CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2023-54326 – misc: pci_endpoint_test: Free IRQs before removing the device
https://notcve.org/view.php?id=CVE-2023-54326
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Free IRQs before removing the device In pci_endpoint_test_remove(), freeing the IRQs after removing the device creates a small race window for IRQs to be received with the test device memory already released, causing the IRQ handler to access invalid memory, resulting in an oops. Free the device IRQs before removing the device to avoid this issue. • https://git.kernel.org/stable/c/e03327122e2c8e6ae4565ef5b3d3cbe4364546a1 •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2023-54324 – dm: fix a race condition in retrieve_deps
https://notcve.org/view.php?id=CVE-2023-54324
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: dm: fix a race condition in retrieve_deps There's a race condition in the multipath target when retrieve_deps races with multipath_message calling dm_get_device and dm_put_device. retrieve_deps walks the list of open devices without holding any lock but multipath may add or remove devices to the list while it is running. The end result may be memory corruption or use-after-free memory access. See this description of a UAF with multipath_mes... • https://git.kernel.org/stable/c/dbf1a719850577bb51fc7512a3972994b797a17b •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2023-54322 – arm64: set __exception_irq_entry with __irq_entry as a default
https://notcve.org/view.php?id=CVE-2023-54322
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entries which are related irq entries from its call stack. And in_irqentry_text() which is called by filter_irq_stacks() uses __irqentry_text_start/end symbol to find irq entries in callstack. But it doesn't work correctly as without "CONFIG_FUNCTION_GRAPH_TRACER", arm64 kernel doesn't include gic_handle_irq which is entry point of arm64 ir... • https://git.kernel.org/stable/c/c71d6934c6ac40a97146a410e0320768c7b1bb3c •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2023-54320 – platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2()
https://notcve.org/view.php?id=CVE-2023-54320
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: pmc: Fix memory leak in amd_pmc_stb_debugfs_open_v2() Function amd_pmc_stb_debugfs_open_v2() may be called when the STB debug mechanism enabled. When amd_pmc_send_cmd() fails, the 'buf' needs to be released. • https://git.kernel.org/stable/c/d804adef7b23b22bb82e1b3dd113e9073cea9bc1 •
CVSS: -EPSS: 0%CPEs: 9EXPL: 0CVE-2023-54319 – pinctrl: at91-pio4: check return value of devm_kasprintf()
https://notcve.org/view.php?id=CVE-2023-54319
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91-pio4: check return value of devm_kasprintf() devm_kasprintf() returns a pointer to dynamically allocated memory. Pointer could be NULL in case allocation fails. Check pointer validity. Identified with coccinelle (kmerr.cocci script). Depends-on: 1c4e5c470a56 ("pinctrl: at91: use devm_kasprintf() to avoid potential leaks") Depends-on: 5a8f9cf269e8 ("pinctrl: at91-pio4: use proper format specifier for unsigned int") • https://git.kernel.org/stable/c/776180848b574c9c01217fa958f10843ffce584f •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2023-54318 – net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
https://notcve.org/view.php?id=CVE-2023-54318
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add While doing smcr_port_add, there maybe linkgroup add into or delete from smc_lgr_list.list at the same time, which may result kernel crash. So, use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add. The crash calltrace show below: BUG: kernel NULL pointer dereference, address: 0000000000000000 PGD 0 P4D 0 Oops: 0000 [#1] SMP NOPTI CPU:... • https://git.kernel.org/stable/c/1f90a05d9ff907c70456e7c9d7058372679a88c6 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2023-54316 – refscale: Fix uninitalized use of wait_queue_head_t
https://notcve.org/view.php?id=CVE-2023-54316
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: refscale: Fix uninitalized use of wait_queue_head_t Running the refscale test occasionally crashes the kernel with the following error: [ 8569.952896] BUG: unable to handle page fault for address: ffffffffffffffe8 [ 8569.952900] #PF: supervisor read access in kernel mode [ 8569.952902] #PF: error_code(0x0000) - not-present page [ 8569.952904] PGD c4b048067 P4D c4b049067 PUD c4b04b067 PMD 0 [ 8569.952910] Oops: 0000 [#1] PREEMPT_RT SMP NOPTI... • https://git.kernel.org/stable/c/653ed64b01dc5989f8f579d0038e987476c2c023 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2023-54315 – powerpc/powernv/sriov: perform null check on iov before dereferencing iov
https://notcve.org/view.php?id=CVE-2023-54315
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: powerpc/powernv/sriov: perform null check on iov before dereferencing iov Currently pointer iov is being dereferenced before the null check of iov which can lead to null pointer dereference errors. Fix this by moving the iov null check before the dereferencing. Detected using cppcheck static analysis: linux/arch/powerpc/platforms/powernv/pci-sriov.c:597:12: warning: Either the condition '!iov' is redundant or there is possible null pointer ... • https://git.kernel.org/stable/c/052da31d45fc71238ea8bed7e9a84648a1ee0bf3 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2023-54314 – media: af9005: Fix null-ptr-deref in af9005_i2c_xfer
https://notcve.org/view.php?id=CVE-2023-54314
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: media: af9005: Fix null-ptr-deref in af9005_i2c_xfer In af9005_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach af9005_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref i... • https://git.kernel.org/stable/c/98c12abb275b75a98ff62de9466d21e4daa98536 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2023-54313 – ovl: fix null pointer dereference in ovl_get_acl_rcu()
https://notcve.org/view.php?id=CVE-2023-54313
30 Dec 2025 — In the Linux kernel, the following vulnerability has been resolved: ovl: fix null pointer dereference in ovl_get_acl_rcu() Following process: P1 P2 path_openat link_path_walk may_lookup inode_permission(rcu) ovl_permission acl_permission_check check_acl get_cached_acl_rcu ovl_get_inode_acl realinode = ovl_inode_real(ovl_inode) drop_cache __dentry_kill(ovl_dentry) iput(ovl_inode) ovl_destroy_inode(ovl_inode) dput(oi->__upperdentry) dentry_kill(upperdentry) dentry_unlink_inode upperdentry->d_inode = NULL ovl_... • https://git.kernel.org/stable/c/332f606b32b6291a944c8cf23b91f53a6e676525 •