CVE-2023-4623

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

(CVE-2023-5197)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

(CVE-2023-5197)

The Linux Kernel, the operating system core itself.

Security Fix(es):

An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically allocating fops.(CVE-2022-45884)

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-35823. Reason: This candidate is a reservation duplicate of CVE-2023-35823. Notes: All CVE users should reference CVE-2023-35823 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.(CVE-2023-3327)

A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an attacker to guess the returned handle value and trigger a use-after-free issue, potentially leading to a denial of service or privilege escalation.(CVE-2023-39198)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

(CVE-2023-4623)

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

(CVE-2023-5197)

A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation. If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free. We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

• kernel: net/sched: sch_hfsc UAF (CVE-2023-4623)
• kernel: use-after-free in sch_qfq network scheduler (CVE-2023-4921)
• kernel: inactive elements in nft_pipapo_walk (CVE-2023-6817)
• kernel: IGB driver inadequate buffer size for frames larger than MTU (CVE-2023-45871)
• kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVE-2024-0646)
• kernel: nfp: use-after-free in area_cache_get() (CVE-2022-3545)
• kernel: null-ptr-deref vulnerabilities in sl_tx_timeout in drivers/net/slip (CVE-2022-41858)
• kernel: HID: check empty report_list in hid_validate_values() (CVE-2023-1073)
• kernel: Possible use-after-free since the two fdget() during vhost_net_set_backend() (CVE-2023-1838)
• kernel: NULL pointer dereference in can_rcv_filter (CVE-2023-2166)
• kernel: Slab-out-of-bound read in compare_netdev_and_ip (CVE-2023-2176)
• kernel: A heap out-of-bounds write when function perf_read_group is called and sibling_list is smaller than its child's sibling_list (CVE-2023-5717)
• kernel: NULL pointer dereference in nvmet_tcp_build_iovec (CVE-2023-6356)
• kernel: NULL pointer dereference in nvmet_tcp_execute_request (CVE-2023-6535)
• kernel: NULL pointer dereference in __nvmet_req_complete (CVE-2023-6536)
• kernel: Out-Of-Bounds Read vulnerability in smbCalcSize (CVE-2023-6606)
• kernel: OOB Access in smb2_dump_detail (CVE-2023-6610)
• kernel: use-after-free in l2cap_sock_release in net/bluetooth/l2cap_sock.c (CVE-2023-40283)
• kernel: SEV-ES local priv escalation (CVE-2023-46813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2023-42752 // CVE-url: https://ubuntu.com/security/CVE-2023-42752
  • igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
• CVE-2023-4623 // CVE-url: https://ubuntu.com/security/CVE-2023-4623
  • net/sched: sch_hfsc: Ensure inner classes have fsc curve
• CVE-2023-34319 // CVE-url: https://ubuntu.com/security/CVE-2023-34319
  • xen/netback: Fix buffer overrun triggered by unusual packet
• CVE-2023-4881 // CVE-url: https://ubuntu.com/security/CVE-2023-4881
  • netfilter: nftables: exthdr: fix 4-byte stack OOB write
• CVE-2023-31083 // CVE-url: https://ubuntu.com/security/CVE-2023-31083
  • Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
• CVE-2023-3772 // CVE-url: https://ubuntu.com/security/CVE-2023-3772
  • xfrm: add NULL check in xfrm_update_ae_params

• CVE-2023-42752 // CVE-url: https://ubuntu.com/security/CVE-2023-42752
  • igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
• CVE-2023-4623 // CVE-url: https://ubuntu.com/security/CVE-2023-4623
  • net/sched: sch_hfsc: Ensure inner classes have fsc curve
• CVE-2023-34319 // CVE-url: https://ubuntu.com/security/CVE-2023-34319
  • xen/netback: Fix buffer overrun triggered by unusual packet
• CVE-2023-4881 // CVE-url: https://ubuntu.com/security/CVE-2023-4881
  • netfilter: nftables: exthdr: fix 4-byte stack OOB write
• CVE-2023-31083 // CVE-url: https://ubuntu.com/security/CVE-2023-31083
  • Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
• CVE-2023-3772 // CVE-url: https://ubuntu.com/security/CVE-2023-3772
  • xfrm: add NULL check in xfrm_update_ae_params

