It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585) Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

Jann Horn discovered that the watchqueue event notification subsystem in the Linux kernel contained an out-of-bounds write vulnerability. A local attacker could use this to cause a denial of service (system crash) or escalate their privileges. (CVE-2022-0995)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - iSCSI Boot Firmware Table Attributes driver; - Network drivers; - File systems infrastructure; - NTFS3 file system; - Ethernet bridge; - Ethtool driver; - IPv6 networking; - Network traffic control; - VMware vSockets driver; (CVE-2024-26837, CVE-2025-21993, CVE-2025-21702, CVE-2024-50248, CVE-2024-46826, CVE-2024-50256, CVE-2025-21703, CVE-2025-21700, CVE-2025-21756, CVE-2025-21701, CVE-2024-56651)

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - S390 architecture; - SuperH RISC architecture; - User-Mode Linux (UML); - x86 architecture; - Block layer subsystem; - Cryptographic API; - ACPI drivers; - Drivers core; - ATA over ethernet (AOE) driver; - Virtio block driver; - TPM device driver; - Data acquisition framework and drivers; - Hardware crypto device drivers; - DMA engine subsystem; - EDAC drivers; - ARM SCPI message protocol; - GPIO subsystem; - GPU drivers; - HID subsystem; - Microsoft Hyper-V drivers; - I2C subsystem; - I3C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - LED subsystem; - Mailbox framework; - Multiple devices driver; - Media drivers; - Multifunction device drivers; - MMC subsystem; - MTD block device drivers; - Network drivers; - Mellanox network drivers; - NTB driver; - Virtio pmem driver; - NVME drivers; - Parport drivers; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Real Time Clock drivers; - SCSI subsystem; - SuperH / SH-Mobile drivers; - QCOM SoC drivers; - SPI subsystem; - Direct Digital Synthesis drivers; - USB Device Class drivers; - USB Gadget drivers; - USB Dual Role (OTG-ready) Controller drivers; - USB Serial drivers; - USB Type-C support driver; - USB Type-C Port Controller Manager driver; - VFIO drivers; - Framebuffer layer; - Xen hypervisor drivers; - BTRFS file system; - Ceph distributed file system; - Ext4 file system; - F2FS file system; - GFS2 file system; - File systems infrastructure; - JFFS2 file system; - JFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - NILFS2 file system; - Overlay file system; - Proc file system; - Diskquota system; - SMB network file system; - UBI file system; - Timer subsystem; - VLANs driver; - LAPB network protocol; - Network traffic control; - Network sockets; - TCP network protocol; - Kernel init infrastructure; - BPF subsystem; - Kernel CPU control infrastructure; - Perf