Vulnerability-Lookup

CERTFR-2026-AVI-0547

Vulnerability from certfr_avis - Published: 2026-05-07 - Updated: 2026-05-07

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Debian	Debian	Debian 11 bullseye versions antérieures à 6.1.170-1~deb11u1
	Debian	Debian	Debian 11 bullseye versions antérieures à 5.10.251-3

References

Title

Publication Time

Tags

Bulletin de sécurité Debian LTS msg00004	2026-05-02	vendor-advisory
Bulletin de sécurité Debian LTS msg00005	2026-05-02	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 6.1.170-1~deb11u1",
      "product": {
        "name": "Debian",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    },
    {
      "description": "Debian 11 bullseye versions ant\u00e9rieures \u00e0 5.10.251-3",
      "product": {
        "name": "Debian",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-31483",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31483"
    },
    {
      "name": "CVE-2026-31409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31409"
    },
    {
      "name": "CVE-2026-31522",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31522"
    },
    {
      "name": "CVE-2026-31770",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31770"
    },
    {
      "name": "CVE-2026-31658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31658"
    },
    {
      "name": "CVE-2025-21682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21682"
    },
    {
      "name": "CVE-2026-31756",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31756"
    },
    {
      "name": "CVE-2026-31467",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31467"
    },
    {
      "name": "CVE-2026-23318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23318"
    },
    {
      "name": "CVE-2026-23368",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23368"
    },
    {
      "name": "CVE-2026-31485",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31485"
    },
    {
      "name": "CVE-2026-23475",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23475"
    },
    {
      "name": "CVE-2026-31754",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31754"
    },
    {
      "name": "CVE-2026-31402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31402"
    },
    {
      "name": "CVE-2025-40219",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40219"
    },
    {
      "name": "CVE-2026-23426",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23426"
    },
    {
      "name": "CVE-2026-31758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31758"
    },
    {
      "name": "CVE-2025-71265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71265"
    },
    {
      "name": "CVE-2026-23450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23450"
    },
    {
      "name": "CVE-2026-23281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23281"
    },
    {
      "name": "CVE-2025-71221",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71221"
    },
    {
      "name": "CVE-2026-31416",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31416"
    },
    {
      "name": "CVE-2026-31656",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31656"
    },
    {
      "name": "CVE-2025-39764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39764"
    },
    {
      "name": "CVE-2026-31453",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31453"
    },
    {
      "name": "CVE-2026-23438",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23438"
    },
    {
      "name": "CVE-2026-23293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23293"
    },
    {
      "name": "CVE-2026-23463",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23463"
    },
    {
      "name": "CVE-2026-23227",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23227"
    },
    {
      "name": "CVE-2026-23454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23454"
    },
    {
      "name": "CVE-2026-31405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31405"
    },
    {
      "name": "CVE-2026-43054",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43054"
    },
    {
      "name": "CVE-2026-31664",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31664"
    },
    {
      "name": "CVE-2026-31473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31473"
    },
    {
      "name": "CVE-2026-31448",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31448"
    },
    {
      "name": "CVE-2026-31550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31550"
    },
    {
      "name": "CVE-2026-23290",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23290"
    },
    {
      "name": "CVE-2026-31549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31549"
    },
    {
      "name": "CVE-2026-31752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31752"
    },
    {
      "name": "CVE-2025-40016",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40016"
    },
    {
      "name": "CVE-2026-31787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31787"
    },
    {
      "name": "CVE-2025-38626",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38626"
    },
    {
      "name": "CVE-2026-23303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23303"
    },
    {
      "name": "CVE-2026-43011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43011"
    },
    {
      "name": "CVE-2026-31396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31396"
    },
    {
      "name": "CVE-2026-31680",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31680"
    },
    {
      "name": "CVE-2026-23340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23340"
    },
    {
      "name": "CVE-2026-43046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43046"
    },
    {
      "name": "CVE-2026-31738",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31738"
    },
    {
      "name": "CVE-2025-40005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40005"
    },
    {
      "name": "CVE-2026-31751",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31751"
    },
    {
      "name": "CVE-2026-23439",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23439"
    },
    {
      "name": "CVE-2026-23253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23253"
    },
    {
      "name": "CVE-2026-43025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43025"
    },
    {
      "name": "CVE-2026-31721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31721"
    },
    {
      "name": "CVE-2026-23271",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23271"
    },
    {
      "name": "CVE-2025-68265",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68265"
    },
    {
      "name": "CVE-2026-23434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23434"
    },
    {
      "name": "CVE-2026-43018",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43018"
    },
    {
      "name": "CVE-2026-43014",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43014"
    },
    {
      "name": "CVE-2026-31447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31447"
    },
    {
      "name": "CVE-2026-31431",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31431"
    },
    {
      "name": "CVE-2026-43028",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43028"
    },
    {
      "name": "CVE-2026-23422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23422"
    },
    {
      "name": "CVE-2026-31548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31548"
    },
    {
      "name": "CVE-2026-23304",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23304"
    },
    {
      "name": "CVE-2026-31683",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31683"
    },
    {
      "name": "CVE-2026-23357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23357"
    },
    {
      "name": "CVE-2026-31408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31408"
    },
    {
      "name": "CVE-2025-38105",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38105"
    },
    {
      "name": "CVE-2026-31524",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31524"
    },
    {
      "name": "CVE-2026-31668",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31668"
    },
    {
      "name": "CVE-2026-31478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31478"
    },
    {
      "name": "CVE-2026-31546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31546"
    },
    {
      "name": "CVE-2025-38436",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38436"
    },
    {
      "name": "CVE-2026-23324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23324"
    },
    {
      "name": "CVE-2024-50298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-50298"
    },
    {
      "name": "CVE-2026-23317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23317"
    },
    {
      "name": "CVE-2026-43047",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43047"
    },
    {
      "name": "CVE-2026-31389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31389"
    },
    {
      "name": "CVE-2026-31786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31786"
    },
    {
      "name": "CVE-2026-31545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31545"
    },
    {
      "name": "CVE-2026-23456",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23456"
    },
    {
      "name": "CVE-2026-43033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43033"
    },
    {
      "name": "CVE-2026-43023",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43023"
    },
    {
      "name": "CVE-2026-23287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23287"
    },
    {
      "name": "CVE-2026-31510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31510"
    },
    {
      "name": "CVE-2026-23457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23457"
    },
    {
      "name": "CVE-2026-31496",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31496"
    },
    {
      "name": "CVE-2025-40242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40242"
    },
    {
      "name": "CVE-2026-31659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31659"
    },
    {
      "name": "CVE-2026-23401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23401"
    },
    {
      "name": "CVE-2026-43057",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43057"
    },
    {
      "name": "CVE-2026-43030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43030"
    },
    {
      "name": "CVE-2025-38250",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38250"
    },
    {
      "name": "CVE-2026-23391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23391"
    },
    {
      "name": "CVE-2026-31415",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31415"
    },
    {
      "name": "CVE-2024-47809",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47809"
    },
    {
      "name": "CVE-2026-23204",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23204"
    },
    {
      "name": "CVE-2026-23462",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23462"
    },
    {
      "name": "CVE-2026-31563",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31563"
    },
    {
      "name": "CVE-2026-23273",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23273"
    },
    {
      "name": "CVE-2026-23372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23372"
    },
    {
      "name": "CVE-2026-31689",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31689"
    },
    {
      "name": "CVE-2026-23319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23319"
    },
    {
      "name": "CVE-2024-56719",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-56719"
    },
    {
      "name": "CVE-2026-31566",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31566"
    },
    {
      "name": "CVE-2026-31494",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31494"
    },
    {
      "name": "CVE-2026-31565",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31565"
    },
    {
      "name": "CVE-2026-23270",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23270"
    },
    {
      "name": "CVE-2026-31763",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31763"
    },
    {
      "name": "CVE-2026-23279",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23279"
    },
    {
      "name": "CVE-2026-31670",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31670"
    },
    {
      "name": "CVE-2026-31422",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31422"
    },
    {
      "name": "CVE-2026-23286",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23286"
    },
    {
      "name": "CVE-2026-23359",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23359"
    },
    {
      "name": "CVE-2026-31533",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31533"
    },
    {
      "name": "CVE-2026-23298",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23298"
    },
    {
      "name": "CVE-2026-31469",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31469"
    },
    {
      "name": "CVE-2026-31498",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31498"
    },
    {
      "name": "CVE-2026-31520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31520"
    },
    {
      "name": "CVE-2026-31418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31418"
    },
    {
      "name": "CVE-2026-23296",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23296"
    },
    {
      "name": "CVE-2026-31427",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31427"
    },
    {
      "name": "CVE-2026-31555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31555"
    },
    {
      "name": "CVE-2026-31392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31392"
    },
    {
      "name": "CVE-2026-31515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31515"
    },
    {
      "name": "CVE-2026-31661",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31661"
    },
    {
      "name": "CVE-2026-31737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31737"
    },
    {
      "name": "CVE-2026-43017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43017"
    },
    {
      "name": "CVE-2025-71267",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71267"
    },
    {
      "name": "CVE-2026-43043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43043"
    },
    {
      "name": "CVE-2025-37945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-37945"
    },
    {
      "name": "CVE-2026-23396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23396"
    },
    {
      "name": "CVE-2026-31423",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31423"
    },
    {
      "name": "CVE-2026-43051",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43051"
    },
    {
      "name": "CVE-2026-31759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31759"
    },
    {
      "name": "CVE-2026-23370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23370"
    },
    {
      "name": "CVE-2025-38303",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38303"
    },
    {
      "name": "CVE-2026-23414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23414"
    },
    {
      "name": "CVE-2026-31781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31781"
    },
    {
      "name": "CVE-2026-23315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23315"
    },
    {
      "name": "CVE-2026-31523",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31523"
    },
    {
      "name": "CVE-2026-31669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31669"
    },
    {
      "name": "CVE-2026-31450",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31450"
    },
    {
      "name": "CVE-2026-31671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31671"
    },
    {
      "name": "CVE-2026-31749",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31749"
    },
    {
      "name": "CVE-2026-43024",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43024"
    },
    {
      "name": "CVE-2026-23352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23352"
    },
    {
      "name": "CVE-2026-31720",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31720"
    },
    {
      "name": "CVE-2026-31748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31748"