[ Ubuntu: 4.15.0-220.231 ]

• CVE-2023-0597 // CVE-url: https://ubuntu.com/security/CVE-2023-0597
  • x86/kasan: Map shadow for percpu pages on demand
  • x86/mm: Recompute physical address for every page of per-CPU CEA mapping
  • x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
  • x86/mm: Do not shuffle CPU entry areas without KASLR
• CVE-url: https://ubuntu.com/security/CVE-2023-0597
  • random32: add noise from network and scheduling activity
  • x86/mm: Randomize per-cpu entry area
  • x86/cpu_entry_area: Move percpu_setup_debug_store() to __init section
  • x86/cpu_entry_area: Cleanup setup functions
• CVE-2023-42752 // CVE-url: https://ubuntu.com/security/CVE-2023-42752
  • igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
• CVE-2023-4623 // CVE-url: https://ubuntu.com/security/CVE-2023-4623
  • net/sched: sch_hfsc: Ensure inner classes have fsc curve
• CVE-2023-34319 // CVE-url: https://ubuntu.com/security/CVE-2023-34319
  • xen/netback: Fix buffer overrun triggered by unusual packet
• CVE-2023-4881 // CVE-url: https://ubuntu.com/security/CVE-2023-4881
  • netfilter: nftables: exthdr: fix 4-byte stack OOB write
• CVE-2023-31083 // CVE-url: https://ubuntu.com/security/CVE-2023-31083
  • Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
• CVE-2023-3772 // CVE-url: https://ubuntu.com/security/CVE-2023-3772
  • xfrm: add NULL check in xfrm_update_ae_params

• CVE-2023-0597 // CVE-url: https://ubuntu.com/security/CVE-2023-0597
  • x86/kasan: Map shadow for percpu pages on demand
  • x86/mm: Recompute physical address for every page of per-CPU CEA mapping
  • x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
  • x86/mm: Do not shuffle CPU entry areas without KASLR
• CVE-url: https://ubuntu.com/security/CVE-2023-0597
  • random32: add noise from network and scheduling activity
  • x86/mm: Randomize per-cpu entry area
  • x86/cpu_entry_area: Move percpu_setup_debug_store() to __init section
  • x86/cpu_entry_area: Cleanup setup functions
• CVE-2023-42752 // CVE-url: https://ubuntu.com/security/CVE-2023-42752
  • igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
• CVE-2023-4623 // CVE-url: https://ubuntu.com/security/CVE-2023-4623
  • net/sched: sch_hfsc: Ensure inner classes have fsc curve
• CVE-2023-34319 // CVE-url: https://ubuntu.com/security/CVE-2023-34319
  • xen/netback: Fix buffer overrun triggered by unusual packet
• CVE-2023-4881 // CVE-url: https://ubuntu.com/security/CVE-2023-4881
  • netfilter: nftables: exthdr: fix 4-byte stack OOB write
• CVE-2023-31083 // CVE-url: https://ubuntu.com/security/CVE-2023-31083
  • Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
• CVE-2023-3772 // CVE-url: https://ubuntu.com/security/CVE-2023-3772
  • xfrm: add NULL check in xfrm_update_ae_params

