Open Source Vulnerabilities
, Kernel
ext4: don't enable DAX on new encrypted files
, Kernel
xfs: validate attr entry pointer before field access
, Kernel
xfs: restore nofs context unconditionally in xfs_trans_roll
/ Kernel
xfs: restore nofs context unconditionally in xfs_trans_roll
, Kernel
nfc: digital: clamp SENSF_RES length to the destination buffer
/ Kernel
nfc: digital: clamp SENSF_RES length to the destination buffer
, Kernel
nfc: fdp: bound the device-reported read length and fix an skb leak
/ Kernel
nfc: fdp: bound the device-reported read length and fix an skb leak
, Kernel
nfc: microread: validate target discovery payload lengths
/ Kernel
nfc: microread: validate target discovery payload lengths
, Kernel
nfc: llcp: bound the connect_sn TLV walk to the skb
, Kernel
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
/ Kernel
nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers
, Kernel
nfc: llcp: reject PDUs shorter than the LLCP header
, Kernel
nfc: pn533: purge fragmented skbs during cleanup
, Kernel
nfc: nci: add data_len bound checks to activation parameter extractors
/ Kernel
nfc: nci: add data_len bound checks to activation parameter extractors
, Kernel
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
/ Kernel
nfc: nci: fix out-of-bounds write in nci_target_auto_activated()
, Kernel
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
/ Kernel
nfc: nci: fix uninit-value in the RF discover/activated NTF handlers
, Kernel
ipv4: reject undersized MTUs in ip_do_fragment()
, Kernel
ipv6: fix use-after-free in ip6_finish_output2()
, Kernel
nvmet-auth: zero the AUTH_RECEIVE response buffer
, Kernel
nvmet-fc: fix invalid free in LS IOD error path
, Kernel
nvmet-tcp: bound SGL data length before allocating command buffers
/ Kernel
nvmet-tcp: bound SGL data length before allocating command buffers
, Kernel
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
/ Kernel
nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations
, Kernel
nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
/ Kernel
nvmet: pci-epf: fix use-after-free in nvmet_pci_epf_exec_iod_work()
, Kernel
fbdev: Wrap user-invoked calls to fb_set_var() in helper
/ Kernel
fbdev: Wrap user-invoked calls to fb_set_var() in helper
, Kernel
fbdev: serialize mode sysfs access with lock_fb_info()
/ Kernel
fbdev: serialize mode sysfs access with lock_fb_info()
, Kernel
mptcp: pm: fix memory leak from alloc-during-teardown race
/ Kernel
mptcp: pm: fix memory leak from alloc-during-teardown race
, Kernel
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
/ Kernel
HID: magicmouse: prevent unbounded recursion in magicmouse_raw_event()
, Kernel
HID: magicmouse: do not keep a stale msc->input if no input is claimed
/ Kernel
HID: magicmouse: do not keep a stale msc->input if no input is claimed
, Kernel
HID: core: fix OOB read of field->usage in hid_set_field()
/ Kernel
HID: core: fix OOB read of field->usage in hid_set_field()
, Kernel
HID: pidff: fix OOB write when hid->inputs is empty
, Kernel
net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
/ Kernel
net/ionic: avoid OOB TX partner lookup for hwstamp RXQ
, Kernel
futex/pi: Reject cross-mm private futex owners
, Kernel
futex/pi: Plug private futex exec() race
, Kernel
futex: Fix race in futex_pivot_pending() during private hash resize
/ Kernel
futex: Fix race in futex_pivot_pending() during private hash resize
, Kernel
futex: Fix race on the initial mm->futex.phash.ref allocation
/ Kernel
futex: Fix race on the initial mm->futex.phash.ref allocation
, Kernel
HID: asus: fix missing hid_is_usb() check
, Kernel
HID: huawei: fix missing hid_is_usb() check
, Kernel
HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
/ Kernel
HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler()
, Kernel
HID: nintendo: register input device after capabilities are set
/ Kernel
HID: nintendo: register input device after capabilities are set
, Kernel
HID: nintendo: stop device IO before hid_hw_stop on probe failure
/ Kernel
HID: nintendo: stop device IO before hid_hw_stop on probe failure
, Kernel
HID: rapoo: fix missing hid_is_usb() check
, Kernel
HID: ft260: fix stack-use-after-return write in I2C read race
/ Kernel
HID: ft260: fix stack-use-after-return write in I2C read race
, Kernel
HID: sensor: custom: Fix use-after-free in enable_sensor
/ Kernel
HID: sensor: custom: Fix use-after-free in enable_sensor
, Kernel
HID: uclogic: fix use-after-free of inrange_timer on remove
/ Kernel
HID: uclogic: fix use-after-free of inrange_timer on remove
, Kernel
HID: hyperv: validate initial device info bounds
, Kernel
Bluetooth: hci_event: fix LE list UAF on reset
, Kernel
Bluetooth: hci_event: validate LE Set CIG Parameters response
/ Kernel
Bluetooth: hci_event: validate LE Set CIG Parameters response
, Kernel
Bluetooth: hci_sync: Fix accept list UAF during suspend
/ Kernel
Bluetooth: hci_sync: Fix accept list UAF during suspend
, Kernel
Bluetooth: ISO: zero the sockaddr before returning it in getname
/ Kernel
Bluetooth: ISO: zero the sockaddr before returning it in getname
, Kernel
Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
/ Kernel
Bluetooth: MGMT: reject HCI_CMD_SYNC params_len above 255
, Kernel
Bluetooth: hci_aml: validate firmware segment lengths