    },
    {
      "name": "CVE-2026-23367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23367"
    },
    {
      "name": "CVE-2026-31628",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31628"
    },
    {
      "name": "CVE-2026-31662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31662"
    },
    {
      "name": "CVE-2025-71067",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71067"
    },
    {
      "name": "CVE-2026-31768",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31768"
    },
    {
      "name": "CVE-2026-43026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43026"
    },
    {
      "name": "CVE-2026-31480",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31480"
    },
    {
      "name": "CVE-2026-23446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23446"
    },
    {
      "name": "CVE-2026-43035",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43035"
    },
    {
      "name": "CVE-2025-71269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71269"
    },
    {
      "name": "CVE-2026-31665",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31665"
    },
    {
      "name": "CVE-2025-40358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40358"
    },
    {
      "name": "CVE-2026-23300",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23300"
    },
    {
      "name": "CVE-2026-31391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31391"
    },
    {
      "name": "CVE-2026-31672",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31672"
    },
    {
      "name": "CVE-2026-31780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31780"
    },
    {
      "name": "CVE-2026-23243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23243"
    },
    {
      "name": "CVE-2023-53510",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53510"
    },
    {
      "name": "CVE-2026-31521",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31521"
    },
    {
      "name": "CVE-2026-31634",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31634"
    },
    {
      "name": "CVE-2024-47736",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47736"
    },
    {
      "name": "CVE-2026-31412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31412"
    },
    {
      "name": "CVE-2026-43032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43032"
    },
    {
      "name": "CVE-2026-23362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23362"
    },
    {
      "name": "CVE-2026-23379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23379"
    },
    {
      "name": "CVE-2026-31421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31421"
    },
    {
      "name": "CVE-2023-53545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53545"
    },
    {
      "name": "CVE-2026-23381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23381"
    },
    {
      "name": "CVE-2026-31518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31518"
    },
    {
      "name": "CVE-2026-31660",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31660"
    },
    {
      "name": "CVE-2026-23392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23392"
    },
    {
      "name": "CVE-2026-23245",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23245"
    },
    {
      "name": "CVE-2026-31728",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31728"
    },
    {
      "name": "CVE-2024-49998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49998"
    },
    {
      "name": "CVE-2026-31403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31403"
    },
    {
      "name": "CVE-2026-31400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31400"
    },
    {
      "name": "CVE-2026-31512",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31512"
    },
    {
      "name": "CVE-2026-31726",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31726"
    },
    {
      "name": "CVE-2026-31504",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31504"
    },
    {
      "name": "CVE-2026-31773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31773"
    },
    {
      "name": "CVE-2026-23364",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23364"
    },
    {
      "name": "CVE-2026-23242",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23242"
    },
    {
      "name": "CVE-2026-43015",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43015"
    },
    {
      "name": "CVE-2026-31509",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31509"
    },
    {
      "name": "CVE-2026-31679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31679"
    },
    {
      "name": "CVE-2025-40135",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40135"
    },
    {
      "name": "CVE-2026-31779",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31779"
    },
    {
      "name": "CVE-2026-23428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23428"
    },
    {
      "name": "CVE-2026-23274",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23274"
    },
    {
      "name": "CVE-2025-38192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38192"
    },
    {
      "name": "CVE-2026-43020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43020"
    },
    {
      "name": "CVE-2026-31417",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31417"
    },
    {
      "name": "CVE-2026-43041",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43041"
    },
    {
      "name": "CVE-2026-31761",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31761"
    },
    {
      "name": "CVE-2026-31466",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31466"
    },
    {
      "name": "CVE-2026-31414",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31414"
    },
    {
      "name": "CVE-2026-31778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31778"
    },
    {
      "name": "CVE-2025-38704",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38704"
    },
    {
      "name": "CVE-2026-31426",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31426"
    },
    {
      "name": "CVE-2025-21676",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21676"
    },
    {
      "name": "CVE-2026-43040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43040"
    },
    {
      "name": "CVE-2026-31552",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31552"
    },
    {
      "name": "CVE-2026-23284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23284"
    },
    {
      "name": "CVE-2026-23397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23397"
    },
    {
      "name": "CVE-2026-23452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23452"
    },
    {
      "name": "CVE-2026-23474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23474"
    },
    {
      "name": "CVE-2026-31434",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31434"
    },
    {
      "name": "CVE-2026-23343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23343"
    },
    {
      "name": "CVE-2026-23336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23336"
    },
    {
      "name": "CVE-2026-31497",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31497"
    },
    {
      "name": "CVE-2026-31682",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31682"
    },
    {
      "name": "CVE-2026-31570",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31570"
    },
    {
      "name": "CVE-2026-23289",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23289"
    },
    {
      "name": "CVE-2026-31755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31755"
    },
    {
      "name": "CVE-2026-23292",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23292"
    },
    {
      "name": "CVE-2026-23141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23141"
    },
    {
      "name": "CVE-2026-23277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23277"
    },
    {
      "name": "CVE-2026-31399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31399"
    },
    {
      "name": "CVE-2026-31441",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31441"
    },
    {
      "name": "CVE-2026-23455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23455"
    },
    {
      "name": "CVE-2026-23335",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23335"
    },
    {
      "name": "CVE-2026-31551",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31551"
    },
    {
      "name": "CVE-2026-31495",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31495"
    },
    {
      "name": "CVE-2026-31507",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31507"
    },
    {
      "name": "CVE-2026-31762",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31762"
    },
    {
      "name": "CVE-2026-31788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31788"
    },
    {
      "name": "CVE-2026-31411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31411"
    },
    {
      "name": "CVE-2026-31428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31428"
    },
    {
      "name": "CVE-2026-23420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23420"
    },
    {
      "name": "CVE-2026-23388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23388"
    },
    {
      "name": "CVE-2025-39748",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39748"
    },
    {
      "name": "CVE-2026-23449",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23449"
    },
    {
      "name": "CVE-2025-39863",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39863"
    },
    {
      "name": "CVE-2025-71266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71266"
    },
    {
      "name": "CVE-2026-31492",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31492"
    },
    {
      "name": "CVE-2026-43037",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43037"
    },
    {
      "name": "CVE-2026-31476",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31476"
    },
    {
      "name": "CVE-2026-23458",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23458"
    },
    {
      "name": "CVE-2026-31649",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31649"
    },
    {
      "name": "CVE-2026-31674",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31674"
    },
    {
      "name": "CVE-2026-31393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31393"
    },
    {
      "name": "CVE-2026-43027",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43027"
    },
    {
      "name": "CVE-2025-68206",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68206"
    },
    {
      "name": "CVE-2026-23339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23339"
    },
    {
      "name": "CVE-2026-31433",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31433"
    },
    {
      "name": "CVE-2026-31776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31776"
    },
    {
      "name": "CVE-2026-23321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23321"
    },
    {
      "name": "CVE-2026-23460",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23460"
    },
    {
      "name": "CVE-2026-31678",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31678"
    },
    {
      "name": "CVE-2025-71161",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71161"
    },
    {
      "name": "CVE-2026-31540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31540"
    },
    {
      "name": "CVE-2026-23395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23395"
    },
    {
      "name": "CVE-2026-31651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31651"
    },
    {
      "name": "CVE-2023-53228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53228"
    },
    {
      "name": "CVE-2026-23100",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23100"
    },
    {
      "name": "CVE-2026-31503",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31503"
    },
    {
      "name": "CVE-2026-31657",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31657"
    },
    {
      "name": "CVE-2026-31747",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31747"
    },
    {
      "name": "CVE-2026-31455",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31455"
    },
    {
      "name": "CVE-2026-23306",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23306"
    },
    {
      "name": "CVE-2026-23378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23378"
    },
    {
      "name": "CVE-2026-31519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31519"
    },
    {
      "name": "CVE-2026-23291",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23291"
    },
    {
      "name": "CVE-2025-68239",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68239"
    },
    {
      "name": "CVE-2026-23382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23382"
    },
    {
      "name": "CVE-2026-31446",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31446"
    },
    {
      "name": "CVE-2026-23113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23113"
    },
    {
      "name": "CVE-2026-23157",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23157"
    },
    {
      "name": "CVE-2026-31464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31464"
    },
    {
      "name": "CVE-2026-31695",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31695"
    },
    {
      "name": "CVE-2025-37980",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-37980"
    },
    {
      "name": "CVE-2026-23231",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23231"
    },
    {
      "name": "CVE-2025-40261",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40261"
    },
    {
      "name": "CVE-2026-23312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23312"
    },
    {
      "name": "CVE-2026-31508",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31508"
    },
    {
      "name": "CVE-2026-23365",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23365"
    },
    {
      "name": "CVE-2026-31424",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31424"
    },
    {
      "name": "CVE-2026-23356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23356"
    },
    {
      "name": "CVE-2026-23307",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23307"
    },
    {
      "name": "CVE-2025-38162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38162"
    },
    {
      "name": "CVE-2026-31477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31477"
    },
    {
      "name": "CVE-2026-43038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43038"
    },
    {
      "name": "CVE-2026-43013",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43013"
    },
    {
      "name": "CVE-2026-31454",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31454"
    },
    {
      "name": "CVE-2025-38659",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38659"
    },
    {
      "name": "CVE-2026-31452",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31452"
    },
    {
      "name": "CVE-2026-23398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23398"
    },
    {
      "name": "CVE-2026-31425",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31425"
    },
    {
      "name": "CVE-2026-23351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23351"
    },
    {
      "name": "CVE-2026-43050",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43050"
    },
    {
      "name": "CVE-2026-23154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23154"
    },
    {
      "name": "CVE-2026-31667",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31667"
    }
  ],
  "initial_release_date": "2026-05-07T00:00:00",
  "last_revision_date": "2026-05-07T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0547",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-05-07T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
  "vendor_advisories": [
    {
      "published_at": "2026-05-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00004",
      "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00004.html"
    },
    {
      "published_at": "2026-05-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian LTS msg00005",
      "url": "https://lists.debian.org/debian-lts-announce/2026/05/msg00005.html"
    }
  ]
}

