CVE-2022-50470

xhci: Remove device endpoints from bandwidth list when freeing the device

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

xhci: Remove device endpoints from bandwidth list when freeing the device

Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed.

If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller.

So check and delete endpoints that are still on the bandwidth list when freeing the virt device.

Solves a list_del corruption kernel crash when unbinding xhci-pci, caused by xhci_mem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list.

This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.17%Up 0.1 points since Oct 5, 2025

What each source reports

NVD Score used 7.8

In the Linux kernel, the following vulnerability has been resolved:

xhci: Remove device endpoints from bandwidth list when freeing the device

Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed.

If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller.

So check and delete endpoints that are still on the bandwidth list when freeing the virt device.

Solves a list_del corruption kernel crash when unbinding xhci-pci, caused by xhci_mem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list.

This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)

Record: CVE-2022-50470
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-415
Updated: 2026-11-05

CVE List No score

xhci: Remove device endpoints from bandwidth list when freeing the device

In the Linux kernel, the following vulnerability has been resolved:

xhci: Remove device endpoints from bandwidth list when freeing the device

Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed.

If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller.

So check and delete endpoints that are still on the bandwidth list when freeing the virt device.

Solves a list_del corruption kernel crash when unbinding xhci-pci, caused by xhci_mem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list.

This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)

Record: CVE-2022-50470
Updated: 2026-11-05

EUVDEUVD-2025-32373 No score

In the Linux kernel, the following vulnerability has been resolved:

xhci: Remove device endpoints from bandwidth list when freeing the device

Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed.

If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller.

So check and delete endpoints that are still on the bandwidth list when freeing the virt device.

Solves a list_del corruption kernel crash when unbinding xhci-pci, caused by xhci_mem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list.

This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)

Record: EUVD-2025-32373
Updated: 2026-11-05

GitHub AdvisoriesGHSA-7jr9-85rw-772f 7.8

In the Linux kernel, the following vulnerability has been resolved: xhci: Remove device...

In the Linux kernel, the following vulnerability has been resolved:

xhci: Remove device endpoints from bandwidth list when freeing the device

Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed.

If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller.

So check and delete endpoints that are still on the bandwidth list when freeing the virt device.

Solves a list_del corruption kernel crash when unbinding xhci-pci, caused by xhci_mem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list.

This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)

Record: GHSA-7jr9-85rw-772f
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-415
Updated: 2026-11-02

OSVDEBIAN-CVE-2022-50470 7.8

In the Linux kernel, the following vulnerability has been resolved: xhci: Remove device endpoints from bandwidth list when freeing the device Endpoints are normally deleted from the bandwidth list when they are dropped, before the virt device is freed. If xHC host is dying or being removed then the endpoints aren't dropped cleanly due to functions returning early to avoid interacting with a non-accessible host controller. So check and delete endpoints that are still on the bandwidth list when freeing the virt device. Solves a list_del corruption kernel crash when unbinding xhci-pci, caused by xhci_mem_cleanup() when it later tried to delete already freed endpoints from the bandwidth list. This only affects hosts that use software bandwidth checking, which currenty is only the xHC in intel Panther Point PCH (Ivy Bridge)

Record: DEBIAN-CVE-2022-50470
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVOESA-2025-2553 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

net/tunnel: wait until all sk_user_data reader finish before releasing the sock

There is a race condition in vxlan that when deleting a vxlan device during receiving packets, there is a possibility that the sock is released after getting vxlan_sock vs from sk_user_data. Then in later vxlan_ecn_decapsulate(), vxlan_get_sk_family() we will got NULL pointer dereference. e.g.

