Vulnerability-Lookup

CERTFR-2026-AVI-0167

Vulnerability from certfr_avis - Published: 2026-02-13 - Updated: 2026-02-13

De multiples vulnérabilités ont été découvertes dans le noyau Linux de Debian LTS. Elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Debian	Debian	Debian LTS bullseye versions antérieures à 5.10.249-1
	Debian	Debian	Debian LTS bullseye versions antérieures à 6.1.162-1~deb11u1

References

Title

Publication Time

Tags

Bulletin de sécurité Debian LTS DLA-4476-1	2026-02-10	vendor-advisory
Bulletin de sécurité Debian LTS DLA-4475-1	2026-02-10	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Debian LTS bullseye versions ant\u00e9rieures \u00e0 5.10.249-1",
      "product": {
        "name": "Debian",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    },
    {
      "description": "Debian LTS bullseye versions ant\u00e9rieures \u00e0 6.1.162-1~deb11u1",
      "product": {
        "name": "Debian",
        "vendor": {
          "name": "Debian",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-36903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36903"
    },
    {
      "name": "CVE-2025-71075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71075"
    },
    {
      "name": "CVE-2025-71086",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71086"
    },
    {
      "name": "CVE-2025-22083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22083"
    },
    {
      "name": "CVE-2025-22107",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22107"
    },
    {
      "name": "CVE-2026-23098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23098"
    },
    {
      "name": "CVE-2025-71094",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71094"
    },
    {
      "name": "CVE-2025-68788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68788"
    },
    {
      "name": "CVE-2025-68778",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68778"
    },
    {
      "name": "CVE-2026-23054",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23054"
    },
    {
      "name": "CVE-2025-71064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71064"
    },
    {
      "name": "CVE-2025-68725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68725"
    },
    {
      "name": "CVE-2025-68795",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68795"
    },
    {
      "name": "CVE-2025-68349",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68349"
    },
    {
      "name": "CVE-2025-38104",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38104"
    },
    {
      "name": "CVE-2025-68380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68380"
    },
    {
      "name": "CVE-2025-39702",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39702"
    },
    {
      "name": "CVE-2026-23069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23069"
    },
    {
      "name": "CVE-2023-53421",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-53421"
    },
    {
      "name": "CVE-2026-22992",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22992"
    },
    {
      "name": "CVE-2022-49465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49465"
    },
    {
      "name": "CVE-2025-71071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71071"
    },
    {
      "name": "CVE-2025-71191",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71191"
    },
    {
      "name": "CVE-2025-68728",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68728"
    },
    {
      "name": "CVE-2025-68364",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68364"
    },
    {
      "name": "CVE-2025-71087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71087"
    },
    {
      "name": "CVE-2025-40039",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40039"
    },
    {
      "name": "CVE-2025-68746",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68746"
    },
    {
      "name": "CVE-2025-68773",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68773"
    },
    {
      "name": "CVE-2025-71133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71133"
    },
    {
      "name": "CVE-2026-23020",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23020"
    },
    {
      "name": "CVE-2025-68796",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68796"
    },
    {
      "name": "CVE-2022-49168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49168"
    },
    {
      "name": "CVE-2025-68804",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68804"
    },
    {
      "name": "CVE-2025-68769",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68769"
    },
    {
      "name": "CVE-2025-71189",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71189"
    },
    {
      "name": "CVE-2025-38408",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38408"
    },
    {
      "name": "CVE-2025-71088",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71088"
    },
    {
      "name": "CVE-2026-23090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23090"
    },
    {
      "name": "CVE-2022-49711",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49711"
    },
    {
      "name": "CVE-2026-23064",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23064"
    },
    {
      "name": "CVE-2025-38591",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38591"
    },
    {
      "name": "CVE-2025-68806",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68806"
    },
    {
      "name": "CVE-2025-71098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71098"
    },
    {
      "name": "CVE-2025-71078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71078"
    },
    {
      "name": "CVE-2025-71083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71083"
    },
    {
      "name": "CVE-2026-23061",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23061"
    },
    {
      "name": "CVE-2025-68813",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68813"
    },
    {
      "name": "CVE-2026-23047",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23047"
    },
    {
      "name": "CVE-2025-22121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22121"
    },
    {
      "name": "CVE-2025-68365",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68365"
    },
    {
      "name": "CVE-2025-71085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71085"
    },
    {
      "name": "CVE-2025-68344",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68344"
    },
    {
      "name": "CVE-2025-71154",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71154"
    },
    {
      "name": "CVE-2025-68257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68257"
    },
    {
      "name": "CVE-2025-71084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71084"
    },
    {
      "name": "CVE-2026-23049",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23049"
    },
    {
      "name": "CVE-2022-49743",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-49743"
    },
    {
      "name": "CVE-2025-68347",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68347"
    },
    {
      "name": "CVE-2025-68814",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68814"
    },
    {
      "name": "CVE-2025-68780",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68780"
    },
    {
      "name": "CVE-2025-71081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71081"
    },
    {
      "name": "CVE-2026-23101",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23101"
    },
    {
      "name": "CVE-2026-23099",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23099"
    },
    {
      "name": "CVE-2025-71121",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71121"
    },
    {
      "name": "CVE-2025-38022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38022"
    },
    {
      "name": "CVE-2026-23085",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23085"
    },
    {
      "name": "CVE-2025-71136",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71136"
    },
    {
      "name": "CVE-2025-68354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68354"
    },
    {
      "name": "CVE-2025-68801",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68801"
    },
    {
      "name": "CVE-2025-22090",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22090"
    },
    {
      "name": "CVE-2025-68258",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68258"
    },
    {
      "name": "CVE-2025-39871",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39871"
    },
    {
      "name": "CVE-2025-37926",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-37926"
    },
    {
      "name": "CVE-2025-68291",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68291"
    },
    {
      "name": "CVE-2026-22991",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22991"
    },
    {
      "name": "CVE-2025-21946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-21946"
    },
    {
      "name": "CVE-2025-68255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68255"
    },
    {
      "name": "CVE-2026-22980",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22980"
    },
    {
      "name": "CVE-2025-71093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71093"
    },
    {
      "name": "CVE-2025-71102",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71102"
    },
    {
      "name": "CVE-2025-68759",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68759"
    },
    {
      "name": "CVE-2026-23019",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23019"
    },
    {
      "name": "CVE-2025-68733",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68733"
    },
    {
      "name": "CVE-2026-23005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23005"
    },
    {
      "name": "CVE-2025-68335",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68335"
    },
    {
      "name": "CVE-2025-71079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71079"
    },
    {
      "name": "CVE-2026-23030",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23030"
    },
    {
      "name": "CVE-2026-22997",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22997"
    },
    {
      "name": "CVE-2025-71196",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71196"
    },
    {
      "name": "CVE-2025-68772",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68772"
    },
    {
      "name": "CVE-2026-23078",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23078"
    },
    {
      "name": "CVE-2025-68785",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68785"
    },
    {
      "name": "CVE-2025-71130",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71130"
    },
    {
      "name": "CVE-2025-68808",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68808"
    },
    {
      "name": "CVE-2025-68223",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68223"
    },
    {
      "name": "CVE-2025-68783",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68783"
    },
    {
      "name": "CVE-2025-71147",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71147"
    },
    {
      "name": "CVE-2025-68724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68724"
    },
    {
      "name": "CVE-2026-23103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23103"
    },
    {
      "name": "CVE-2026-23074",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23074"
    },
    {
      "name": "CVE-2025-71126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71126"
    },
    {
      "name": "CVE-2025-68786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68786"
    },
    {
      "name": "CVE-2025-71199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71199"
    },
    {
      "name": "CVE-2024-42079",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-42079"
    },
    {
      "name": "CVE-2025-68797",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68797"
    },
    {
      "name": "CVE-2024-49968",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-49968"
    },
    {
      "name": "CVE-2025-68259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68259"
    },
    {
      "name": "CVE-2025-71125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71125"
    },
    {
      "name": "CVE-2026-23006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23006"
    },
    {
      "name": "CVE-2025-71108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71108"
    },
    {
      "name": "CVE-2025-71069",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71069"
    },
    {
      "name": "CVE-2026-22994",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22994"
    },
    {
      "name": "CVE-2026-23083",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23083"
    },
    {
      "name": "CVE-2025-68774",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68774"
    },
    {
      "name": "CVE-2026-23108",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23108"
    },
    {
      "name": "CVE-2025-38119",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38119"
    },
    {
      "name": "CVE-2025-71180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71180"
    },
    {
      "name": "CVE-2025-38232",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38232"
    },
    {
      "name": "CVE-2025-71194",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71194"
    },
    {
      "name": "CVE-2025-37830",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-37830"
    },
    {
      "name": "CVE-2026-22999",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22999"
    },
    {
      "name": "CVE-2025-71082",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71082"
    },
    {
      "name": "CVE-2026-23068",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23068"
    },
    {
      "name": "CVE-2025-68765",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68765"
    },
    {
      "name": "CVE-2026-23089",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23089"
    },
    {
      "name": "CVE-2025-71132",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71132"
    },
    {
      "name": "CVE-2026-23071",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23071"
    },
    {
      "name": "CVE-2026-23056",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23056"
    },
    {
      "name": "CVE-2025-71077",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71077"
    },
    {
      "name": "CVE-2024-36927",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-36927"
    },
    {
      "name": "CVE-2023-54321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54321"
    },
    {