CVE-2023-53228 (GCVE-0-2023-53228)

Vulnerability from cvelistv5 – Published: 2025-09-15 14:21 – Updated: 2026-05-23 15:28

Title

drm/amdgpu: drop redundant sched job cleanup when cs is aborted

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: drop redundant sched job cleanup when cs is aborted Once command submission failed due to userptr invalidation in amdgpu_cs_submit, legacy code will perform cleanup of scheduler job. However, it's not needed at all, as former commit has integrated job cleanup stuff into amdgpu_job_free. Otherwise, because of double free, a NULL pointer dereference will occur in such scenario. Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/2457

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/cdce1644d85e858c6…
https://git.kernel.org/stable/c/c1564d4b105ae535e…
https://git.kernel.org/stable/c/ec02a29c3c2ef8ad3…
https://git.kernel.org/stable/c/1253685f0d3eb3eab…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 49aa99f05dbc75b9ae360a74648c420a80f7ee49 , < cdce1644d85e858c68fb5fa67d78eb1035bf34f4 (git) Affected: f7d66fb2ea43a3016e78a700a2ca6c77a74579f9 , < c1564d4b105ae535eb3183ecaaa987685b20a888 (git) Affected: f7d66fb2ea43a3016e78a700a2ca6c77a74579f9 , < ec02a29c3c2ef8ad3e15a0e3f96b99a00e5d97b4 (git) Affected: f7d66fb2ea43a3016e78a700a2ca6c77a74579f9 , < 1253685f0d3eb3eab0bfc4bf15ab341a5f3da0c8 (git) Affected: 6.1.160 , < 6.1.167 (semver)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.2.16 , ≤ 6.2.* (semver) Unaffected: 6.3.3 , ≤ 6.3.* (semver) Unaffected: 6.4 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53228",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T17:51:27.851489Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T17:52:59.981Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cdce1644d85e858c68fb5fa67d78eb1035bf34f4",
              "status": "affected",
              "version": "49aa99f05dbc75b9ae360a74648c420a80f7ee49",
              "versionType": "git"
            },
            {
              "lessThan": "c1564d4b105ae535eb3183ecaaa987685b20a888",
              "status": "affected",
              "version": "f7d66fb2ea43a3016e78a700a2ca6c77a74579f9",
              "versionType": "git"
            },
            {
              "lessThan": "ec02a29c3c2ef8ad3e15a0e3f96b99a00e5d97b4",
              "status": "affected",
              "version": "f7d66fb2ea43a3016e78a700a2ca6c77a74579f9",
              "versionType": "git"
            },
            {
              "lessThan": "1253685f0d3eb3eab0bfc4bf15ab341a5f3da0c8",
              "status": "affected",
              "version": "f7d66fb2ea43a3016e78a700a2ca6c77a74579f9",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.167",
              "status": "affected",
              "version": "6.1.160",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.2.*",
              "status": "unaffected",
              "version": "6.2.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1.160",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2.16",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.3",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: drop redundant sched job cleanup when cs is aborted\n\nOnce command submission failed due to userptr invalidation in\namdgpu_cs_submit, legacy code will perform cleanup of scheduler\njob. However, it\u0027s not needed at all, as former commit has integrated\njob cleanup stuff into amdgpu_job_free. Otherwise, because of double\nfree, a NULL pointer dereference will occur in such scenario.\n\nBug: https://gitlab.freedesktop.org/drm/amd/-/issues/2457"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:28:19.017Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cdce1644d85e858c68fb5fa67d78eb1035bf34f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/c1564d4b105ae535eb3183ecaaa987685b20a888"
        },
        {
          "url": "https://git.kernel.org/stable/c/ec02a29c3c2ef8ad3e15a0e3f96b99a00e5d97b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1253685f0d3eb3eab0bfc4bf15ab341a5f3da0c8"
        }
      ],
      "title": "drm/amdgpu: drop redundant sched job cleanup when cs is aborted",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53228",
    "datePublished": "2025-09-15T14:21:59.550Z",
    "dateReserved": "2025-09-15T14:19:21.846Z",
    "dateUpdated": "2026-05-23T15:28:19.017Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-53510 (GCVE-0-2023-53510)

Vulnerability from cvelistv5 – Published: 2025-10-01 11:45 – Updated: 2026-05-11 19:46

Title

scsi: ufs: core: Fix handling of lrbp->cmd

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix handling of lrbp->cmd ufshcd_queuecommand() may be called two times in a row for a SCSI command before it is completed. Hence make the following changes: - In the functions that submit a command, do not check the old value of lrbp->cmd nor clear lrbp->cmd in error paths. - In ufshcd_release_scsi_cmd(), do not clear lrbp->cmd. See also scsi_send_eh_cmnd(). This commit prevents that the following appears if a command times out: WARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8 Call trace: ufshcd_queuecommand+0x6f8/0x9a8 scsi_send_eh_cmnd+0x2c0/0x960 scsi_eh_test_devices+0x100/0x314 scsi_eh_ready_devs+0xd90/0x114c scsi_error_handler+0x2b4/0xb70 kthread+0x16c/0x1e0

Severity

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/b6d76d63c6d21d5d2…
https://git.kernel.org/stable/c/f3ee24af62681b942…
https://git.kernel.org/stable/c/49234a401e161a2f2…
https://git.kernel.org/stable/c/549e91a9bbaa0ee48…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 , < b6d76d63c6d21d5d26c301a46853a2aee72397d5 (git) Affected: 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 , < f3ee24af62681b942bbd799ac77b90a6d7e1fdb1 (git) Affected: 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 , < 49234a401e161a2f2698f4612ab792c49b3cad1b (git) Affected: 5a0b0cb9bee767ef10ff9ce2fb4141af06416288 , < 549e91a9bbaa0ee480f59357868421a61d369770 (git)
Linux	Linux	Affected: 3.12 Unaffected: 0 , < 3.12 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.3.13 , ≤ 6.3.* (semver) Unaffected: 6.4.4 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b6d76d63c6d21d5d26c301a46853a2aee72397d5",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "f3ee24af62681b942bbd799ac77b90a6d7e1fdb1",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "49234a401e161a2f2698f4612ab792c49b3cad1b",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            },
            {
              "lessThan": "549e91a9bbaa0ee480f59357868421a61d369770",
              "status": "affected",
              "version": "5a0b0cb9bee767ef10ff9ce2fb4141af06416288",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ufs/core/ufshcd.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.13",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: ufs: core: Fix handling of lrbp-\u003ecmd\n\nufshcd_queuecommand() may be called two times in a row for a SCSI command\nbefore it is completed. Hence make the following changes:\n\n - In the functions that submit a command, do not check the old value of\n   lrbp-\u003ecmd nor clear lrbp-\u003ecmd in error paths.\n\n - In ufshcd_release_scsi_cmd(), do not clear lrbp-\u003ecmd.\n\nSee also scsi_send_eh_cmnd().\n\nThis commit prevents that the following appears if a command times out:\n\nWARNING: at drivers/ufs/core/ufshcd.c:2965 ufshcd_queuecommand+0x6f8/0x9a8\nCall trace:\n ufshcd_queuecommand+0x6f8/0x9a8\n scsi_send_eh_cmnd+0x2c0/0x960\n scsi_eh_test_devices+0x100/0x314\n scsi_eh_ready_devs+0xd90/0x114c\n scsi_error_handler+0x2b4/0xb70\n kthread+0x16c/0x1e0"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:46:22.267Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b6d76d63c6d21d5d26c301a46853a2aee72397d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3ee24af62681b942bbd799ac77b90a6d7e1fdb1"
        },
        {
          "url": "https://git.kernel.org/stable/c/49234a401e161a2f2698f4612ab792c49b3cad1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/549e91a9bbaa0ee480f59357868421a61d369770"
        }
      ],
      "title": "scsi: ufs: core: Fix handling of lrbp-\u003ecmd",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53510",
    "datePublished": "2025-10-01T11:45:59.421Z",
    "dateReserved": "2025-10-01T11:39:39.405Z",
    "dateUpdated": "2026-05-11T19:46:22.267Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-53545 (GCVE-0-2023-53545)

Vulnerability from cvelistv5 – Published: 2025-10-04 15:16 – Updated: 2026-05-11 19:47

Title

drm/amdgpu: unmap and remove csa_va properly

Summary

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: unmap and remove csa_va properly Root PD BO should be reserved before unmap and remove a bo_va from VM otherwise lockdep will complain. v2: check fpriv->csa_va is not NULL instead of amdgpu_mcbp (christian) [14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu] [14616.937096] Call Trace: [14616.937097] <TASK> [14616.937102] amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu] [14616.937187] drm_file_free+0x1d6/0x300 [drm] [14616.937207] drm_close_helper.isra.0+0x62/0x70 [drm] [14616.937220] drm_release+0x5e/0x100 [drm] [14616.937234] __fput+0x9f/0x280 [14616.937239] ____fput+0xe/0x20 [14616.937241] task_work_run+0x61/0x90 [14616.937246] exit_to_user_mode_prepare+0x215/0x220 [14616.937251] syscall_exit_to_user_mode+0x2a/0x60 [14616.937254] do_syscall_64+0x48/0x90 [14616.937257] entry_SYSCALL_64_after_hwframe+0x63/0xcd

Severity

No CVSS data available.

