CVSS: 5.5EPSS: %CPEs: 4EXPL: 0CVE-2023-53111 – loop: Fix use-after-free issues
https://notcve.org/view.php?id=CVE-2023-53111
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: loop: Fix use-after-free issues do_req_filebacked() calls blk_mq_complete_request() synchronously or asynchronously when using asynchronous I/O unless memory allocation fails. Hence, modify loop_handle_cmd() such that it does not dereference 'cmd' nor 'rq' after do_req_filebacked() finished unless we are sure that the request has not yet been completed. This patch fixes the following kernel crash: Unable to handle kernel NULL pointer derefe... • https://git.kernel.org/stable/c/bc07c10a3603a5ab3ef01ba42b3d41f9ac63d1b6 •
CVSS: 7.8EPSS: %CPEs: 8EXPL: 0CVE-2023-53109 – net: tunnels: annotate lockless accesses to dev->needed_headroom
https://notcve.org/view.php?id=CVE-2023-53109
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net: tunnels: annotate lockless accesses to dev->needed_headroom IP tunnels can apparently update dev->needed_headroom in their xmit path. This patch takes care of three tunnels xmit, and also the core LL_RESERVED_SPACE() and LL_RESERVED_SPACE_EXTRA() helpers. More changes might be needed for completeness. BUG: KCSAN: data-race in ip_tunnel_xmit / ip_tunnel_xmit read to 0xffff88815b9da0ec of 2 bytes by task 888 on cpu 1: ip_tunnel_xmit+0x12... • https://git.kernel.org/stable/c/8eb30be0352d09165e94a41fef1c7b994dca0714 •
CVSS: 6.8EPSS: %CPEs: 8EXPL: 0CVE-2023-53108 – net/iucv: Fix size of interrupt data
https://notcve.org/view.php?id=CVE-2023-53108
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net/iucv: Fix size of interrupt data iucv_irq_data needs to be 4 bytes larger. These bytes are not used by the iucv module, but written by the z/VM hypervisor in case a CPU is deconfigured. Reported as: BUG dma-kmalloc-64 (Not tainted): kmalloc Redzone overwritten ----------------------------------------------------------------------------- 0x0000000000400564-0x0000000000400567 @offset=1380. First byte 0x80 instead of 0xcc Allocated in iucv... • https://git.kernel.org/stable/c/2356f4cb191100a5e92d537f13e5efdbc697e9cb •
CVSS: 7.1EPSS: %CPEs: 8EXPL: 0CVE-2023-53106 – nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
https://notcve.org/view.php?id=CVE-2023-53106
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition This bug influences both st_nci_i2c_remove and st_nci_spi_remove. Take st_nci_i2c_remove as an example. In st_nci_i2c_probe, it called ndlc_probe and bound &ndlc->sm_work with llt_ndlc_sm_work. When it calls ndlc_recv or timeout handler, it will finally call schedule_work to start the work. When we call st_nci_i2c_remove to remove the driver, there may be a sequence as... • https://git.kernel.org/stable/c/35630df68d6030daf12dde12ed07bbe26324e6ac •
CVSS: 5.5EPSS: %CPEs: 3EXPL: 0CVE-2023-53105 – net/mlx5e: Fix cleanup null-ptr deref on encap lock
https://notcve.org/view.php?id=CVE-2023-53105
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix cleanup null-ptr deref on encap lock During module is unloaded while a peer tc flow is still offloaded, first the peer uplink rep profile is changed to a nic profile, and so neigh encap lock is destroyed. Next during unload, the VF reps netdevs are unregistered which causes the original non-peer tc flow to be deleted, which deletes the peer flow. The peer flow deletion detaches the encap entry and try to take the already dest... • https://git.kernel.org/stable/c/04de7dda7394fa9c2b0fc9cec65661d9b4f0d04d •
CVSS: 5.5EPSS: %CPEs: 1EXPL: 0CVE-2023-53104 – net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull
https://notcve.org/view.php?id=CVE-2023-53104
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull Packet length check needs to be located after size and align_count calculation to prevent kernel panic in skb_pull() in case rx_cmd_a & RX_CMD_A_RED evaluates to true. In the Linux kernel, the following vulnerability has been resolved: net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull Packet length check needs to be located after ... • https://git.kernel.org/stable/c/43ffe6caccc7a1bb9d7442fbab521efbf6c1378c •
CVSS: 7.1EPSS: %CPEs: 4EXPL: 0CVE-2023-53103 – bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
https://notcve.org/view.php?id=CVE-2023-53103
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails syzbot reported a warning[1] where the bond device itself is a slave and we try to enslave a non-ethernet device as the first slave which fails but then in the error path when ether_setup() restores the bond device it also clears all flags. In my previous fix[2] I restored the IFF_MASTER flag, but I didn't consider the case that the bond device itself might also be a slav... • https://git.kernel.org/stable/c/7d5cd2ce5292b45e555de776cb9e72975a07460d •
CVSS: 7.1EPSS: %CPEs: 8EXPL: 0CVE-2023-53101 – ext4: zero i_disksize when initializing the bootloader inode
https://notcve.org/view.php?id=CVE-2023-53101
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ext4: zero i_disksize when initializing the bootloader inode If the boot loader inode has never been used before, the EXT4_IOC_SWAP_BOOT inode will initialize it, including setting the i_size to 0. However, if the "never before used" boot loader has a non-zero i_size, then i_disksize will be non-zero, and the inconsistency between i_size and i_disksize can trigger a kernel warning: WARNING: CPU: 0 PID: 2580 at fs/ext4/file.c:319 CPU: 0 PID:... • https://git.kernel.org/stable/c/d6c1447e483c05dbcfb3ff77ac04237a82070b8c •
CVSS: 6.6EPSS: %CPEs: 8EXPL: 0CVE-2023-53100 – ext4: fix WARNING in ext4_update_inline_data
https://notcve.org/view.php?id=CVE-2023-53100
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: ext4: fix WARNING in ext4_update_inline_data Syzbot found the following issue: EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 without journal. Quota mode: none. fscrypt: AES-256-CTS-CBC using implementation "cts-cbc-aes-aesni" fscrypt: AES-256-XTS using implementation "xts-aes-aesni" ------------[ cut here ]------------ WARNING: CPU: 0 PID: 5071 at mm/page_alloc.c:5525 __alloc_pages+0x30a/0x560 mm/page_alloc.c:5525... • https://git.kernel.org/stable/c/c5aa102b433b1890e1ccaa40c06826c77dda1665 •
CVSS: 6.5EPSS: %CPEs: 5EXPL: 0CVE-2023-53098 – media: rc: gpio-ir-recv: add remove function
https://notcve.org/view.php?id=CVE-2023-53098
02 May 2025 — In the Linux kernel, the following vulnerability has been resolved: media: rc: gpio-ir-recv: add remove function In case runtime PM is enabled, do runtime PM clean up to remove cpu latency qos request, otherwise driver removal may have below kernel dump: [ 19.463299] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000048 [ 19.472161] Mem abort info: [ 19.474985] ESR = 0x0000000096000004 [ 19.478754] EC = 0x25: DABT (current EL), IL = 32 bits [ 19.484081] SET = 0, FnV = 0 [ 19.4... • https://git.kernel.org/stable/c/a5c140d88a69eb43de2a030f1d7ff7b16bff3b1a •