CVE-2023-53432

firewire: net: fix use after free in fwnet_finish_incoming_packet()

8.8 HighFix available

What does this mean?

: 8.8v3.1, from CVE List
: 0.21%10th percentile
Fixed in: 6.1.50-r0linux-lts
Published: September 18, 2025
Modified: November 11, 2026
Weakness: CWE-416
Also known as: BELL-CVE-2023-53432CLSA-2026-1768669128CLSA-2026-1769610819CLSA-2026-1770028389CLSA-2026-1770028764CLSA-2026-1770040438CLSA-2026-1771077729CLSA-2026-1771078945
Show 21 moreShow less
CLSA-2026-1780301172CLSA-2026-1782148597CLSA-2026-1788449727CLSA-2026-1791780738CLSA-2026-1791858923DEBIAN-CVE-2023-53432EUVD-2025-29852GHSA-vgfh-vgxv-c838OESA-2025-2406ROOT-OS-DEBIAN-11-CVE-2023-53432SUSE-SU-2025:03600-1SUSE-SU-2025:03634-1SUSE-SU-2025:20851-1SUSE-SU-2025:20861-1SUSE-SU-2025:20870-1SUSE-SU-2025:20898-1SUSE-SU-2025:3751-1SUSE-SU-2025:4057-1SUSE-SU-2025:4132-1SUSE-SU-2025:4141-1UBUNTU-CVE-2023-53432

In the Linux kernel, the following vulnerability has been resolved:

firewire: net: fix use after free in fwnet_finish_incoming_packet()

The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.21%Up 0.2 points since Sep 19, 2025

What each source reports

CVE List Score used 8.8

firewire: net: fix use after free in fwnet_finish_incoming_packet()

In the Linux kernel, the following vulnerability has been resolved:

firewire: net: fix use after free in fwnet_finish_incoming_packet()

The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Record: CVE-2023-53432
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

EUVDEUVD-2025-29852 8.8

In the Linux kernel, the following vulnerability has been resolved:

firewire: net: fix use after free in fwnet_finish_incoming_packet()

The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Record: EUVD-2025-29852
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-vgfh-vgxv-c838 7.8

In the Linux kernel, the following vulnerability has been resolved: firewire: net: fix use after...

In the Linux kernel, the following vulnerability has been resolved:

firewire: net: fix use after free in fwnet_finish_incoming_packet()

The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Record: GHSA-vgfh-vgxv-c838
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 8.8

In the Linux kernel, the following vulnerability has been resolved:

firewire: net: fix use after free in fwnet_finish_incoming_packet()

The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Record: CVE-2023-53432
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2023-53432 7.8

Record: BELL-CVE-2023-53432
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 8.8

firewire: net: fix use after free in fwnet_finish_incoming_packet()

In the Linux kernel, the following vulnerability has been resolved:

firewire: net: fix use after free in fwnet_finish_incoming_packet()

The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Record: CVE-2023-53432
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 26 moreShow less

OSVDEBIAN-CVE-2023-53432 7.8

In the Linux kernel, the following vulnerability has been resolved: firewire: net: fix use after free in fwnet_finish_incoming_packet() The netif_rx() function frees the skb so we can't dereference it to save the skb->len.

Record: DEBIAN-CVE-2023-53432
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-2406 7.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

memory: of: Fix refcount leak bug in of_get_ddr_timings()

We should add the of_node_put() when breaking out of for_each_child_of_node() as it will automatically increase and decrease the refcount.(CVE-2022-50249)

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: Add the missed acpi_put_table() to fix memory leak

When the radeon driver reads the bios information from ACPI table in radeon_acpi_vfct_bios(), it misses to call acpi_put_table() to release the ACPI memory after the init, so add acpi_put_table() properly to fix the memory leak.

v2: fix text formatting (Alex)(CVE-2022-50275)

In the Linux kernel, the following vulnerability has been resolved:

wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit()

There is a global-out-of-bounds reported by KASAN:

BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411

CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK>

The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough.

Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit.(CVE-2022-50279)

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath9k: verify the expected usb_endpoints are present

The bug arises when a USB device claims to be an ATH9K but doesn't have the expected endpoints. (In this case there was an interrupt endpoint where the driver expected a bulk endpoint.) The kernel needs to be able to handle such devices without getting an internal error.

usb 1-1: BOGUS urb xfer, pipe 3 != type 1 WARNING: CPU: 3 PID: 500 at drivers/usb/core/urb.c:493 usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 Modules linked in: CPU: 3 PID: 500 Comm: kworker/3:2 Not tainted 5.10.135-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Workqueue: events request_firmware_work_func RIP: 0010:usb_submit_urb+0xce2/0x1430 drivers/usb/core/urb.c:493 Call Trace: ath9k_hif_usb_alloc_rx_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:908 [inline] ath9k_hif_usb_alloc_urbs+0x75e/0x1010 drivers/net/wireless/ath/ath9k/hif_usb.c:1019 ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1109…

Record: OESA-2025-2406
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2023-53432 7.8

CVE-2023-53432 in linux - Patched by Root

Root has patched CVE-2023-53432 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2023-53432
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-53432 0.0

Record: UBUNTU-CVE-2023-53432
CVSS 4.0: 0.0 NoneCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 8.8 HighCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVCLSA-2026-1768669128 No score

kernel: Fix of 42 CVEs

Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
spec: merge oraclelinux6els changes
ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
ipvs: use explicitly signed chars
HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
md-raid10: fix KASAN warning {CVE-2022-50211}
usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
isofs: Prevent the use of too small fid {CVE-2025-37780}
net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

Record: CLSA-2026-1768669128
Updated: 2026-11-02

OSVCLSA-2026-1769610819 No score

kernel: Fix of 42 CVEs

Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
wifi: brcmfmac: fix use-after-free bug in brcmf_netdev_start_xmit() {CVE-2022-50408}
wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies() {CVE-2023-1380}
wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
NFSD: Protect against send buffer overflow in NFSv2 READ {CVE-2022-43945}
can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-2978}
ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}
atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
spec: merge oraclelinux6els changes
ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
ipvs: use explicitly signed chars
HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
xen/netfront: react properly to failing gnttab_end_foreign_access_ref() {CVE-2022-48900}
netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
mtd: inftlcore: Add error check for inftl_read_oob() {CVE-2025-37892}
igb: Do not free q_vector unless new one was allocated {CVE-2022-50252}
scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
md-raid10: fix KASAN warning {CVE-2022-50211}
usb: xhci: Fix isochronous Ring Underrun/Overrun event handling {CVE-2025-37882}
ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
isofs: Prevent the use of too small fid {CVE-2025-37780}
net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
partitions: mac: fix handling of bogus partition table {CVE-2025-21772}

Record: CLSA-2026-1769610819
Updated: 2026-11-02

OSVCLSA-2026-1770028389 No score

kernel: Fix of 16 CVEs

efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705}
libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282}
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
net: openvswitch: fix nested key length validation in the set() action
wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
fix: crypto: lzo - Fix compression buffer overrun
fix: NFSD: Protect against send buffer overflow in NFSv2 READ
cifs: fix oops during encryption {CVE-2022-50341}
SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL
fix smb3-encryption breakage when CONFIG_DEBUG_SG=y
Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
mm: fix zswap writeback race condition
Bluetooth: prefetch channel before killing sock
Bluetooth: Fix l2cap_disconnect_req deadlock
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
Bluetooth: Fix refcount use-after-free issue
Bluetooth: Check state in l2cap_disconnect_rsp
Bluetooth: L2CAP: Fix build errors in some archs
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
Bluetooth: use the correct print format for L2CAP debug statements
i40e: fix Jumbo Frame support after iPXE boot
i40e: Report MFS in decimal base instead of hex
i40e: Fix unexpected MFS warning message
i40e: Add a check to see if MFS is set
bitops: Add non-atomic bitops for pointers
bitfield: Add FIELD_MODIFY() helper