events; - Arbitrary resource management; - Tracing infrastructure; - Closures library; - Memory management; - 9P file system network protocol; - Amateur Radio drivers; - Bluetooth subsystem; - Ethernet bridge; - CAN network layer; - Networking core; - DCCP (Datagram Congestion Control Protocol); - IEEE802154.4 network protocol; - IPv4 networking; - IPv6 networking; - MAC80211 subsystem; - IEEE 802.15.4 subsystem; - Netfilter; - Netlink; - NET/ROM layer; - Packet sockets; - SCTP protocol; - Sun RPC protocol; - TIPC protocol; - Wireless networking; - eXpress Data Path; - XFRM subsystem; - Key management; - SELinux security module; - FireWire sound drivers; - AudioScience HPI driver; - Amlogic Meson SoC drivers; - USB sound devices; - KVM core; (CVE-2024-56637, CVE-2024-56576, CVE-2024-47685, CVE-2024-56558, CVE-2024-47684, CVE-2024-50233, CVE-2024-50301, CVE-2024-49860, CVE-2021-47219, CVE-2024-56581, CVE-2024-57902, CVE-2024-49851, CVE-2024-50074, CVE-2025-21640, CVE-2023-52458, CVE-2024-50134, CVE-2024-47692, CVE-2024-46849, CVE-2024-49902, CVE-2024-56720, CVE-2024-53171, CVE-2024-56615, CVE-2024-47674, CVE-2024-53172, CVE-2024-50218, CVE-2024-50262, CVE-2024-50290, CVE-2024-53680, CVE-2024-53104, CVE-2024-49982, CVE-2024-50282, CVE-2024-49997, CVE-2024-56574, CVE-2024-56595, CVE-2024-47747, CVE-2024-56642, CVE-2024-49878, CVE-2024-35896, CVE-2024-53197, CVE-2024-56770, CVE-2024-56593, CVE-2024-53174, CVE-2024-41066, CVE-2024-56606, CVE-2024-56630, CVE-2024-49879, CVE-2024-50131, CVE-2025-21699, CVE-2024-53214, CVE-2024-50279, CVE-2024-56691, CVE-2024-49925, CVE-2024-53145, CVE-2024-49985, CVE-2024-57802, CVE-2024-50116, CVE-2024-50234, CVE-2024-47672, CVE-2024-56645, CVE-2024-50082, CVE-2024-50035, CVE-2024-50039, CVE-2024-56594, CVE-2024-56596, CVE-2024-49903, CVE-2024-50299, CVE-2024-53138, CVE-2024-50229, CVE-2024-50051, CVE-2024-53161, CVE-2024-40953, CVE-2024-56747, CVE-2024-50230, CVE-2024-49900, CVE-2024-50040, CVE-2024-50287, CVE-2024-49948, CVE-2024-47742, CVE-2024-50033, CVE-2024-57912, CVE-2024-56650, CVE-2024-50267, CVE-2024-56567, CVE-2024-57922, CVE-2024-56605, CVE-2024-57946, CVE-2024-56694, CVE-2024-53194, CVE-2024-56644, CVE-2024-56602, CVE-2024-56619, CVE-2025-21678, CVE-2024-53059, CVE-2024-47749, CVE-2024-56781, CVE-2024-46854, CVE-2024-49867, CVE-2024-50278, CVE-2024-53239, CVE-2024-56548, CVE-2024-57890, CVE-2024-53158, CVE-2024-57807, CVE-2024-56587, CVE-2024-50180, CVE-2024-53227, CVE-2024-49944, CVE-2024-49959, CVE-2024-56614, CVE-2024-53148, CVE-2024-57938, CVE-2024-56746, CVE-2024-49966, CVE-2024-50199, CVE-2024-53173, CVE-2024-53063, CVE-2024-50142, CVE-2024-56700, CVE-2024-49995, CVE-2024-43098, CVE-2024-47737, CVE-2024-50008, CVE-2024-56690, CVE-