Assigner

Linux

References

3 references

URL	Tags
https://git.kernel.org/stable/c/ae325b24520839427…
https://git.kernel.org/stable/c/a3a96bf843c356d1d…
https://git.kernel.org/stable/c/5daff15cd013422bc…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < ae325b245208394279a1dc412c831ebd71befb0d (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0 (git) Affected: d38ceaf99ed015f2a0b9af3499791bd3a3daae21 , < 5daff15cd013422bc6d1efcfe82b586800025384 (git)
Linux	Linux	Affected: 4.2 Unaffected: 0 , < 4.2 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.4.12 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae325b245208394279a1dc412c831ebd71befb0d",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            },
            {
              "lessThan": "5daff15cd013422bc6d1efcfe82b586800025384",
              "status": "affected",
              "version": "d38ceaf99ed015f2a0b9af3499791bd3a3daae21",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/amd/amdgpu/amdgpu_csa.c",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_csa.h",
            "drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.2"
            },
            {
              "lessThan": "4.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.12",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "4.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/amdgpu: unmap and remove csa_va properly\n\nRoot PD BO should be reserved before unmap and remove\na bo_va from VM otherwise lockdep will complain.\n\nv2: check fpriv-\u003ecsa_va is not NULL instead of amdgpu_mcbp (christian)\n\n[14616.936827] WARNING: CPU: 6 PID: 1711 at drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c:1762 amdgpu_vm_bo_del+0x399/0x3f0 [amdgpu]\n[14616.937096] Call Trace:\n[14616.937097]  \u003cTASK\u003e\n[14616.937102]  amdgpu_driver_postclose_kms+0x249/0x2f0 [amdgpu]\n[14616.937187]  drm_file_free+0x1d6/0x300 [drm]\n[14616.937207]  drm_close_helper.isra.0+0x62/0x70 [drm]\n[14616.937220]  drm_release+0x5e/0x100 [drm]\n[14616.937234]  __fput+0x9f/0x280\n[14616.937239]  ____fput+0xe/0x20\n[14616.937241]  task_work_run+0x61/0x90\n[14616.937246]  exit_to_user_mode_prepare+0x215/0x220\n[14616.937251]  syscall_exit_to_user_mode+0x2a/0x60\n[14616.937254]  do_syscall_64+0x48/0x90\n[14616.937257]  entry_SYSCALL_64_after_hwframe+0x63/0xcd"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:47:02.747Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae325b245208394279a1dc412c831ebd71befb0d"
        },
        {
          "url": "https://git.kernel.org/stable/c/a3a96bf843c356d1d9b2d7f6d0784b6ee28ca9d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5daff15cd013422bc6d1efcfe82b586800025384"
        }
      ],
      "title": "drm/amdgpu: unmap and remove csa_va properly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53545",
    "datePublished": "2025-10-04T15:16:53.452Z",
    "dateReserved": "2025-10-04T15:14:15.920Z",
    "dateUpdated": "2026-05-11T19:47:02.747Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-47736 (GCVE-0-2024-47736)

Vulnerability from cvelistv5 – Published: 2024-10-21 12:14 – Updated: 2026-05-11 20:39

Title

erofs: handle overlapped pclusters out of crafted images properly

Summary

In the Linux kernel, the following vulnerability has been resolved: erofs: handle overlapped pclusters out of crafted images properly syzbot reported a task hang issue due to a deadlock case where it is waiting for the folio lock of a cached folio that will be used for cache I/Os. After looking into the crafted fuzzed image, I found it's formed with several overlapped big pclusters as below: Ext: logical offset | length : physical offset | length 0: 0.. 16384 | 16384 : 151552.. 167936 | 16384 1: 16384.. 32768 | 16384 : 155648.. 172032 | 16384 2: 32768.. 49152 | 16384 : 537223168.. 537239552 | 16384 ... Here, extent 0/1 are physically overlapped although it's entirely _impossible_ for normal filesystem images generated by mkfs. First, managed folios containing compressed data will be marked as up-to-date and then unlocked immediately (unlike in-place folios) when compressed I/Os are complete. If physical blocks are not submitted in the incremental order, there should be separate BIOs to avoid dependency issues. However, the current code mis-arranges z_erofs_fill_bio_vec() and BIO submission which causes unexpected BIO waits. Second, managed folios will be connected to their own pclusters for efficient inter-queries. However, this is somewhat hard to implement easily if overlapped big pclusters exist. Again, these only appear in fuzzed images so let's simply fall back to temporary short-lived pages for correctness. Additionally, it justifies that referenced managed folios cannot be truncated for now and reverts part of commit 2080ca1ed3e4 ("erofs: tidy up `struct z_erofs_bvec`") for simplicity although it shouldn't be any difference.

Severity

No CVSS data available.

Assigner

Linux

References

5 references

URL	Tags
https://git.kernel.org/stable/c/c1172e65aad4b1153…
https://git.kernel.org/stable/c/1bf7e414cac303c9a…
https://git.kernel.org/stable/c/b9b30af0e86ffb485…
https://git.kernel.org/stable/c/9cfa199bcbbbba31c…
https://git.kernel.org/stable/c/9e2f9d34dd12e6e5b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8e6c8fa9f2e95c88a642521a5da19a8e31748846 , < c1172e65aad4b115392ea4c6e61e56e5b9b69df4 (git) Affected: 8e6c8fa9f2e95c88a642521a5da19a8e31748846 , < 1bf7e414cac303c9aec1be67872e19be8b64980c (git) Affected: 8e6c8fa9f2e95c88a642521a5da19a8e31748846 , < b9b30af0e86ffb485301ecd83b9129c9dfb7ebf8 (git) Affected: 8e6c8fa9f2e95c88a642521a5da19a8e31748846 , < 9cfa199bcbbbba31cbf97b2786f44f4464f3f29a (git) Affected: 8e6c8fa9f2e95c88a642521a5da19a8e31748846 , < 9e2f9d34dd12e6e5b244ec488bcebd0c2d566c50 (git)
Linux	Linux	Affected: 5.13 Unaffected: 0 , < 5.13 (semver) Unaffected: 6.1.168 , ≤ 6.1.* (semver) Unaffected: 6.6.72 , ≤ 6.6.* (semver) Unaffected: 6.10.13 , ≤ 6.10.* (semver) Unaffected: 6.11.2 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47736",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-21T12:59:50.164921Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-21T13:04:15.151Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zdata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c1172e65aad4b115392ea4c6e61e56e5b9b69df4",
              "status": "affected",
              "version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
              "versionType": "git"
            },
            {
              "lessThan": "1bf7e414cac303c9aec1be67872e19be8b64980c",
              "status": "affected",
              "version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
              "versionType": "git"
            },
            {
              "lessThan": "b9b30af0e86ffb485301ecd83b9129c9dfb7ebf8",
              "status": "affected",
              "version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
              "versionType": "git"
            },
            {
              "lessThan": "9cfa199bcbbbba31cbf97b2786f44f4464f3f29a",
              "status": "affected",
              "version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
              "versionType": "git"
            },
            {
              "lessThan": "9e2f9d34dd12e6e5b244ec488bcebd0c2d566c50",
              "status": "affected",
              "version": "8e6c8fa9f2e95c88a642521a5da19a8e31748846",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zdata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.72",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.13",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: handle overlapped pclusters out of crafted images properly\n\nsyzbot reported a task hang issue due to a deadlock case where it is\nwaiting for the folio lock of a cached folio that will be used for\ncache I/Os.\n\nAfter looking into the crafted fuzzed image, I found it\u0027s formed with\nseveral overlapped big pclusters as below:\n\n Ext:   logical offset   |  length :     physical offset    |  length\n   0:        0..   16384 |   16384 :     151552..    167936 |   16384\n   1:    16384..   32768 |   16384 :     155648..    172032 |   16384\n   2:    32768..   49152 |   16384 :  537223168.. 537239552 |   16384\n...\n\nHere, extent 0/1 are physically overlapped although it\u0027s entirely\n_impossible_ for normal filesystem images generated by mkfs.\n\nFirst, managed folios containing compressed data will be marked as\nup-to-date and then unlocked immediately (unlike in-place folios) when\ncompressed I/Os are complete.  If physical blocks are not submitted in\nthe incremental order, there should be separate BIOs to avoid dependency\nissues.  However, the current code mis-arranges z_erofs_fill_bio_vec()\nand BIO submission which causes unexpected BIO waits.\n\nSecond, managed folios will be connected to their own pclusters for\nefficient inter-queries.  However, this is somewhat hard to implement\neasily if overlapped big pclusters exist.  Again, these only appear in\nfuzzed images so let\u0027s simply fall back to temporary short-lived pages\nfor correctness.\n\nAdditionally, it justifies that referenced managed folios cannot be\ntruncated for now and reverts part of commit 2080ca1ed3e4 (\"erofs: tidy\nup `struct z_erofs_bvec`\") for simplicity although it shouldn\u0027t be any\ndifference."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:39:45.456Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c1172e65aad4b115392ea4c6e61e56e5b9b69df4"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bf7e414cac303c9aec1be67872e19be8b64980c"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9b30af0e86ffb485301ecd83b9129c9dfb7ebf8"
        },
        {
          "url": "https://git.kernel.org/stable/c/9cfa199bcbbbba31cbf97b2786f44f4464f3f29a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e2f9d34dd12e6e5b244ec488bcebd0c2d566c50"
        }
      ],
      "title": "erofs: handle overlapped pclusters out of crafted images properly",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47736",
    "datePublished": "2024-10-21T12:14:06.530Z",
    "dateReserved": "2024-09-30T16:00:12.958Z",
    "dateUpdated": "2026-05-11T20:39:45.456Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-47809 (GCVE-0-2024-47809)