Record: CLSA-2026-1770028389
Updated: 2026-11-02

OSVCLSA-2026-1770028764 No score

kernel: Fix of 14 CVEs

efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705}
libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282}
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
net: openvswitch: fix nested key length validation in the set() action
wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
fix: crypto: lzo - Fix compression buffer overrun
fix: NFSD: Protect against send buffer overflow in NFSv2 READ
cifs: fix oops during encryption {CVE-2022-50341}
SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL
fix smb3-encryption breakage when CONFIG_DEBUG_SG=y
Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
mm: fix zswap writeback race condition
Bluetooth: prefetch channel before killing sock
Bluetooth: Fix l2cap_disconnect_req deadlock
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
Bluetooth: Fix refcount use-after-free issue
Bluetooth: Check state in l2cap_disconnect_rsp
Bluetooth: L2CAP: Fix build errors in some archs
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
Bluetooth: use the correct print format for L2CAP debug statements
i40e: fix Jumbo Frame support after iPXE boot
i40e: Report MFS in decimal base instead of hex
i40e: Fix unexpected MFS warning message
i40e: Add a check to see if MFS is set
bitops: Add non-atomic bitops for pointers
bitfield: Add FIELD_MODIFY() helper

Record: CLSA-2026-1770028764
Updated: 2026-11-02

OSVCLSA-2026-1770040438 No score

kernel: Fix of 14 CVEs

efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
ipv6: Fix out-of-bounds access in ipv6_find_tlv() {CVE-2023-53705}
libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282}
Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
net: openvswitch: fix nested key length validation in the set() action
wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
fix: crypto: lzo - Fix compression buffer overrun
fix: NFSD: Protect against send buffer overflow in NFSv2 READ
cifs: fix oops during encryption {CVE-2022-50341}
SMB3: Kernel oops mounting a encryptData share with CONFIG_DEBUG_VIRTUAL
fix smb3-encryption breakage when CONFIG_DEBUG_SG=y
Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
mm: fix zswap writeback race condition
Bluetooth: prefetch channel before killing sock
Bluetooth: Fix l2cap_disconnect_req deadlock
Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} {CVE-2023-53827}
Bluetooth: Fix refcount use-after-free issue
Bluetooth: Check state in l2cap_disconnect_rsp
Bluetooth: L2CAP: Fix build errors in some archs
Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression
Bluetooth: use the correct print format for L2CAP debug statements
i40e: fix Jumbo Frame support after iPXE boot
i40e: Report MFS in decimal base instead of hex
i40e: Fix unexpected MFS warning message
i40e: Add a check to see if MFS is set
bitops: Add non-atomic bitops for pointers
bitfield: Add FIELD_MODIFY() helper

Record: CLSA-2026-1770040438
Updated: 2026-11-02

OSVCLSA-2026-1771077729 No score

kernel: Fix of 108 CVEs

net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
ipv6: addrlabel: fix infoleak when sending struct ifaddrlblmsg to network {CVE-2022-49865}
scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
wifi: iwlwifi: mvm: fix double list_add at iwl_mvm_mac_wake_tx_queue {CVE-2022-50164}
mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
xfrm: Duplicate SPI Handling {CVE-2025-39797}
scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
nfs: fix UAF in direct writes {CVE-2024-26958}
iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
i40e: fix idx validation in config queues msg {CVE-2025-39971}
loop: Fix use-after-free issues {CVE-2023-53111}
fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
media: rc: fix races with imon_disconnect() {CVE-2025-39993}
fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
pid: take a reference when initializing cad_pid {CVE-2021-47118}
net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
iommu/amd: Fix potential buffer overflow in…

