CVE-2023-53629

fs: dlm: fix use after free in midcomms commit

9.8 CriticalFix available

CVE-2023-53629 is a critical vulnerability (CVSS 9.8) in Linux, published October 7, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.50%, the 42nd percentile. Fixed in linux-lts 6.6.58-r0.

In the Linux kernel, the following vulnerability has been resolved:

fs: dlm: fix use after free in midcomms commit

While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning:

[ 151.760477] ================================================================== [ 151.761803] BUG: KASAN: use-after-free in dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.763414] Read of size 4 at addr ffff88811a980c60 by task lock_torture/1347

[ 151.765284] CPU: 7 PID: 1347 Comm: lock_torture Not tainted 6.1.0-rc4+ #2828 [ 151.766778] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+16134+e5908aa2 04/01/2014 [ 151.768726] Call Trace: [ 151.769277] <TASK> [ 151.769748] dump_stack_lvl+0x5b/0x86 [ 151.770556] print_report+0x180/0x4c8 [ 151.771378] ? kasan_complete_mode_report_info+0x7c/0x1e0 [ 151.772241] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.773069] kasan_report+0x93/0x1a0 [ 151.773668] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.774514] __asan_load4+0x7e/0xa0 [ 151.775089] dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.775890] ? create_message.isra.29.constprop.64+0x57/0xc0 [ 151.776770] send_common+0x19f/0x1b0 [ 151.777342] ? remove_from_waiters+0x60/0x60 [ 151.778017] ? lock_downgrade+0x410/0x410 [ 151.778648] ? __this_cpu_preempt_check+0x13/0x20 [ 151.779421] ? rcu_lockdep_current_cpu_online+0x88/0xc0 [ 151.780292] _convert_lock+0x46/0x150 [ 151.780893] convert_lock+0x7b/0xc0 [ 151.781459] dlm_lock+0x3ac/0x580 [ 151.781993] ? 0xffffffffc0540000 [ 151.782522] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.783379] ? dlm_scan_rsbs+0xa70/0xa70 [ 151.784003] ? preempt_count_sub+0xd6/0x130 [ 151.784661] ? is_module_address+0x47/0x70 [ 151.785309] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.786166] ? 0xffffffffc0540000 [ 151.786693] ? lockdep_init_map_type+0xc3/0x360 [ 151.787414] ? 0xffffffffc0540000 [ 151.787947] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.789004] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.789858] ? 0xffffffffc0540000 [ 151.790392] ? lock_torture_cleanup+0x20/0x20 [dlm_locktorture] [ 151.791347] ? delay_tsc+0x94/0xc0 [ 151.791898] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.792735] ? torture_start+0x30/0x30 [dlm_locktorture] [ 151.793606] lock_torture+0x177/0x270 [dlm_locktorture] [ 151.794448] ? torture_dlm_lock_sync.isra.3+0x150/0x150 [dlm_locktorture] [ 151.795539] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.796476] ? do_raw_spin_lock+0x11e/0x1e0 [ 151.797152] ? mark_held_locks+0x34/0xb0 [ 151.797784] ? _raw_spin_unlock_irqrestore+0x30/0x70 [ 151.798581] ? __kthread_parkme+0x79/0x110 [ 151.799246] ? trace_preempt_on+0x2a/0xf0 [ 151.799902] ? __kthread_parkme+0x79/0x110 [ 151.800579] ? preempt_count_sub+0xd6/0x130 [ 151.801271] ? __kasan_check_read+0x11/0x20 [ 151.801963] ? __kthread_parkme+0xec/0x110 [ 151.802630] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.803569] kthread+0x192/0x1d0 [ 151.804104] ? kthread_complete_and_exit+0x30/0x30 [ 151.804881] ret_from_fork+0x1f/0x30 [ 151.805480] </TASK>

[ 151.806111] Allocated by task 1347: [ 151.806681] kasan_save_stack+0x26/0x50 [ 151.807308] kasan_set_track+0x25/0x30 [ 151.807920] kasan_save_alloc_info+0x1e/0x30 [ 151.808609] __kasan_slab_alloc+0x63/0x80 [ 151.809263] kmem_cache_alloc+0x1ad/0x830 [ 151.809916] dlm_allocate_mhandle+0x17/0x20 [ 151.810590] dlm_midcomms_get_mhandle+0x96/0x260 [ 151.811344] _create_message+0x95/0x180 [ 151.811994] create_message.isra.29.constprop.64+0x57/0xc0 [ 151.812880] send_common+0x129/0x1b0 [ 151.813467] _convert_lock+0x46/0x150 [ 151.814074] convert_lock+0x7b/0xc0 [ 151.814648] dlm_lock+0x3ac/0x580 [ 151.815199] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.816258] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.817129] lock_t ---truncated---