Vulnerability from cvelistv5 – Published: 2025-01-11 12:25 – Updated: 2026-05-11 20:40

Title

dlm: fix possible lkb_resource null dereference

Summary

In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkb_resource null dereference This patch fixes a possible null pointer dereference when this function is called from request_lock() as lkb->lkb_resource is not assigned yet, only after validate_lock_args() by calling attach_lkb(). Another issue is that a resource name could be a non printable bytearray and we cannot assume to be ASCII coded. The log functionality is probably never being hit when DLM is used in normal way and no debug logging is enabled. The null pointer dereference can only occur on a new created lkb that does not have the resource assigned yet, it probably never hits the null pointer dereference but we should be sure that other changes might not change this behaviour and we actually can hit the mentioned null pointer dereference. In this patch we just drop the printout of the resource name, the lkb id is enough to make a possible connection to a resource name if this exists.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/8d55ce46dd543c696…
https://git.kernel.org/stable/c/6fbdc3980b70e9c1c…
https://git.kernel.org/stable/c/2db11504ef82a60c1…
https://git.kernel.org/stable/c/b98333c67daf887c7…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 43279e5376017c40b4be9af5bc79cbb4ef6f53d7 , < 8d55ce46dd543c6965970ce70c22c3076dd35b1e (git) Affected: 43279e5376017c40b4be9af5bc79cbb4ef6f53d7 , < 6fbdc3980b70e9c1c86eccea7d5ee68108008fa7 (git) Affected: 43279e5376017c40b4be9af5bc79cbb4ef6f53d7 , < 2db11504ef82a60c1a2063ba7431a5cd013ecfcb (git) Affected: 43279e5376017c40b4be9af5bc79cbb4ef6f53d7 , < b98333c67daf887c724cd692e88e2db9418c0861 (git)
Linux	Linux	Affected: 2.6.30 Unaffected: 0 , < 2.6.30 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.66 , ≤ 6.6.* (semver) Unaffected: 6.12.5 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-47809",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:55:47.946343Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:22.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/lock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8d55ce46dd543c6965970ce70c22c3076dd35b1e",
              "status": "affected",
              "version": "43279e5376017c40b4be9af5bc79cbb4ef6f53d7",
              "versionType": "git"
            },
            {
              "lessThan": "6fbdc3980b70e9c1c86eccea7d5ee68108008fa7",
              "status": "affected",
              "version": "43279e5376017c40b4be9af5bc79cbb4ef6f53d7",
              "versionType": "git"
            },
            {
              "lessThan": "2db11504ef82a60c1a2063ba7431a5cd013ecfcb",
              "status": "affected",
              "version": "43279e5376017c40b4be9af5bc79cbb4ef6f53d7",
              "versionType": "git"
            },
            {
              "lessThan": "b98333c67daf887c724cd692e88e2db9418c0861",
              "status": "affected",
              "version": "43279e5376017c40b4be9af5bc79cbb4ef6f53d7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/dlm/lock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.66",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.5",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndlm: fix possible lkb_resource null dereference\n\nThis patch fixes a possible null pointer dereference when this function is\ncalled from request_lock() as lkb-\u003elkb_resource is not assigned yet,\nonly after validate_lock_args() by calling attach_lkb(). Another issue\nis that a resource name could be a non printable bytearray and we cannot\nassume to be ASCII coded.\n\nThe log functionality is probably never being hit when DLM is used in\nnormal way and no debug logging is enabled. The null pointer dereference\ncan only occur on a new created lkb that does not have the resource\nassigned yet, it probably never hits the null pointer dereference but we\nshould be sure that other changes might not change this behaviour and we\nactually can hit the mentioned null pointer dereference.\n\nIn this patch we just drop the printout of the resource name, the lkb id\nis enough to make a possible connection to a resource name if this\nexists."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:40:13.966Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8d55ce46dd543c6965970ce70c22c3076dd35b1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6fbdc3980b70e9c1c86eccea7d5ee68108008fa7"
        },
        {
          "url": "https://git.kernel.org/stable/c/2db11504ef82a60c1a2063ba7431a5cd013ecfcb"
        },
        {
          "url": "https://git.kernel.org/stable/c/b98333c67daf887c724cd692e88e2db9418c0861"
        }
      ],
      "title": "dlm: fix possible lkb_resource null dereference",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-47809",
    "datePublished": "2025-01-11T12:25:15.356Z",
    "dateReserved": "2025-01-09T09:51:32.479Z",
    "dateUpdated": "2026-05-11T20:40:13.966Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-49998 (GCVE-0-2024-49998)

Vulnerability from cvelistv5 – Published: 2024-10-21 18:02 – Updated: 2026-05-23 15:54

Title

net: dsa: improve shutdown sequence

Summary

In the Linux kernel, the following vulnerability has been resolved: net: dsa: improve shutdown sequence Alexander Sverdlin presents 2 problems during shutdown with the lan9303 driver. One is specific to lan9303 and the other just happens to reproduce there. The first problem is that lan9303 is unique among DSA drivers in that it calls dev_get_drvdata() at "arbitrary runtime" (not probe, not shutdown, not remove): phy_state_machine() -> ... -> dsa_user_phy_read() -> ds->ops->phy_read() -> lan9303_phy_read() -> chip->ops->phy_read() -> lan9303_mdio_phy_read() -> dev_get_drvdata() But we never stop the phy_state_machine(), so it may continue to run after dsa_switch_shutdown(). Our common pattern in all DSA drivers is to set drvdata to NULL to suppress the remove() method that may come afterwards. But in this case it will result in an NPD. The second problem is that the way in which we set dp->conduit->dsa_ptr = NULL; is concurrent with receive packet processing. dsa_switch_rcv() checks once whether dev->dsa_ptr is NULL, but afterwards, rather than continuing to use that non-NULL value, dev->dsa_ptr is dereferenced again and again without NULL checks: dsa_conduit_find_user() and many other places. In between dereferences, there is no locking to ensure that what was valid once continues to be valid. Both problems have the common aspect that closing the conduit interface solves them. In the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN event in dsa_user_netdevice_event() which closes user ports as well. dsa_port_disable_rt() calls phylink_stop(), which synchronously stops the phylink state machine, and ds->ops->phy_read() will thus no longer call into the driver after this point. In the second case, dev_close(conduit) should do this, as per Documentation/networking/driver.rst: | Quiescence | ---------- | | After the ndo_stop routine has been called, the hardware must | not receive or transmit any data. All in flight packets must | be aborted. If necessary, poll or wait for completion of | any reset commands. So it should be sufficient to ensure that later, when we zeroize conduit->dsa_ptr, there will be no concurrent dsa_switch_rcv() call on this conduit. The addition of the netif_device_detach() function is to ensure that ioctls, rtnetlinks and ethtool requests on the user ports no longer propagate down to the driver - we're no longer prepared to handle them. The race condition actually did not exist when commit 0650bf52b31f ("net: dsa: be compatible with masters which unregister on shutdown") first introduced dsa_switch_shutdown(). It was created later, when we stopped unregistering the user interfaces from a bad spot, and we just replaced that sequence with a racy zeroization of conduit->dsa_ptr (one which doesn't ensure that the interfaces aren't up).

Severity

No CVSS data available.