      "name": "CVE-2025-22111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22111"
    },
    {
      "name": "CVE-2026-23063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23063"
    },
    {
      "name": "CVE-2026-23073",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23073"
    },
    {
      "name": "CVE-2025-71114",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71114"
    },
    {
      "name": "CVE-2026-23058",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23058"
    },
    {
      "name": "CVE-2025-71182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71182"
    },
    {
      "name": "CVE-2026-23038",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23038"
    },
    {
      "name": "CVE-2026-22990",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22990"
    },
    {
      "name": "CVE-2025-71186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71186"
    },
    {
      "name": "CVE-2025-68821",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68821"
    },
    {
      "name": "CVE-2026-23026",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23026"
    },
    {
      "name": "CVE-2025-68325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68325"
    },
    {
      "name": "CVE-2025-71190",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71190"
    },
    {
      "name": "CVE-2026-23107",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23107"
    },
    {
      "name": "CVE-2025-68332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68332"
    },
    {
      "name": "CVE-2025-71104",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71104"
    },
    {
      "name": "CVE-2026-22978",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22978"
    },
    {
      "name": "CVE-2025-38129",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38129"
    },
    {
      "name": "CVE-2026-23037",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23037"
    },
    {
      "name": "CVE-2026-23001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23001"
    },
    {
      "name": "CVE-2025-68367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68367"
    },
    {
      "name": "CVE-2025-68820",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68820"
    },
    {
      "name": "CVE-2023-54207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54207"
    },
    {
      "name": "CVE-2025-68740",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68740"
    },
    {
      "name": "CVE-2025-68742",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68742"
    },
    {
      "name": "CVE-2026-23025",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23025"
    },
    {
      "name": "CVE-2024-46786",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-46786"
    },
    {
      "name": "CVE-2025-68816",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68816"
    },
    {
      "name": "CVE-2025-68256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68256"
    },
    {
      "name": "CVE-2025-68777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68777"
    },
    {
      "name": "CVE-2025-68254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68254"
    },
    {
      "name": "CVE-2025-38556",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38556"
    },
    {
      "name": "CVE-2026-22982",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22982"
    },
    {
      "name": "CVE-2025-71118",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71118"
    },
    {
      "name": "CVE-2025-71150",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71150"
    },
    {
      "name": "CVE-2025-39721",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-39721"
    },
    {
      "name": "CVE-2026-23091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23091"
    },
    {
      "name": "CVE-2025-38718",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38718"
    },
    {
      "name": "CVE-2025-71192",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71192"
    },
    {
      "name": "CVE-2025-68776",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68776"
    },
    {
      "name": "CVE-2025-71066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71066"
    },
    {
      "name": "CVE-2025-68799",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68799"
    },
    {
      "name": "CVE-2025-68345",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68345"
    },
    {
      "name": "CVE-2025-71097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71097"
    },
    {
      "name": "CVE-2025-71111",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71111"
    },
    {
      "name": "CVE-2026-23087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23087"
    },
    {
      "name": "CVE-2025-71185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71185"
    },
    {
      "name": "CVE-2026-23096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23096"
    },
    {
      "name": "CVE-2025-68337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68337"
    },
    {
      "name": "CVE-2025-71131",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71131"
    },
    {
      "name": "CVE-2025-40149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40149"
    },
    {
      "name": "CVE-2025-40164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40164"
    },
    {
      "name": "CVE-2025-71116",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71116"
    },
    {
      "name": "CVE-2023-52658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52658"
    },
    {
      "name": "CVE-2025-68362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68362"
    },
    {
      "name": "CVE-2025-71162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71162"
    },
    {
      "name": "CVE-2026-23075",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23075"
    },
    {
      "name": "CVE-2025-68803",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68803"
    },
    {
      "name": "CVE-2026-23105",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23105"
    },
    {
      "name": "CVE-2026-22976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22976"
    },
    {
      "name": "CVE-2025-68753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68753"
    },
    {
      "name": "CVE-2025-68781",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68781"
    },
    {
      "name": "CVE-2025-68369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68369"
    },
    {
      "name": "CVE-2025-71112",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71112"
    },
    {
      "name": "CVE-2023-54285",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-54285"
    },
    {
      "name": "CVE-2026-23086",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23086"
    },
    {
      "name": "CVE-2025-22022",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22022"
    },
    {
      "name": "CVE-2025-68818",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68818"
    },
    {
      "name": "CVE-2025-38125",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38125"
    },
    {
      "name": "CVE-2025-68366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68366"
    },
    {
      "name": "CVE-2025-68815",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68815"
    },
    {
      "name": "CVE-2025-40215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40215"
    },
    {
      "name": "CVE-2026-23095",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23095"
    },
    {
      "name": "CVE-2025-68346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68346"
    },
    {
      "name": "CVE-2025-71163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71163"
    },
    {
      "name": "CVE-2025-71096",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71096"
    },
    {
      "name": "CVE-2025-71095",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71095"
    },
    {
      "name": "CVE-2025-71105",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71105"
    },
    {
      "name": "CVE-2025-68266",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68266"
    },
    {
      "name": "CVE-2025-68771",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68771"
    },
    {
      "name": "CVE-2025-68363",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68363"
    },
    {
      "name": "CVE-2026-22984",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22984"
    },
    {
      "name": "CVE-2025-68757",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68757"
    },
    {
      "name": "CVE-2026-23033",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23033"
    },
    {
      "name": "CVE-2026-22977",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22977"
    },
    {
      "name": "CVE-2026-23003",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23003"
    },
    {
      "name": "CVE-2025-68766",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68766"
    },
    {
      "name": "CVE-2026-23076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23076"
    },
    {
      "name": "CVE-2025-71123",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71123"
    },
    {
      "name": "CVE-2025-68372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68372"
    },
    {
      "name": "CVE-2026-23010",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23010"
    },
    {
      "name": "CVE-2025-71137",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71137"
    },
    {
      "name": "CVE-2026-23084",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23084"
    },
    {
      "name": "CVE-2026-22979",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22979"
    },
    {
      "name": "CVE-2026-23011",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23011"
    },
    {
      "name": "CVE-2026-23110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23110"
    },
    {
      "name": "CVE-2025-71120",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71120"
    },
    {
      "name": "CVE-2026-23060",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23060"
    },
    {
      "name": "CVE-2025-68282",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68282"
    },
    {
      "name": "CVE-2025-68817",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68817"
    },
    {
      "name": "CVE-2025-71119",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71119"
    },
    {
      "name": "CVE-2025-68787",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68787"
    },
    {
      "name": "CVE-2025-68782",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68782"
    },
    {
      "name": "CVE-2025-71197",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71197"
    },
    {
      "name": "CVE-2025-68758",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68758"
    },
    {
      "name": "CVE-2026-23031",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23031"
    },
    {
      "name": "CVE-2025-71113",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71113"
    },
    {
      "name": "CVE-2025-71127",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71127"
    },
    {
      "name": "CVE-2026-23102",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23102"
    },
    {
      "name": "CVE-2026-22998",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22998"
    },
    {
      "name": "CVE-2025-68340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68340"
    },
    {
      "name": "CVE-2025-40110",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-40110"
    },
    {
      "name": "CVE-2025-68798",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68798"
    },
    {
      "name": "CVE-2025-68336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68336"
    },
    {
      "name": "CVE-2023-52975",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-52975"
    },
    {
      "name": "CVE-2026-23097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23097"
    },
    {
      "name": "CVE-2025-68819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68819"
    },
    {
      "name": "CVE-2026-23021",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23021"
    },
    {
      "name": "CVE-2025-68732",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68732"
    },
    {
      "name": "CVE-2026-23093",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23093"
    },
    {
      "name": "CVE-2025-71183",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71183"
    },
    {
      "name": "CVE-2025-68371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68371"
    },
    {
      "name": "CVE-2025-68211",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68211"
    },
    {
      "name": "CVE-2025-71091",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71091"
    },
    {
      "name": "CVE-2025-68263",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68263"
    },
    {
      "name": "CVE-2025-68800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68800"
    },
    {
      "name": "CVE-2025-68261",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68261"
    },
    {
      "name": "CVE-2022-48744",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-48744"
    },
    {
      "name": "CVE-2025-71149",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-71149"
    },
    {
      "name": "CVE-2025-68767",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68767"
    },
    {
      "name": "CVE-2025-68727",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68727"
    },
    {
      "name": "CVE-2026-23080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-23080"
    },
    {
      "name": "CVE-2025-38361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-38361"
    },
    {
      "name": "CVE-2025-68264",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68264"
    },
    {
      "name": "CVE-2025-68764",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68764"
    }
  ],
  "initial_release_date": "2026-02-13T00:00:00",
  "last_revision_date": "2026-02-13T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0167",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-02-13T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans le noyau Linux de Debian LTS. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans le noyau Linux de Debian LTS",
  "vendor_advisories": [
    {
      "published_at": "2026-02-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian LTS DLA-4476-1",
      "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00017.html"
    },
    {
      "published_at": "2026-02-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Debian LTS DLA-4475-1",
      "url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00016.html"
    }
  ]
}