• CVE-2023-0597 // CVE-url: https://ubuntu.com/security/CVE-2023-0597
  • x86/kasan: Map shadow for percpu pages on demand
  • x86/mm: Recompute physical address for every page of per-CPU CEA mapping
  • x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area
  • x86/mm: Do not shuffle CPU entry areas without KASLR
• CVE-url: https://ubuntu.com/security/CVE-2023-0597
  • random32: add noise from network and scheduling activity
  • x86/mm: Randomize per-cpu entry area
  • x86/cpu_entry_area: Move percpu_setup_debug_store() to __init section
  • x86/cpu_entry_area: Cleanup setup functions
• CVE-2023-42752 // CVE-url: https://ubuntu.com/security/CVE-2023-42752
  • igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
• CVE-2023-4623 // CVE-url: https://ubuntu.com/security/CVE-2023-4623
  • net/sched: sch_hfsc: Ensure inner classes have fsc curve
• CVE-2023-34319 // CVE-url: https://ubuntu.com/security/CVE-2023-34319
  • xen/netback: Fix buffer overrun triggered by unusual packet
• CVE-2023-4881 // CVE-url: https://ubuntu.com/security/CVE-2023-4881
  • netfilter: nftables: exthdr: fix 4-byte stack OOB write
• CVE-2023-31083 // CVE-url: https://ubuntu.com/security/CVE-2023-31083
  • Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
• CVE-2023-3772 // CVE-url: https://ubuntu.com/security/CVE-2023-3772
  • xfrm: add NULL check in xfrm_update_ae_params

• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-4881}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
• igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• net: add kerneldoc comment for sk_peer_lock {CVE-2021-4203}
• af_unix: fix races in sk_peer_pid and sk_peer_cred accesses {CVE-2021-4203}
• block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern {CVE-2022-0494}
• media: ov519: add missing endpoint sanity checks {CVE-2020-11608}
• act_mirred: use the backlog for nested calls to mirred ingress {CVE-2022-4269}
• net/sched: act_mirred: better wording on protection against excessive stack growth {CVE-2022-4269}
• inet: use bigger hash table for IP ID generation {CVE-2021-45486}
• net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" {CVE-2021-45486}

• net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
• x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
• x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
• netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-4881}
• net: sched: sch_qfq: Fix UAF in qfq_dequeue() {CVE-2023-4921}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• USB: ene_usb6250: Allocate enough memory for full object {CVE-2023-45862}
• igb: set max size RX buffer when store bad packet is enabled {CVE-2023-45871}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• drm/qxl: fix UAF on handle creation {CVE-2023-39198}
• net: add kerneldoc comment for sk_peer_lock {CVE-2021-4203}
• af_unix: fix races in sk_peer_pid and sk_peer_cred accesses {CVE-2021-4203}
• block-map: add __GFP_ZERO flag for alloc_page in function bio_copy_kern {CVE-2022-0494}
• media: ov519: add missing endpoint sanity checks {CVE-2020-11608}
• act_mirred: use the backlog for nested calls to mirred ingress {CVE-2022-4269}
• net/sched: act_mirred: better wording on protection against excessive stack growth {CVE-2022-4269}
• inet: use bigger hash table for IP ID generation {CVE-2021-45486}
• net: revert "net: get rid of an signed integer overflow in ip_idents_reserve()" {CVE-2021-45486}

• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
• xirc2ps_cs: Fix use after free bug in xirc2ps_detach {CVE-2023-1670}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: use prandom_u32() for ID generation {CVE-2021-45485}

• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
• xirc2ps_cs: Fix use after free bug in xirc2ps_detach {CVE-2023-1670}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: use prandom_u32() for ID generation {CVE-2021-45485}

• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
• xirc2ps_cs: Fix use after free bug in xirc2ps_detach {CVE-2023-1670}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: use prandom_u32() for ID generation {CVE-2021-45485}

• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• net/sched: cls_fw: Fix improper refcount update leads to use-after-free {CVE-2023-3776}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() {CVE-2023-3111}
• xirc2ps_cs: Fix use after free bug in xirc2ps_detach {CVE-2023-1670}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM {CVE-2022-42896}
• tcp: Fix data races around icsk->icsk_af_ops. {CVE-2022-3566}
• ipv6: use prandom_u32() for ID generation {CVE-2021-45485}

