CVE-2023-53343

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

5.5 MediumFix available

In the Linux kernel, the following vulnerability has been resolved:

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr.

For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::.

for f in $(find /proc/sys/net/ -name seg6_enabled); do echo 1 > $f; done

python3

from socket import * from scapy.all import *
SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) sk.sendto(bytes(pkt), (DST_ADDR, 0))

For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type.

ipv6_rthdr_rcv()
ipv6_rpl_srh_rcv()
ipv6_srh_rcv()

If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop().

Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev as the input device is the loopback interface. Then, we have to check if skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref for ip6_null_entry.

BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503) Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01 RSP: 0018:ffffc90000003c70 EFLAGS: 00000286 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18 RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001 R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10 R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0 FS: 00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ip6_pkt_drop (net/ipv6/route.c:4513) ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5)) ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483) __netif_receive_skb_one_core (net/core/dev.c:5455) process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895) __napi_poll (net/core/dev.c:6460) net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554) do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) </IRQ> <TASK> __local_bh_enable_ip (kernel/softirq.c:381) __dev_queue_xmit (net/core/dev.c:4231) ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135) rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914) sock_sendmsg (net/socket.c:725 net/socket.c:748) __sys_sendto (net/socket.c:2134) __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) RIP: 0033:0x7f9dc751baea Code: d8 64 89 02 48 c7 c0 ff f ---truncated---

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.21%Up 0.2 points since Sep 18, 2025

What each source reports

NVD Score used5.5

In the Linux kernel, the following vulnerability has been resolved:

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr.

For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::.

for f in $(find /proc/sys/net/ -name seg6_enabled); do echo 1 > $f; done

python3

from socket import * from scapy.all import *
SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) sk.sendto(bytes(pkt), (DST_ADDR, 0))

For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type.

ipv6_rthdr_rcv()
ipv6_rpl_srh_rcv()
ipv6_srh_rcv()

If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop().

Record: CVE-2023-53343
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

CVE List5.5

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

In the Linux kernel, the following vulnerability has been resolved:

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr.

For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::.

for f in $(find /proc/sys/net/ -name seg6_enabled); do echo 1 > $f; done

python3

from socket import * from scapy.all import *
SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) sk.sendto(bytes(pkt), (DST_ADDR, 0))

For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type.

ipv6_rthdr_rcv()
ipv6_rpl_srh_rcv()
ipv6_srh_rcv()

If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop().

Record: CVE-2023-53343
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

EUVDEUVD-2023-599835.5

In the Linux kernel, the following vulnerability has been resolved:

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr.

For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::.

for f in $(find /proc/sys/net/ -name seg6_enabled); do echo 1 > $f; done

python3

from socket import * from scapy.all import *
SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) sk.sendto(bytes(pkt), (DST_ADDR, 0))

For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type.

ipv6_rthdr_rcv()
ipv6_rpl_srh_rcv()
ipv6_srh_rcv()

If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop().

Record: EUVD-2023-59983
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-wcr6-fh62-j9wm5.5

In the Linux kernel, the following vulnerability has been resolved: icmp6: Fix null-ptr-deref of...

In the Linux kernel, the following vulnerability has been resolved:

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr.

For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::.

for f in $(find /proc/sys/net/ -name seg6_enabled); do echo 1 > $f; done

python3

from socket import * from scapy.all import *
SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) sk.sendto(bytes(pkt), (DST_ADDR, 0))

For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type.

ipv6_rthdr_rcv()
ipv6_rpl_srh_rcv()
ipv6_srh_rcv()

If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop().

Record: GHSA-wcr6-fh62-j9wm
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSVBELL-CVE-2023-533435.5

Record: BELL-CVE-2023-53343
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSV5.5

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

In the Linux kernel, the following vulnerability has been resolved:

icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev().

With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr.

For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::.

for f in $(find /proc/sys/net/ -name seg6_enabled); do echo 1 > $f; done

python3

from socket import * from scapy.all import *
SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456"
pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1)
sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) sk.sendto(bytes(pkt), (DST_ADDR, 0))

For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type.

ipv6_rthdr_rcv()
ipv6_rpl_srh_rcv()
ipv6_srh_rcv()

If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop().