CVE-2022-48744 (GCVE-0-2022-48744)

Vulnerability from cvelistv5 – Published: 2024-06-20 11:13 – Updated: 2026-05-11 18:46

Title

net/mlx5e: Avoid field-overflowing memcpy()

Summary

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use flexible arrays instead of zero-element arrays (which look like they are always overflowing) and split the cross-field memcpy() into two halves that can be appropriately bounds-checked by the compiler. We were doing: #define ETH_HLEN 14 #define VLAN_HLEN 4 ... #define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN) ... struct mlx5e_tx_wqe *wqe = mlx5_wq_cyc_get_wqe(wq, pi); ... struct mlx5_wqe_eth_seg *eseg = &wqe->eth; struct mlx5_wqe_data_seg *dseg = wqe->data; ... memcpy(eseg->inline_hdr.start, xdptxd->data, MLX5E_XDP_MIN_INLINE); target is wqe->eth.inline_hdr.start (which the compiler sees as being 2 bytes in size), but copying 18, intending to write across start (really vlan_tci, 2 bytes). The remaining 16 bytes get written into wqe->data[0], covering byte_count (4 bytes), lkey (4 bytes), and addr (8 bytes). struct mlx5e_tx_wqe { struct mlx5_wqe_ctrl_seg ctrl; /* 0 16 */ struct mlx5_wqe_eth_seg eth; /* 16 16 */ struct mlx5_wqe_data_seg data[]; /* 32 0 */ /* size: 32, cachelines: 1, members: 3 */ /* last cacheline: 32 bytes */ }; struct mlx5_wqe_eth_seg { u8 swp_outer_l4_offset; /* 0 1 */ u8 swp_outer_l3_offset; /* 1 1 */ u8 swp_inner_l4_offset; /* 2 1 */ u8 swp_inner_l3_offset; /* 3 1 */ u8 cs_flags; /* 4 1 */ u8 swp_flags; /* 5 1 */ __be16 mss; /* 6 2 */ __be32 flow_table_metadata; /* 8 4 */ union { struct { __be16 sz; /* 12 2 */ u8 start[2]; /* 14 2 */ } inline_hdr; /* 12 4 */ struct { __be16 type; /* 12 2 */ __be16 vlan_tci; /* 14 2 */ } insert; /* 12 4 */ __be32 trailer; /* 12 4 */ }; /* 12 4 */ /* size: 16, cachelines: 1, members: 9 */ /* last cacheline: 16 bytes */ }; struct mlx5_wqe_data_seg { __be32 byte_count; /* 0 4 */ __be32 lkey; /* 4 4 */ __be64 addr; /* 8 8 */ /* size: 16, cachelines: 1, members: 3 */ /* last cacheline: 16 bytes */ }; So, split the memcpy() so the compiler can reason about the buffer sizes. "pahole" shows no size nor member offset changes to struct mlx5e_tx_wqe nor struct mlx5e_umr_wqe. "objdump -d" shows no meaningful object code changes (i.e. only source line number induced differences and optimizations).

Severity ?

No CVSS data available.

Assigner

Linux

References

3 references

URL	Tags
https://git.kernel.org/stable/c/49bcbe531f79fc35b…
https://git.kernel.org/stable/c/8fbdf8c8b8ab82bea…
https://git.kernel.org/stable/c/ad5185735f7dab342…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: b5503b994ed5ed8dbfe821317e7b5b38acb065c5 , < 49bcbe531f79fc35bb10020f7695f9f01e4f0ca8 (git) Affected: b5503b994ed5ed8dbfe821317e7b5b38acb065c5 , < 8fbdf8c8b8ab82beab882175157650452c46493e (git) Affected: b5503b994ed5ed8dbfe821317e7b5b38acb065c5 , < ad5185735f7dab342fdd0dd41044da4c9ccfef67 (git)
Linux	Linux	Affected: 4.9 Unaffected: 0 , < 4.9 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.16.6 , ≤ 5.16.* (semver) Unaffected: 5.17 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:25:00.531Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8fbdf8c8b8ab82beab882175157650452c46493e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/ad5185735f7dab342fdd0dd41044da4c9ccfef67"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48744",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T17:10:38.103398Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:34:48.322Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en.h",
            "drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "49bcbe531f79fc35bb10020f7695f9f01e4f0ca8",
              "status": "affected",
              "version": "b5503b994ed5ed8dbfe821317e7b5b38acb065c5",
              "versionType": "git"
            },
            {
              "lessThan": "8fbdf8c8b8ab82beab882175157650452c46493e",
              "status": "affected",
              "version": "b5503b994ed5ed8dbfe821317e7b5b38acb065c5",
              "versionType": "git"
            },
            {
              "lessThan": "ad5185735f7dab342fdd0dd41044da4c9ccfef67",
              "status": "affected",
              "version": "b5503b994ed5ed8dbfe821317e7b5b38acb065c5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/en.h",
            "drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "lessThan": "4.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.17",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.6",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17",
                  "versionStartIncluding": "4.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/mlx5e: Avoid field-overflowing memcpy()\n\nIn preparation for FORTIFY_SOURCE performing compile-time and run-time\nfield bounds checking for memcpy(), memmove(), and memset(), avoid\nintentionally writing across neighboring fields.\n\nUse flexible arrays instead of zero-element arrays (which look like they\nare always overflowing) and split the cross-field memcpy() into two halves\nthat can be appropriately bounds-checked by the compiler.\n\nWe were doing:\n\n\t#define ETH_HLEN  14\n\t#define VLAN_HLEN  4\n\t...\n\t#define MLX5E_XDP_MIN_INLINE (ETH_HLEN + VLAN_HLEN)\n\t...\n        struct mlx5e_tx_wqe      *wqe  = mlx5_wq_cyc_get_wqe(wq, pi);\n\t...\n        struct mlx5_wqe_eth_seg  *eseg = \u0026wqe-\u003eeth;\n        struct mlx5_wqe_data_seg *dseg = wqe-\u003edata;\n\t...\n\tmemcpy(eseg-\u003einline_hdr.start, xdptxd-\u003edata, MLX5E_XDP_MIN_INLINE);\n\ntarget is wqe-\u003eeth.inline_hdr.start (which the compiler sees as being\n2 bytes in size), but copying 18, intending to write across start\n(really vlan_tci, 2 bytes). The remaining 16 bytes get written into\nwqe-\u003edata[0], covering byte_count (4 bytes), lkey (4 bytes), and addr\n(8 bytes).\n\nstruct mlx5e_tx_wqe {\n        struct mlx5_wqe_ctrl_seg   ctrl;                 /*     0    16 */\n        struct mlx5_wqe_eth_seg    eth;                  /*    16    16 */\n        struct mlx5_wqe_data_seg   data[];               /*    32     0 */\n\n        /* size: 32, cachelines: 1, members: 3 */\n        /* last cacheline: 32 bytes */\n};\n\nstruct mlx5_wqe_eth_seg {\n        u8                         swp_outer_l4_offset;  /*     0     1 */\n        u8                         swp_outer_l3_offset;  /*     1     1 */\n        u8                         swp_inner_l4_offset;  /*     2     1 */\n        u8                         swp_inner_l3_offset;  /*     3     1 */\n        u8                         cs_flags;             /*     4     1 */\n        u8                         swp_flags;            /*     5     1 */\n        __be16                     mss;                  /*     6     2 */\n        __be32                     flow_table_metadata;  /*     8     4 */\n        union {\n                struct {\n                        __be16     sz;                   /*    12     2 */\n                        u8         start[2];             /*    14     2 */\n                } inline_hdr;                            /*    12     4 */\n                struct {\n                        __be16     type;                 /*    12     2 */\n                        __be16     vlan_tci;             /*    14     2 */\n                } insert;                                /*    12     4 */\n                __be32             trailer;              /*    12     4 */\n        };                                               /*    12     4 */\n\n        /* size: 16, cachelines: 1, members: 9 */\n        /* last cacheline: 16 bytes */\n};\n\nstruct mlx5_wqe_data_seg {\n        __be32                     byte_count;           /*     0     4 */\n        __be32                     lkey;                 /*     4     4 */\n        __be64                     addr;                 /*     8     8 */\n\n        /* size: 16, cachelines: 1, members: 3 */\n        /* last cacheline: 16 bytes */\n};\n\nSo, split the memcpy() so the compiler can reason about the buffer\nsizes.\n\n\"pahole\" shows no size nor member offset changes to struct mlx5e_tx_wqe\nnor struct mlx5e_umr_wqe. \"objdump -d\" shows no meaningful object\ncode changes (i.e. only source line number induced differences and\noptimizations)."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:46:05.575Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/49bcbe531f79fc35bb10020f7695f9f01e4f0ca8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8fbdf8c8b8ab82beab882175157650452c46493e"
        },
        {
          "url": "https://git.kernel.org/stable/c/ad5185735f7dab342fdd0dd41044da4c9ccfef67"
        }
      ],
      "title": "net/mlx5e: Avoid field-overflowing memcpy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48744",
    "datePublished": "2024-06-20T11:13:27.979Z",
    "dateReserved": "2024-06-20T11:09:39.055Z",
    "dateUpdated": "2026-05-11T18:46:05.575Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49168 (GCVE-0-2022-49168)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:55 – Updated: 2026-05-11 18:54

Title

btrfs: do not clean up repair bio if submit fails

Summary

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not clean up repair bio if submit fails The submit helper will always run bio_endio() on the bio if it fails to submit, so cleaning up the bio just leads to a variety of use-after-free and NULL pointer dereference bugs because we race with the endio function that is cleaning up the bio. Instead just return BLK_STS_OK as the repair function has to continue to process the rest of the pages, and the endio for the repair bio will do the appropriate cleanup for the page that it was given.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

