Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability

Use after free in io_uring in the Linux Kernel

In the Linux kernel through 6.3.1, a use-after-free in Netfilter nf_tables when processing batch requests can be abused to perform arbitrary read and write operations on kernel…

qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX

A use-after-free flaw was found in Linux kernel before 5.19.2

An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks

In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition

An issue was discovered in the Linux kernel before 6.0.11

In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking

Linux Kernel IPsec devlink.c devlink_param_get use after free

Linux Kernel IPsec nfp_cppcore.c area_cache_get use after free

Linux Kernel Bluetooth l1oip_core.c del_timer use after free

Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject…

In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free

A flaw use after free in the Linux kernel NILFS file system was found in the way user triggers function security_inode_alloc to fail with following call to function…

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss)

Use-after-free in io_uring ad work_flags in Linux Kernel

An issue was discovered in the Linux kernel through 5.18.9

net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect…

A use-after-free flaw was found in the Linux kernel’s pipes functionality in how a user performs manipulations with the pipe post_one_notification() after free_pipe_info() that is…

A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input…

json-c through 0.14 has an integer overflow and out-of-bounds write via a large JSON file, as demonstrated by printbuf_memappend

smb: client: require a full NFS mode SID before reading mode bits

udp: clear skb->dev before running a sockmap verdict

mptcp: allow subflow rcv wnd to shrink

fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling

sctp: stream: fully roll back denied add-stream state

flow_dissector: do not dissect PPPoE PFC frames

nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free

ipmi: Add limits to event and receive message requests

isofs: validate block number from NFS file handle in isofs_export_iget

net: stmmac: Prevent NULL deref when RX memory exhausted

net: strparser: fix skb_head leak in strp_abort_strp()

ipv4: icmp: fix null-ptr-deref in icmp_build_probe()

smb: server: fix active_num_conn leak on transport allocation failure

rxrpc: only handle RESPONSE during service challenge

ksmbd: validate EaNameLength in smb2_get_ea()

Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo

Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo

NULL Pointer Dereference When Processing a Delta CRL

NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function

Missing ASN1_TYPE validation in TS_RESP_verify_response() function

netfilter: nft_ct: add seqadj extension for natted connections

Out-of-bounds read & write in RFC 3211 KEK Unwrap

net: ethernet: lantiq_etop: fix memory disclosure

Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to…

M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5

Gnutls: rejects certificate chain with distributed trust

Gnutls: incomplete fix for cve-2023-5981