https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 13:39:37 +0000 https://cve.radiocsirt.org/vuln/alsa-2023:7077 <p><strong>Affected:</strong> AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208) * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436) * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975) * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594) * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640) * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388) * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952) * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982) * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895) * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456) * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887) * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458) * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590) * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597) * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073) * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074) * kernel: hid: Use After Free in asus_rem…</p> <p><strong>Affected:</strong> AlmaLinux:8: bpftool, AlmaLinux:8: kernel, AlmaLinux:8: kernel-abi-stablelists, AlmaLinux:8: kernel-core, AlmaLinux:8: kernel-cross-headers, AlmaLinux:8: kernel-debug, AlmaLinux:8: kernel-debug-core, AlmaLinux:8: kernel-debug-devel, AlmaLinux:8: kernel-debug-modules, AlmaLinux:8: kernel-debug-modules-extra and 15 more</p> <p>The kernel packages contain the Linux kernel, the core of any Linux operating system.</p> <p>Security Fix(es):</p> <p>* kernel: tun: avoid double free in tun_free_netdev (CVE-2022-4744) * kernel: net/sched: multiple vulnerabilities (CVE-2023-3609, CVE-2023-3611, CVE-2023-4128, CVE-2023-4206, CVE-2023-4207, CVE-2023-4208) * kernel: out-of-bounds write in qfq_change_class function (CVE-2023-31436) * kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait (CVE-2021-43975) * kernel: Rate limit overflow messages in r8152 in intr_callback (CVE-2022-3594) * kernel: use after free flaw in l2cap_conn_del (CVE-2022-3640) * kernel: double free in usb_8dev_start_xmit (CVE-2022-28388) * kernel: vmwgfx: multiple vulnerabilities (CVE-2022-38457, CVE-2022-40133, CVE-2023-33951, CVE-2023-33952) * hw: Intel: Gather Data Sampling (GDS) side channel vulnerability (CVE-2022-40982) * kernel: Information leak in l2cap_parse_conf_req (CVE-2022-42895) * kernel: KVM: multiple vulnerabilities (CVE-2022-45869, CVE-2023-4155, CVE-2023-30456) * kernel: memory leak in ttusb_dec_exit_dvb (CVE-2022-45887) * kernel: speculative pointer dereference in do_prlimit (CVE-2023-0458) * kernel: use-after-free due to race condition in qdisc_graft (CVE-2023-0590) * kernel: x86/mm: Randomize per-cpu entry area (CVE-2023-0597) * kernel: HID: check empty report_list in hid_validate_values (CVE-2023-1073) * kernel: sctp: fail if no bound addresses can be used for a given scope (CVE-2023-1074) * kernel: hid: Use After Free in asus_rem…</p> https://cve.radiocsirt.org/vuln/alsa-2023:7077 https://cve.radiocsirt.org/vuln/bdu:2023-05369 bdu:2023-05369 https://cve.radiocsirt.org/vuln/bdu:2023-05369 https://cve.radiocsirt.org/vuln/bell-cve-2023-4207 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2023-4207 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0752 certfr-2023-avi-0752 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0752 https://cve.radiocsirt.org/vuln/cnvd-2023-70084 cnvd-2023-70084 https://cve.radiocsirt.org/vuln/cnvd-2023-70084 https://cve.radiocsirt.org/vuln/euvd-2026-216807 EUVD-2026-216807 https://cve.radiocsirt.org/vuln/euvd-2026-216807 https://cve.radiocsirt.org/vuln/fkie_cve-2023-4207 <p>A use-after-free vulnerability in the Linux kernel&#39;s net/sched: cls_fw component can be exploited to achieve local privilege escalation.</p> <p>When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.</p> <p>We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.</p> <p>A use-after-free vulnerability in the Linux kernel&#39;s net/sched: cls_fw component can be exploited to achieve local privilege escalation.</p> <p>When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.</p> <p>We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-4207 https://cve.radiocsirt.org/vuln/ghsa-4fhg-56x9-rf4r <p>A use-after-free vulnerability in the Linux kernel&#39;s net/sched: cls_fw component can be exploited to achieve local privilege escalation.</p> <p>When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.</p> <p>We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.</p> <p>A use-after-free vulnerability in the Linux kernel&#39;s net/sched: cls_fw component can be exploited to achieve local privilege escalation.</p> <p>When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free.</p> <p>We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.</p> https://cve.radiocsirt.org/vuln/ghsa-4fhg-56x9-rf4r https://cve.radiocsirt.org/vuln/gsd-2023-4207 gsd-2023-4207 https://cve.radiocsirt.org/vuln/gsd-2023-4207 https://cve.radiocsirt.org/vuln/msrc_cve-2023-4207 msrc_CVE-2023-4207 https://cve.radiocsirt.org/vuln/msrc_cve-2023-4207 https://cve.radiocsirt.org/vuln/oesa-2023-1634 <p><strong>Affected:</strong> openEuler:22.03-LTS: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es): A flaw was found in the Linux kernel&amp;apos;s ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32247) A use-after-free vulnerability in the Linux kernel&amp;apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain&amp;apos;s owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777) A use-after-free vulnerability in the Linux kernel&amp;apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015) A use-after-free vulnerability in the Linux kernel&amp;apos;s net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the…</p> <p><strong>Affected:</strong> openEuler:22.03-LTS: kernel</p> <p>The Linux Kernel, the operating system core itself. Security Fix(es): A flaw was found in the Linux kernel&amp;apos;s ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the handling of SMB2_SESSION_SETUP commands. The issue results from the lack of control of resource consumption. An attacker can leverage this vulnerability to create a denial-of-service condition on the system.