Record: CVE-2023-53343
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 17 moreShow less

OSVDEBIAN-CVE-2023-533435.5

In the Linux kernel, the following vulnerability has been resolved: icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). With some IPv6 Ext Hdr (RPL, SRv6, etc.), we can send a packet that has the link-local address as src and dst IP and will be forwarded to an external IP in the IPv6 Ext Hdr. For example, the script below generates a packet whose src IP is the link-local address and dst is updated to 11::. # for f in $(find /proc/sys/net/ -name seg6_enabled); do echo 1 > $f; done # python3 >>> from socket import * >>> from scapy.all import * >>> >>> SRC_ADDR = DST_ADDR = "fe80::5054:ff:fe12:3456" >>> >>> pkt = IPv6(src=SRC_ADDR, dst=DST_ADDR) >>> pkt /= IPv6ExtHdrSegmentRouting(type=4, addresses=["11::", "22::"], segleft=1) >>> >>> sk = socket(AF_INET6, SOCK_RAW, IPPROTO_RAW) >>> sk.sendto(bytes(pkt), (DST_ADDR, 0)) For such a packet, we call ip6_route_input() to look up a route for the next destination in these three functions depending on the header type. * ipv6_rthdr_rcv() * ipv6_rpl_srh_rcv() * ipv6_srh_rcv() If no route is found, ip6_null_entry is set to skb, and the following dst_input(skb) calls ip6_pkt_drop(). Finally, in icmp6_dev(), we dereference skb_rt6_info(skb)->rt6i_idev->dev as the input device is the loopback interface. Then, we have to check if skb_rt6_info(skb)->rt6i_idev is NULL or not to avoid NULL pointer deref for ip6_null_entry. BUG: kernel NULL pointer dereference, address: 0000000000000000 PF: supervisor read access in kernel mode PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP PTI CPU: 0 PID: 157 Comm: python3 Not tainted 6.4.0-11996-gb121d614371c #35 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:icmp6_send (net/ipv6/icmp.c:436 net/ipv6/icmp.c:503) Code: fe ff ff 48 c7 40 30 c0 86 5d 83 e8 c6 44 1c 00 e9 c8 fc ff ff 49 8b 46 58 48 83 e0 fe 0f 84 4a fb ff ff 48 8b 80 d0 00 00 00 <48> 8b 00 44 8b 88 e0 00 00 00 e9 34 fb ff ff 4d 85 ed 0f 85 69 01 RSP: 0018:ffffc90000003c70 EFLAGS: 00000286 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 00000000000000e0 RDX: 0000000000000021 RSI: 0000000000000000 RDI: ffff888006d72a18 RBP: ffffc90000003d80 R08: 0000000000000000 R09: 0000000000000001 R10: ffffc90000003d98 R11: 0000000000000040 R12: ffff888006d72a10 R13: 0000000000000000 R14: ffff8880057fb800 R15: ffffffff835d86c0 FS: 00007f9dc72ee740(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 00000000057b2000 CR4: 00000000007506f0 PKRU: 55555554 Call Trace: <IRQ> ip6_pkt_drop (net/ipv6/route.c:4513) ipv6_rthdr_rcv (net/ipv6/exthdrs.c:640 net/ipv6/exthdrs.c:686) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:437 (discriminator 5)) ip6_input_finish (./include/linux/rcupdate.h:781 net/ipv6/ip6_input.c:483) __netif_receive_skb_one_core (net/core/dev.c:5455) process_backlog (./include/linux/rcupdate.h:781 net/core/dev.c:5895) __napi_poll (net/core/dev.c:6460) net_rx_action (net/core/dev.c:6529 net/core/dev.c:6660) __do_softirq (./arch/x86/include/asm/jump_label.h:27 ./include/linux/jump_label.h:207 ./include/trace/events/irq.h:142 kernel/softirq.c:554) do_softirq (kernel/softirq.c:454 kernel/softirq.c:441) </IRQ> <TASK> __local_bh_enable_ip (kernel/softirq.c:381) __dev_queue_xmit (net/core/dev.c:4231) ip6_finish_output2 (./include/net/neighbour.h:544 net/ipv6/ip6_output.c:135) rawv6_sendmsg (./include/net/dst.h:458 ./include/linux/netfilter.h:303 net/ipv6/raw.c:656 net/ipv6/raw.c:914) sock_sendmsg (net/socket.c:725 net/socket.c:748) __sys_sendto (net/socket.c:2134) __x64_sys_sendto (net/socket.c:2146 net/socket.c:2142 net/socket.c:2142) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) RIP: 0033:0x7f9dc751baea Code: d8 64 89 02 48 c7 c0 ff f ---truncated---