• bpf: Fix re-attachment branch in bpf_tracing_prog_attach {CVE-2024-26591}
• ext4: improve error recovery code paths in __ext4_remount() {CVE-2024-0775}
• smb: client: fix OOB in receive_encrypted_standard() {CVE-2024-0565}
• mtd: Fix gluebi NULL pointer dereference caused by ftl notifier {CVE-2023-52449}
• net: prevent mss overflow in skb_segment() {CVE-2023-52435}
• smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
• atm: Fix Use-After-Free in do_vcc_ioctl {CVE-2023-51780}
• ida: Fix crash in ida_free when the bitmap is empty {CVE-2023-6915}
• nvmet: nul-terminate the NQNs passed in the connect command {CVE-2023-6121}
• netfilter: nf_tables: Reject tables of unsupported family {CVE-2023-6040}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work {CVE-2023-1989}
• NFSD: fix use-after-free in nfsd4_ssc_setup_dul() {CVE-2023-1652}
• x86/bugs: Flush IBP in ib_prctl_set() {CVE-2023-0045}
• Bluetooth: L2CAP: Fix u8 overflow {CVE-2022-45934}
• Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm {CVE-2022-42896}
• x86: Clear .brk area at early boot {CVE-2022-36123}
• misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os {CVE-2022-3424}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
• netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one {CVE-2023-39197}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• ipv6: rpl: Fix Route of Death. {CVE-2023-2156}
• ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-2156}
• net: rpl: fix rpl header size calculation {CVE-2023-2156}
• memstick: r592: Fix UAF bug in r592_remove due to race condition {CVE-2023-3141}
• ovl: fix use after free in struct ovl_aio_req {CVE-2023-1252}
• drm/amdgpu: Fix potential fence use-after-free v2 {CVE-2023-51042}
• netfilter: nf_tables: reject QUEUE/DROP verdict parameters {CVE-2024-1086}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• drm/atomic: Fix potential use-after-free in nonblocking commits {CVE-2023-51043}
• nvmet-tcp: Fix the H2C expected PDU len calculation {CVE-2023-6356}
• nvmet-tcp: remove boilerplate code {CVE-2023-6356}
• nvmet-tcp: fix a crash in nvmet_req_complete() {CVE-2023-6356}
• nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length {CVE-2023-6356}
• net: tls, update curr on splice as well {CVE-2024-0646}
• smb: client: fix potential OOB in smb2_dump_detail() {CVE-2023-6610}
• smb: client: fix potential OOB in cifs_dump_detail() {CVE-2023-6610}
• smb: client: fix OOB in smbCalcSize() {CVE-2023-6606}
• ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet {CVE-2023-6932}
• RDMA/core: Update CMA destination address on rdma_resolve_addr {CVE-2023-2176}
• RDMA/core: Refactor rdma_bind_addr {CVE-2023-2176}
• nfp: fix use-after-free in area_cache_get() {CVE-2022-3545}
• netfilter: nf_tables: skip bound chain on rule flush {CVE-2023-3777}
• Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb {CVE-2023-40283}
• drivers: net: slip: fix NPD bug in sl_tx_timeout() {CVE-2022-41858}
• net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve {CVE-2023-4623}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF {CVE-2023-3567}
• nvmet-tcp: Fix a possible UAF in queue intialization setup {CVE-2023-5178}
• net: tun: fix bugs for oversize packet when napi frags enabled {CVE-2023-3812}
• netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c {CVE-2023-42753}
• bpf: Fix incorrect verifier pruning due to missing register precision taints {CVE-2023-2163}
• net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free {CVE-2023-4206}…