Record: CLSA-2026-1771077729
Updated: 2026-11-02

OSVCLSA-2026-1771078945 No score

kernel: Fix of 131 CVEs

net/ieee802154: don't warn zero-sized raw_sendmsg() {CVE-2022-50706}
scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
xfrm: Duplicate SPI Handling {CVE-2025-39797}
scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input {CVE-2022-50030}
net/mlx5e: IPoIB, Block PKEY interfaces with less rx queues than parent {CVE-2022-48883}
net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
dm raid: fix address sanitizer warning in raid_resume {CVE-2022-50085}
ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf() {CVE-2022-50050}
nfs: fix UAF in direct writes {CVE-2024-26958}
iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
loop: Fix use-after-free issues {CVE-2023-53111}
media: rc: fix races with imon_disconnect() {CVE-2025-39993}
fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
iommu/vt-d: avoid invalid memory access via node_online(NUMA_NO_NODE) {CVE-2022-50093}
drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
wifi: mac80211: Fix UAF in ieee80211_scan_rx() {CVE-2022-49934}
drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers() {CVE-2022-50185}
ext4: fix undefined behavior in bit shift for ext4_check_flag_values {CVE-2022-50403}
wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
sctp: handle the error returned from sctp_auth_asoc_init_active_key {CVE-2022-50243}
crypto: qat - resolve race condition during AER recovery {CVE-2024-39493}
i40e: fix idx validation in config queues msg {CVE-2025-39971}
netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
netfilter: validate user input for expected length {CVE-2024-35962}
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
pid: take a reference when initializing cad_pid {CVE-2021-47118}
wifi: cfg80211: check A-MSDU format more carefully…

Record: CLSA-2026-1771078945
Updated: 2026-11-02

OSVCLSA-2026-1780301172 No score

Fix of 19 CVEs

CVE-2025-38715
- hfs: fix slab-out-of-bounds in hfs_bnode_read() {CVE-2025-38715}
CVE-2023-53432
- firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
CVE-2025-39891
- wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
CVE-2025-38666
- net: appletalk: Fix use-after-free in AARP proxy probe {CVE-2025-38666}
CVE-2025-39828
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() {CVE-2025-39828}
Miscellaneous upstream changes
- UBUNTU: [Packaging] drop abi/module/retpoline checks (match u18/u20)
- smb: client: reject userspace cifs.spnego descriptions
- UBUNTU: Vendor linux-meta sources and integrate meta-build into linux
Bump ABI 4.4.0-282

Record: CLSA-2026-1780301172
Updated: 2026-11-02

OSVCLSA-2026-1782148597 No score

Fix of 33 CVEs

CVE-2022-49267
- mmc: core: use sysfs_emit() instead of sprintf() {CVE-2022-49267}
- mmc: sdio: Export SDIO revision and info strings to userspace {CVE-2022-49267}
CVE-2026-43040
- net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
CVE-2026-43027
- netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
CVE-2025-71091
- team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
CVE-2025-71075
- scsi: aic94xx: fix use-after-free in device removal path {CVE-2025-71075}
CVE-2025-38565
- perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
CVE-2025-38401
- mtk-sd: Prevent memory corruption from DMA map failure {CVE-2025-38401}
CVE-2023-53218
- rxrpc: Make it so that a waiting process can be aborted {CVE-2023-53218}
CVE-2025-38230
- jfs: validate AG parameters in dbMount() to prevent crashes {CVE-2025-38230}
CVE-2023-52867
- drm/radeon: possible buffer overflow {CVE-2023-52867}
CVE-2023-53432
- firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
CVE-2025-39891
- wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
CVE-2025-38666
- net: appletalk: Fix use-after-free in AARP proxy probe {CVE-2025-38666}
CVE-2025-39828
- atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control() {CVE-2025-39828}
CVE-2026-43020
- Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
CVE-2026-43011
- net/x25: Fix potential double free of skb {CVE-2026-43011}
CVE-2026-31778
- ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
CVE-2026-31748
- comedi: me_daq: Fix potential overrun of firmware buffer {CVE-2026-31748}
CVE-2026-31747
- comedi: me4000: Fix potential overrun of firmware buffer {CVE-2026-31747}
CVE-2026-31720
- usb: gadget: f_uac1_legacy: validate control request size {CVE-2026-31720}
CVE-2026-31696
- rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696}
CVE-2026-31659
- batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
CVE-2026-31629
- nfc: llcp: add missing return after LLCP_CLOSED checks {CVE-2026-31629}
CVE-2026-31626
- staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() {CVE-2026-31626}
CVE-2026-31622
- NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
CVE-2026-31602
- ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
CVE-2026-31583
- media: em28xx: fix use-after-free in em28xx_v4l2_open() {CVE-2026-31583}
CVE-2026-31581
- ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}
CVE-2026-31576
- media: hackrf: fix to not free memory after the device is registered in hackrf_probe() {CVE-2026-31576}
CVE-2026-31504
- net: fix fanout UAF in packet_release() via NETDEV_UP race {CVE-2026-31504}
CVE-2026-23388
- Squashfs: check metadata block offset is within range {CVE-2026-23388}
CVE-2026-23372
- nfc: rawsock: cancel tx_work before socket teardown {CVE-2026-23372}
Bump ABI 4.15.0-259

