Open Source Vulnerabilities

Kernel

media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com

Kernel

media: ir_toy: free before error exiting

Kernel

video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow

Kernel

video: fbdev: cirrusfb: check pixclock to avoid divide by zero

Kernel

media: atomisp: fix dummy_ptr check to avoid duplicate active_bo

Kernel

media: imx-jpeg: fix a bug of accessing array out of bounds

Kernel

powerpc/kasan: Fix early region not updated correctly

Kernel

KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU

Kernel

drm/dp: Fix off-by-one in register cache size

Kernel

video: fbdev: sm712fb: Fix crash in smtcfb_write()

Kernel

ARM: mmp: Fix failure to remove sram device

Kernel

mmc: host: Return an error when ->enable_sdio_irq() ops is missing

Kernel

drm/i915: Treat SAGV block time 0 as SAGV disabled

Kernel

scsi: qla2xxx: Fix warning message due to adisc being flushed

Kernel

scsi: qla2xxx: Implement ref count for SRB

Kernel

ubifs: rename_whiteout: Fix double free for whiteout_ui->data

Kernel

KVM: x86/mmu: do compare-and-exchange of gPTE via the user address

Kernel

scsi: qla2xxx: Fix scheduling while atomic

Kernel

scsi: qla2xxx: Fix premature hw access after PCI error

Kernel

scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()

Kernel

KVM: x86: Avoid theoretical NULL pointer dereference in kvm_irq_delivery_to_apic_fast()

Kernel

KVM: SVM: fix panic on out-of-bounds guest IRQ

Kernel

ubifs: Fix deadlock in concurrent rename whiteout and inode writeback

Kernel

ubifs: Fix 'ui->dirty' race between do_tmpfile() and writeback work

Kernel

ubifs: Fix read out-of-bounds in ubifs_wbuf_write_nolock()

Kernel

ubifs: Fix to add refcount once page is set private

Kernel

wireguard: socket: ignore v6 endpoints when ipv6 is disabled

Kernel

wireguard: socket: free skb in send6 when ipv6 is disabled

Kernel

can: mcba_usb: properly check endpoint type

Kernel

rxrpc: fix some null-ptr-deref bugs in server_key.c

Kernel

watch_queue: Free the page array when watch_queue is dismantled

Kernel

block: Fix the maximum minor value is blk_alloc_ext_minor()

Kernel

ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl

Kernel

rxrpc: Fix call timer start racing with call destruction

Kernel

io_uring: fix memory leak of uid in files registration

Kernel

ACPI: CPPC: Avoid out of bounds access when parsing _CPC data

Kernel

ax25: fix UAF bug in ax25_send_control()

Kernel

nbd: fix possible overflow on 'first_minor' in nbd_dev_add()

Kernel

docs: sysctl/kernel: add missing bit to panic_print

Kernel

net: preserve skb_end_offset() in skb_unclone_keeptruesize()

Kernel

Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""

Kernel

coredump: Use the vma snapshot in fill_files_note

Kernel

KVM: x86/svm: Clear reserved bits written to PerfEvtSeln MSRs

Kernel

Revert "nbd: fix possible overflow on 'first_minor' in nbd_dev_add()"

Kernel

ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111

Kernel

drm/amd/display: Fix memory leak

Kernel

drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj

Kernel

usb: cdnsp: fix cdnsp_decode_trb function to properly handle ret value

Kernel

drm/bridge: Add missing pm_runtime_put_sync

Kernel

ath11k: fix kernel panic during unload/load ath11k modules