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.50%Up 0.5 points since Oct 8, 2025

What each source reports

CVE List Score used 9.8

fs: dlm: fix use after free in midcomms commit

In the Linux kernel, the following vulnerability has been resolved:

fs: dlm: fix use after free in midcomms commit

While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning:

Record: CVE-2023-53629
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2025-31988 9.8

In the Linux kernel, the following vulnerability has been resolved:

fs: dlm: fix use after free in midcomms commit

While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning:

Record: EUVD-2025-31988
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rf27-4m25-62jv 7.8

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free...

In the Linux kernel, the following vulnerability has been resolved:

fs: dlm: fix use after free in midcomms commit

While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning:

Record: GHSA-rf27-4m25-62jv
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

NVD 9.8

In the Linux kernel, the following vulnerability has been resolved:

fs: dlm: fix use after free in midcomms commit

While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning:

Record: CVE-2023-53629
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-416
Updated: 2026-11-02

OSVBELL-CVE-2023-53629 7.8

Record: BELL-CVE-2023-53629
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSV 9.8

fs: dlm: fix use after free in midcomms commit

In the Linux kernel, the following vulnerability has been resolved:

fs: dlm: fix use after free in midcomms commit

While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning:

Record: CVE-2023-53629
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 20 moreShow less

OSVDEBIAN-CVE-2023-53629 7.8

In the Linux kernel, the following vulnerability has been resolved: fs: dlm: fix use after free in midcomms commit While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning: [ 151.760477] ================================================================== [ 151.761803] BUG: KASAN: use-after-free in dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.763414] Read of size 4 at addr ffff88811a980c60 by task lock_torture/1347 [ 151.765284] CPU: 7 PID: 1347 Comm: lock_torture Not tainted 6.1.0-rc4+ #2828 [ 151.766778] Hardware name: Red Hat KVM/RHEL-AV, BIOS 1.16.0-3.module+el8.7.0+16134+e5908aa2 04/01/2014 [ 151.768726] Call Trace: [ 151.769277] <TASK> [ 151.769748] dump_stack_lvl+0x5b/0x86 [ 151.770556] print_report+0x180/0x4c8 [ 151.771378] ? kasan_complete_mode_report_info+0x7c/0x1e0 [ 151.772241] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.773069] kasan_report+0x93/0x1a0 [ 151.773668] ? dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.774514] __asan_load4+0x7e/0xa0 [ 151.775089] dlm_midcomms_commit_mhandle+0x19d/0x4b0 [ 151.775890] ? create_message.isra.29.constprop.64+0x57/0xc0 [ 151.776770] send_common+0x19f/0x1b0 [ 151.777342] ? remove_from_waiters+0x60/0x60 [ 151.778017] ? lock_downgrade+0x410/0x410 [ 151.778648] ? __this_cpu_preempt_check+0x13/0x20 [ 151.779421] ? rcu_lockdep_current_cpu_online+0x88/0xc0 [ 151.780292] _convert_lock+0x46/0x150 [ 151.780893] convert_lock+0x7b/0xc0 [ 151.781459] dlm_lock+0x3ac/0x580 [ 151.781993] ? 0xffffffffc0540000 [ 151.782522] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.783379] ? dlm_scan_rsbs+0xa70/0xa70 [ 151.784003] ? preempt_count_sub+0xd6/0x130 [ 151.784661] ? is_module_address+0x47/0x70 [ 151.785309] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.786166] ? 0xffffffffc0540000 [ 151.786693] ? lockdep_init_map_type+0xc3/0x360 [ 151.787414] ? 0xffffffffc0540000 [ 151.787947] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.789004] ? torture_stop+0x120/0x120 [dlm_locktorture] [ 151.789858] ? 0xffffffffc0540000 [ 151.790392] ? lock_torture_cleanup+0x20/0x20 [dlm_locktorture] [ 151.791347] ? delay_tsc+0x94/0xc0 [ 151.791898] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.792735] ? torture_start+0x30/0x30 [dlm_locktorture] [ 151.793606] lock_torture+0x177/0x270 [dlm_locktorture] [ 151.794448] ? torture_dlm_lock_sync.isra.3+0x150/0x150 [dlm_locktorture] [ 151.795539] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.796476] ? do_raw_spin_lock+0x11e/0x1e0 [ 151.797152] ? mark_held_locks+0x34/0xb0 [ 151.797784] ? _raw_spin_unlock_irqrestore+0x30/0x70 [ 151.798581] ? __kthread_parkme+0x79/0x110 [ 151.799246] ? trace_preempt_on+0x2a/0xf0 [ 151.799902] ? __kthread_parkme+0x79/0x110 [ 151.800579] ? preempt_count_sub+0xd6/0x130 [ 151.801271] ? __kasan_check_read+0x11/0x20 [ 151.801963] ? __kthread_parkme+0xec/0x110 [ 151.802630] ? lock_torture_stats+0x80/0x80 [dlm_locktorture] [ 151.803569] kthread+0x192/0x1d0 [ 151.804104] ? kthread_complete_and_exit+0x30/0x30 [ 151.804881] ret_from_fork+0x1f/0x30 [ 151.805480] </TASK> [ 151.806111] Allocated by task 1347: [ 151.806681] kasan_save_stack+0x26/0x50 [ 151.807308] kasan_set_track+0x25/0x30 [ 151.807920] kasan_save_alloc_info+0x1e/0x30 [ 151.808609] __kasan_slab_alloc+0x63/0x80 [ 151.809263] kmem_cache_alloc+0x1ad/0x830 [ 151.809916] dlm_allocate_mhandle+0x17/0x20 [ 151.810590] dlm_midcomms_get_mhandle+0x96/0x260 [ 151.811344] _create_message+0x95/0x180 [ 151.811994] create_message.isra.29.constprop.64+0x57/0xc0 [ 151.812880] send_common+0x129/0x1b0 [ 151.813467] _convert_lock+0x46/0x150 [ 151.814074] convert_lock+0x7b/0xc0 [ 151.814648] dlm_lock+0x3ac/0x580 [ 151.815199] torture_dlm_lock_sync.isra.3+0xe9/0x150 [dlm_locktorture] [ 151.816258] torture_ex_iter+0xc3/0xea [dlm_locktorture] [ 151.817129] lock_t ---truncated---

Record: DEBIAN-CVE-2023-53629
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2023-53629 4.8

CVE-2023-53629 in linux - Patched by Root

Root has patched CVE-2023-53629 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2023-53629
CVSS 3.1: 4.8 MediumCVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2023-53629 7.3

Record: UBUNTU-CVE-2023-53629
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-76407 No score

CVE-2023-53629 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

fs: dlm: fix use after free in midcomms commit

While working on processing dlm message in softirq context I experienced the following KASAN use-after-free warning:

Record: AZL-76407
Updated: 2026-11-02

OSVCLSA-2026-1773139548 No score

kernel: Fix of 78 CVEs

fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
wifi: mac80211: check for station first in client probe {CVE-2023-53588}
bonding: do not assume skb mac_header is set {CVE-2023-53601}
drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
md/raid10: fix memleak of md thread {CVE-2023-54294}
usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
HID: core: ensure __hid_request reserves the report ID as the first byte
HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
xfs: do not propagate ENODATA…

Record: CLSA-2026-1773139548
Updated: 2026-11-02

OSVCLSA-2026-1778787063 No score

kernel: Fix of 123 CVEs

net: skbuff: propagate shared-frag marker through pskb_copy()
mptcp: always handle address removal under msk socket lock {CVE-2025-21875}
uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}
net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error {CVE-2025-21924}
wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() {CVE-2025-21744}
mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}
bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
blk-cgroup: Fix class @block_class's subsystem refcount leakage {CVE-2025-21745}
net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776}
wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
ice: fix memory leak in aRFS after reset {CVE-2025-21981}
KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken {CVE-2025-38099}
regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
acpi: nfit: fix narrowing conversion in acpi_nfit_ctl {CVE-2025-22044}
drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}
nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request {CVE-2025-38430}
net: decrease cached dst counters in dst_release {CVE-2025-22057}
bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT {CVE-2025-38439}
net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103}
dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}
drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}
net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree {CVE-2025-38468}
drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params {CVE-2025-21941}
drm/amdgpu: check if hubbub is NULL in debugfs/amdgpu_dm_capabilities {CVE-2025-39707}
HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
usb: net: sierra: check for no status endpoint {CVE-2025-38474}
drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}
netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}
thermal: int340x: Add NULL check for adev {CVE-2025-23136}
Bluetooth: l2cap: Check encryption key size on incoming connection {CVE-2025-39889}
dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
tracing: Add down_write(trace_event_sem) when adding trace event {CVE-2025-38539}
usbnet: Fix using smp_processor_id() in preemptible code warnings {CVE-2025-40164}
bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643}
dm-stripe: fix a possible integer overflow {CVE-2025-39940}
usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}
fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
usbnet: fix memory leak in error case {CVE-2022-49657}
wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845}
ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
posix-clock: Fix missing timespec64 check in pc_clock_settime() {CVE-2024-50195}
net_sched: Prevent creation of classes with TC_H_ROOT {CVE-2025-21971}
mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow…