Linux

References

5 references

URL	Tags
https://git.kernel.org/stable/c/e7e1d15d2bd8c373c…
https://git.kernel.org/stable/c/7170875083254b51f…
https://git.kernel.org/stable/c/e76c78c48902dae6f…
https://git.kernel.org/stable/c/d1cb11fb45ebbb1e7…
https://git.kernel.org/stable/c/8cbc3001a3264d998…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 6c387ab20db15f2bd448f7c508e2638101b16ea1 , < e7e1d15d2bd8c373cf621614ddd17971a2132713 (git) Affected: 6c387ab20db15f2bd448f7c508e2638101b16ea1 , < 7170875083254b51fcc5d67f96640977083f481e (git) Affected: 6c387ab20db15f2bd448f7c508e2638101b16ea1 , < e76c78c48902dae6fa612749f59162bca0a79e0b (git) Affected: 6c387ab20db15f2bd448f7c508e2638101b16ea1 , < d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14 (git) Affected: 6c387ab20db15f2bd448f7c508e2638101b16ea1 , < 8cbc3001a3264d998d6b6db3e23f935c158abd4d (git)
Linux	Linux	Affected: 3.18 Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.184 , ≤ 5.15.* (semver) Unaffected: 5.16.19 , ≤ 5.16.* (semver) Unaffected: 5.17.2 , ≤ 5.17.* (semver) Unaffected: 5.18 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49168",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:17:10.610606Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:34.706Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e7e1d15d2bd8c373cf621614ddd17971a2132713",
              "status": "affected",
              "version": "6c387ab20db15f2bd448f7c508e2638101b16ea1",
              "versionType": "git"
            },
            {
              "lessThan": "7170875083254b51fcc5d67f96640977083f481e",
              "status": "affected",
              "version": "6c387ab20db15f2bd448f7c508e2638101b16ea1",
              "versionType": "git"
            },
            {
              "lessThan": "e76c78c48902dae6fa612749f59162bca0a79e0b",
              "status": "affected",
              "version": "6c387ab20db15f2bd448f7c508e2638101b16ea1",
              "versionType": "git"
            },
            {
              "lessThan": "d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14",
              "status": "affected",
              "version": "6c387ab20db15f2bd448f7c508e2638101b16ea1",
              "versionType": "git"
            },
            {
              "lessThan": "8cbc3001a3264d998d6b6db3e23f935c158abd4d",
              "status": "affected",
              "version": "6c387ab20db15f2bd448f7c508e2638101b16ea1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/extent_io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.184",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.184",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: do not clean up repair bio if submit fails\n\nThe submit helper will always run bio_endio() on the bio if it fails to\nsubmit, so cleaning up the bio just leads to a variety of use-after-free\nand NULL pointer dereference bugs because we race with the endio\nfunction that is cleaning up the bio.  Instead just return BLK_STS_OK as\nthe repair function has to continue to process the rest of the pages,\nand the endio for the repair bio will do the appropriate cleanup for the\npage that it was given."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T18:54:27.200Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e7e1d15d2bd8c373cf621614ddd17971a2132713"
        },
        {
          "url": "https://git.kernel.org/stable/c/7170875083254b51fcc5d67f96640977083f481e"
        },
        {
          "url": "https://git.kernel.org/stable/c/e76c78c48902dae6fa612749f59162bca0a79e0b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d1cb11fb45ebbb1e7dfe5e9038b32ea72c184b14"
        },
        {
          "url": "https://git.kernel.org/stable/c/8cbc3001a3264d998d6b6db3e23f935c158abd4d"
        }
      ],
      "title": "btrfs: do not clean up repair bio if submit fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49168",
    "datePublished": "2025-02-26T01:55:26.532Z",
    "dateReserved": "2025-02-26T01:49:39.278Z",
    "dateUpdated": "2026-05-11T18:54:27.200Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49465 (GCVE-0-2022-49465)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-05-11 19:00

Title

blk-throttle: Set BIO_THROTTLED when bio has been throttled

Summary

In the Linux kernel, the following vulnerability has been resolved: blk-throttle: Set BIO_THROTTLED when bio has been throttled 1.In current process, all bio will set the BIO_THROTTLED flag after __blk_throtl_bio(). 2.If bio needs to be throttled, it will start the timer and stop submit bio directly. Bio will submit in blk_throtl_dispatch_work_fn() when the timer expires.But in the current process, if bio is throttled. The BIO_THROTTLED will be set to bio after timer start. If the bio has been completed, it may cause use-after-free blow. BUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70 Read of size 2 at addr ffff88801b8902d4 by task fio/26380 dump_stack+0x9b/0xce print_address_description.constprop.6+0x3e/0x60 kasan_report.cold.9+0x22/0x3a blk_throtl_bio+0x12f0/0x2c70 submit_bio_checks+0x701/0x1550 submit_bio_noacct+0x83/0xc80 submit_bio+0xa7/0x330 mpage_readahead+0x380/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 26380: kasan_save_stack+0x19/0x40 __kasan_kmalloc.constprop.2+0xc1/0xd0 kmem_cache_alloc+0x146/0x440 mempool_alloc+0x125/0x2f0 bio_alloc_bioset+0x353/0x590 mpage_alloc+0x3b/0x240 do_mpage_readpage+0xddf/0x1ef0 mpage_readahead+0x264/0x500 read_pages+0x1c1/0xbf0 page_cache_ra_unbounded+0x471/0x6f0 do_page_cache_ra+0xda/0x110 ondemand_readahead+0x442/0xae0 page_cache_async_ra+0x210/0x300 generic_file_buffered_read+0x4d9/0x2130 generic_file_read_iter+0x315/0x490 blkdev_read_iter+0x113/0x1b0 aio_read+0x2ad/0x450 io_submit_one+0xc8e/0x1d60 __se_sys_io_submit+0x125/0x350 do_syscall_64+0x2d/0x40 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 0: kasan_save_stack+0x19/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x1b/0x30 __kasan_slab_free+0x111/0x160 kmem_cache_free+0x94/0x460 mempool_free+0xd6/0x320 bio_free+0xe0/0x130 bio_put+0xab/0xe0 bio_endio+0x3a6/0x5d0 blk_update_request+0x590/0x1370 scsi_end_request+0x7d/0x400 scsi_io_completion+0x1aa/0xe50 scsi_softirq_done+0x11b/0x240 blk_mq_complete_request+0xd4/0x120 scsi_mq_done+0xf0/0x200 virtscsi_vq_done+0xbc/0x150 vring_interrupt+0x179/0x390 __handle_irq_event_percpu+0xf7/0x490 handle_irq_event_percpu+0x7b/0x160 handle_irq_event+0xcc/0x170 handle_edge_irq+0x215/0xb20 common_interrupt+0x60/0x120 asm_common_interrupt+0x1e/0x40 Fix this by move BIO_THROTTLED set into the queue_lock.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

Linux

References

5 references

URL	Tags
https://git.kernel.org/stable/c/24ba80efaf6e772f6…
https://git.kernel.org/stable/c/047ea38d41d90d748…
https://git.kernel.org/stable/c/0cfc8a0fb07cde619…
https://git.kernel.org/stable/c/935fa666534d7b718…
https://git.kernel.org/stable/c/5a011f889b4832aa8…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 24ba80efaf6e772f6132465fad08e20fb4767da7 (git) Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 047ea38d41d90d748bca812a43339632f52ba715 (git) Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 0cfc8a0fb07cde61915e4a77c4794c47de3114a4 (git) Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 935fa666534d7b7185e8c6b0191cd06281be4290 (git) Affected: 2a0f61e6ecd08d260054bde4b096ff207ce5350f , < 5a011f889b4832aa80c2a872a5aade5c48d2756f (git)
Linux	Linux	Affected: 3.11 Unaffected: 0 , < 3.11 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.198 , ≤ 5.15.* (semver) Unaffected: 5.17.14 , ≤ 5.17.* (semver) Unaffected: 5.18.3 , ≤ 5.18.* (semver) Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49465",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:16:02.824581Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:32.723Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-throttle.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "24ba80efaf6e772f6132465fad08e20fb4767da7",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            },
            {
              "lessThan": "047ea38d41d90d748bca812a43339632f52ba715",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            },
            {
              "lessThan": "0cfc8a0fb07cde61915e4a77c4794c47de3114a4",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            },
            {
              "lessThan": "935fa666534d7b7185e8c6b0191cd06281be4290",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            },
            {
              "lessThan": "5a011f889b4832aa80c2a872a5aade5c48d2756f",
              "status": "affected",
              "version": "2a0f61e6ecd08d260054bde4b096ff207ce5350f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-throttle.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.198",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-throttle: Set BIO_THROTTLED when bio has been throttled\n\n1.In current process, all bio will set the BIO_THROTTLED flag\nafter __blk_throtl_bio().\n\n2.If bio needs to be throttled, it will start the timer and\nstop submit bio directly. Bio will submit in\nblk_throtl_dispatch_work_fn() when the timer expires.But in\nthe current process, if bio is throttled. The BIO_THROTTLED\nwill be set to bio after timer start. If the bio has been\ncompleted, it may cause use-after-free blow.\n\nBUG: KASAN: use-after-free in blk_throtl_bio+0x12f0/0x2c70\nRead of size 2 at addr ffff88801b8902d4 by task fio/26380\n\n dump_stack+0x9b/0xce\n print_address_description.constprop.6+0x3e/0x60\n kasan_report.cold.9+0x22/0x3a\n blk_throtl_bio+0x12f0/0x2c70\n submit_bio_checks+0x701/0x1550\n submit_bio_noacct+0x83/0xc80\n submit_bio+0xa7/0x330\n mpage_readahead+0x380/0x500\n read_pages+0x1c1/0xbf0\n page_cache_ra_unbounded+0x471/0x6f0\n do_page_cache_ra+0xda/0x110\n ondemand_readahead+0x442/0xae0\n page_cache_async_ra+0x210/0x300\n generic_file_buffered_read+0x4d9/0x2130\n generic_file_read_iter+0x315/0x490\n blkdev_read_iter+0x113/0x1b0\n aio_read+0x2ad/0x450\n io_submit_one+0xc8e/0x1d60\n __se_sys_io_submit+0x125/0x350\n do_syscall_64+0x2d/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nAllocated by task 26380:\n kasan_save_stack+0x19/0x40\n __kasan_kmalloc.constprop.2+0xc1/0xd0\n kmem_cache_alloc+0x146/0x440\n mempool_alloc+0x125/0x2f0\n bio_alloc_bioset+0x353/0x590\n mpage_alloc+0x3b/0x240\n do_mpage_readpage+0xddf/0x1ef0\n mpage_readahead+0x264/0x500\n read_pages+0x1c1/0xbf0\n page_cache_ra_unbounded+0x471/0x6f0\n do_page_cache_ra+0xda/0x110\n ondemand_readahead+0x442/0xae0\n page_cache_async_ra+0x210/0x300\n generic_file_buffered_read+0x4d9/0x2130\n generic_file_read_iter+0x315/0x490\n blkdev_read_iter+0x113/0x1b0\n aio_read+0x2ad/0x450\n io_submit_one+0xc8e/0x1d60\n __se_sys_io_submit+0x125/0x350\n do_syscall_64+0x2d/0x40\n entry_SYSCALL_64_after_hwframe+0x44/0xa9\n\nFreed by task 0:\n kasan_save_stack+0x19/0x40\n kasan_set_track+0x1c/0x30\n kasan_set_free_info+0x1b/0x30\n __kasan_slab_free+0x111/0x160\n kmem_cache_free+0x94/0x460\n mempool_free+0xd6/0x320\n bio_free+0xe0/0x130\n bio_put+0xab/0xe0\n bio_endio+0x3a6/0x5d0\n blk_update_request+0x590/0x1370\n scsi_end_request+0x7d/0x400\n scsi_io_completion+0x1aa/0xe50\n scsi_softirq_done+0x11b/0x240\n blk_mq_complete_request+0xd4/0x120\n scsi_mq_done+0xf0/0x200\n virtscsi_vq_done+0xbc/0x150\n vring_interrupt+0x179/0x390\n __handle_irq_event_percpu+0xf7/0x490\n handle_irq_event_percpu+0x7b/0x160\n handle_irq_event+0xcc/0x170\n handle_edge_irq+0x215/0xb20\n common_interrupt+0x60/0x120\n asm_common_interrupt+0x1e/0x40\n\nFix this by move BIO_THROTTLED set into the queue_lock."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:00:24.588Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/24ba80efaf6e772f6132465fad08e20fb4767da7"
        },
        {
          "url": "https://git.kernel.org/stable/c/047ea38d41d90d748bca812a43339632f52ba715"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cfc8a0fb07cde61915e4a77c4794c47de3114a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/935fa666534d7b7185e8c6b0191cd06281be4290"
        },
        {
          "url": "https://git.kernel.org/stable/c/5a011f889b4832aa80c2a872a5aade5c48d2756f"
        }
      ],
      "title": "blk-throttle: Set BIO_THROTTLED when bio has been throttled",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49465",
    "datePublished": "2025-02-26T02:13:10.975Z",
    "dateReserved": "2025-02-26T02:08:31.577Z",
    "dateUpdated": "2026-05-11T19:00:24.588Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49711 (GCVE-0-2022-49711)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:24 – Updated: 2026-05-11 19:05

