CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2023-53649 – perf trace: Really free the evsel->priv area
https://notcve.org/view.php?id=CVE-2023-53649
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: perf trace: Really free the evsel->priv area In 3cb4d5e00e037c70 ("perf trace: Free syscall tp fields in evsel->priv") it only was freeing if strcmp(evsel->tp_format->system, "syscalls") returned zero, while the corresponding initialization of evsel->priv was being performed if it was _not_ zero, i.e. if the tp system wasn't 'syscalls'. Just stop looking for that and free it if evsel->priv was set, which should be equivalent. Also use the p... • https://git.kernel.org/stable/c/3cb4d5e00e037c70f239173bdd399a7e6040830f • CWE-771: Missing Reference to Active Allocated Resource •
CVSS: 5.5EPSS: 0%CPEs: 9EXPL: 0CVE-2023-53648 – ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer
https://notcve.org/view.php?id=CVE-2023-53648
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer smatch error: sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() error: we previously assumed 'rac97' could be null (see line 2072) remove redundant assignment, return error if rac97 is NULL. In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer smatch error: sound/pci/ac97/ac97_codec.c:2354 snd_ac97_mixer() e... • https://git.kernel.org/stable/c/da3cec35dd3c31d8706db4bf379372ce70d92118 • CWE-476: NULL Pointer Dereference •
CVSS: 7.2EPSS: 0%CPEs: 4EXPL: 0CVE-2023-53647 – Drivers: hv: vmbus: Don't dereference ACPI root object handle
https://notcve.org/view.php?id=CVE-2023-53647
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Don't dereference ACPI root object handle Since the commit referenced in the Fixes: tag below the VMBus client driver is walking the ACPI namespace up from the VMBus ACPI device to the ACPI namespace root object trying to find Hyper-V MMIO ranges. However, if it is not able to find them it ends trying to walk resources of the ACPI namespace root object itself. This object has all-ones handle, which causes a NULL pointer ... • https://git.kernel.org/stable/c/7f163a6fd957a85f7f66a129db1ad243a44399ee • CWE-476: NULL Pointer Dereference •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-53646 – drm/i915/perf: add sentinel to xehp_oa_b_counters
https://notcve.org/view.php?id=CVE-2023-53646
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: drm/i915/perf: add sentinel to xehp_oa_b_counters Arrays passed to reg_in_range_table should end with empty record. The patch solves KASAN detected bug with signature: BUG: KASAN: global-out-of-bounds in xehp_is_valid_b_counter_addr+0x2c7/0x350 [i915] Read of size 4 at addr ffffffffa1555d90 by task perf/1518 CPU: 4 PID: 1518 Comm: perf Tainted: G U 6.4.0-kasan_438-g3303d06107f3+ #1 Hardware name: Intel Corporation Meteor Lake Client Platfor... • https://git.kernel.org/stable/c/0fa9349dda030fa847b36f880a5eea25c3202b66 • CWE-125: Out-of-bounds Read •
CVSS: 6.6EPSS: 0%CPEs: 8EXPL: 0CVE-2023-53644 – media: radio-shark: Add endpoint checks
https://notcve.org/view.php?id=CVE-2023-53644
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: media: radio-shark: Add endpoint checks The syzbot fuzzer was able to provoke a WARNING from the radio-shark2 driver: ------------[ cut here ]------------ usb 1-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 0 PID: 3271 at drivers/usb/core/urb.c:504 usb_submit_urb+0xed2/0x1880 drivers/usb/core/urb.c:504 Modules linked in: CPU: 0 PID: 3271 Comm: kworker/0:3 Not tainted 6.1.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Goo... • https://git.kernel.org/stable/c/3ed6a312ac1e7278f92b1b3d95377b335ae21e89 •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2023-53643 – nvme-tcp: don't access released socket during error recovery
https://notcve.org/view.php?id=CVE-2023-53643
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: don't access released socket during error recovery While the error recovery work is temporarily failing reconnect attempts, running the 'nvme list' command causes a kernel NULL pointer dereference by calling getsockname() with a released socket. During error recovery work, the nvme tcp socket is released and a new one created, so it is not safe to access the socket without proper check. In the Linux kernel, the following vulnerabi... • https://git.kernel.org/stable/c/02c57a82c0081141abc19150beab48ef47f97f18 • CWE-825: Expired Pointer Dereference •
CVSS: 7.1EPSS: 0%CPEs: 2EXPL: 0CVE-2023-53642 – x86: fix clear_user_rep_good() exception handling annotation
https://notcve.org/view.php?id=CVE-2023-53642
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: x86: fix clear_user_rep_good() exception handling annotation This code no longer exists in mainline, because it was removed in commit d2c95f9d6802 ("x86: don't use REP_GOOD or ERMS for user memory clearing") upstream. However, rather than backport the full range of x86 memory clearing and copying cleanups, fix the exception table annotation placement for the final 'rep movsb' in clear_user_rep_good(): rather than pointing at the actual inst... • https://git.kernel.org/stable/c/0db7058e8e23e6bbab1b4747ecabd1784c34f50b •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2023-53641 – wifi: ath9k: hif_usb: fix memory leak of remain_skbs
https://notcve.org/view.php?id=CVE-2023-53641
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of remain_skbs hif_dev->remain_skb is allocated and used exclusively in ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is processed and subsequently freed (in error paths) only during the next call of ath9k_hif_usb_rx_stream(). So, if the urbs are deallocated between those two calls due to the device deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream() is not... • https://git.kernel.org/stable/c/fb9987d0f748c983bb795a86f47522313f701a08 • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.1EPSS: 0%CPEs: 4EXPL: 0CVE-2023-53640 – ASoC: lpass: Fix for KASAN use_after_free out of bounds
https://notcve.org/view.php?id=CVE-2023-53640
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: ASoC: lpass: Fix for KASAN use_after_free out of bounds When we run syzkaller we get below Out of Bounds error. "KASAN: slab-out-of-bounds Read in regcache_flat_read" Below is the backtrace of the issue: BUG: KASAN: slab-out-of-bounds in regcache_flat_read+0x10c/0x110 Read of size 4 at addr ffffff8088fbf714 by task syz-executor.4/14144 CPU: 6 PID: 14144 Comm: syz-executor.4 Tainted: G W Hardware name: Qualcomm Technologies, Inc. sc7280 CRD ... • https://git.kernel.org/stable/c/c39667ddcfc516fee084e449179d54430a558298 • CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 9EXPL: 0CVE-2023-53639 – wifi: ath6kl: reduce WARN to dev_dbg() in callback
https://notcve.org/view.php?id=CVE-2023-53639
07 Oct 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: reduce WARN to dev_dbg() in callback The warn is triggered on a known race condition, documented in the code above the test, that is correctly handled. Using WARN() hinders automated testing. Reducing severity. In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: reduce WARN to dev_dbg() in callback The warn is triggered on a known race condition, documented in the code above the test, that is corr... • https://git.kernel.org/stable/c/de2070fc4aa7c0205348010f500f5abce012e67b •