Record: DEBIAN-CVE-2023-53343
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2024:23947.8

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:2394
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2024:31388.0

Red Hat Security Advisory: kernel security, bug fix, and enhancement update

Record: RHSA-2024:3138
CVSS 3.1: 8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSVRXSA-2024:31388.0

Moderate: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

Record: RXSA-2024:3138
CVSS 3.1: 8.0 HighCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-533436.8

Record: UBUNTU-CVE-2023-53343
CVSS 4.0: 6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-11

OSVCLSA-2025-1759866837No score

kernel: Fix of 44 CVEs

mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
mm: fix zswap writeback race condition {CVE-2023-53178}
dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
gpio: davinci: Validate the obtained number of IRQs {CVE-2024-42092}
ASoC: topology: Fix references to freed memory {CVE-2024-41069}
Bluetooth: hci_sock: Fix not validating setsockopt user input {CVE-2024-35963}
Bluetooth: ISO: Fix not validating setsockopt user input {CVE-2024-35964}
Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939}
wifi: mwifiex: avoid possible NULL skb pointer dereference {CVE-2023-53384}
md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
thermal: core: prevent potential string overflow {CVE-2023-52868}
drm/amdkfd: Fix shift out-of-bounds issue {CVE-2023-52816}
drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369}
nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
net/mlx5: Fix tainted pointer delete is case of flow rules creation fail {CVE-2024-40940}
ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
platform/x86: wmi: remove unnecessary initializations
perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
kobject_uevent: Fix OOB access within zap_modalias_env() {CVE-2024-42292}
mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() {CVE-2023-53401}
net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
drm/radeon: possible buffer overflow {CVE-2023-52867}
media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
wifi: mac80211_hwsim: Fix possible NULL dereference {CVE-2023-53209}
vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
wifi: iwlwifi: fw: fix memory leak in debugfs {CVE-2023-53422}
drm/amdgpu: fix memory leak in mes self test {CVE-2023-53370}
skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
md/raid10: fix leak of 'r10bio->remaining' for recovery {CVE-2023-53299}
nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
ppdev: Add an error check in register_device {CVE-2024-36015}
wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
net: add atomic_long_t to net_device_stats fields {CVE-2024-26882}

Record: CLSA-2025-1759866837
Updated: 2026-11-02

OSVCLSA-2026-1782146775No score

kernel: Fix of 58 CVEs

libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}
wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
drm/i915/gem: add missing boundary check in vm_access {CVE-2023-28410}
ASoC: SOF: debug: Fix potential buffer overflow by snprintf() {CVE-2022-50051}
tipc: fix use-after-free Read in tipc_named_reinit {CVE-2022-49696}
wifi: mac8021: fix possible oob access in ieee80211_get_rate_duration {CVE-2022-49022}
drm/i915/gem: Really move i915_gem_context.link under ref protection {CVE-2022-48662}
drm/i915: Release i915_gem_context from a worker {CVE-2022-48662}
KVM: x86/mmu: Don't advance iterator after restart due to yielding {CVE-2021-47094}
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
media: dvb-net: fix OOB access in ULE extension header tables {CVE-2026-31405}
net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
RDMA/mlx5: Fix mlx5_ib_get_hw_stats when used for device {CVE-2023-53393}
scsi: target: iscsi: Fix a race condition between login_work and the login thread {CVE-2022-50350}
Make filldir64 verify the directory entry filename is valid {CVE-2019-10220}
usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
proc/vmcore: fix clearing user buffer by properly using clear_user() {CVE-2021-47566}
cxgb4: avoid accessing registers when clearing filters {CVE-2021-47138}
bpf: Fix ringbuf helper function compatibility {CVE-2021-34866}
ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
ext4: block range must be validated before use in ext4_mb_clear_bb() {CVE-2022-50021}
bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
ice: Fix memory corruption in VF driver {CVE-2022-49722}
net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
netfilter: nf_conntrack_helper: pass helper to…

Record: CLSA-2026-1782146775
Updated: 2026-11-02

OSVSUSE-SU-2025:03600-1No score