Title

bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()

Summary

In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove() In fsl_mc_bus_remove(), mc->root_mc_bus_dev->mc_io is passed to fsl_destroy_mc_io(). However, mc->root_mc_bus_dev is already freed in fsl_mc_device_remove(). Then reference to mc->root_mc_bus_dev->mc_io triggers KASAN use-after-free. To avoid the use-after-free, keep the reference to mc->root_mc_bus_dev->mc_io in a local variable and pass to fsl_destroy_mc_io(). This patch needs rework to apply to kernels older than v5.15.

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/720ab105df7bf3eee…
https://git.kernel.org/stable/c/ccd1751092341ac12…
https://git.kernel.org/stable/c/161b68b0a728377aa…
https://git.kernel.org/stable/c/928ea98252ad75118…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f93627146f0e371093966ed3d44c065aa077cfb1 , < 720ab105df7bf3eee62d2bddd41526b29d07d045 (git) Affected: f93627146f0e371093966ed3d44c065aa077cfb1 , < ccd1751092341ac120a961835211f9f2e3735963 (git) Affected: f93627146f0e371093966ed3d44c065aa077cfb1 , < 161b68b0a728377aaa10a8e14c70e7734f3c9ff7 (git) Affected: f93627146f0e371093966ed3d44c065aa077cfb1 , < 928ea98252ad75118950941683893cf904541da9 (git)
Linux	Linux	Affected: 4.8 Unaffected: 0 , < 4.8 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.49 , ≤ 5.15.* (semver) Unaffected: 5.18.6 , ≤ 5.18.* (semver) Unaffected: 5.19 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49711",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-27T18:14:53.258258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T18:22:30.635Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/bus/fsl-mc/fsl-mc-bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "720ab105df7bf3eee62d2bddd41526b29d07d045",
              "status": "affected",
              "version": "f93627146f0e371093966ed3d44c065aa077cfb1",
              "versionType": "git"
            },
            {
              "lessThan": "ccd1751092341ac120a961835211f9f2e3735963",
              "status": "affected",
              "version": "f93627146f0e371093966ed3d44c065aa077cfb1",
              "versionType": "git"
            },
            {
              "lessThan": "161b68b0a728377aaa10a8e14c70e7734f3c9ff7",
              "status": "affected",
              "version": "f93627146f0e371093966ed3d44c065aa077cfb1",
              "versionType": "git"
            },
            {
              "lessThan": "928ea98252ad75118950941683893cf904541da9",
              "status": "affected",
              "version": "f93627146f0e371093966ed3d44c065aa077cfb1",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/bus/fsl-mc/fsl-mc-bus.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.49",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.49",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.6",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()\n\nIn fsl_mc_bus_remove(), mc-\u003eroot_mc_bus_dev-\u003emc_io is passed to\nfsl_destroy_mc_io(). However, mc-\u003eroot_mc_bus_dev is already freed in\nfsl_mc_device_remove(). Then reference to mc-\u003eroot_mc_bus_dev-\u003emc_io\ntriggers KASAN use-after-free. To avoid the use-after-free, keep the\nreference to mc-\u003eroot_mc_bus_dev-\u003emc_io in a local variable and pass to\nfsl_destroy_mc_io().\n\nThis patch needs rework to apply to kernels older than v5.15."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:05:19.155Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/720ab105df7bf3eee62d2bddd41526b29d07d045"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccd1751092341ac120a961835211f9f2e3735963"
        },
        {
          "url": "https://git.kernel.org/stable/c/161b68b0a728377aaa10a8e14c70e7734f3c9ff7"
        },
        {
          "url": "https://git.kernel.org/stable/c/928ea98252ad75118950941683893cf904541da9"
        }
      ],
      "title": "bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49711",
    "datePublished": "2025-02-26T02:24:28.224Z",
    "dateReserved": "2025-02-26T02:21:30.444Z",
    "dateUpdated": "2026-05-11T19:05:19.155Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2022-49743 (GCVE-0-2022-49743)

Vulnerability from cvelistv5 – Published: 2025-03-27 16:42 – Updated: 2026-05-11 19:05

Title

ovl: Use "buf" flexible array for memcpy() destination

Summary

In the Linux kernel, the following vulnerability has been resolved: ovl: Use "buf" flexible array for memcpy() destination The "buf" flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE hardening: memcpy: detected field-spanning write (size 93) of single field "&fh->fb" at fs/overlayfs/export.c:799 (size 21)

Severity ?

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/012cdef22000f3104…
https://git.kernel.org/stable/c/a77141a06367825d6…
https://git.kernel.org/stable/c/07a96977b2f462337…
https://git.kernel.org/stable/c/cf8aa9bf97cadf857…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 , < 012cdef22000f3104e4fa8224ad29fde509b8caf (git) Affected: cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 , < a77141a06367825d639ac51b04703d551163e36c (git) Affected: cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 , < 07a96977b2f462337a9121302de64277b8747ab1 (git) Affected: cbe7fba8edfc8cb8e621599e376f8ac5c224fa72 , < cf8aa9bf97cadf85745506c6a3e244b22c268d63 (git)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.93 , ≤ 5.15.* (semver) Unaffected: 6.1.11 , ≤ 6.1.* (semver) Unaffected: 6.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/overlayfs/export.c",
            "fs/overlayfs/overlayfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "012cdef22000f3104e4fa8224ad29fde509b8caf",
              "status": "affected",
              "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72",
              "versionType": "git"
            },
            {
              "lessThan": "a77141a06367825d639ac51b04703d551163e36c",
              "status": "affected",
              "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72",
              "versionType": "git"
            },
            {
              "lessThan": "07a96977b2f462337a9121302de64277b8747ab1",
              "status": "affected",
              "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72",
              "versionType": "git"
            },
            {
              "lessThan": "cf8aa9bf97cadf85745506c6a3e244b22c268d63",
              "status": "affected",
              "version": "cbe7fba8edfc8cb8e621599e376f8ac5c224fa72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/overlayfs/export.c",
            "fs/overlayfs/overlayfs.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.93",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.11",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\novl: Use \"buf\" flexible array for memcpy() destination\n\nThe \"buf\" flexible array needs to be the memcpy() destination to avoid\nfalse positive run-time warning from the recent FORTIFY_SOURCE\nhardening:\n\n  memcpy: detected field-spanning write (size 93) of single field \"\u0026fh-\u003efb\"\n  at fs/overlayfs/export.c:799 (size 21)"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:05:53.744Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/012cdef22000f3104e4fa8224ad29fde509b8caf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a77141a06367825d639ac51b04703d551163e36c"
        },
        {
          "url": "https://git.kernel.org/stable/c/07a96977b2f462337a9121302de64277b8747ab1"
        },
        {
          "url": "https://git.kernel.org/stable/c/cf8aa9bf97cadf85745506c6a3e244b22c268d63"
        }
      ],
      "title": "ovl: Use \"buf\" flexible array for memcpy() destination",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49743",
    "datePublished": "2025-03-27T16:42:54.289Z",
    "dateReserved": "2025-03-27T16:39:17.987Z",
    "dateUpdated": "2026-05-11T19:05:53.744Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52658 (GCVE-0-2023-52658)

Vulnerability from cvelistv5 – Published: 2024-05-17 12:01 – Updated: 2026-05-11 19:31

Title

Revert "net/mlx5: Block entering switchdev mode with ns inconsistency"

Summary

In the Linux kernel, the following vulnerability has been resolved: Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" This reverts commit 662404b24a4c4d839839ed25e3097571f5938b9b. The revert is required due to the suspicion it is not good for anything and cause crash.