Record: CLSA-2026-1782148597
Updated: 2026-11-02

OSVCLSA-2026-1788449727 No score

Fix of 235 CVEs

Bump kernel ABI to 29: ship the ELS kernel as 4.19.0-29-*, distinct from the prior 4.19.0-28.
CVE-2021-46984
- kyber: fix out of bounds access when preempted {CVE-2021-46984}
CVE-2021-47049
- Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
CVE-2021-47101
- asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
CVE-2021-47191
- scsi: scsi_debug: Fix out-of-bound read in resp_readcap16() {CVE-2021-47191}
CVE-2021-47352
- virtio-net: Add validation for used length {CVE-2021-47352}
CVE-2021-47379
- blk-cgroup: fix UAF by grabbing blkcg lock before destroying blkg pd {CVE-2021-47379}
CVE-2021-47391
- RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests {CVE-2021-47391}
CVE-2021-47479
- staging: rtl8712: fix use-after-free in rtl8712_dl_fw {CVE-2021-47479}
CVE-2022-21546
- scsi: target: Fix WRITE_SAME No Data Buffer crash {CVE-2022-21546}
CVE-2022-39189
- KVM: x86: do not report a vCPU as preempted outside instruction boundaries {CVE-2022-39189}
CVE-2022-43945
- SUNRPC: Fix svcxdr_init_encode's buflen calculation {CVE-2022-43945}
- NFSD: Cap rsize_bop result based on send buffer size {CVE-2022-43945}
CVE-2022-48744
- net/mlx5e: Avoid field-overflowing memcpy() {CVE-2022-48744}
CVE-2022-49026
- e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
CVE-2022-49720
- block: Fix handling of offline queues in blk_mq_alloc_request_hctx() {CVE-2022-49720}
CVE-2022-49975
- bpf: Don't redirect packets with invalid pkt_len {CVE-2022-49975}
- bpf: Move skb->len == 0 checks into __bpf_redirect {CVE-2022-49975}
CVE-2022-50066
- net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
CVE-2022-50103
- sched, cpuset: Fix dl_cpu_busy() panic due to empty cs->cpus_allowed {CVE-2022-50103}
CVE-2022-50129
- RDMA/srpt: Introduce a reference count in struct srpt_device {CVE-2022-50129}
- RDMA/srpt: Fix a use-after-free {CVE-2022-50129}
CVE-2022-50300
- btrfs: fix extent map use-after-free when handling missing device in read_one_chunk {CVE-2022-50300}
CVE-2022-50406
- iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
CVE-2022-50422
- scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
CVE-2022-50552
- blk-mq: use quiesced elevator switch when reinitializing queues {CVE-2022-50552}
CVE-2023-51779
- Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
CVE-2023-52434
- smb: client: fix potential OOBs in smb2_parse_contexts() {CVE-2023-52434}
CVE-2023-52515
- RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
CVE-2023-52531
- wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
CVE-2023-52741
- cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
CVE-2023-53000
- netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
CVE-2023-53039
- workqueue: Add resource managed version of delayed work init {CVE-2023-53039}
- devm-helpers: Fix devm_delayed_work_autocancel() kerneldoc {CVE-2023-53039}
- devm-helpers: Add resource managed version of work init {CVE-2023-53039}
- HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
- HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized dev->devc {CVE-2023-53039}
CVE-2023-53111
- loop: Fix use-after-free issues {CVE-2023-53111}
CVE-2023-53254
- cacheinfo: Fix shared_cpu_map to handle shared caches at different levels…