Record: CLSA-2026-1778787063
Updated: 2026-11-02

OSVLSN-0122-1 No score

Kernel Live Patch Security Notice

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g. 512) and a lot of queued SKBs are sent from the pkt queue.

In the Linux kernel, the following vulnerability has been resolved: padata: fix UAF in padata_reorder A bug was found when run ltp test: BUG: KASAN: slab-use-after-free in padata_find_next+0x29/0x1a0 Read of size 4 at addr ffff88bbfe003524 by task kworker/u113:2/3039206 CPU: 0 PID: 3039206 Comm: kworker/u113:2 Kdump: loaded Not tainted 6.6.0+ Workqueue: pdecrypt_parallel padata_parallel_worker Call Trace: <TASK> dump_stack_lvl+0x32/0x50 print_address_description.constprop.0+0x6b/0x3d0 print_report+0xdd/0x2c0 kasan_report+0xa5/0xd0 padata_find_next+0x29/0x1a0 padata_reorder+0x131/0x220 padata_parallel_worker+0x3d/0xc0 process_one_work+0x2ec/0x5a0 If 'mdelay(10)' is added before calling 'padata_find_next' in the 'padata_reorder' function, this issue could be reproduced easily with ltp test (pcrypt_aead01).

In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev().

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_sessions_deregister() In multichannel mode, UAF issue can occur in session_deregister when the second channel sets up a session through the connection of the first channel.

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tunnel: fix geneve_opt type confusion addition When handling multiple NFTA_TUNNEL_KEY_OPTS_GENEVE attributes, the parsing logic should place every geneve_opt structure one by one compactly.

In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore xattrs entries past the 'end' entry.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in __smb2_lease_break_noti() Move tcp_transport free to ksmbd_conn_free.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix dangling pointer in krb_authenticate krb_authenticate frees sess->user and does not set the pointer to NULL.

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too Similarly to the previous patch, we need to safe guard hfsc_dequeue() too. But for this one, we don't have a reliable reproducer.)(CVE-2025-37823).

In the Linux kernel, the following vulnerability has been resolved: jbd2: remove wrong sb->s_sequence check Journal emptiness is not determined by sb->s_sequence .

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix mode1 reset crash issue If HW scheduler hangs and mode1 reset is used to recover GPU, KFD signal user space to abort the processes.

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Use local fence in error path of xe_migrate_clear The intent of the error path in xe_migrate_clear is to wait on locally generated fence and then return.

In the Linux kernel, the following vulnerability has been resolved: net_sched: qfq: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: net_sched: ets: Fix double list add in class with netem as child qdisc As described in Gerrard's report .

In the Linux kernel, the following vulnerability has been resolved: vxlan: vnifilter: Fix unlocked deletion of default FDB entry When a VNI is deleted…

Record: LSN-0122-1
Updated: 2026-11-02

OSVUSN-8575-1 No score

linux, linux-gcp, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-5.15, linux-kvm, linux-lowlatency, linux-lowlatency-hwe-5.15, linux-realtime, linux-xilinx-zynqmp vulnerabilities

Maxim Suhanov discovered that the NTFS file system implementation in the Linux kernel did not properly validate file name length in certain situations, leading to an out-of-bounds read. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could expose sensitive information (kernel memory). (CVE-2023-45896)

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. (CVE-2025-54505)

It was discovered that some AMD Zen 2 processors did not properly isolate shared resources in the operation cache. A local attacker could possibly use this issue to corrupt instructions executed at a higher privilege level, resulting in privilege escalation. (CVE-2025-54518)