.kernel.org/stable/c/5d8544e2d0075a5f3c9a2cf27152354d54360da1 •