Assigner

Linux

References

6 references

URL	Tags
https://git.kernel.org/stable/c/87bd909a7014e3279…
https://git.kernel.org/stable/c/ab9e90619b6339bec…
https://git.kernel.org/stable/c/2e93bf719462ac6d2…
https://git.kernel.org/stable/c/ab5d3420a11209507…
https://git.kernel.org/stable/c/b4a65d479213fe84e…
https://git.kernel.org/stable/c/6c24a03a61a245fe3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: ff45899e732e57088985e3a497b1d9100571c0f5 , < 87bd909a7014e32790e8c759d5b7694a95778ca5 (git) Affected: ee534378f00561207656663d93907583958339ae , < ab9e90619b6339becc5415647ae154a9a46a044d (git) Affected: ee534378f00561207656663d93907583958339ae , < 2e93bf719462ac6d23c881c8b93e5dc9bf5ab7f5 (git) Affected: ee534378f00561207656663d93907583958339ae , < ab5d3420a1120950703dbdc33698b28a6ebc3d23 (git) Affected: ee534378f00561207656663d93907583958339ae , < b4a65d479213fe84ecb14e328271251eebe69492 (git) Affected: ee534378f00561207656663d93907583958339ae , < 6c24a03a61a245fe34d47582898331fa034b6ccd (git) Affected: 89b60402d43cdab4387dbbf24afebda5cf092ae7 (git) Affected: 5.15.155 , < 5.15.176 (semver) Affected: 5.16.10 , < 5.17 (semver)
Linux	Linux	Affected: 5.17 Unaffected: 0 , < 5.17 (semver) Unaffected: 5.15.176 , ≤ 5.15.* (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.117 , ≤ 6.6.* (semver) Unaffected: 6.10.14 , ≤ 6.10.* (semver) Unaffected: 6.11.3 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-49998",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-22T13:30:20.999100Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-22T13:38:41.547Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/dsa/dsa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "87bd909a7014e32790e8c759d5b7694a95778ca5",
              "status": "affected",
              "version": "ff45899e732e57088985e3a497b1d9100571c0f5",
              "versionType": "git"
            },
            {
              "lessThan": "ab9e90619b6339becc5415647ae154a9a46a044d",
              "status": "affected",
              "version": "ee534378f00561207656663d93907583958339ae",
              "versionType": "git"
            },
            {
              "lessThan": "2e93bf719462ac6d23c881c8b93e5dc9bf5ab7f5",
              "status": "affected",
              "version": "ee534378f00561207656663d93907583958339ae",
              "versionType": "git"
            },
            {
              "lessThan": "ab5d3420a1120950703dbdc33698b28a6ebc3d23",
              "status": "affected",
              "version": "ee534378f00561207656663d93907583958339ae",
              "versionType": "git"
            },
            {
              "lessThan": "b4a65d479213fe84ecb14e328271251eebe69492",
              "status": "affected",
              "version": "ee534378f00561207656663d93907583958339ae",
              "versionType": "git"
            },
            {
              "lessThan": "6c24a03a61a245fe34d47582898331fa034b6ccd",
              "status": "affected",
              "version": "ee534378f00561207656663d93907583958339ae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "89b60402d43cdab4387dbbf24afebda5cf092ae7",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.176",
              "status": "affected",
              "version": "5.15.155",
              "versionType": "semver"
            },
            {
              "lessThan": "5.17",
              "status": "affected",
              "version": "5.16.10",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/dsa/dsa.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.117",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.176",
                  "versionStartIncluding": "5.15.155",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.117",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.14",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.3",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.16.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: dsa: improve shutdown sequence\n\nAlexander Sverdlin presents 2 problems during shutdown with the\nlan9303 driver. One is specific to lan9303 and the other just happens\nto reproduce there.\n\nThe first problem is that lan9303 is unique among DSA drivers in that it\ncalls dev_get_drvdata() at \"arbitrary runtime\" (not probe, not shutdown,\nnot remove):\n\nphy_state_machine()\n-\u003e ...\n   -\u003e dsa_user_phy_read()\n      -\u003e ds-\u003eops-\u003ephy_read()\n         -\u003e lan9303_phy_read()\n            -\u003e chip-\u003eops-\u003ephy_read()\n               -\u003e lan9303_mdio_phy_read()\n                  -\u003e dev_get_drvdata()\n\nBut we never stop the phy_state_machine(), so it may continue to run\nafter dsa_switch_shutdown(). Our common pattern in all DSA drivers is\nto set drvdata to NULL to suppress the remove() method that may come\nafterwards. But in this case it will result in an NPD.\n\nThe second problem is that the way in which we set\ndp-\u003econduit-\u003edsa_ptr = NULL; is concurrent with receive packet\nprocessing. dsa_switch_rcv() checks once whether dev-\u003edsa_ptr is NULL,\nbut afterwards, rather than continuing to use that non-NULL value,\ndev-\u003edsa_ptr is dereferenced again and again without NULL checks:\ndsa_conduit_find_user() and many other places. In between dereferences,\nthere is no locking to ensure that what was valid once continues to be\nvalid.\n\nBoth problems have the common aspect that closing the conduit interface\nsolves them.\n\nIn the first case, dev_close(conduit) triggers the NETDEV_GOING_DOWN\nevent in dsa_user_netdevice_event() which closes user ports as well.\ndsa_port_disable_rt() calls phylink_stop(), which synchronously stops\nthe phylink state machine, and ds-\u003eops-\u003ephy_read() will thus no longer\ncall into the driver after this point.\n\nIn the second case, dev_close(conduit) should do this, as per\nDocumentation/networking/driver.rst:\n\n| Quiescence\n| ----------\n|\n| After the ndo_stop routine has been called, the hardware must\n| not receive or transmit any data.  All in flight packets must\n| be aborted. If necessary, poll or wait for completion of\n| any reset commands.\n\nSo it should be sufficient to ensure that later, when we zeroize\nconduit-\u003edsa_ptr, there will be no concurrent dsa_switch_rcv() call\non this conduit.\n\nThe addition of the netif_device_detach() function is to ensure that\nioctls, rtnetlinks and ethtool requests on the user ports no longer\npropagate down to the driver - we\u0027re no longer prepared to handle them.\n\nThe race condition actually did not exist when commit 0650bf52b31f\n(\"net: dsa: be compatible with masters which unregister on shutdown\")\nfirst introduced dsa_switch_shutdown(). It was created later, when we\nstopped unregistering the user interfaces from a bad spot, and we just\nreplaced that sequence with a racy zeroization of conduit-\u003edsa_ptr\n(one which doesn\u0027t ensure that the interfaces aren\u0027t up)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:54:15.188Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/87bd909a7014e32790e8c759d5b7694a95778ca5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab9e90619b6339becc5415647ae154a9a46a044d"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e93bf719462ac6d23c881c8b93e5dc9bf5ab7f5"
        },
        {
          "url": "https://git.kernel.org/stable/c/ab5d3420a1120950703dbdc33698b28a6ebc3d23"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4a65d479213fe84ecb14e328271251eebe69492"
        },
        {
          "url": "https://git.kernel.org/stable/c/6c24a03a61a245fe34d47582898331fa034b6ccd"
        }
      ],
      "title": "net: dsa: improve shutdown sequence",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-49998",
    "datePublished": "2024-10-21T18:02:38.316Z",
    "dateReserved": "2024-10-21T12:17:06.057Z",
    "dateUpdated": "2026-05-23T15:54:15.188Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-50298 (GCVE-0-2024-50298)

Vulnerability from cvelistv5 – Published: 2024-11-19 01:30 – Updated: 2026-05-11 20:49

Title

net: enetc: allocate vf_state during PF probes

Summary

In the Linux kernel, the following vulnerability has been resolved: net: enetc: allocate vf_state during PF probes In the previous implementation, vf_state is allocated memory only when VF is enabled. However, net_device_ops::ndo_set_vf_mac() may be called before VF is enabled to configure the MAC address of VF. If this is the case, enetc_pf_set_vf_mac() will access vf_state, resulting in access to a null pointer. The simplified error log is as follows. root@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89 [ 173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004 [ 173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy [ 173.641973] lr : do_setlink+0x4a8/0xec8 [ 173.732292] Call trace: [ 173.734740] enetc_pf_set_vf_mac+0x3c/0x80 [ 173.738847] __rtnl_newlink+0x530/0x89c [ 173.742692] rtnl_newlink+0x50/0x7c [ 173.746189] rtnetlink_rcv_msg+0x128/0x390 [ 173.750298] netlink_rcv_skb+0x60/0x130 [ 173.754145] rtnetlink_rcv+0x18/0x24 [ 173.757731] netlink_unicast+0x318/0x380 [ 173.761665] netlink_sendmsg+0x17c/0x3c8

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/35668e29e979b3a19…
https://git.kernel.org/stable/c/ef0edfbe9eeed1fcc…
https://git.kernel.org/stable/c/7eb923f8d4819737c…
https://git.kernel.org/stable/c/e15c5506dd39885cd…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: d4fd0404c1c95b17880f254ebfee3485693fa8ba , < 35668e29e979b3a1927d3959cdd87327afd8e5eb (git) Affected: d4fd0404c1c95b17880f254ebfee3485693fa8ba , < ef0edfbe9eeed1fccad7cb705648af5222664944 (git) Affected: d4fd0404c1c95b17880f254ebfee3485693fa8ba , < 7eb923f8d4819737c07d6a8d0daef0a4d7f99e0c (git) Affected: d4fd0404c1c95b17880f254ebfee3485693fa8ba , < e15c5506dd39885cd047f811a64240e2e8ab401b (git)
Linux	Linux	Affected: 5.1 Unaffected: 0 , < 5.1 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.61 , ≤ 6.6.* (semver) Unaffected: 6.11.8 , ≤ 6.11.* (semver) Unaffected: 6.12 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-50298",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T20:14:01.307319Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:17:20.205Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/enetc/enetc_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "35668e29e979b3a1927d3959cdd87327afd8e5eb",
              "status": "affected",
              "version": "d4fd0404c1c95b17880f254ebfee3485693fa8ba",
              "versionType": "git"
            },
            {
              "lessThan": "ef0edfbe9eeed1fccad7cb705648af5222664944",
              "status": "affected",
              "version": "d4fd0404c1c95b17880f254ebfee3485693fa8ba",
              "versionType": "git"
            },
            {
              "lessThan": "7eb923f8d4819737c07d6a8d0daef0a4d7f99e0c",
              "status": "affected",
              "version": "d4fd0404c1c95b17880f254ebfee3485693fa8ba",
              "versionType": "git"
            },
            {
              "lessThan": "e15c5506dd39885cd047f811a64240e2e8ab401b",
              "status": "affected",
              "version": "d4fd0404c1c95b17880f254ebfee3485693fa8ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/enetc/enetc_pf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.61",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.11.*",
              "status": "unaffected",
              "version": "6.11.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.12",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.61",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11.8",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: enetc: allocate vf_state during PF probes\n\nIn the previous implementation, vf_state is allocated memory only when VF\nis enabled. However, net_device_ops::ndo_set_vf_mac() may be called before\nVF is enabled to configure the MAC address of VF. If this is the case,\nenetc_pf_set_vf_mac() will access vf_state, resulting in access to a null\npointer. The simplified error log is as follows.\n\nroot@ls1028ardb:~# ip link set eno0 vf 1 mac 00:0c:e7:66:77:89\n[  173.543315] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000004\n[  173.637254] pc : enetc_pf_set_vf_mac+0x3c/0x80 Message from sy\n[  173.641973] lr : do_setlink+0x4a8/0xec8\n[  173.732292] Call trace:\n[  173.734740]  enetc_pf_set_vf_mac+0x3c/0x80\n[  173.738847]  __rtnl_newlink+0x530/0x89c\n[  173.742692]  rtnl_newlink+0x50/0x7c\n[  173.746189]  rtnetlink_rcv_msg+0x128/0x390\n[  173.750298]  netlink_rcv_skb+0x60/0x130\n[  173.754145]  rtnetlink_rcv+0x18/0x24\n[  173.757731]  netlink_unicast+0x318/0x380\n[  173.761665]  netlink_sendmsg+0x17c/0x3c8"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T20:49:26.256Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/35668e29e979b3a1927d3959cdd87327afd8e5eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef0edfbe9eeed1fccad7cb705648af5222664944"
        },
        {
          "url": "https://git.kernel.org/stable/c/7eb923f8d4819737c07d6a8d0daef0a4d7f99e0c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e15c5506dd39885cd047f811a64240e2e8ab401b"
        }
      ],
      "title": "net: enetc: allocate vf_state during PF probes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-50298",
    "datePublished": "2024-11-19T01:30:46.029Z",
    "dateReserved": "2024-10-21T19:36:19.987Z",
    "dateUpdated": "2026-05-11T20:49:26.256Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-56719 (GCVE-0-2024-56719)

