CVSS: 7.1EPSS: 0%CPEs: 8EXPL: 0CVE-2023-53222 – jfs: jfs_dmap: Validate db_l2nbperpage while mounting
https://notcve.org/view.php?id=CVE-2023-53222
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: jfs: jfs_dmap: Validate db_l2nbperpage while mounting In jfs_dmap.c at line 381, BLKTODMAP is used to get a logical block number inside dbFree(). db_l2nbperpage, which is the log2 number of blocks per page, is passed as an argument to BLKTODMAP which uses it for shifting. Syzbot reported a shift out-of-bounds crash because db_l2nbperpage is too big. This happens because the large value is set without any validation in dbMount() at line 181.... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 • CWE-125: Out-of-bounds Read •
CVSS: 7.7EPSS: 0%CPEs: 9EXPL: 0CVE-2023-53213 – wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
https://notcve.org/view.php?id=CVE-2023-53213
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info->req_len, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WL_EXTRA_BUF_MAX. Add the size check for req_len/resp_len of assoc_info. Found by a modified version of syzkaller. [ 46.592467][ T7] ==============... • https://git.kernel.org/stable/c/cf2b448852abd47cee21007b8313fbf962bf3c9a • CWE-125: Out-of-bounds Read •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2023-53199 – wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
https://notcve.org/view.php?id=CVE-2023-53199
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and... • https://git.kernel.org/stable/c/44b23b488d44e56d467764ecb661830e5b02b308 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50289 – ocfs2: fix memory leak in ocfs2_stack_glue_init()
https://notcve.org/view.php?id=CVE-2022-50289
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2_stack_glue_init() ocfs2_table_header should be free in ocfs2_stack_glue_init() if ocfs2_sysfs_init() failed, otherwise kmemleak will report memleak. BUG: memory leak unreferenced object 0xffff88810eeb5800 (size 128): comm "modprobe", pid 4507, jiffies 4296182506 (age 55.888s) hex dump (first 32 bytes): c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00 .@.............. 01 00 00 00 00 00 00 00 00 00 00 00 00 00 0... • https://git.kernel.org/stable/c/3878f110f71a0971ff7acc15dd6db711b6ef37c6 •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50278 – PNP: fix name memory leak in pnp_alloc_dev()
https://notcve.org/view.php?id=CVE-2022-50278
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: PNP: fix name memory leak in pnp_alloc_dev() After commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically, move dev_set_name() after pnp_add_id() to avoid memory leak. In the Linux kernel, the following vulnerability has been resolved: PNP: fix name memory leak in pnp_alloc_dev() After commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")... • https://git.kernel.org/stable/c/1fa5ae857bb14f6046205171d98506d8112dd74e •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2022-50274 – media: dvbdev: adopts refcnt to avoid UAF
https://notcve.org/view.php?id=CVE-2022-50274
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: adopts refcnt to avoid UAF dvb_unregister_device() is known that prone to use-after-free. That is, the cleanup from dvb_unregister_device() releases the dvb_device even if there are pointers stored in file->private_data still refer to it. This patch adds a reference counter into struct dvb_device and delays its deallocation until no pointer refers to the object. In the Linux kernel, the following vulnerability has been resolv... • https://git.kernel.org/stable/c/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 • CWE-416: Use After Free •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2022-50272 – media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()
https://notcve.org/view.php?id=CVE-2022-50272
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() Wei Chen reports a kernel bug as blew: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] ... Call Trace:
CVSS: 7.1EPSS: 0%CPEs: 9EXPL: 0CVE-2023-53185 – wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes
https://notcve.org/view.php?id=CVE-2023-53185
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes A bad USB device is able to construct a service connection response message with target endpoint being ENDPOINT0 which is reserved for HTC_CTRL_RSVD_SVC and should not be modified to be used for any other services. Reject such service connection responses. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. In the Linux kernel, the following vulnerability has been ... • https://git.kernel.org/stable/c/fb9987d0f748c983bb795a86f47522313f701a08 • CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2023-53182 – ACPICA: Avoid undefined behavior: applying zero offset to null pointer
https://notcve.org/view.php?id=CVE-2023-53182
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid undefined behavior: applying zero offset to null pointer ACPICA commit 770653e3ba67c30a629ca7d12e352d83c2541b1e Before this change we see the following UBSAN stack trace in Fuchsia: #0 0x000021e4213b3302 in acpi_ds_init_aml_walk(struct acpi_walk_state*, union acpi_parse_object*, struct acpi_namespace_node*, u8*, u32, struct acpi_evaluate_info*, u8) ../../third_party/acpica/source/components/dispatcher/dswstate.c:682
CVSS: 8.4EPSS: 0%CPEs: 8EXPL: 0CVE-2023-53176 – serial: 8250: Reinit port->pm on port specific driver unbind
https://notcve.org/view.php?id=CVE-2023-53176
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Reinit port->pm on port specific driver unbind When we unbind a serial port hardware specific 8250 driver, the generic serial8250 driver takes over the port. After that we see an oops about 10 seconds later. This can produce the following at least on some TI SoCs: Unhandled fault: imprecise external abort (0x1406) Internal error: : 1406 [#1] SMP ARM Turns out that we may still have the serial port hardware specific driver port... • https://git.kernel.org/stable/c/c161afe9759ddcc174d08e7c4f683d08ac9ba86f •