Record: CLSA-2026-1788449727
Updated: 2026-11-02

OSVCLSA-2026-1791780738 No score

kernel: Fix of 72 CVEs

drm/amd/pm: bound pp_dpm_set_pp_table() memcpy {CVE-2026-97427}
Bluetooth: L2CAP: validate connectionless PSM length {CVE-2026-97408}
ipv6: sr: restore network header before routing and forwarding {CVE-2026-98096}
ipv6: fix fib6 walker UAF on seq stop {CVE-2026-97940}
net: mpls: clear inner_protocol when the last label is popped {CVE-2026-97612}
netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
usb: xusbatm: don't rely on id table pointer arithmetic {CVE-2026-97539}
ALSA: 6fire: Fix UAF at error handling during probe {CVE-2026-74505}
drm/vmwgfx: validate DRAW_PRIMITIVES header size before division {CVE-2026-74444}
ALSA: firewire: isight: bound the sample count to the packet payload {CVE-2026-64483}
Bluetooth: btusb: fix use-after-free on registration failure {CVE-2026-64471}
thunderbolt: Keep XDomain reference during the lifetime of a service {CVE-2026-97509}
ACPICA: Fix use-after-free in acpi_ds_terminate_control_method() {CVE-2026-97455}
ACPICA: Add validation for node in acpi_ns_build_normalized_path() {CVE-2026-97448}
inet: frags: strip GSO state from fragments before reassembly {CVE-2026-80590}
libnvdimm/labels: Prevent integer overflow in __nd_label_validate() {CVE-2026-89559}
SUNRPC: always drain cache_cleaner before destroying a cache_detail {CVE-2026-89548}
SUNRPC: harden gss_krb5_unwrap_v2 against short tokens {CVE-2026-89542}
openvswitch: only skb_tx_error() a packet we are about to drop {CVE-2026-89487}
nvme-tcp: fix host memory disclosure on R2T for a read command {CVE-2026-89481}
sctp: fix NULL deref on untransmitted RECONF completion {CVE-2026-89477}
net: openvswitch: fix flow mask use-after-free on flow deletion {CVE-2026-80994}
ALSA: bcd2000: clear the URB pointers on disconnect {CVE-2026-80971}
netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() {CVE-2026-74569}
Bluetooth: mgmt: fix UAF in pair command cancellation {CVE-2026-74510}
cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control {CVE-2026-72261}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
net: tun: bound receive headroom {CVE-2026-81000}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace() {CVE-2026-98077}
net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
firewire: net: fix use after free in fwnet_finish_incoming_packet() {CVE-2023-53432}
firewire: net: remove unused variable 'guid' {CVE-2023-53432}
gfs2: Fix slab-use-after-free in gfs2_qd_dealloc {CVE-2023-52760}
gfs2: fix kernel…