Vulnerability from cvelistv5 – Published: 2024-12-29 08:48 – Updated: 2026-05-23 15:55

Title

net: stmmac: fix TSO DMA API usage causing oops

Summary

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members to be later in stmmac_tso_xmit(). The buf (dma cookie) and len stored in this structure are passed to dma_unmap_single() by stmmac_tx_clean(). The DMA API requires that the dma cookie passed to dma_unmap_single() is the same as the value returned from dma_map_single(). However, by moving the assignment later, this is not the case when priv->dma_cap.addr64 > 32 as "des" is offset by proto_hdr_len. This causes problems such as: dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed and with DMA_API_DEBUG enabled: DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes] Fix this by maintaining "des" as the original DMA cookie, and use tso_des to pass the offset DMA cookie to stmmac_tso_allocator(). Full details of the crashes can be found at: https://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/ https://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-noinfo Not enough information

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/6abcdc9a73274052a…
https://git.kernel.org/stable/c/db3667c9bbfbbf5de…
https://git.kernel.org/stable/c/9d5dd7ccea1b46a9a…
https://git.kernel.org/stable/c/4c49f38e20a57f8ab…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a3ff23f7c3f0e13f718900803e090fd3997d6bc9 , < 6abcdc9a73274052a9e96a1926994ecf9aedad82 (git) Affected: 07c9c26e37542486e34d767505e842f48f29c3f6 , < db3667c9bbfbbf5de98e6c9542f7e03fb5243286 (git) Affected: 66600fac7a984dea4ae095411f644770b2561ede , < 9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2 (git) Affected: 66600fac7a984dea4ae095411f644770b2561ede , < 4c49f38e20a57f8abaebdf95b369295b153d1f8e (git) Affected: ece593fc9c00741b682869d3f3dc584d37b7c9df (git) Affected: 58d23d835eb498336716cca55b5714191a309286 (git) Affected: 6.1.116 , < 6.1.167 (semver) Affected: 6.6.60 , < 6.6.68 (semver) Affected: 5.15.171 , < 5.16 (semver) Affected: 6.11.7 , < 6.12 (semver)
Linux	Linux	Affected: 6.12 Unaffected: 0 , < 6.12 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.68 , ≤ 6.6.* (semver) Unaffected: 6.12.7 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-56719",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:58:24.752519Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "description": "CWE-noinfo Not enough information",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T20:07:06.268Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6abcdc9a73274052a9e96a1926994ecf9aedad82",
              "status": "affected",
              "version": "a3ff23f7c3f0e13f718900803e090fd3997d6bc9",
              "versionType": "git"
            },
            {
              "lessThan": "db3667c9bbfbbf5de98e6c9542f7e03fb5243286",
              "status": "affected",
              "version": "07c9c26e37542486e34d767505e842f48f29c3f6",
              "versionType": "git"
            },
            {
              "lessThan": "9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2",
              "status": "affected",
              "version": "66600fac7a984dea4ae095411f644770b2561ede",
              "versionType": "git"
            },
            {
              "lessThan": "4c49f38e20a57f8abaebdf95b369295b153d1f8e",
              "status": "affected",
              "version": "66600fac7a984dea4ae095411f644770b2561ede",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ece593fc9c00741b682869d3f3dc584d37b7c9df",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "58d23d835eb498336716cca55b5714191a309286",
              "versionType": "git"
            },
            {
              "lessThan": "6.1.167",
              "status": "affected",
              "version": "6.1.116",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.68",
              "status": "affected",
              "version": "6.6.60",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.171",
              "versionType": "semver"
            },
            {
              "lessThan": "6.12",
              "status": "affected",
              "version": "6.11.7",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/stmicro/stmmac/stmmac_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1.116",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.68",
                  "versionStartIncluding": "6.6.60",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.7",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.171",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.11.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: stmmac: fix TSO DMA API usage causing oops\n\nCommit 66600fac7a98 (\"net: stmmac: TSO: Fix unbalanced DMA map/unmap\nfor non-paged SKB data\") moved the assignment of tx_skbuff_dma[]\u0027s\nmembers to be later in stmmac_tso_xmit().\n\nThe buf (dma cookie) and len stored in this structure are passed to\ndma_unmap_single() by stmmac_tx_clean(). The DMA API requires that\nthe dma cookie passed to dma_unmap_single() is the same as the value\nreturned from dma_map_single(). However, by moving the assignment\nlater, this is not the case when priv-\u003edma_cap.addr64 \u003e 32 as \"des\"\nis offset by proto_hdr_len.\n\nThis causes problems such as:\n\n  dwc-eth-dwmac 2490000.ethernet eth0: Tx DMA map failed\n\nand with DMA_API_DEBUG enabled:\n\n  DMA-API: dwc-eth-dwmac 2490000.ethernet: device driver tries to +free DMA memory it has not allocated [device address=0x000000ffffcf65c0] [size=66 bytes]\n\nFix this by maintaining \"des\" as the original DMA cookie, and use\ntso_des to pass the offset DMA cookie to stmmac_tso_allocator().\n\nFull details of the crashes can be found at:\nhttps://lore.kernel.org/all/d8112193-0386-4e14-b516-37c2d838171a@nvidia.com/\nhttps://lore.kernel.org/all/klkzp5yn5kq5efgtrow6wbvnc46bcqfxs65nz3qy77ujr5turc@bwwhelz2l4dw/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T15:55:58.609Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6abcdc9a73274052a9e96a1926994ecf9aedad82"
        },
        {
          "url": "https://git.kernel.org/stable/c/db3667c9bbfbbf5de98e6c9542f7e03fb5243286"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d5dd7ccea1b46a9a7c6b3c2b9e5ed8864e185e2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c49f38e20a57f8abaebdf95b369295b153d1f8e"
        }
      ],
      "title": "net: stmmac: fix TSO DMA API usage causing oops",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-56719",
    "datePublished": "2024-12-29T08:48:51.495Z",
    "dateReserved": "2024-12-27T15:00:39.858Z",
    "dateUpdated": "2026-05-23T15:55:58.609Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21676 (GCVE-0-2025-21676)

Vulnerability from cvelistv5 – Published: 2025-01-31 11:25 – Updated: 2026-05-11 21:04

