A flaw was found in the Linux kernel's IPv6 Neighbor Discovery (NDISC) component. An unprivileged user, operating within a network namespace, can trigger a null pointer dereference in the `accept_untracked_na()` function. This occurs due to a race condition where the `inet6_dev` structure is re-fetched without a null check, while another process concurrently clears the device's IPv6 pointer. Successful exploitation of this vulnerability leads to a kernel crash, resulting in a Denial of Service (DoS).

No description is available for this CVE.

A flaw was found in the Linux kernel's GeneLink (GL620A) USB network driver. A malicious GeneLink device can send specially crafted Universal Serial Bus (USB) packets that cause an out-of-bounds read vulnerability. This can lead to the disclosure of sensitive kernel memory, potentially revealing confidential system information. No special privileges are required for an attacker to exploit this vulnerability.

No description is available for this CVE.

A flaw was found in the Linux kernel's IPv6 networking component. A null pointer dereference vulnerability exists in the `fib6_nh_mtu_change()` function. This can occur when the `idev` (in6_device) pointer is cleared during network interface shutdown, but the `fib6_nh_mtu_change()` function attempts to dereference it without a proper null check. An attacker could potentially trigger this condition, leading to a kernel crash and a Denial of Service (DoS).

No description is available for this CVE.

No description is available for this CVE.

A use-after-free flaw was found in the Linux kernel's NVMe-over-Fabrics TCP target (nvmet-tcp) driver. When NVMe/TCP data digest is enabled and a digest mismatch occurs on a non-final H2C_DATA PDU during an R2T-based write transfer, the digest error handler in nvmet_tcp_try_recv_ddgst() calls nvmet_req_uninit(), which drops a percpu_ref reference on the submission queue without marking the command as completed. During the subsequent queue teardown, the same command is treated as still needing data and nvmet_req_uninit() is called a second time, resulting in a double percpu_ref_put against a single percpu_ref_get. This use-after-free and reference-count underflow can crash the kernel (denial of service) when a remote NVMe/TCP initiator triggers a digest mismatch against a host configured as an NVMe/TCP target.

A flaw was found in the Linux kernel's NVMe over TCP (nvmet-tcp) implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock, causing a Denial of Service (DoS) for the system.

A flaw was found in the Linux kernel's ntfs3 filesystem driver. A local attacker could exploit this vulnerability by crafting a specially designed NTFS filesystem image. This flaw allows an attacker to cause an out-of-bounds memory write during the log replay conversion process, potentially leading to memory corruption and system instability or denial of service.

No description is available for this CVE.

No description is available for this CVE.

A flaw was found in the Linux kernel's traffic control (TC) classifier application programming interface (API). The `tcf_qevent_handle` function does not properly handle a consumed socket buffer (`skb`) when it is processed by the defragmentation engine. This can lead to a Use-After-Free (UAF) vulnerability, where the system attempts to use memory that has already been freed. An attacker could potentially exploit this to cause system instability or execute arbitrary code.

A flaw was found in the Linux kernel's QAT (QuickAssist Technology) driver. Unused character devices and IOCTLs (Input/Output Control) were exposed, which increased the potential attack surface. Removing these interfaces reduces the risk of future vulnerabilities and improves the overall security posture of the system.

A flaw was found in the Linux kernel's Samsung serial driver. When console flow control is enabled, a redundant attempt to acquire a port lock occurs within the receive helper functions. This can lead to a deadlock on the same CPU, causing the system to become unresponsive.

A flaw was found in the `drm/hyperv` component of the Linux kernel. The `hyperv_receive_sub()` function, responsible for processing VMBus packets, does not adequately validate the size of incoming data. This oversight allows a malicious or compromised host to send specially crafted packets, potentially causing the system to read up to 16 KiB of unintended data from memory. This could lead to information disclosure or memory corruption within the kernel.

A flaw was found in the Linux kernel's ethtool tsconfig component. A missing cleanup function call after an operation could lead to resource exhaustion. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by depleting system resources.

A flaw was found in the Linux kernel's `xfrm` (IPSec framework) component. An issue with improper RCU (Read-Copy-Update) synchronization in the `xfrm_policy_fini()` function, specifically the serial execution of `synchronize_rcu()` for each network namespace during cleanup, can lead to a Denial of Service (DoS). Under specific workloads involving frequent network namespace creation and destruction, this can cause system processes to become unresponsive, accumulate cleanup tasks, and consume excessive memory, ultimately leading to Out-Of-Memory (OOM) conditions.

A flaw was found in the Linux kernel's `drm/hyperv` component. A malicious Hyper-V guest could exploit an out-of-bounds memory access vulnerability by sending a crafted resolution response. This could potentially lead to information disclosure or a denial of service. Additionally, an issue with the resolution probe fallback mechanism could prevent display functionality from initializing correctly, resulting in a denial of service.

A flaw was found in the Linux kernel's networking handshake component. This vulnerability occurs because a critical file reference is not properly maintained during the handshake process. An attacker could potentially exploit this by causing the system to prematurely release a socket, leading to a use-after-free condition. This could result in a system crash, causing a denial of service.