Record: CLSA-2026-1791780738
Updated: 2026-11-02

OSVCLSA-2026-1791858923 No score

Fix of 174 CVEs

CVE-2026-90205
- ocfs2: validate orphan slot during inode read {CVE-2026-90205}
CVE-2026-93054
- uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
CVE-2026-93103
- RDMA/hfi1: Preserve unit 0 on allocation failure {CVE-2026-93103}
CVE-2026-89833
- f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages() {CVE-2026-89833}
CVE-2026-89878
- media: s2255: check firmware size before reading trailing marker {CVE-2026-89878}
CVE-2026-90037
- NFSD: Prevent client use-after-free during close_lru reaping {CVE-2026-90037}
CVE-2026-90296
- cpufreq: imx6q: fix devres accumulation across driver rebind {CVE-2026-90296}
CVE-2026-90415
- RDMA/cxgb4: free STAG index when TPT entry write fails {CVE-2026-90415}
CVE-2026-90081
- net/rds: use wq_has_sleeper() in rds_cong_map_updated() {CVE-2026-90081}
CVE-2026-90420
- nilfs2: fix infinite loop in nilfs_clean_segments() {CVE-2026-90420}
CVE-2026-90116
- ALSA: mtpav: shut down output timer before card teardown {CVE-2026-90116}
CVE-2026-90070
- tpm: st33zp24: Return zero on status read failure {CVE-2026-90070}
CVE-2026-89845
- scsi: qla2xxx: Avoid req_q_map double-read in qla2x00_error_entry() {CVE-2026-89845}
CVE-2026-89944
- ASoC: hdac_hda: Fix hlink refcount leak on component registration failure {CVE-2026-89944}
CVE-2026-90018
- staging: rtl8723bs: fix OOB read / stack overflow in rtw_get_wps_attr() {CVE-2026-90018}
CVE-2026-89860
- scsi: qla2xxx: Initialize NVMe abort_work once at submission {CVE-2026-89860}
CVE-2026-90007
- scsi: pm8001: Use rollback index when freeing MSI-X vectors {CVE-2026-90007}
CVE-2026-90044
- usb: gadget: f_fs: Fix Use-After-Free in AIO error path {CVE-2026-90044}
CVE-2026-68289
- tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() {CVE-2026-68289}
CVE-2026-90143
- net: kcm: Hold RCU read lock while running BPF parser {CVE-2026-90143}
CVE-2026-90111
- ip6mr: do not clone dst in ip6mr_cache_report() {CVE-2026-90111}
CVE-2026-90283
- hugetlbfs: release subpool on fill_super failure {CVE-2026-90283}
CVE-2026-92521
- ACPI: PCI: Clear driver_data on all paths that free the acpi_pci_root {CVE-2026-92521}
CVE-2026-93048
- mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() {CVE-2026-93048}
CVE-2026-93160
- crypto: atmel-ecc - reject hardware ECDH without a public key {CVE-2026-93160}
CVE-2026-93199
- i3c: master: Do not treat master device as a duplicate target {CVE-2026-93199}
CVE-2026-89953
- mtd: mtdoops: free page bitmap when the backing MTD is removed {CVE-2026-89953}
CVE-2026-89822
- drm/i915: Guard against NULL driver_data in i915_pci_probe() {CVE-2026-89822}
CVE-2026-89937
- iio: chemical: sgp30: Handle IAQ thread creation failure {CVE-2026-89937}
CVE-2026-89993
- dmaengine: dw-edma: Initialize IRQ data before requesting IRQs {CVE-2026-89993}
CVE-2026-89972
- nvme: add missing SRCU grace period in error path {CVE-2026-89972}
CVE-2026-89892
- media: em28xx: defer audio-only extension registration {CVE-2026-89892}
CVE-2026-90023
- usb: gadget: f_mass_storage: fix null pointer dereference in fsg_common_set_num_buffers() {CVE-2026-90023}
CVE-2026-90020
- USB: gadget: fix NULL pointer dereference in gadget_dev_ioctl() {CVE-2026-90020}
CVE-2026-90017
- staging: rtl8723bs: fix OOB read in rtw_action_frame_parse() {CVE-2026-90017}
CVE-2026-90016
- staging: rtl8723bs: fix OOB read in rtw_restruct_wmm_ie() {CVE-2026-90016}
CVE-2026-90329
- HID: synchronize input before cleaning up a failed probe {CVE-2026-90329} *…

Record: CLSA-2026-1791858923
Updated: 2026-11-02

OSVSUSE-SU-2025:03600-1 No score