CVE-2023-53392

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux SIG Cloud 8.10 Release Notes linked from the References section.

In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix kernel panic during warm reset During warm reset device->fw_client is set to NULL. If a bus driver is registered after this NULL setting and before new firmware clients are enumerated by ISHTP, kernel panic will result in the function ishtp_cl_bus_match(). This is because of reference to device->fw_client->props.protocol_name. ISH firmware after getting successfully loaded, sends a warm reset notification to remove all clients from the bus and sets device->fw_client to NULL. Until kernel v5.15, all enabled ISHTP kernel module drivers were loaded right after any of the first ISHTP device was registered, regardless of whether it was a matched or an unmatched device. This resulted in all drivers getting registered much before the warm reset notification from ISH. Starting kernel v5.16, this issue got exposed after the change was introduced to load only bus drivers for the respective matching devices. In this scenario, cros_ec_ishtp device and cros_ec_ishtp driver are registered after the warm reset device fw_client NULL setting. cros_ec_ishtp driver_register() triggers the callback to ishtp_cl_bus_match() to match ISHTP driver to the device and causes kernel panic in guid_equal() when dereferencing fw_client NULL pointer to get protocol_name.

• fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
• qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
• drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
• pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
• netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
• ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
• fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
• svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
• bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
• scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
• fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
• scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
• RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
• memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
• ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
• KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
• net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
• net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
• usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
• scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
• rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
• block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
• wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
• wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
• wifi: mac80211: check for station first in client probe {CVE-2023-53588}
• bonding: do not assume skb mac_header is set {CVE-2023-53601}
• drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
• wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
• net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
• media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
• md/raid10: fix memleak of md thread {CVE-2023-54294}
• usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
• scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
• HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
• driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
• net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
• rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
• bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
• usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
• nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
• drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
• mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
• bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
• net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
• net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
• net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
• smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
• perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
• HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
• HID: core: ensure __hid_request reserves the report ID as the first byte
• HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
• HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
• xfs: do not propagate ENODATA…

In the Linux kernel, the following vulnerability has been resolved:

HID: intel-ish-hid: Fix kernel panic during warm reset

During warm reset device->fw_client is set to NULL. If a bus driver is registered after this NULL setting and before new firmware clients are enumerated by ISHTP, kernel panic will result in the function ishtp_cl_bus_match(). This is because of reference to device->fw_client->props.protocol_name.

ISH firmware after getting successfully loaded, sends a warm reset notification to remove all clients from the bus and sets device->fw_client to NULL. Until kernel v5.15, all enabled ISHTP kernel module drivers were loaded right after any of the first ISHTP device was registered, regardless of whether it was a matched or an unmatched device. This resulted in all drivers getting registered much before the warm reset notification from ISH.

Starting kernel v5.16, this issue got exposed after the change was introduced to load only bus drivers for the respective matching devices. In this scenario, cros_ec_ishtp device and cros_ec_ishtp driver are registered after the warm reset device fw_client NULL setting. cros_ec_ishtp driver_register() triggers the callback to ishtp_cl_bus_match() to match ISHTP driver to the device and causes kernel panic in guid_equal() when dereferencing fw_client NULL pointer to get protocol_name.