#0 [ffffa25ec6978a38] machine_kexec at ffffffff8c669757 #1 [ffffa25ec6978a90] __crash_kexec at ffffffff8c7c0a4d #2 [ffffa25ec6978b58] crash_kexec at ffffffff8c7c1c48 #3 [ffffa25ec6978b60] oops_end at ffffffff8c627f2b #4 [ffffa25ec6978b80] page_fault_oops at ffffffff8c678fcb #5 [ffffa25ec6978bd8] exc_page_fault at ffffffff8d109542 #6 [ffffa25ec6978c00] asm_exc_page_fault at ffffffff8d200b62 [exception RIP: vxlan_ecn_decapsulate+0x3b] RIP: ffffffffc1014e7b RSP: ffffa25ec6978cb0 RFLAGS: 00010246 RAX: 0000000000000008 RBX: ffff8aa000888000 RCX: 0000000000000000 RDX: 000000000000000e RSI: ffff8a9fc7ab803e RDI: ffff8a9fd1168700 RBP: ffff8a9fc7ab803e R8: 0000000000700000 R9: 00000000000010ae R10: ffff8a9fcb748980 R11: 0000000000000000 R12: ffff8a9fd1168700 R13: ffff8aa000888000 R14: 00000000002a0000 R15: 00000000000010ae ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 #7 [ffffa25ec6978ce8] vxlan_rcv at ffffffffc10189cd [vxlan] #8 [ffffa25ec6978d90] udp_queue_rcv_one_skb at ffffffff8cfb6507 #9 [ffffa25ec6978dc0] udp_unicast_rcv_skb at ffffffff8cfb6e45 #10 [ffffa25ec6978dc8] __udp4_lib_rcv at ffffffff8cfb8807 #11 [ffffa25ec6978e20] ip_protocol_deliver_rcu at ffffffff8cf76951 #12 [ffffa25ec6978e48] ip_local_deliver at ffffffff8cf76bde #13 [ffffa25ec6978ea0] __netif_receive_skb_one_core at ffffffff8cecde9b #14 [ffffa25ec6978ec8] process_backlog at ffffffff8cece139 #15 [ffffa25ec6978f00] __napi_poll at ffffffff8ceced1a #16 [ffffa25ec6978f28] net_rx_action at ffffffff8cecf1f3 #17 [ffffa25ec6978fa0] __softirqentry_text_start at ffffffff8d4000ca #18 [ffffa25ec6978ff0] do_softirq at ffffffff8c6fbdc3

Reproducer: https://github.com/Mellanox/ovs-tests/blob/master/test-ovs-vxlan-remove-tunnel-during-traffic.sh

Fix this by waiting for all sk_user_data reader to finish before releasing the sock.(CVE-2022-50405)

In the Linux kernel, there is a vulnerability in the USB host controller interface (xHCI). When the xHC host is dying or being removed, endpoints are not properly cleaned up, remaining in the bandwidth list when freeing the virtual device. This causes a list_del corruption kernel crash when unbinding xhci-pci, as xhci_mem_cleanup() later attempts to delete already freed endpoints from the bandwidth list. This vulnerability only affects hosts that use software bandwidth checking, which currently is only the xHC in Intel Panther Point PCH (Ivy Bridge).(CVE-2022-50470)

In the Linux kernel, the following vulnerability has been resolved:thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crashWhen CPU 0 is offline and intel_powerclamp is used to injectidle, it generates kernel BUG:BUG: using smp_processor_id() in preemptible [00000000] code: bash/15687caller is debug_smp_processor_id+0x17/0x20CPU: 4 PID: 15687 Comm: bash Not tainted 5.19.0-rc7+ #57Call Trace:<TASK>dump_stack_lvl+0x49/0x63dump_stack+0x10/0x16check_preemption_disabled+0xdd/0xe0debug_smp_processor_id+0x17/0x20powerclamp_set_cur_state+0x7f/0xf9 [intel_powerclamp]......Here CPU 0 is the control CPU by default and changed to the current CPU,if CPU 0 offlined. This check has to be performed under cpus_read_lock(),hence the above warning.Use get_cpu() instead of smp_processor_id() to avoid this BUG. rjw: Subject edits

In the Linux kernel, the following vulnerability has been resolved:iommu/amd: Fix pci device…