• kvm: initialize all of the kvm_debugregs structure before sending it to userspace {CVE-2023-1513}
• wifi: mac80211: fix MBSSID parsing use-after-free {CVE-2022-42719}
• mac80211: always allocate struct ieee802_11_elems {CVE-2022-42719}
• netfilter: nf_tables: initialize registers in nft_do_chain() {CVE-2022-1016}
• xprtrdma: fix incorrect header size calculations {CVE-2022-0812}
• net: usb: fix memory leak in smsc75xx_bind {CVE-2021-47171}
• i2c: i801: Don't generate an interrupt on bus reset {CVE-2021-47153}
• pid: take a reference when initializing cad_pid {CVE-2021-47118}
• Input: appletouch - initialize work before device registration {CVE-2021-46932}
• HID: usbhid: fix info leak in hid_submit_ctrl {CVE-2021-46906}
• quota: check block number when reading the block in quota file {CVE-2021-45868}
• mwifiex: Fix skb_over_panic in mwifiex_usb_recv() {CVE-2021-43976}
• atlantic: Fix OOB read and write in hw_atl_utils_fw_rpc_wait {CVE-2021-43975}
• isdn: cpai: check ctr->cnr to avoid array index out of bound {CVE-2021-43389}
• usb: hso: fix error handling code of hso_create_net_device {CVE-2021-37159}
• can: bcm: fix infoleak in struct bcm_msg_head {CVE-2021-34693}
• dm ioctl: fix out of bounds array access when no devices {CVE-2021-31916}
• KVM: x86: hyper-v: Fix Hyper-V context null-ptr-deref {CVE-2021-30178}
• perf/x86/intel: Fix a crash caused by zero PEBS status {CVE-2021-28971}
• btrfs: fix race when cloning extent buffer during rewind of an old root {CVE-2021-28964}
• ovl: fix missing negative dentry check in ovl_rename() {CVE-2021-20321}
• drm/ttm/nouveau: don't call tt destroy callback on alloc failure. {CVE-2021-20292}
• bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() {CVE-2021-4159}
• btrfs: unlock newly allocated extent buffer after error {CVE-2021-4149}
• tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop. {CVE-2021-3679}
• net: mac802154: Fix general protection fault {CVE-2021-3659}
• nfsd4: readdirplus shouldn't return parent of export {CVE-2021-3178}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2021-0129}
• drm/nouveau: clean up all clients on device removal {CVE-2020-27820}
• drm/nouveau: Add a dedicated mutex for the clients list {CVE-2020-27820}
• drm/nouveau: use drm_dev_unplug() during device removal {CVE-2020-27820}
• Bluetooth: SMP: Fail if remote and local public keys are identical {CVE-2020-26555}
• vsock: Fix memory leak in vsock_connect() {CVE-2022-3629}
• RDMA/core: Don't infoleak GRH fields {CVE-2021-3923}
• xen/netfront: force data bouncing when backend is untrusted {CVE-2022-33741}
• net: Rename and export copy_skb_header
• floppy: use a statically allocated error counter {CVE-2022-1652}
• fuse: fix pipe buffer lifetime for direct_io {CVE-2022-1011}
• aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts {CVE-2024-26898}
• smb: client: fix use-after-free bug in cifs_debug_data_proc_show() {CVE-2023-52752}
• media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
• media: dm1105: Fix use after free bug in dm1105_remove due to race condition {CVE-2023-35824}
• perf: Fix perf_event_validate_size() lockdep splat {CVE-2023-6931}
• perf: Fix perf_event_validate_size() {CVE-2023-6931}
• net/sched: sch_hfsc: Ensure inner classes have fsc curve {CVE-2023-4623}
• relayfs: fix out-of-bounds access in relay_file_read {CVE-2023-3268}
• xfs: verify buffer contents when we skip log replay {CVE-2023-2124}
• Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-1989}
• Fix double fget() in vhost_net_set_backend() {CVE-2023-1838}
• net/sched: cls_tcindex: downgrade to imperfect hash {CVE-2023-1829}
• xen/netfront: fix leaking data in shared pages {CVE-2022-33740}
• can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path {CVE-2022-28390}
• xen/blkfront: fix leaking data in shared pages {CVE-2022-26365}
• mISDN: fix use-after-free bugs in l1oip timer…