2024-47713, CVE-2024-50117, CVE-2024-53165, CVE-2024-49882, CVE-2024-47699, CVE-2024-53127, CVE-2024-56598, CVE-2024-57892, CVE-2024-53146, CVE-2024-50059, CVE-2024-49963, CVE-2024-47707, CVE-2024-53155, CVE-2024-56634, CVE-2024-47697, CVE-2024-49958, CVE-2024-47706, CVE-2024-56603, CVE-2024-50302, CVE-2024-35887, CVE-2024-56539, CVE-2024-53183, CVE-2024-44938, CVE-2024-57900, CVE-2024-53130, CVE-2025-21697, CVE-2024-49892, CVE-2024-50265, CVE-2024-50024, CVE-2025-0927, CVE-2024-49924, CVE-2024-56780, CVE-2024-56569, CVE-2024-57929, CVE-2024-50236, CVE-2024-50273, CVE-2024-49949, CVE-2024-53157, CVE-2024-56659, CVE-2024-57849, CVE-2024-57908, CVE-2024-49894, CVE-2024-47723, CVE-2024-56723, CVE-2024-49957, CVE-2024-50127, CVE-2024-43863, CVE-2025-21687, CVE-2024-48881, CVE-2024-56704, CVE-2024-49884, CVE-2024-47710, CVE-2024-56739, CVE-2024-53135, CVE-2024-56532, CVE-2024-49965, CVE-2024-57889, CVE-2024-53112, CVE-2024-42252, CVE-2024-49896, CVE-2024-50237, CVE-2024-56600, CVE-2024-57951, CVE-2024-43900, CVE-2024-53156, CVE-2024-50099, CVE-2024-56631, CVE-2024-50045, CVE-2024-38588, CVE-2024-57884, CVE-2024-49938, CVE-2025-21694, CVE-2024-47757, CVE-2024-56562, CVE-2024-57904, CVE-2024-49955, CVE-2024-47709, CVE-2024-56756, CVE-2024-49962, CVE-2024-53184, CVE-2024-53131, CVE-2024-57901, CVE-2024-47756, CVE-2024-47701, CVE-2024-50148, CVE-2024-44931, CVE-2024-50202, CVE-2024-56601, CVE-2024-56643, CVE-2024-47670, CVE-2024-56633, CVE-2024-57931, CVE-2024-50184, CVE-2024-47712, CVE-2024-57906, CVE-2024-47671, CVE-2025-21638, CVE-2024-50143, CVE-2024-57913, CVE-2024-50205, CVE-2024-56670, CVE-2024-53198, CVE-2024-56629, CVE-2024-53101, CVE-2024-56748, CVE-2024-49981, CVE-2024-53142, CVE-2024-47696, CVE-2024-56779, CVE-2025-21689, CVE-2024-57948, CVE-2022-49034, CVE-2025-21639, CVE-2024-56769, CVE-2025-21653, CVE-2024-56688, CVE-2024-57911, CVE-2024-50269, CVE-2024-46853, CVE-2024-53066, CVE-2024-53140, CVE-2024-47679, CVE-2024-47698, CVE-2024-50167, CVE-2024-38544, CVE-2024-50096, CVE-2024-49973, CVE-2024-50044, CVE-2024-53217, CVE-2024-50006, CVE-2024-50194, CVE-2024-50296, CVE-2024-53150, CVE-2024-40911, CVE-2024-46731, CVE-2024-56724, CVE-2024-41016, CVE-2024-50251, CVE-2024-56681, CVE-2024-53690, CVE-2024-47740, CVE-2024-49936, CVE-2024-40965, CVE-2024-49975, CVE-2024-50150, CVE-2024-56572, CVE-2024-49996, CVE-2024-56586, CVE-2024-53124, CVE-2024-49877, CVE-2024-57910, CVE-2024-49952, CVE-2024-55916, CVE-2024-53121, CVE-2024-56531, CVE-2024-50151, CVE-2024-56767, CVE-2024-52332, CVE-2024-49868, CVE-2024-50179, CVE-2024-56570, CVE-2024-53061, CVE-2024-50171, CVE-2025-21664, CVE-2024-57850, CVE-2024-53181, CVE-2024-50195, CVE-2024-50007, CVE-2024-49883, CVE-2024-56597, CVE-2021-47469)