Record: OESA-2025-2553
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 18 moreShow less

OSVRHSA-2023:6583 8.2

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2023:6583
CVSS 3.1: 8.2 HighCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2023:7077 7.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2023:7077
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2022-50470 7.8

Record: UBUNTU-CVE-2022-50470
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVCLSA-2026-1773047921 No score

kernel: Fix of 70 CVEs

wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
ASoC: topology: Fix references to freed memory {CVE-2024-41069}
net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739}
drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673}
xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687}
NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
netfilter: validate user input for expected length {CVE-2024-35896}
erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
i40e: remove read access to debugfs files {CVE-2025-39901}
wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
dm-bufio: don't schedule in atomic context {CVE-2025-37928}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
dm cache: Fix UAF in destroy() {CVE-2022-50496}
xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
igb: Do not bring the device up after non-fatal error {CVE-2024-50040}
wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
udf: Do not bother merging very long extents {CVE-2023-53506}
wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path…

Record: CLSA-2026-1773047921
Updated: 2026-11-02

OSVCLSA-2026-1773048865 No score

kernel: Fix of 53 CVEs

xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
dm cache: Fix UAF in destroy() {CVE-2022-50496}
Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf {CVE-2023-53524}
xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
NFSD: Fix the behavior of READ near OFFSET_MAX {CVE-2022-48827}
NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
i40e: remove read access to debugfs files {CVE-2025-39901}
Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
dm-bufio: don't schedule in atomic context {CVE-2025-37928}
ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
net/sched: Enforce that teql can only be used as root qdisc {CVE-2026-23074}
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
igb: Do not bring the device up after non-fatal error {CVE-2024-50040}
HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras {CVE-2023-53471}
wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
udf: Do not bother merging very long extents {CVE-2023-53506}
wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
iavf: Fix use-after-free in free_netdev {CVE-2023-53556}
cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
kernfs: fix use-after-free in __kernfs_remove {CVE-2022-50432}
net/sched: act_mirred: don't override retval if we already lost the skb…

Record: CLSA-2026-1773048865
Updated: 2026-11-02

OSVCLSA-2026-1773139548 No score

kernel: Fix of 78 CVEs

fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
wifi: mac80211: check for station first in client probe {CVE-2023-53588}
bonding: do not assume skb mac_header is set {CVE-2023-53601}
drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
md/raid10: fix memleak of md thread {CVE-2023-54294}
usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
HID: core: ensure __hid_request reserves the report ID as the first byte
HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
xfs: do not propagate ENODATA…