Severity ?

No CVSS data available.

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/136ccb2041a5d1a47…
https://git.kernel.org/stable/c/3fba8eab2cfc7334e…
https://git.kernel.org/stable/c/1bcdd66d33edb4469…
https://git.kernel.org/stable/c/8deeefb24786ea795…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 93260bd809e0ce44fda463ebc590376e24d8cc11 , < 136ccb2041a5d1a475f845d3bc138550be6f5daa (git) Affected: 662404b24a4c4d839839ed25e3097571f5938b9b , < 3fba8eab2cfc7334e0f132d29dfd2552f2f2a579 (git) Affected: 662404b24a4c4d839839ed25e3097571f5938b9b , < 1bcdd66d33edb446903132456c948f0b764ef2f9 (git) Affected: 662404b24a4c4d839839ed25e3097571f5938b9b , < 8deeefb24786ea7950b37bde4516b286c877db00 (git) Affected: 882b988a3897062abed5f935de527797913f5876 (git)
Linux	Linux	Affected: 6.3 Unaffected: 0 , < 6.3 (semver) Unaffected: 6.1.162 , ≤ 6.1.* (semver) Unaffected: 6.6.22 , ≤ 6.6.* (semver) Unaffected: 6.7.10 , ≤ 6.7.* (semver) Unaffected: 6.8 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-52658",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-17T17:16:57.755821Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:23:24.188Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:03:21.340Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3fba8eab2cfc7334e0f132d29dfd2552f2f2a579"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/1bcdd66d33edb446903132456c948f0b764ef2f9"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/8deeefb24786ea7950b37bde4516b286c877db00"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "136ccb2041a5d1a475f845d3bc138550be6f5daa",
              "status": "affected",
              "version": "93260bd809e0ce44fda463ebc590376e24d8cc11",
              "versionType": "git"
            },
            {
              "lessThan": "3fba8eab2cfc7334e0f132d29dfd2552f2f2a579",
              "status": "affected",
              "version": "662404b24a4c4d839839ed25e3097571f5938b9b",
              "versionType": "git"
            },
            {
              "lessThan": "1bcdd66d33edb446903132456c948f0b764ef2f9",
              "status": "affected",
              "version": "662404b24a4c4d839839ed25e3097571f5938b9b",
              "versionType": "git"
            },
            {
              "lessThan": "8deeefb24786ea7950b37bde4516b286c877db00",
              "status": "affected",
              "version": "662404b24a4c4d839839ed25e3097571f5938b9b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "882b988a3897062abed5f935de527797913f5876",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.22",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.7.*",
              "status": "unaffected",
              "version": "6.7.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.8",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "6.1.22",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.22",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.7.10",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.8",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"net/mlx5: Block entering switchdev mode with ns inconsistency\"\n\nThis reverts commit 662404b24a4c4d839839ed25e3097571f5938b9b.\nThe revert is required due to the suspicion it is not good for anything\nand cause crash."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:31:12.599Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/136ccb2041a5d1a475f845d3bc138550be6f5daa"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fba8eab2cfc7334e0f132d29dfd2552f2f2a579"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bcdd66d33edb446903132456c948f0b764ef2f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8deeefb24786ea7950b37bde4516b286c877db00"
        }
      ],
      "title": "Revert \"net/mlx5: Block entering switchdev mode with ns inconsistency\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52658",
    "datePublished": "2024-05-17T12:01:24.220Z",
    "dateReserved": "2024-03-06T09:52:12.099Z",
    "dateUpdated": "2026-05-11T19:31:12.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-52975 (GCVE-0-2023-52975)

Vulnerability from cvelistv5 – Published: 2025-03-27 16:43 – Updated: 2026-05-11 19:36

Title

scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress

Summary

In the Linux kernel, the following vulnerability has been resolved: scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress Bug report and analysis from Ding Hui. During iSCSI session logout, if another task accesses the shost ipaddress attr, we can get a KASAN UAF report like this: [ 276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0 [ 276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088 [ 276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G E 6.1.0-rc8+ #3 [ 276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020 [ 276.944470] Call Trace: [ 276.944943] <TASK> [ 276.945397] dump_stack_lvl+0x34/0x48 [ 276.945887] print_address_description.constprop.0+0x86/0x1e7 [ 276.946421] print_report+0x36/0x4f [ 276.947358] kasan_report+0xad/0x130 [ 276.948234] kasan_check_range+0x35/0x1c0 [ 276.948674] _raw_spin_lock_bh+0x78/0xe0 [ 276.949989] iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp] [ 276.951765] show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi] [ 276.952185] dev_attr_show+0x3f/0x80 [ 276.953005] sysfs_kf_seq_show+0x1fb/0x3e0 [ 276.953401] seq_read_iter+0x402/0x1020 [ 276.954260] vfs_read+0x532/0x7b0 [ 276.955113] ksys_read+0xed/0x1c0 [ 276.955952] do_syscall_64+0x38/0x90 [ 276.956347] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.956769] RIP: 0033:0x7f5d3a679222 [ 276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 <48> 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24 [ 276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222 [ 276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003 [ 276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000 [ 276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000 [ 276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58 [ 276.960536] </TASK> [ 276.961357] Allocated by task 2209: [ 276.961756] kasan_save_stack+0x1e/0x40 [ 276.962170] kasan_set_track+0x21/0x30 [ 276.962557] __kasan_kmalloc+0x7e/0x90 [ 276.962923] __kmalloc+0x5b/0x140 [ 276.963308] iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi] [ 276.963712] iscsi_session_setup+0xda/0xba0 [libiscsi] [ 276.964078] iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp] [ 276.964431] iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi] [ 276.964793] iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi] [ 276.965153] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.965546] netlink_unicast+0x4d5/0x7b0 [ 276.965905] netlink_sendmsg+0x78d/0xc30 [ 276.966236] sock_sendmsg+0xe5/0x120 [ 276.966576] ____sys_sendmsg+0x5fe/0x860 [ 276.966923] ___sys_sendmsg+0xe0/0x170 [ 276.967300] __sys_sendmsg+0xc8/0x170 [ 276.967666] do_syscall_64+0x38/0x90 [ 276.968028] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 276.968773] Freed by task 2209: [ 276.969111] kasan_save_stack+0x1e/0x40 [ 276.969449] kasan_set_track+0x21/0x30 [ 276.969789] kasan_save_free_info+0x2a/0x50 [ 276.970146] __kasan_slab_free+0x106/0x190 [ 276.970470] __kmem_cache_free+0x133/0x270 [ 276.970816] device_release+0x98/0x210 [ 276.971145] kobject_cleanup+0x101/0x360 [ 276.971462] iscsi_session_teardown+0x3fb/0x530 [libiscsi] [ 276.971775] iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp] [ 276.972143] iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi] [ 276.972485] iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi] [ 276.972808] netlink_unicast+0x4d5/0x7b0 [ 276.973201] netlink_sendmsg+0x78d/0xc30 [ 276.973544] sock_sendmsg+0xe5/0x120 [ 276.973864] ____sys_sendmsg+0x5fe/0x860 [ 276.974248] ___sys_ ---truncated---

Severity ?

