RHSA-2023:2736

Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free condi…

A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver.

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that…

A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, poten…

In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.

A vulnerability has been found in Linux Kernel and classified as problematic.

An issue was discovered in the Linux kernel before 5.19.16.

A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.

An issue was discovered the x86 KVM subsystem in the Linux kernel before 5.18.17.

In the Linux kernel through 5.16.10, certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g., with GCC 3.2.2 and Linux kernel 2.4.20).

A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages.

There is a use-after-free vulnerability in the Linux Kernel which can be exploited to achieve local privilege escalation.

The Linux kernel before 5.17.2 mishandles seccomp permissions.

A vulnerability was found in Linux Kernel.

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Fix use-after-free warning Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use…

A vulnerability was found in Linux Kernel.

A vulnerability classified as critical was found in Linux Kernel.

A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards.

When setting font with malicous data by ioctl cmd PIO_FONT,kernel will write memory out of bounds.

drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory.

An issue was found in the Linux kernel in nf_conntrack_irc where the message handling can be confused and incorrectly matches the message.

In ip_check_mc_rcu of igmp.c, there is a possible use after free due to improper locking.

A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple calls to xfrm_probe_algs occurred simultaneously.

With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva.

When sending malicous data to kernel by ioctl cmd FBIOPUT_VSCREENINFO,kernel will write memory out of bounds.

Some AMD CPUs may transiently execute beyond unconditional direct branches, which may potentially result in data leakage.

A vulnerability has been found in Linux Kernel and classified as problematic.

An out-of-bounds read flaw was found in the Linux kernel’s TeleTYpe subsystem.

A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel.

mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.

A vulnerability was found in Linux Kernel.

In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P…

cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_AC…

In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu_object.c misinterprets the drm_gem_shmem_get_sg_table return value (expects it to be NULL in the error case, whereas it is actually an error pointer).

An issue was discovered in the Linux kernel through 5.18.14.

A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device.

A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel.

A use-after-free flaw was found in reconn_set_ipaddr_from_hostname in fs/cifs/connect.c in the Linux kernel.

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object.

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP).

A double-free memory flaw was found in the Linux kernel.

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix tc flower deletion for VLAN priority Rx steering To replicate the issue:- 1) Add 1 flower filter for VLAN Priority based frame steering…

A race problem was found in fs/proc/task_mmu.c in the memory management sub-component in the Linux kernel.

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19.

A vulnerability was identified in Linux Kernel up to 4.19.316/5.4.278/5.10.220/5.15.161.