wireguard: netlink: check for dangling peer via is_dead instead of empty list

wireguard: netlink: access device through ctx instead of peer

USB: core: Fix deadlock in usb_deauthorize_interface()

RDMA/mlx5: Fix fortify source warning while accessing Eth segment

aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts

wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces

bpf: Fix DEVMAP_HASH overflow check on 32-bit arches

bpf: Fix hashtab overflow check on 32-bit arches

bpf: Fix stackmap overflow check on 32-bit arches

net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()

net/ipv6: avoid possible UAF in ip6_route_mpath_notify()

vfio/pci: Lock external INTx masking ops

PM / devfreq: Fix buffer overflow in trans_stat_show

NFSD: Fix READDIR buffer overflow

Integer overflow in raid5_cache_count in Linux kernel

It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handle had the value 0

Use-after-free in Linux kernel's netfilter: nf_tables component

Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

The Linux kernel before 6.5.4 has an es1 use-after-free in fs/ext4/extents_status.c, related to ext4_es_insert_extent

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

Use-after-free in Linux kernel's net/sched: sch_qfq component

Use-after-free in Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component

Use-after-free in Linux kernel's netfilter: nf_tables component

Use-after-free in Linux kernel's netfilter: nf_tables component

Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()

Out-of-bounds write in Linux kernel's net/sched: sch_qfq component

Use-after-free in Linux kernel's netfilter: nf_tables component

Use-after-free in Linux kernel's net/sched: cls_u32 component

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability

Use after free in io_uring in the Linux Kernel

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel…

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX

A use-after-free flaw was found in Linux kernel before 5.19.2

An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks

In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition

An issue was discovered in the Linux kernel before 6.0.11

In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking

Linux Kernel IPsec devlink.c devlink_param_get use after free

Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

Linux Kernel Bluetooth l1oip_core.c del_timer use after free

Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject…

In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free

A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function…

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss)

Use-after-free in io_uring ad work_flags in Linux Kernel

An issue was discovered in the Linux kernel through 5.18.9

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect…

A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is…

A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input…

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend