CVSS: 5.5EPSS: %CPEs: 8EXPL: 0CVE-2023-53220 – media: az6007: Fix null-ptr-deref in az6007_i2c_xfer()
https://notcve.org/view.php?id=CVE-2023-53220
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() In az6007_i2c_xfer, msg is controlled by user. When msg[i].buf is null and msg[i].len is zero, former checks on msg[i].buf would be passed. Malicious data finally reach az6007_i2c_xfer. If accessing msg[i].buf[0] without sanity check, null ptr deref would happen. We add check on msg[i].len to prevent crash. Similar commit: commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref... • https://git.kernel.org/stable/c/c6763fefa267f6e62595a6ac1f57815d99fc90b7 •
CVSS: 5.5EPSS: %CPEs: 8EXPL: 0CVE-2023-53215 – sched/fair: Don't balance task to its current running CPU
https://notcve.org/view.php?id=CVE-2023-53215
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: sched/fair: Don't balance task to its current running CPU We've run into the case that the balancer tries to balance a migration disabled task and trigger the warning in set_task_cpu() like below: ------------[ cut here ]------------ WARNING: CPU: 7 PID: 0 at kernel/sched/core.c:3115 set_task_cpu+0x188/0x240 Modules linked in: hclgevf xt_CHECKSUM ipt_REJECT nf_reject_ipv4 <...snip> CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G O 6.... • https://git.kernel.org/stable/c/32d937f94b7805d4c9028b8727a7d6241547da54 •
CVSS: 7.7EPSS: %CPEs: 9EXPL: 0CVE-2023-53213 – wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
https://notcve.org/view.php?id=CVE-2023-53213
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() Fix a slab-out-of-bounds read that occurs in kmemdup() called from brcmf_get_assoc_ies(). The bug could occur when assoc_info->req_len, data from a URB provided by a USB device, is bigger than the size of buffer which is defined as WL_EXTRA_BUF_MAX. Add the size check for req_len/resp_len of assoc_info. Found by a modified version of syzkaller. [ 46.592467][ T7] ==============... • https://git.kernel.org/stable/c/ac5305e5d227b9af3aae25fa83380d3ff0225b73 •
CVSS: 5.5EPSS: %CPEs: 3EXPL: 0CVE-2023-53209 – wifi: mac80211_hwsim: Fix possible NULL dereference
https://notcve.org/view.php?id=CVE-2023-53209
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: Fix possible NULL dereference In a call to mac80211_hwsim_select_tx_link() the sta pointer might be NULL, thus need to check that it is not NULL before accessing it. In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: Fix possible NULL dereference In a call to mac80211_hwsim_select_tx_link() the sta pointer might be NULL, thus need to check that it is not NULL before accessing it. • https://git.kernel.org/stable/c/d0124848c7940aba73492e282506b32a13f2e30e •
CVSS: 6.5EPSS: %CPEs: 16EXPL: 0CVE-2023-53204 – af_unix: Fix data-races around user->unix_inflight.
https://notcve.org/view.php?id=CVE-2023-53204
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: af_unix: Fix data-races around user->unix_inflight. user->unix_inflight is changed under spin_lock(unix_gc_lock), but too_many_unix_fds() reads it locklessly. Let's annotate the write/read accesses to user->unix_inflight. BUG: KCSAN: data-race in unix_attach_fds / unix_inflight write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1: unix_inflight+0x157/0x180 net/unix/scm.c:66 unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123 unix_scm_to... • https://git.kernel.org/stable/c/712f4aad406bb1ed67f3f98d04c044191f0ff593 •
CVSS: 5.5EPSS: %CPEs: 4EXPL: 0CVE-2023-53202 – PM: domains: fix memory leak with using debugfs_lookup()
https://notcve.org/view.php?id=CVE-2023-53202
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: PM: domains: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. To make things simpler, just call debugfs_lookup_and_remove() instead which handles all of the logic at once. In the Linux kernel, the following vulnerability has been resolved: PM: domains: fix memory leak with using debugfs_lookup() When calling debugfs_lookup() the resu... • https://git.kernel.org/stable/c/dddc132eb0dca3969f9146ef8feac0aa542aa305 •
CVSS: 5.5EPSS: %CPEs: 7EXPL: 0CVE-2023-53199 – wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails
https://notcve.org/view.php?id=CVE-2023-53199
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails Syzkaller detected a memory leak of skbs in ath9k_hif_usb_rx_stream(). While processing skbs in ath9k_hif_usb_rx_stream(), the already allocated skbs in skb_pool are not freed if ath9k_hif_usb_rx_stream() fails. If we have an incorrect pkt_len or pkt_tag, the input skb is considered invalid and dropped. All the associated packets already in skb_pool should be dropped and... • https://git.kernel.org/stable/c/44b23b488d44e56d467764ecb661830e5b02b308 •
CVSS: 5.6EPSS: %CPEs: 9EXPL: 0CVE-2022-50289 – ocfs2: fix memory leak in ocfs2_stack_glue_init()
https://notcve.org/view.php?id=CVE-2022-50289
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix memory leak in ocfs2_stack_glue_init() ocfs2_table_header should be free in ocfs2_stack_glue_init() if ocfs2_sysfs_init() failed, otherwise kmemleak will report memleak. BUG: memory leak unreferenced object 0xffff88810eeb5800 (size 128): comm "modprobe", pid 4507, jiffies 4296182506 (age 55.888s) hex dump (first 32 bytes): c0 40 14 a0 ff ff ff ff 00 00 00 00 01 00 00 00 .@.............. 01 00 00 00 00 00 00 00 00 00 00 00 00 00 0... • https://git.kernel.org/stable/c/3878f110f71a0971ff7acc15dd6db711b6ef37c6 •
CVSS: 5.5EPSS: %CPEs: 6EXPL: 0CVE-2022-50286 – ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline
https://notcve.org/view.php?id=CVE-2022-50286
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline When converting files with inline data to extents, delayed allocations made on a file system created with both the bigalloc and inline options can result in invalid extent status cache content, incorrect reserved cluster counts, kernel memory leaks, and potential kernel panics. With bigalloc, the code that determines whether a block must be delayed allocated searches ... • https://git.kernel.org/stable/c/6f4200ec76a0d31200c308ec5a71c68df5417004 •
CVSS: 5.5EPSS: %CPEs: 9EXPL: 0CVE-2022-50278 – PNP: fix name memory leak in pnp_alloc_dev()
https://notcve.org/view.php?id=CVE-2022-50278
15 Sep 2025 — In the Linux kernel, the following vulnerability has been resolved: PNP: fix name memory leak in pnp_alloc_dev() After commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array"), the name of device is allocated dynamically, move dev_set_name() after pnp_add_id() to avoid memory leak. In the Linux kernel, the following vulnerability has been resolved: PNP: fix name memory leak in pnp_alloc_dev() After commit 1fa5ae857bb1 ("driver core: get rid of struct device's bus_id string array")... • https://git.kernel.org/stable/c/1fa5ae857bb14f6046205171d98506d8112dd74e •