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416 - Use After Free

Assigner

Linux

References

4 references

URL	Tags
https://git.kernel.org/stable/c/0af745fddefbd5619…
https://git.kernel.org/stable/c/17b738590b97fb3fc…
https://git.kernel.org/stable/c/8859687f5b242c0b0…
https://git.kernel.org/stable/c/6f1d64b13097e85ab…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 , < 0af745fddefbd56198f4f35eb309215ee5f9e21e (git) Affected: a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 , < 17b738590b97fb3fc287289971d1519ff9b875a1 (git) Affected: a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 , < 8859687f5b242c0b057461df0a9ff51d5500783b (git) Affected: a79af8a64d395bd89de8695a5ea5e1a7f01f02a8 , < 6f1d64b13097e85abda0f91b5638000afc5f9a06 (git)
Linux	Linux	Affected: 2.6.39 Unaffected: 0 , < 2.6.39 (semver) Unaffected: 5.10.248 , ≤ 5.10.* (semver) Unaffected: 5.15.93 , ≤ 5.15.* (semver) Unaffected: 6.1.11 , ≤ 6.1.* (semver) Unaffected: 6.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-52975",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-27T16:59:46.852113Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-416",
                "description": "CWE-416 Use After Free",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-27T17:08:22.400Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/iscsi_tcp.c",
            "drivers/scsi/libiscsi.c",
            "include/scsi/libiscsi.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0af745fddefbd56198f4f35eb309215ee5f9e21e",
              "status": "affected",
              "version": "a79af8a64d395bd89de8695a5ea5e1a7f01f02a8",
              "versionType": "git"
            },
            {
              "lessThan": "17b738590b97fb3fc287289971d1519ff9b875a1",
              "status": "affected",
              "version": "a79af8a64d395bd89de8695a5ea5e1a7f01f02a8",
              "versionType": "git"
            },
            {
              "lessThan": "8859687f5b242c0b057461df0a9ff51d5500783b",
              "status": "affected",
              "version": "a79af8a64d395bd89de8695a5ea5e1a7f01f02a8",
              "versionType": "git"
            },
            {
              "lessThan": "6f1d64b13097e85abda0f91b5638000afc5f9a06",
              "status": "affected",
              "version": "a79af8a64d395bd89de8695a5ea5e1a7f01f02a8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/iscsi_tcp.c",
            "drivers/scsi/libiscsi.c",
            "include/scsi/libiscsi.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.248",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.248",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.93",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.11",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress\n\nBug report and analysis from Ding Hui.\n\nDuring iSCSI session logout, if another task accesses the shost ipaddress\nattr, we can get a KASAN UAF report like this:\n\n[  276.942144] BUG: KASAN: use-after-free in _raw_spin_lock_bh+0x78/0xe0\n[  276.942535] Write of size 4 at addr ffff8881053b45b8 by task cat/4088\n[  276.943511] CPU: 2 PID: 4088 Comm: cat Tainted: G            E      6.1.0-rc8+ #3\n[  276.943997] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\n[  276.944470] Call Trace:\n[  276.944943]  \u003cTASK\u003e\n[  276.945397]  dump_stack_lvl+0x34/0x48\n[  276.945887]  print_address_description.constprop.0+0x86/0x1e7\n[  276.946421]  print_report+0x36/0x4f\n[  276.947358]  kasan_report+0xad/0x130\n[  276.948234]  kasan_check_range+0x35/0x1c0\n[  276.948674]  _raw_spin_lock_bh+0x78/0xe0\n[  276.949989]  iscsi_sw_tcp_host_get_param+0xad/0x2e0 [iscsi_tcp]\n[  276.951765]  show_host_param_ISCSI_HOST_PARAM_IPADDRESS+0xe9/0x130 [scsi_transport_iscsi]\n[  276.952185]  dev_attr_show+0x3f/0x80\n[  276.953005]  sysfs_kf_seq_show+0x1fb/0x3e0\n[  276.953401]  seq_read_iter+0x402/0x1020\n[  276.954260]  vfs_read+0x532/0x7b0\n[  276.955113]  ksys_read+0xed/0x1c0\n[  276.955952]  do_syscall_64+0x38/0x90\n[  276.956347]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  276.956769] RIP: 0033:0x7f5d3a679222\n[  276.957161] Code: c0 e9 b2 fe ff ff 50 48 8d 3d 32 c0 0b 00 e8 a5 fe 01 00 0f 1f 44 00 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 56 c3 0f 1f 44 00 00 48 83 ec 28 48 89 54 24\n[  276.958009] RSP: 002b:00007ffc864d16a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\n[  276.958431] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f5d3a679222\n[  276.958857] RDX: 0000000000020000 RSI: 00007f5d3a4fe000 RDI: 0000000000000003\n[  276.959281] RBP: 00007f5d3a4fe000 R08: 00000000ffffffff R09: 0000000000000000\n[  276.959682] R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000020000\n[  276.960126] R13: 0000000000000003 R14: 0000000000000000 R15: 0000557a26dada58\n[  276.960536]  \u003c/TASK\u003e\n[  276.961357] Allocated by task 2209:\n[  276.961756]  kasan_save_stack+0x1e/0x40\n[  276.962170]  kasan_set_track+0x21/0x30\n[  276.962557]  __kasan_kmalloc+0x7e/0x90\n[  276.962923]  __kmalloc+0x5b/0x140\n[  276.963308]  iscsi_alloc_session+0x28/0x840 [scsi_transport_iscsi]\n[  276.963712]  iscsi_session_setup+0xda/0xba0 [libiscsi]\n[  276.964078]  iscsi_sw_tcp_session_create+0x1fd/0x330 [iscsi_tcp]\n[  276.964431]  iscsi_if_create_session.isra.0+0x50/0x260 [scsi_transport_iscsi]\n[  276.964793]  iscsi_if_recv_msg+0xc5a/0x2660 [scsi_transport_iscsi]\n[  276.965153]  iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]\n[  276.965546]  netlink_unicast+0x4d5/0x7b0\n[  276.965905]  netlink_sendmsg+0x78d/0xc30\n[  276.966236]  sock_sendmsg+0xe5/0x120\n[  276.966576]  ____sys_sendmsg+0x5fe/0x860\n[  276.966923]  ___sys_sendmsg+0xe0/0x170\n[  276.967300]  __sys_sendmsg+0xc8/0x170\n[  276.967666]  do_syscall_64+0x38/0x90\n[  276.968028]  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n[  276.968773] Freed by task 2209:\n[  276.969111]  kasan_save_stack+0x1e/0x40\n[  276.969449]  kasan_set_track+0x21/0x30\n[  276.969789]  kasan_save_free_info+0x2a/0x50\n[  276.970146]  __kasan_slab_free+0x106/0x190\n[  276.970470]  __kmem_cache_free+0x133/0x270\n[  276.970816]  device_release+0x98/0x210\n[  276.971145]  kobject_cleanup+0x101/0x360\n[  276.971462]  iscsi_session_teardown+0x3fb/0x530 [libiscsi]\n[  276.971775]  iscsi_sw_tcp_session_destroy+0xd8/0x130 [iscsi_tcp]\n[  276.972143]  iscsi_if_recv_msg+0x1bf1/0x2660 [scsi_transport_iscsi]\n[  276.972485]  iscsi_if_rx+0x198/0x4b0 [scsi_transport_iscsi]\n[  276.972808]  netlink_unicast+0x4d5/0x7b0\n[  276.973201]  netlink_sendmsg+0x78d/0xc30\n[  276.973544]  sock_sendmsg+0xe5/0x120\n[  276.973864]  ____sys_sendmsg+0x5fe/0x860\n[  276.974248]  ___sys_\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:36:14.101Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0af745fddefbd56198f4f35eb309215ee5f9e21e"
        },
        {
          "url": "https://git.kernel.org/stable/c/17b738590b97fb3fc287289971d1519ff9b875a1"
        },
        {
          "url": "https://git.kernel.org/stable/c/8859687f5b242c0b057461df0a9ff51d5500783b"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f1d64b13097e85abda0f91b5638000afc5f9a06"
        }
      ],
      "title": "scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-52975",
    "datePublished": "2025-03-27T16:43:15.322Z",
    "dateReserved": "2025-03-27T16:40:15.737Z",
    "dateUpdated": "2026-05-11T19:36:14.101Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-53421 (GCVE-0-2023-53421)

Vulnerability from cvelistv5 – Published: 2025-09-18 16:04 – Updated: 2026-05-11 19:44

Title

blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()

Summary

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() When blkg_alloc() is called to allocate a blkcg_gq structure with the associated blkg_iostat_set's, there are 2 fields within blkg_iostat_set that requires proper initialization - blkg & sync. The former field was introduced by commit 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") while the later one was introduced by commit f73316482977 ("blk-cgroup: reimplement basic IO stats using cgroup rstat"). Unfortunately those fields in the blkg_iostat_set's are not properly re-initialized when they are cleared in v1's blkcg_reset_stats(). This can lead to a kernel panic due to NULL pointer access of the blkg pointer. The missing initialization of sync is less problematic and can be a problem in a debug kernel due to missing lockdep initialization. Fix these problems by re-initializing them after memory clearing.

Severity ?

5.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

CWE-476 - NULL Pointer Dereference

Assigner

Linux

References

5 references

URL	Tags
https://git.kernel.org/stable/c/0561aa6033dd18159…
https://git.kernel.org/stable/c/892faa76be894d324…
https://git.kernel.org/stable/c/b0d26283af612b9e0…
https://git.kernel.org/stable/c/abbce7f82613ea5ee…
https://git.kernel.org/stable/c/3d2af77e31ade05ff…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: f73316482977ac401ac37245c9df48079d4e11f3 , < 0561aa6033dd181594116d705c41fc16e97161a2 (git) Affected: f73316482977ac401ac37245c9df48079d4e11f3 , < 892faa76be894d324bf48b12a55c7af7be2bad83 (git) Affected: f73316482977ac401ac37245c9df48079d4e11f3 , < b0d26283af612b9e0cc3188b0b88ad7fdea447e8 (git) Affected: f73316482977ac401ac37245c9df48079d4e11f3 , < abbce7f82613ea5eeefd0fc3c1c8e449b9cef2a2 (git) Affected: f73316482977ac401ac37245c9df48079d4e11f3 , < 3d2af77e31ade05ff7ccc3658c3635ec1bea0979 (git)
Linux	Linux	Affected: 5.5 Unaffected: 0 , < 5.5 (semver) Unaffected: 5.15.199 , ≤ 5.15.* (semver) Unaffected: 6.1.162 , ≤ 6.1.* (semver) Unaffected: 6.3.13 , ≤ 6.3.* (semver) Unaffected: 6.4.4 , ≤ 6.4.* (semver) Unaffected: 6.5 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2023-53421",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-14T19:12:11.098390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-14T19:13:10.626Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0561aa6033dd181594116d705c41fc16e97161a2",
              "status": "affected",
              "version": "f73316482977ac401ac37245c9df48079d4e11f3",
              "versionType": "git"
            },
            {
              "lessThan": "892faa76be894d324bf48b12a55c7af7be2bad83",
              "status": "affected",
              "version": "f73316482977ac401ac37245c9df48079d4e11f3",
              "versionType": "git"
            },
            {
              "lessThan": "b0d26283af612b9e0cc3188b0b88ad7fdea447e8",
              "status": "affected",
              "version": "f73316482977ac401ac37245c9df48079d4e11f3",
              "versionType": "git"
            },
            {
              "lessThan": "abbce7f82613ea5eeefd0fc3c1c8e449b9cef2a2",
              "status": "affected",
              "version": "f73316482977ac401ac37245c9df48079d4e11f3",
              "versionType": "git"
            },
            {
              "lessThan": "3d2af77e31ade05ff7ccc3658c3635ec1bea0979",
              "status": "affected",
              "version": "f73316482977ac401ac37245c9df48079d4e11f3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/blk-cgroup.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.5"
            },
            {
              "lessThan": "5.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.3.*",
              "status": "unaffected",
              "version": "6.3.13",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.5",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.3.13",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.4",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5",
                  "versionStartIncluding": "5.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nblk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()\n\nWhen blkg_alloc() is called to allocate a blkcg_gq structure\nwith the associated blkg_iostat_set\u0027s, there are 2 fields within\nblkg_iostat_set that requires proper initialization - blkg \u0026 sync.\nThe former field was introduced by commit 3b8cc6298724 (\"blk-cgroup:\nOptimize blkcg_rstat_flush()\") while the later one was introduced by\ncommit f73316482977 (\"blk-cgroup: reimplement basic IO stats using\ncgroup rstat\").\n\nUnfortunately those fields in the blkg_iostat_set\u0027s are not properly\nre-initialized when they are cleared in v1\u0027s blkcg_reset_stats(). This\ncan lead to a kernel panic due to NULL pointer access of the blkg\npointer. The missing initialization of sync is less problematic and\ncan be a problem in a debug kernel due to missing lockdep initialization.\n\nFix these problems by re-initializing them after memory clearing."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:44:39.128Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0561aa6033dd181594116d705c41fc16e97161a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/892faa76be894d324bf48b12a55c7af7be2bad83"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0d26283af612b9e0cc3188b0b88ad7fdea447e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/abbce7f82613ea5eeefd0fc3c1c8e449b9cef2a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d2af77e31ade05ff7ccc3658c3635ec1bea0979"
        }
      ],
      "title": "blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-53421",
    "datePublished": "2025-09-18T16:04:04.526Z",
    "dateReserved": "2025-09-17T14:54:09.741Z",
    "dateUpdated": "2026-05-11T19:44:39.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-54207 (GCVE-0-2023-54207)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:11 – Updated: 2026-05-11 19:57

Title

HID: uclogic: Correct devm device reference for hidinput input_dev name

Summary

In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Correct devm device reference for hidinput input_dev name Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string.

