CVSS: 8.4EPSS: 0%CPEs: 6EXPL: 0CVE-2023-53201 – RDMA/bnxt_re: wraparound mbox producer index
https://notcve.org/view.php?id=CVE-2023-53201
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: wraparound mbox producer index Driver is not handling the wraparound of the mbox producer index correctly. Currently the wraparound happens once u32 max is reached. Bit 31 of the producer index register is special and should be set only once for the first command. Because the producer index overflow setting bit31 after a long time, FW goes to initialization sequence and this causes FW hang. Fix is to wraparound the mbox produc... • https://git.kernel.org/stable/c/1ac5a404797523cedaf424a3aaa3cf8f9548dff8 •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-53200 – netfilter: x_tables: fix percpu counter block leak on error path when creating new netns
https://notcve.org/view.php?id=CVE-2023-53200
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix percpu counter block leak on error path when creating new netns Here is the stack where we allocate percpu counter block: +-< __alloc_percpu +-< xt_percpu_counter_alloc +-< find_check_entry # {arp,ip,ip6}_tables.c +-< translate_table And it can be leaked on this code path: +-> ip6t_register_table +-> translate_table # allocates percpu counter block +-> xt_register_table # fails there is no freeing of the counter blo... • https://git.kernel.org/stable/c/71ae0dff02d756e4d2ca710b79f2ff5390029a5f •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2023-53199 – wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
https://notcve.org/view.php?id=CVE-2023-53199
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and... • https://git.kernel.org/stable/c/44b23b488d44e56d467764ecb661830e5b02b308 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50289 – ocfs2: fix memory leak in ocfs2_stack_glue_init()
https://notcve.org/view.php?id=CVE-2022-50289
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2_stack_glue_init() ocfs2_table_header should be free in ocfs2_stack_glue_init() if ocfs2_sysfs_init() failed, otherwise kmemleak will report memleak. BUG: memory leak unreferenced object 0xffff88810eeb5800 (size 128): comm "modprobe", pid 4507, jiffies 4296182506 (age 55.888s) hex dump (first 32 bytes): c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00 .@.............. 01 00 00 00 00 00 00 00 00 00 00 00 00 00 0... • https://git.kernel.org/stable/c/3878f110f71a0971ff7acc15dd6db711b6ef37c6 •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2022-50288 – qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure
https://notcve.org/view.php?id=CVE-2022-50288
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: qlcnic: prevent ->dcb use-after-free on qlcnic_dcb_enable() failure adapter->dcb would get silently freed inside qlcnic_dcb_enable() in case qlcnic_dcb_attach() would return an error, which always happens under OOM conditions. This would lead to use-after-free because both of the existing callers invoke qlcnic_dcb_get_info() on the obtained pointer, which is potentially freed at that point. Propagate errors from qlcnic_dcb_enable(), and ins... • https://git.kernel.org/stable/c/3c44bba1d270cb1620b4fe76786d0968118cb86b •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50285 – mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages
https://notcve.org/view.php?id=CVE-2022-50285
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: mm,hugetlb: take hugetlb_lock before decrementing h->resv_huge_pages The h->*_huge_pages counters are protected by the hugetlb_lock, but alloc_huge_page has a corner case where it can decrement the counter outside of the lock. This could lead to a corrupted value of h->resv_huge_pages, which we have observed on our systems. Take the hugetlb_lock before decrementing h->resv_huge_pages to avoid a potential race. In the Linux kernel, the follo... • https://git.kernel.org/stable/c/a88c769548047b21f76fd71e04b6a3300ff17160 •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 0CVE-2022-50282 – chardev: fix error handling in cdev_device_add()
https://notcve.org/view.php?id=CVE-2022-50282
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: chardev: fix error handling in cdev_device_add() While doing fault injection test, I got the following report: ------------[ cut here ]------------ kobject: '(null)' (0000000039956980): is not initialized, yet kobject_put() is being called. WARNING: CPU: 3 PID: 6306 at kobject_put+0x23d/0x4e0 CPU: 3 PID: 6306 Comm: 283 Tainted: G W 6.1.0-rc2-00005-g307c1086d7c9 #1253 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu... • https://git.kernel.org/stable/c/da97a80a657d1b1b50ef633e8ff5dbf0d417fc8d •
CVSS: 6.3EPSS: 0%CPEs: 10EXPL: 0CVE-2022-50280 – pnode: terminate at peers of source
https://notcve.org/view.php?id=CVE-2022-50280
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: pnode: terminate at peers of source The propagate_mnt() function handles mount propagation when creating mounts and propagates the source mount tree @source_mnt to all applicable nodes of the destination propagation mount tree headed by @dest_mnt. Unfortunately it contains a bug where it fails to terminate at peers of @source_mnt when looking up copies of the source mount that become masters for copies of the source mount tree mounted on to... • https://git.kernel.org/stable/c/f2ebb3a921c1ca1e2ddd9242e95a1989a50c4c68 •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2022-50279 – wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()
https://notcve.org/view.php?id=CVE-2022-50279
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace:
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50278 – PNP: fix name memory leak in pnp_alloc_dev()
https://notcve.org/view.php?id=CVE-2022-50278
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: PNP: fix name memory leak in pnp_alloc_dev() After commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically, move dev_set_name() after pnp_add_id() to avoid memory leak. In the Linux kernel, the following vulnerability has been resolved: PNP: fix name memory leak in pnp_alloc_dev() After commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")... • https://git.kernel.org/stable/c/1fa5ae857bb14f6046205171d98506d8112dd74e •