A flaw was found in the Linux kernel. An uninitialized variable in the IPComp (IP Compression) state handling could allow a local attacker to trigger an out-of-bounds read during state migration. This vulnerability could lead to the disclosure of sensitive kernel memory or cause a denial of service by making the migration clone fail.

A flaw was found in the Linux kernel's auditing subsystem. Multiple readers could access the `audit_queue` length (`qlen`) concurrently with a writer without proper synchronization, leading to a data race. This race condition could result in inconsistent data reads, potentially causing unpredictable system behavior or affecting the accuracy of audit logs.

A flaw was found in the Linux kernel's Bluetooth L2CAP (Logical Link Control and Adaptation Protocol) component. An asynchronous operation in the l2cap_chan_timeout() function can attempt to access a connection that has already been deallocated. This use-after-free vulnerability could allow a local attacker to cause a denial of service or potentially execute arbitrary code.

A flaw was found in the Linux kernel's Bluetooth Management (MGMT) subsystem. A use-after-free (UAF) vulnerability exists in the add_device_complete() function. This occurs because the function does not properly acquire a lock before accessing connection parameters, allowing a concurrent device removal operation to free memory that is still in use. An attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution.

A flaw was found in the Linux kernel's ntfs3 file system driver. A local attacker can exploit this vulnerability by mounting a specially crafted NTFS image. This can lead to a kernel slab out-of-bounds write during the $LogFile journal replay process, potentially causing a system crash or denial of service.

A flaw was found in the Linux kernel's NTFS file system driver. A remote attacker could exploit this vulnerability by providing a specially crafted NTFS image, leading to out-of-bounds memory access. This memory corruption can cause the system to crash, resulting in a denial of service.

A flaw was found in the Linux kernel's Non-Transparent Bridge (NTB) Endpoint Function (EPF) component. During critical interrupt processing, the system attempts to acquire a lock, which is an operation not permitted in this context. This improper handling can lead to a system crash, resulting in a denial of service for the affected system.

A flaw was found in the Linux kernel. The Spreadtrum EIC (External Interrupt Controller) driver incorrectly uses a standard spinlock in a critical interrupt handling path. When running on a PREEMPT_RT (Preemptible Real-Time) kernel, this can cause the system to attempt to sleep in an invalid context. This issue can lead to a kernel panic, resulting in a Denial of Service (DoS) for the affected system.

A flaw was found in the Linux kernel's GPIO (General Purpose Input/Output) SCH controller. When the PREEMPT_RT (Preemptible Real-Time) feature is enabled, a locking mechanism intended for sleeping contexts is incorrectly used within a non-sleepable interrupt setup path. This can lead to a system crash, resulting in a denial of service.

A flaw was found in the Linux kernel's Human Interface Device (HID) Logitech DJ driver. This vulnerability arises from an incorrect check in the DJ short report validation, where a specially crafted device descriptor can lead to a null pointer dereference during device initialization. Successful exploitation of this flaw could allow a local attacker to cause a system crash, resulting in a denial of service (DoS).

A flaw was found in the Linux kernel's io_uring/nop component. A local user could exploit this by submitting a specially crafted no-operation (NOP) request. This could lead to a file reference not being properly released, resulting in a memory leak. Over time, this memory leak could impact system stability and resource availability.

A flaw was found in the Linux kernel's `io_uring` subsystem. This vulnerability allows linked work items to continue executing even after a system exit process has begun. This can lead to a denial of service by prolonging the exit sequence and potentially consuming system resources unexpectedly.

A flaw was found in the Linux kernel's netpoll module. During the system shutdown process, a race condition can occur where a network transmission worker attempts to access memory that has already been deallocated. This use-after-free vulnerability can lead to system instability, causing a denial of service (DoS) by crashing the system.

A flaw was found in the Linux kernel's Internet Group Management Protocol (IGMP) multicast group handling. When a network device is destroyed, its associated multicast groups are not properly removed from the device's hash table before their memory is reclaimed. This creates a race condition where a local attacker with low privileges could exploit this use-after-free vulnerability to cause system instability, escalate privileges, or potentially execute arbitrary code.

A flaw was found in the Linux kernel's IPv4 networking stack. Invalid values for `net.ipv4.tcp_reordering`, particularly negative inputs, can lead to an integer overflow when processed. When `tcp_mtu_probing` is enabled, this overflow can cause an out-of-bounds read within the `tcp_mtu_probe()` function. This vulnerability may allow an attacker to access sensitive information or cause system instability.

A flaw was found in the Linux kernel's `imx8-isi` media driver. This use-after-free vulnerability occurs during the removal of the driver due to an incorrect order of cleanup operations. A local attacker could potentially exploit this to cause a denial of service or achieve arbitrary code execution.

A flaw was found in the Linux kernel's `cros_ec` driver. This vulnerability, a use-after-free, occurs when the device's data pointer is set too early during initialization. If the initialization process fails, the memory for the `cros_ec_dev` structure is released, but other kernel components, such as the `cros_ec_typec` driver, may still attempt to access the freed memory using a stale pointer. This can lead to an invalid memory access, resulting in a system crash and a denial of service.

A flaw was found in the Linux kernel. A local user could trigger a system crash by reading a specific debugfs "count" file related to memory management. This issue arises because a function attempts to perform an operation that can cause it to pause (sleep) while holding a critical system lock, which is an invalid operation. This vulnerability could lead to a denial of service, making the system unavailable.

A flaw was found in the Linux kernel's memory management (mm) shrinker subsystem. A race condition exists where the `shrinker_info` array can be prematurely freed while still accessible, leading to a use-after-free or double-free vulnerability. This memory corruption can be exploited by a local attacker to cause system instability or a denial of service.

A flaw was found in the Linux kernel's memory management (mm) shrinker subsystem. This vulnerability arises because the `shrinker_debugfs_add()` function unconditionally creates debugfs files for 'count' and 'scan' operations, even if the corresponding callback functions (like `scan_objects()`) are not implemented by a specific shrinker. A local attacker could trigger a NULL pointer dereference by attempting to write to a scan file associated with a shrinker that has a missing `scan_objects()` callback. This can lead to a kernel panic, effectively causing a denial of service (DoS) on the system.