Severity ?

No CVSS data available.

Assigner

Linux

References

6 references

URL	Tags
https://git.kernel.org/stable/c/f78bb490b16ecb506…
https://git.kernel.org/stable/c/51f49e3927ad545ce…
https://git.kernel.org/stable/c/f283805d984343b2f…
https://git.kernel.org/stable/c/4c2707dfee5847dc0…
https://git.kernel.org/stable/c/58f0d1c0e494a88f3…
https://git.kernel.org/stable/c/dd613a4e45f8d35f4…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: cce2dbdf258e6b27b2b100f511531edabb77f427 , < f78bb490b16ecb506d4904be4b00bf9aad6588f9 (git) Affected: cce2dbdf258e6b27b2b100f511531edabb77f427 , < 51f49e3927ad545cec0c0afb86856ccacd9f085d (git) Affected: cce2dbdf258e6b27b2b100f511531edabb77f427 , < f283805d984343b2f216e2f4c6c7af265b9542ae (git) Affected: cce2dbdf258e6b27b2b100f511531edabb77f427 , < 4c2707dfee5847dc0b5ecfbe512c29c93832fdc4 (git) Affected: cce2dbdf258e6b27b2b100f511531edabb77f427 , < 58f0d1c0e494a88f301bf455da7df4366f179bbb (git) Affected: cce2dbdf258e6b27b2b100f511531edabb77f427 , < dd613a4e45f8d35f49a63a2064e5308fa5619e29 (git)
Linux	Linux	Affected: 4.1 Unaffected: 0 , < 4.1 (semver) Unaffected: 5.10.249 , ≤ 5.10.* (semver) Unaffected: 5.15.199 , ≤ 5.15.* (semver) Unaffected: 6.1.53 , ≤ 6.1.* (semver) Unaffected: 6.4.16 , ≤ 6.4.* (semver) Unaffected: 6.5.3 , ≤ 6.5.* (semver) Unaffected: 6.6 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-uclogic-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f78bb490b16ecb506d4904be4b00bf9aad6588f9",
              "status": "affected",
              "version": "cce2dbdf258e6b27b2b100f511531edabb77f427",
              "versionType": "git"
            },
            {
              "lessThan": "51f49e3927ad545cec0c0afb86856ccacd9f085d",
              "status": "affected",
              "version": "cce2dbdf258e6b27b2b100f511531edabb77f427",
              "versionType": "git"
            },
            {
              "lessThan": "f283805d984343b2f216e2f4c6c7af265b9542ae",
              "status": "affected",
              "version": "cce2dbdf258e6b27b2b100f511531edabb77f427",
              "versionType": "git"
            },
            {
              "lessThan": "4c2707dfee5847dc0b5ecfbe512c29c93832fdc4",
              "status": "affected",
              "version": "cce2dbdf258e6b27b2b100f511531edabb77f427",
              "versionType": "git"
            },
            {
              "lessThan": "58f0d1c0e494a88f301bf455da7df4366f179bbb",
              "status": "affected",
              "version": "cce2dbdf258e6b27b2b100f511531edabb77f427",
              "versionType": "git"
            },
            {
              "lessThan": "dd613a4e45f8d35f49a63a2064e5308fa5619e29",
              "status": "affected",
              "version": "cce2dbdf258e6b27b2b100f511531edabb77f427",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hid/hid-uclogic-core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.1"
            },
            {
              "lessThan": "4.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.249",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.199",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.4.*",
              "status": "unaffected",
              "version": "6.4.16",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.249",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.199",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.53",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.4.16",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.3",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "4.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nHID: uclogic: Correct devm device reference for hidinput input_dev name\n\nReference the HID device rather than the input device for the devm\nallocation of the input_dev name. Referencing the input_dev would lead to a\nuse-after-free when the input_dev was unregistered and subsequently fires a\nuevent that depends on the name. At the point of firing the uevent, the\nname would be freed by devres management.\n\nUse devm_kasprintf to simplify the logic for allocating memory and\nformatting the input_dev name string."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:57:32.385Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f78bb490b16ecb506d4904be4b00bf9aad6588f9"
        },
        {
          "url": "https://git.kernel.org/stable/c/51f49e3927ad545cec0c0afb86856ccacd9f085d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f283805d984343b2f216e2f4c6c7af265b9542ae"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c2707dfee5847dc0b5ecfbe512c29c93832fdc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/58f0d1c0e494a88f301bf455da7df4366f179bbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd613a4e45f8d35f49a63a2064e5308fa5619e29"
        }
      ],
      "title": "HID: uclogic: Correct devm device reference for hidinput input_dev name",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54207",
    "datePublished": "2025-12-30T12:11:06.643Z",
    "dateReserved": "2025-12-30T12:06:44.500Z",
    "dateUpdated": "2026-05-11T19:57:32.385Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2023-54285 (GCVE-0-2023-54285)

Vulnerability from cvelistv5 – Published: 2025-12-30 12:23 – Updated: 2026-05-11 19:59

Title

iomap: Fix possible overflow condition in iomap_write_delalloc_scan

Summary

In the Linux kernel, the following vulnerability has been resolved: iomap: Fix possible overflow condition in iomap_write_delalloc_scan folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly.

Severity ?

No CVSS data available.

Assigner

Linux

References

3 references

URL	Tags
https://git.kernel.org/stable/c/0c6cf409093f307ee…
https://git.kernel.org/stable/c/5c281b0c5d18c8eeb…
https://git.kernel.org/stable/c/eee2d2e6ea5550118…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 38be53c3fd7f4f4bd5de319a323d72f9f6beb16d , < 0c6cf409093f307ee05114f834516730c0da5b21 (git) Affected: f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 , < 5c281b0c5d18c8eeb1cfd5023f4adb153e6d1240 (git) Affected: f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78 , < eee2d2e6ea5550118170dbd5bb1316ceb38455fb (git)
Linux	Linux	Affected: 6.2 Unaffected: 0 , < 6.2 (semver) Unaffected: 6.1.162 , ≤ 6.1.* (semver) Unaffected: 6.5.5 , ≤ 6.5.* (semver) Unaffected: 6.6 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/iomap/buffered-io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0c6cf409093f307ee05114f834516730c0da5b21",
              "status": "affected",
              "version": "38be53c3fd7f4f4bd5de319a323d72f9f6beb16d",
              "versionType": "git"
            },
            {
              "lessThan": "5c281b0c5d18c8eeb1cfd5023f4adb153e6d1240",
              "status": "affected",
              "version": "f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78",
              "versionType": "git"
            },
            {
              "lessThan": "eee2d2e6ea5550118170dbd5bb1316ceb38455fb",
              "status": "affected",
              "version": "f43dc4dc3eff028b5ddddd99f3a66c5a6bdd4e78",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/iomap/buffered-io.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.162",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.5.*",
              "status": "unaffected",
              "version": "6.5.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.6",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.162",
                  "versionStartIncluding": "6.1.92",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.5.5",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niomap: Fix possible overflow condition in iomap_write_delalloc_scan\n\nfolio_next_index() returns an unsigned long value which left shifted\nby PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead\nuse folio_pos(folio) + folio_size(folio), which does this correctly."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T19:59:00.958Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0c6cf409093f307ee05114f834516730c0da5b21"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c281b0c5d18c8eeb1cfd5023f4adb153e6d1240"
        },
        {
          "url": "https://git.kernel.org/stable/c/eee2d2e6ea5550118170dbd5bb1316ceb38455fb"
        }
      ],
      "title": "iomap: Fix possible overflow condition in iomap_write_delalloc_scan",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2023-54285",
    "datePublished": "2025-12-30T12:23:25.770Z",
    "dateReserved": "2025-12-30T12:06:44.526Z",
    "dateUpdated": "2026-05-11T19:59:00.958Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CERTFR-2026-AVI-0167

Solutions

CVE-2022-48744 (GCVE-0-2022-48744)

CVE-2022-49168 (GCVE-0-2022-49168)

CVE-2022-49465 (GCVE-0-2022-49465)

CVE-2022-49711 (GCVE-0-2022-49711)

CVE-2022-49743 (GCVE-0-2022-49743)

CVE-2023-52658 (GCVE-0-2023-52658)

CVE-2023-52975 (GCVE-0-2023-52975)

CVE-2023-53421 (GCVE-0-2023-53421)

CVE-2023-54207 (GCVE-0-2023-54207)

CVE-2023-54285 (GCVE-0-2023-54285)

Tags

Sightings

Nomenclature