Chenyuan Yang discovered that the CEC driver driver in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-23848)

Attila Szász discovered that the HFS+ file system implementation in the Linux Kernel contained a heap overflow vulnerability. An attacker could use a specially crafted file system image that, when mounted, could cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2025-0927)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - PowerPC architecture; - S390 architecture; - SuperH RISC architecture; - User-Mode Linux (UML); - x86 architecture; - Cryptographic API; - Virtio block driver; - Data acquisition framework and drivers; - Hardware crypto device drivers; - DMA engine subsystem; - EDAC drivers; - ARM SCPI message protocol; - GPIO subsystem; - GPU drivers; - HID subsystem; - Microsoft Hyper-V drivers; - I3C subsystem; - IIO ADC drivers; - IIO subsystem; - InfiniBand drivers; - LED subsystem; - Multiple devices driver; - Media drivers; - Multifunction device drivers; - MMC subsystem; - MTD block device drivers; - Network drivers; - Mellanox network drivers; - NVME drivers; - PCI subsystem; - Pin controllers subsystem; - x86 platform drivers; - Real Time Clock drivers; - SCSI subsystem; - SuperH / SH-Mobile drivers; - QCOM SoC drivers; - SPI subsystem; - USB Gadget drivers; - USB Serial drivers; - USB Type-C Port Controller Manager driver; - VFIO drivers; - Framebuffer layer; - Xen hypervisor drivers; - BTRFS file system; - Ext4 file system; - F2FS file system; - GFS2 file system; - File systems infrastructure; - JFFS2 file system; - JFS file system; - Network file system (NFS) client; - Network file system (NFS) server daemon; - NILFS2 file system; - Overlay file system; - Proc file system; - Diskquota system; - SMB network file system; - UBI file system; - Timer subsystem; - VLANs driver; - LAPB network protocol; - Kernel init infrastructure; - BPF subsystem; - Kernel CPU control infrastructure; - Tracing infrastructure; - Memory management; - 9P file system network protocol; - Bluetooth subsystem; - CAN network layer; - Networking core; - DCCP (Datagram Congestion Control Protocol); - IEEE802154.4 network protocol; - IPv4 networking; - IPv6 networking; - IEEE 802.15.4 subsystem; - Netfilter; - Netlink; - NET/ROM layer; - Packet sockets; - Network traffic control; - SCTP protocol; - Sun RPC protocol; - TIPC protocol; - eXpress Data Path; - SELinux security module; - USB sound devices; (CVE-2024-56532, CVE-2024-53127, CVE-2024-56574, CVE-2024-56576, CVE-2024-57922, CVE-2024-53135, CVE-2024-56606, CVE-2024-53155, CVE-2024-53136, CVE-2024-56769, CVE-2024-56690, CVE-2024-53150, CVE-2024-38588, CVE-2024-53171, CVE-2024-56748, CVE-2024-56558, CVE-2024-56595, CVE-2024-56670, CVE-2024-56637, CVE-2024-56739, CVE-2024-56681, CVE-2024-53158, CVE-2024-53172, CVE-2024-56700, CVE-2024-56645, CVE-2024-56723, CVE-2024-56572, CVE-2024-57889, CVE-2024-43098, CVE-2024-56614, CVE-2024-53197, CVE-2025-21640, CVE-2024-57938, CVE-2024-53140, CVE-2024-57929, CVE-2024-56593, CVE-2024-56691, CVE-2025-21687, CVE-2024-56770, CVE-2024-53131, CVE-2024-56531, CVE-2024-56603, CVE-2025-21653, CVE-2024-53239, CVE-2024-57946, CVE-2024-56581, CVE-2024-56694, CVE-2024-56597, CVE-2024-57849, CVE-2024-56601, CVE-2024-53156, CVE-2024-56747, CVE-2024-53146, CVE-2025-21664, CVE-2024-53217, CVE-2025-21638, CVE-2024-53157, CVE-2024-56688, CVE-2024-47707, CVE-2024-53173, CVE-2024-56605, CVE-2024-56619, CVE-2024-49925, CVE-2024-49936, CVE-2024-56586, CVE-2024-57892, CVE-2024-56562, CVE-2024-57902, CVE-2024-53148, CVE-2024-53194, CVE-2024-56720, CVE-2024-53121, CVE-2024-48881, CVE-2024-56767, CVE-2024-56780, CVE-2024-56548, CVE-2024-57931, CVE-2024-56724, CVE-2024-53142, CVE-2024-53214, CVE-2025-21639, CVE-2024-43900, CVE-2024-56659, CVE-2024-57908, CVE-2024-57913, CVE-2024-53181, CVE-2024-56630, CVE-2024-56598, CVE-2024-56539, CVE-2024-57951, CVE-2024-56600, CVE-2024-52332, CVE-2024-55916, CVE-2024-53130, CVE-2024-56587, CVE-2024-57911, CVE-2024-57901, CVE-2024-57807, CVE-2024-49996, CVE-2025-21697, CVE-2024-53198, CVE-2024-53145, CVE-2024-57910, CVE-2022-49034, CVE-2024-56629, CVE-2024-56570, CVE-2024-57948, CVE-2024-53227, CVE-2024-56643, CVE-2024-56602, CVE-2024-57904, CVE-2024-56594, CVE-2024-56615, CVE-2024-53690, CVE-2024-56650, CVE-2025-21699, CVE-2024-56644, CVE-2024-56631, CVE-2024-53183, CVE-2024-50051, CVE-2024-49884, CVE-2024-56569, CVE-2024-56596, CVE-2024-57912, CVE-2024-56781, CVE-2024-57802, CVE-2024-56704, CVE-2024-57850, CVE-2024-57906, CVE-2025-21678, CVE-2024-56634, CVE-2024-53138, CVE-2021-47219, CVE-2024-57890, CVE-2024-53112, CVE-2024-53174, CVE-2024-56756, CVE-2024-56779, CVE-2024-57884, CVE-2024-56746, CVE-2024-53161, CVE-2024-57900, CVE-2024-56567, CVE-2024-56633, CVE-2025-21694, CVE-2024-53165, CVE-2024-56642, CVE-2024-53184, CVE-2024-44938, CVE-2024-53124, CVE-2025-21689, CVE-2024-53680)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems:

Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida discovered that the Linux kernel mitigations for the initial Branch History Injection vulnerability (CVE-2022-0001) were insufficient for Intel processors. A local attacker could potentially use this to expose sensitive information. (CVE-2024-2201)

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Netfilter; (CVE-2024-26925, CVE-2024-26643)

It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the Linux kernel did not properly handle certain error conditions during device registration. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2023-22995) It was discovered that the NVIDIA Tegra XUSB pad controller driver in the Linux kernel did not properly handle return values in certain error conditions. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-23000) Quentin Minster discovered that the KSMBD implementation in the Linux kernel did not properly handle session setup requests. A remote attacker could possibly use this to cause a denial of service (memory exhaustion). (CVE-2023-32247) It was discovered that a race condition existed in the Cypress touchscreen driver in the Linux kernel during device removal, leading to a use-after- free vulnerability. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-4134) 黄思聪 discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel did not properly handle certain memory allocation failure conditions, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-46343) It was discovered that the iouring subsystem in the Linux kernel contained a race condition, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2023-46862) It was discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-51779) It was discovered that a race condition existed in the Rose X.25 protocol implementation in the Linux kernel, leading to a use-after- free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-51782) Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel did not properly handle connect command payloads in certain situations, leading to an out-of-bounds read vulnerability. A remote attacker could use this to expose sensitive information (kernel memory). (CVE-2023-6121) It was discovered that the VirtIO subsystem in the Linux kernel did not properly initialize memory in some situations. A local attacker could use this to possibly expose sensitive information (kernel memory). (CVE-2024-0340) Dan Carpenter discovered that the netfilter subsystem in the Linux kernel did not store data in properly sized memory locations. A local user could use this to cause a denial of service (system crash). (CVE-2024-0607) Lonial Con discovered that the netfilter subsystem in the Linux kernel did not properly handle element deactivation in certain cases, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1085) Notselwyn discovered that the netfilter subsystem in the Linux kernel did not properly handle verdict parameters in certain cases, leading to a use- after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2024-1086) It was discovered that a race condition existed in the SCSI Emulex LightPulse Fibre Channel driver in the Linux kernel when unregistering FCF and re-scanning an HBA FCF table, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service (system crash). (CVE-2024-24855)

Jana Hofmann, Emanuele Vannacci, Cedric Fournet, Boris Kopf, and Oleksii Oleksenko discovered that some AMD processors could leak stale data from division operations in certain situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-20588) It was discovered that a race condition existed in the Linux kernel when performing operations with kernel objects, leading to an out-of-bounds write. A local attacker could use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2023-45863)

Kirill Tkhai discovered that the XFS file system implementation in the Linux kernel did not calculate size correctly when pre-allocating space in some situations. A local attacker could use this to expose sensitive information. (CVE-2021-4155) Lee Jones discovered that a use-after-free vulnerability existed in the Bluetooth implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-20566) Duoming Zhou discovered that a race condition existed in the SLIP driver in the Linux kernel, leading to a null pointer dereference vulnerability. An attacker could use this to cause a denial of service (system crash). (CVE-2022-41858) Tamás Koczka discovered that the Bluetooth L2CAP implementation in the Linux kernel did not properly initialize memory in some situations. A physically proximate attacker could possibly use this to expose sensitive information (kernel memory). (CVE-2022-42895) José Oliveira and Rodrigo Branco discovered that the prctl syscall implementation in the Linux kernel did not properly protect against indirect branch prediction attacks in some situations. A local attacker could possibly use this to expose sensitive information. (CVE-2023-0045) It was discovered that the RNDIS USB driver in the Linux kernel contained an integer overflow vulnerability. A local attacker with physical access could plug in a malicious USB device to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2023-23559)