Title

net: fec: handle page_pool_dev_alloc_pages error

Summary

In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did not handle the case when it returned NULL. There was a WARN_ON(!new_page) but it would still proceed to use the NULL pointer and then crash. This case does seem somewhat rare but when the system is under memory pressure it can happen. One case where I can duplicate this with some frequency is when writing over a smbd share to a SATA HDD attached to an imx6q. Setting /proc/sys/vm/min_free_kbytes to higher values also seems to solve the problem for my test case. But it still seems wrong that the fec driver ignores the memory allocation error and can crash. This commit handles the allocation error by dropping the current packet.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/eacdcc14f3c8d4c14…
https://git.kernel.org/stable/c/8a0097db0544b658c…
https://git.kernel.org/stable/c/1425cb829556398f5…
https://git.kernel.org/stable/c/001ba0902046cb6c3…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 95698ff6177b5f1f13f251da60e7348413046ae4 , < eacdcc14f3c8d4c1447565521e792ddb3a67e08d (git) Affected: 95698ff6177b5f1f13f251da60e7348413046ae4 , < 8a0097db0544b658c159ac787319737712063a23 (git) Affected: 95698ff6177b5f1f13f251da60e7348413046ae4 , < 1425cb829556398f594658512d49292f988a2ab0 (git) Affected: 95698ff6177b5f1f13f251da60e7348413046ae4 , < 001ba0902046cb6c352494df610718c0763e77a5 (git)
Linux	Linux	Affected: 6.1 Unaffected: 0 , < 6.1 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.74 , ≤ 6.6.* (semver) Unaffected: 6.12.11 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21676",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:51:57.870830Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:11.595Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/fec_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "eacdcc14f3c8d4c1447565521e792ddb3a67e08d",
              "status": "affected",
              "version": "95698ff6177b5f1f13f251da60e7348413046ae4",
              "versionType": "git"
            },
            {
              "lessThan": "8a0097db0544b658c159ac787319737712063a23",
              "status": "affected",
              "version": "95698ff6177b5f1f13f251da60e7348413046ae4",
              "versionType": "git"
            },
            {
              "lessThan": "1425cb829556398f594658512d49292f988a2ab0",
              "status": "affected",
              "version": "95698ff6177b5f1f13f251da60e7348413046ae4",
              "versionType": "git"
            },
            {
              "lessThan": "001ba0902046cb6c352494df610718c0763e77a5",
              "status": "affected",
              "version": "95698ff6177b5f1f13f251da60e7348413046ae4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/freescale/fec_main.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.1"
            },
            {
              "lessThan": "6.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.74",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.74",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.11",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "6.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fec: handle page_pool_dev_alloc_pages error\n\nThe fec_enet_update_cbd function calls page_pool_dev_alloc_pages but did\nnot handle the case when it returned NULL. There was a WARN_ON(!new_page)\nbut it would still proceed to use the NULL pointer and then crash.\n\nThis case does seem somewhat rare but when the system is under memory\npressure it can happen. One case where I can duplicate this with some\nfrequency is when writing over a smbd share to a SATA HDD attached to an\nimx6q.\n\nSetting /proc/sys/vm/min_free_kbytes to higher values also seems to solve\nthe problem for my test case. But it still seems wrong that the fec driver\nignores the memory allocation error and can crash.\n\nThis commit handles the allocation error by dropping the current packet."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:04:17.572Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/eacdcc14f3c8d4c1447565521e792ddb3a67e08d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a0097db0544b658c159ac787319737712063a23"
        },
        {
          "url": "https://git.kernel.org/stable/c/1425cb829556398f594658512d49292f988a2ab0"
        },
        {
          "url": "https://git.kernel.org/stable/c/001ba0902046cb6c352494df610718c0763e77a5"
        }
      ],
      "title": "net: fec: handle page_pool_dev_alloc_pages error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21676",
    "datePublished": "2025-01-31T11:25:38.126Z",
    "dateReserved": "2024-12-29T08:45:45.737Z",
    "dateUpdated": "2026-05-11T21:04:17.572Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2025-21682 (GCVE-0-2025-21682)

Vulnerability from cvelistv5 – Published: 2025-01-31 11:25 – Updated: 2026-05-11 21:04

Title

eth: bnxt: always recalculate features after XDP clearing, fix null-deref

Summary

In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: always recalculate features after XDP clearing, fix null-deref Recalculate features when XDP is detached. Before: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: off [requested on] After: # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp # ip li set dev eth0 xdp off # ethtool -k eth0 | grep gro rx-gro-hw: on The fact that HW-GRO doesn't get re-enabled automatically is just a minor annoyance. The real issue is that the features will randomly come back during another reconfiguration which just happens to invoke netdev_update_features(). The driver doesn't handle reconfiguring two things at a time very robustly. Starting with commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") we only reconfigure the RSS hash table if the "effective" number of Rx rings has changed. If HW-GRO is enabled "effective" number of rings is 2x what user sees. So if we are in the bad state, with HW-GRO re-enablement "pending" after XDP off, and we lower the rings by / 2 - the HW-GRO rings doing 2x and the ethtool -L doing / 2 may cancel each other out, and the: if (old_rx_rings != bp->hw_resc.resv_rx_rings && condition in __bnxt_reserve_rings() will be false. The RSS map won't get updated, and we'll crash with: BUG: kernel NULL pointer dereference, address: 0000000000000168 RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0 bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180 __bnxt_setup_vnic_p5+0x58/0x110 bnxt_init_nic+0xb72/0xf50 __bnxt_open_nic+0x40d/0xab0 bnxt_open_nic+0x2b/0x60 ethtool_set_channels+0x18c/0x1d0 As we try to access a freed ring. The issue is present since XDP support was added, really, but prior to commit 98ba1d931f61 ("bnxt_en: Fix RSS logic in __bnxt_reserve_rings()") it wasn't causing major issues.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/076a694a42ae3f046…
https://git.kernel.org/stable/c/90336fc3d6f5e716a…
https://git.kernel.org/stable/c/08831a894d18abfaa…
https://git.kernel.org/stable/c/f0aa6a37a3dbb40b2…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < 076a694a42ae3f0466bc6e4126050eeb7b7d299a (git) Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < 90336fc3d6f5e716ac39a9ddbbde453e23a5aa65 (git) Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < 08831a894d18abfaabb5bbde7c2069a7fb41dd93 (git) Affected: 1054aee82321483dceabbb9b9e5d6512e8fe684b , < f0aa6a37a3dbb40b272df5fc6db93c114688adcd (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 6.1.167 , ≤ 6.1.* (semver) Unaffected: 6.6.130 , ≤ 6.6.* (semver) Unaffected: 6.12.11 , ≤ 6.12.* (semver) Unaffected: 6.13 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2025-21682",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:51:50.706963Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:57:11.247Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c",
            "drivers/net/ethernet/broadcom/bnxt/bnxt.h",
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "076a694a42ae3f0466bc6e4126050eeb7b7d299a",
              "status": "affected",
              "version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
              "versionType": "git"
            },
            {
              "lessThan": "90336fc3d6f5e716ac39a9ddbbde453e23a5aa65",
              "status": "affected",
              "version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
              "versionType": "git"
            },
            {
              "lessThan": "08831a894d18abfaabb5bbde7c2069a7fb41dd93",
              "status": "affected",
              "version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
              "versionType": "git"
            },
            {
              "lessThan": "f0aa6a37a3dbb40b272df5fc6db93c114688adcd",
              "status": "affected",
              "version": "1054aee82321483dceabbb9b9e5d6512e8fe684b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/broadcom/bnxt/bnxt.c",
            "drivers/net/ethernet/broadcom/bnxt/bnxt.h",
            "drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.13",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.11",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.13",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\neth: bnxt: always recalculate features after XDP clearing, fix null-deref\n\nRecalculate features when XDP is detached.\n\nBefore:\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n  # ip li set dev eth0 xdp off\n  # ethtool -k eth0 | grep gro\n  rx-gro-hw: off [requested on]\n\nAfter:\n  # ip li set dev eth0 xdp obj xdp_dummy.bpf.o sec xdp\n  # ip li set dev eth0 xdp off\n  # ethtool -k eth0 | grep gro\n  rx-gro-hw: on\n\nThe fact that HW-GRO doesn\u0027t get re-enabled automatically is just\na minor annoyance. The real issue is that the features will randomly\ncome back during another reconfiguration which just happens to invoke\nnetdev_update_features(). The driver doesn\u0027t handle reconfiguring\ntwo things at a time very robustly.\n\nStarting with commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") we only reconfigure the RSS hash table\nif the \"effective\" number of Rx rings has changed. If HW-GRO is\nenabled \"effective\" number of rings is 2x what user sees.\nSo if we are in the bad state, with HW-GRO re-enablement \"pending\"\nafter XDP off, and we lower the rings by / 2 - the HW-GRO rings\ndoing 2x and the ethtool -L doing / 2 may cancel each other out,\nand the:\n\n  if (old_rx_rings != bp-\u003ehw_resc.resv_rx_rings \u0026\u0026\n\ncondition in __bnxt_reserve_rings() will be false.\nThe RSS map won\u0027t get updated, and we\u0027ll crash with:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000168\n  RIP: 0010:__bnxt_hwrm_vnic_set_rss+0x13a/0x1a0\n    bnxt_hwrm_vnic_rss_cfg_p5+0x47/0x180\n    __bnxt_setup_vnic_p5+0x58/0x110\n    bnxt_init_nic+0xb72/0xf50\n    __bnxt_open_nic+0x40d/0xab0\n    bnxt_open_nic+0x2b/0x60\n    ethtool_set_channels+0x18c/0x1d0\n\nAs we try to access a freed ring.\n\nThe issue is present since XDP support was added, really, but\nprior to commit 98ba1d931f61 (\"bnxt_en: Fix RSS logic in\n__bnxt_reserve_rings()\") it wasn\u0027t causing major issues."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:04:24.597Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/076a694a42ae3f0466bc6e4126050eeb7b7d299a"
        },
        {
          "url": "https://git.kernel.org/stable/c/90336fc3d6f5e716ac39a9ddbbde453e23a5aa65"
        },
        {
          "url": "https://git.kernel.org/stable/c/08831a894d18abfaabb5bbde7c2069a7fb41dd93"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0aa6a37a3dbb40b272df5fc6db93c114688adcd"
        }
      ],
      "title": "eth: bnxt: always recalculate features after XDP clearing, fix null-deref",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-21682",
    "datePublished": "2025-01-31T11:25:42.160Z",
    "dateReserved": "2024-12-29T08:45:45.739Z",
    "dateUpdated": "2026-05-11T21:04:24.597Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0547

Solutions

CVE-2023-53228 (GCVE-0-2023-53228)

CVE-2023-53510 (GCVE-0-2023-53510)

CVE-2023-53545 (GCVE-0-2023-53545)

CVE-2024-47736 (GCVE-0-2024-47736)

CVE-2024-47809 (GCVE-0-2024-47809)

CVE-2024-49998 (GCVE-0-2024-49998)

CVE-2024-50298 (GCVE-0-2024-50298)

CVE-2024-56719 (GCVE-0-2024-56719)

CVE-2025-21676 (GCVE-0-2025-21676)

CVE-2025-21682 (GCVE-0-2025-21682)

Tags

Sightings

Nomenclature