A flaw was found in the Linux kernel's `digi_acceleport` USB serial driver. This vulnerability allows a local attacker with access to the affected USB serial device to corrupt the write buffer due to improper handling of write operations and timeouts. This could lead to arbitrary code execution, allowing the attacker to run malicious code, or cause system instability and denial of service (DoS).

A flaw was found in the Linux kernel's USB ULPI (UTMI+ Low Pin Interface) driver. This vulnerability occurs during early ULPI device registration failures, where the allocated device name is not properly freed. A local attacker could potentially exploit this memory leak, leading to a denial of service (DoS) due to resource exhaustion.

A flaw was found in the Linux kernel's usbip virtual USB device controller (vudc). This vulnerability, a NULL pointer dereference, occurs when vep_alloc_request() fails to initialize a vrequest's udc field, causing asynchronous input/output (AIO) cancellations on the FunctionFS path to arrive without a valid UDC reference. A local attacker, or a remote attacker with control over the host's usbip attach operation to a guest, could exploit this to trigger a kernel crash, resulting in a denial of service (DoS).

A flaw was found in the Linux kernel's USB Type-C subsystem (tcpm). A malicious USB-C partner device could exploit an out-of-bounds read vulnerability in the `svdm_consume_modes()` function. By manipulating the SVID (Standard or Vendor ID) index, the partner device can force the system to register an arbitrary SVID. This could potentially allow the malicious device to bypass security checks or gain unauthorized control over USB-C alternate modes.

A flaw was found in the Linux kernel's USB Type-C UCSI CCG driver. A use-after-free vulnerability occurs during the removal of a USB Type-C device. Specifically, the system attempts to free a memory object before ensuring that all related interrupt handling routines have completed. This timing issue could allow an attacker to potentially access freed memory, leading to system instability or a denial of service.

A flaw was found in the Linux kernel's USB gadget subsystem. Specifically, a DMA (Direct Memory Access) fence leak exists in the `f_fs` module's `ffs_dmabuf_transfer()` function. This issue causes `ffs_dma_fence` objects to be allocated without their initial reference being properly released. Repeated exploitation of this flaw could lead to a gradual memory leak, potentially resulting in a denial of service due to system resource exhaustion.

A flaw was found in the Linux kernel's FunctionFS (f_fs) module, which handles USB gadget functionality. This vulnerability occurs because the endpoint direction (`epfile->in`) was not correctly initialized until a USB host connected. Consequently, early operations initiated by userspace programs could encounter incorrect data transfer directions, potentially leading to unintended data access or corruption.

A flaw was found in the Linux kernel's block device handling. When a block device is unexpectedly removed, the `bdev_mark_dead()` function can unconditionally attempt to synchronize the device, even if it is no longer present. This can lead to a system hang, effectively causing a Denial of Service (DoS), as the system waits indefinitely for writeback operations that cannot complete. This vulnerability can be triggered by a local user or process interacting with block devices during surprise removal events.

A flaw was found in the Linux kernel's mt76 Wi-Fi driver, affecting mt7921 and mt7925 chipsets. When a channel-switch announcement (CSA) beacon is received, a timing issue can occur if a station disconnects before a queued work item processes the beacon. This can lead to a NULL pointer dereference in the mt7921_channel_switch_rx_beacon() or mt7925_channel_switch_rx_beacon() functions, causing a system crash. A remote attacker could potentially exploit this vulnerability to trigger a Denial of Service (DoS).

A flaw was found in the Linux kernel's Universal Disk Format (UDF) filesystem. The `udf_free_blocks()` function fails to properly validate free block extents against the partition length. This allows a local, unprivileged user to create a specially crafted UDF filesystem that, when a file on it is truncated, can lead to an out-of-bounds read and trigger a kernel panic. This vulnerability results in a Denial of Service (DoS) for the affected system.

A flaw was found in the Linux kernel's Universal Disk Format (UDF) filesystem. A local attacker could craft a malicious UDF image with a specially formed Virtual Allocation Table (VAT) header. When this image is mounted, the kernel fails to properly validate the VAT header length against the VAT inode size. This can lead to an out-of-bounds read, potentially causing a system crash or information disclosure.

A flaw was found in the Linux kernel's Universal Disk Format (UDF) filesystem. The udf_load_sparable_map() function incorrectly validates the length of the sparing table, treating it as a byte count instead of an entry count. This allows a local attacker, by providing a specially crafted UDF image, to trigger an out-of-bounds read and write. This can lead to memory corruption, potentially resulting in a denial of service or arbitrary code execution.

A flaw was found in the NVMe over RDMA (nvmet_rdma) target in the Linux kernel. When a host queue backlog is exceeded during a connection attempt, a reference count (kref) is not properly released. This oversight can lead to a resource exhaustion vulnerability, potentially allowing a remote attacker to cause a Denial of Service (DoS) by depleting system resources.

A flaw was found in the Linux kernel's nvmet subsystem. An unauthenticated remote attacker could exploit an out-of-bounds heap read vulnerability in the Discovery Get Log Page function. By sending a specially crafted request with a manipulated offset, an attacker could read sensitive kernel memory, leading to information disclosure of kernel pointers. This vulnerability could also cause a denial of service by crashing the target host.

A flaw was found in the Linux kernel's nvmet-auth component. A remote attacker, by sending a specially crafted NVMe-oF (NVMe over Fabrics) authentication reply message, can cause an out-of-bounds read in the kernel's memory. This vulnerability, exploitable pre-authentication, can lead to the disclosure of sensitive information and potentially a denial of service (DoS) on the affected system.

A flaw was found in the Linux kernel's AIX partition handling. A local attacker can provide a specially crafted AIX/IBM partition table on a block device. When the kernel scans this device, the `aix_partition()` function reads an unvalidated `pp_count` value, causing it to read beyond the allocated buffer. This out-of-bounds read can lead to information disclosure, potentially revealing sensitive kernel memory, and may also result in a denial of service.

A flaw was found in the Linux kernel's ISO 9660 file system (isofs) component. A remote attacker could exploit this vulnerability by providing a specially crafted ISO 9660 image containing a malformed Rock Ridge symbolic link record. This flaw allows for an out-of-bounds read, leading to the disclosure of sensitive kernel memory information. This can occur when the crafted image is mounted, potentially without requiring elevated privileges.

A flaw was found in the Linux kernel's `crypto: caam` module. This vulnerability allows for information disclosure where sensitive cryptographic key material could be leaked at runtime. This occurs when the `CONFIG_DYNAMIC_DEBUG` option is enabled, due to improper guarding of key dumps in the `*_setkey()` and `gen_split_key()` functions. This could allow a local attacker to gain access to sensitive information.

A flaw was found in the Linux kernel's Cryptographic Acceleration and Assurance Module (CAAM) driver. This vulnerability allows for the leakage of sensitive cryptographic key material. When the kernel's dynamic debugging feature is enabled, an attacker could potentially exploit improper handling of key dumps in cryptographic setup functions, leading to the disclosure of confidential information.

A flaw was found in the Linux kernel's `chacha20poly1305` cryptographic module. This vulnerability occurs because the `chachapoly_create()` function does not properly validate a `poly1305` template argument. When this argument is missing, an error pointer is incorrectly passed to a string comparison function, leading to a dereference of the error pointer. This can result in a system crash, causing a Denial of Service (DoS) for affected systems.