Record: CLSA-2026-1773139548
Updated: 2026-11-02

OSVCLSA-2026-1775779453 No score

Fix of 119 CVEs

CVE-2025-39743
- jfs: truncate good inode pages when hard link is 0 {CVE-2025-39743}
CVE-2025-39685
- comedi: pcl726: Prevent invalid irq number {CVE-2025-39685}
CVE-2025-38713
- hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() {CVE-2025-38713}
CVE-2025-38699
- scsi: bfa: Double-free fix {CVE-2025-38699}
CVE-2025-38697
- jfs: upper bound check of tree index in dbAllocAG {CVE-2025-38697}
CVE-2025-38680
- media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
CVE-2025-38677
- f2fs: fix to avoid out-of-boundary access in dnode page {CVE-2025-38677}
CVE-2025-38572
- ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
CVE-2025-38538
- dmaengine: nbpfaxi: Fix memory corruption in probe() {CVE-2025-38538}
CVE-2025-38530
- comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530}
CVE-2025-38529
- comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529}
CVE-2025-38494
- HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
CVE-2025-38482
- comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482}
CVE-2025-38428
- Input: ims-pcu - check record size in ims_pcu_flash_firmware() {CVE-2025-38428}
CVE-2025-38416
- NFC: nci: uart: Set tty->disc_data only in success path {CVE-2025-38416}
CVE-2025-38415
- Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
CVE-2025-38403
- vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
CVE-2025-38286
- pinctrl: at91: Fix possible out-of-boundary access {CVE-2025-38286}
CVE-2025-38245
- atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
CVE-2025-38212
- ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
CVE-2025-38204
- jfs: fix array-index-out-of-bounds read in add_missing_indices {CVE-2025-38204}
CVE-2025-38157
- wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
CVE-2025-38079
- crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
CVE-2025-38051
- smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
CVE-2023-53676
- scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
CVE-2023-53675
- scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
CVE-2023-53668
- ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
CVE-2023-53622
- gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
CVE-2023-53616
- jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount {CVE-2023-53616}
CVE-2023-53608
- nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() {CVE-2023-53608}
CVE-2023-53587
- ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
CVE-2023-53569
- ext2: Check block size validity during mount {CVE-2023-53569}
CVE-2023-53559
- ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
CVE-2023-53541
- mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write {CVE-2023-53541}
CVE-2023-53521
- scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
CVE-2023-53506
- udf: Do not bother merging very long extents {CVE-2023-53506}
CVE-2023-53485
- fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev {CVE-2023-53485}
CVE-2023-53484
- lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
CVE-2023-53454
- HID: multitouch: Correct devm device reference for hidinput input_dev name…

Record: CLSA-2026-1775779453
Updated: 2026-11-02

OSVCLSA-2026-1788170774 No score

kernel: Fix of 132 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788170774
Updated: 2026-11-02

OSVCLSA-2026-1788257079 No score

kernel: Fix of 131 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788257079
Updated: 2026-11-02

OSVCLSA-2026-1788259625 No score

kernel: Fix of 132 CVEs

sctp: fix potential deadlock on &net->sctp.addr_wq_lock {CVE-2024-0639}
sctp: delay auto_asconf init until binding the first addr {CVE-2021-23133}
netfilter: nf_log: validate MAC header was set before dumping it {CVE-2026-52942}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
btrfs: fix use-after-free when attempting to join an aborted transaction {CVE-2025-21753}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
team: fix header_ops type confusion with non-Ethernet ports {CVE-2026-31502}
xfrm: Fix dev use-after-free in xfrm async resumption {CVE-2026-72463}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
xen/privcmd: add IOCTL_PRIVCMD_RESTRICT {CVE-2026-31788}
Bluetooth: L2CAP: make l2cap_connect() return void {CVE-2024-36013}
btrfs: fix incorrect splitting in btrfs_drop_extent_map_range {CVE-2023-54121}
netfilter: nf_conntrack: defer invalid log until after unlock {CVE-2026-74624}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
dm cache: fix flushing uninitialized delayed_work on cache_ctr error {CVE-2024-50280}
audit: fix recursive locking deadlock in audit_dupe_exe() {CVE-2026-68096}
RDMA/rxe: Reject unknown opcodes before ICRC processing {CVE-2026-46133}
Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
net: pull headers in qdisc_pkt_len_segs_init() {CVE-2026-53091}
inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP {CVE-2026-46266}
Bluetooth: RFCOMM: validate skb length in MCC handlers {CVE-2026-53254}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
btrfs: qgroup: fix race between quota disable and quota rescan ioctl {CVE-2025-39759}
fanotify: fix false positive on permission events {CVE-2026-46150}
HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
ext4: fix e4b bitmap inconsistency reports {CVE-2026-45942}
Bluetooth: serialize accept_q access {CVE-2026-52918}
ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}
RDMA/bnxt_re: zero shared page before exposing to userspace {CVE-2026-74584}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
wifi: cfg80211: Partial revert "wifi: cfg80211: Fix use after free for wext" {CVE-2023-53153}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
drm/amdgpu/vce: fix integer overflow in image size {CVE-2026-68108}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
libceph: reject zero bucket types in crush_decode {CVE-2026-68154}
libceph: bound…

Record: CLSA-2026-1788259625
Updated: 2026-11-02

OSV No score