Norbert Slusarek discovered a race condition in the CAN BCM networking protocol of the Linux kernel leading to multiple use-after-free vulnerabilities. A local attacker could use this issue to execute arbitrary code. (CVE-2021-3609) Likang Luo discovered that a race condition existed in the Bluetooth subsystem of the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-3752) It was discovered that the NFC subsystem in the Linux kernel contained a use-after-free vulnerability in its NFC Controller Interface (NCI) implementation. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-3760) Szymon Heidrich discovered that the USB Gadget subsystem in the Linux kernel did not properly restrict the size of control requests for certain gadget types, leading to possible out of bounds reads or writes. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-39685) It was discovered that the Ion Memory Manager subsystem in the Linux kernel contained a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2021-39714) Eric Biederman discovered that the cgroup process migration implementation in the Linux kernel did not perform permission checks correctly in some situations. A local attacker could possibly use this to gain administrative privileges. (CVE-2021-4197) Lin Ma discovered that the NFC Controller Interface (NCI) implementation in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2021-4202) Sushma Venkatesh Reddy discovered that the Intel i915 graphics driver in the Linux kernel did not perform a GPU TLB flush in some situations. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. (CVE-2022-0330) It was discovered that the PFKEYv2 implementation in the Linux kernel did not properly initialize kernel memory in some situations. A local attacker could use this to expose sensitive information (kernel memory). (CVE-2022-1353) It was discovered that the virtual graphics memory manager implementation in the Linux kernel was subject to a race condition, potentially leading to an information leak. (CVE-2022-1419) Minh Yuan discovered that the floppy disk driver in the Linux kernel contained a race condition, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1652) It was discovered that the Atheros ath9k wireless device driver in the Linux kernel did not properly handle some error conditions, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-1679) It was discovered that the Marvell NFC device driver implementation in the Linux kernel did not properly perform memory cleanup operations in some situations, leading to a use-after-free vulnerability. A local attacker could possibly use this to cause a denial of service (system crash) or execute arbitrary code. (CVE-2022-1734) It was discovered that some Intel processors did not completely perform cleanup actions on multi-core shared buffers. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21123) It was discovered that some Intel processors did not completely perform cleanup actions on microarchitectural fill buffers. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21125) It was discovered that some Intel processors did not properly perform cleanup during specific special register write operations. A local attacker could possibly use this to expose sensitive information. (CVE-2022-21166) It was discovered that the USB Gadget file system interface in the Linux kernel contained a use-after-free vulnerability. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2022-24958) 赵子轩 discovered that the 802.2 LLC type 2 driver in the Linux kernel did not properly perform reference counting in some error conditions. A local attacker could use this to cause a denial of service. (CVE-2022-28356) It was discovered that the 8 Devices USB2CAN interface implementation in the Linux kernel did not properly handle certain error conditions, leading to a double-free. A local attacker could possibly use this to cause a denial of service (system crash). (CVE-2022-28388)

It was discovered that a heap buffer overflow existed in the Marvell Wireless LAN device driver for the Linux kernel. An attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-10126) Amit Klein and Benny Pinkas discovered that the Linux kernel did not sufficiently randomize IP ID values generated for connectionless networking protocols. A remote attacker could use this to track particular Linux devices. (CVE-2019-10638) It was discovered that a NULL pointer dereference vulnerability existed in the Near-field communication (NFC) implementation in the Linux kernel. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-12984) Jann Horn discovered a use-after-free vulnerability in the Linux kernel when accessing LDT entries in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-13233) Jann Horn discovered that the ptrace implementation in the Linux kernel did not properly record credentials in some situations. A local attacker could use this to cause a denial of service (system crash) or possibly gain administrative privileges. (CVE-2019-13272) It was discovered that the floppy driver in the Linux kernel did not properly validate meta data, leading to a buffer overread. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14283) It was discovered that the floppy driver in the Linux kernel did not properly validate ioctl() calls, leading to a division-by-zero. A local attacker could use this to cause a denial of service (system crash). (CVE-2019-14284) It was discovered that the Marvell Wireless LAN device driver in the Linux kernel did not properly validate the BSS descriptor. A local attacker could possibly use this to cause a denial of service (system crash) or possibly execute arbitrary code. (CVE-2019-3846) Jason Wang discovered that an infinite loop vulnerability existed in the virtio net driver in the Linux kernel. A local attacker in a guest VM could possibly use this to cause a denial of service in the host system. (CVE-2019-3900)

Jann Horn discovered that the Linux kernel mishandles mapping UID or GID ranges inside nested user namespaces in some situations. A local attacker could use this to bypass access controls on resources outside the namespace. (CVE-2018-18955) Philipp Wendler discovered that the overlayfs implementation in the Linux kernel did not properly verify the directory contents permissions from within a unprivileged user namespace. A local attacker could use this to expose sensitive information (protected file names). (CVE-2018-6559)