(CVE-2023-32247) A use-after-free vulnerability in the Linux kernel&amp;apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation. When nf_tables_delrule() is flushing table rules, it is not checked whether the chain is bound and the chain&amp;apos;s owner rule can also release the objects in certain circumstances. We recommend upgrading past commit 6eaf41e87a223ae6f8e7a28d6e78384ad7e407f8. (CVE-2023-3777) A use-after-free vulnerability in the Linux kernel&amp;apos;s netfilter: nf_tables component can be exploited to achieve local privilege escalation. On an error when building a nftables rule, deactivating immediate expressions in nft_immediate_deactivate() can lead unbinding the chain and objects be deactivated but later used. We recommend upgrading past commit 0a771f7b266b02d262900c75f1e175c7fe76fec2. (CVE-2023-4015) A use-after-free vulnerability in the Linux kernel&amp;apos;s net/sched: cls_route component can be exploited to achieve local privilege escalation. When route4_change() is called on an existing filter, the…</p> https://cve.radiocsirt.org/vuln/oesa-2023-1634 https://cve.radiocsirt.org/vuln/rhsa-2023:6583 <p>kernel: seg6: fix the iif in the IPv6 socket control block Kernel: race when faulting a device private page in memory manager kernel: use-after-free in l1oip timer handlers kernel: Rate limit overflow messages in r8152 in intr_callback kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: perf: Fix perf_pending_task() UaF kernel: gpiolib: fix memory leak in gpiochip_setup_dev() kernel: memcg: fix possible use-after-free in memcg_write_event_control() kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths kernel: char: tpm: Protect tpm_pm_suspend with locks kernel: ixgbevf: Fix resource leak in ixgbevf_init_module() kernel: dax: make sure inodes are flushed before destroy cache kernel: watch_queue: Actually free the watch kernel: watch_queue: Fix NULL dereference in error cleanup kernel: rtc: pl031: fix rtc features null pointer dereference kernel: tpm: fix reference counting for struct tpm_chip kernel: NFSv4: Don&#39;t hold the layoutget locks across multiple RPC calls kernel: xprtrdma: treat all calls not a bcall when bc_serv is NULL kernel: net: ipv6: unexport __init-annotated seg6_hmac_init() kernel: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). kernel: regulator: scmi: Fix refcount leak in scmi_regulator_probe kernel: mm/mempolicy: fix uninit-v…</p> <p>kernel: seg6: fix the iif in the IPv6 socket control block Kernel: race when faulting a device private page in memory manager kernel: use-after-free in l1oip timer handlers kernel: Rate limit overflow messages in r8152 in intr_callback kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: perf: Fix perf_pending_task() UaF kernel: gpiolib: fix memory leak in gpiochip_setup_dev() kernel: memcg: fix possible use-after-free in memcg_write_event_control() kernel: mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths kernel: char: tpm: Protect tpm_pm_suspend with locks kernel: ixgbevf: Fix resource leak in ixgbevf_init_module() kernel: dax: make sure inodes are flushed before destroy cache kernel: watch_queue: Actually free the watch kernel: watch_queue: Fix NULL dereference in error cleanup kernel: rtc: pl031: fix rtc features null pointer dereference kernel: tpm: fix reference counting for struct tpm_chip kernel: NFSv4: Don&#39;t hold the layoutget locks across multiple RPC calls kernel: xprtrdma: treat all calls not a bcall when bc_serv is NULL kernel: net: ipv6: unexport __init-annotated seg6_hmac_init() kernel: af_unix: Fix a data-race in unix_dgram_peer_wake_me(). kernel: regulator: scmi: Fix refcount leak in scmi_regulator_probe kernel: mm/mempolicy: fix uninit-v…</p> https://cve.radiocsirt.org/vuln/rhsa-2023:6583 https://cve.radiocsirt.org/vuln/rhsa-2023:6901 <p>kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c kernel: Rate limit overflow messages in r8152 in intr_callback kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c kernel: tun: avoid double free in tun_free_netdev kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: KVM: x86/mmu: race condition in direct_page_fault() kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c kernel: use-after-free due to race condition in qdisc_graft() kernel: x86/mm: Randomize per-cpu entry area kernel: HID: check empty report_list in hid_validate_values() kernel: sctp: fail if no bound addresses can be used for a given scope kernel: net/tls: tls_is_tx_ready() checked list_entry kernel: hid: Use After Free in asus_remove() kernel: use-after-free in drivers/media/rc/ene_ir.c due to race condition kernel: hash collisions in the IPv6 connection lookup table kernel: ovl: fix use after free in struct ovl_aio_req kernel: denial of service in tipc_conn_close kernel: use-after-free bug in remove function xgene_hwmon_remove kernel: U…</p> <p>kernel: out-of-bounds write in hw_atl_utils_fw_rpc_wait() in drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c kernel: Rate limit overflow messages in r8152 in intr_callback kernel: use after free flaw in l2cap_conn_del in net/bluetooth/l2cap_core.c kernel: tun: avoid double free in tun_free_netdev kernel: double free in usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c kernel: vmwgfx: use-after-free in vmw_cmd_res_check kernel: vmwgfx: use-after-free in vmw_execbuf_tie_context hw: Intel: Gather Data Sampling (GDS) side channel vulnerability kernel: Information leak in l2cap_parse_conf_req in net/bluetooth/l2cap_core.c kernel: KVM: x86/mmu: race condition in direct_page_fault() kernel: memory leak in ttusb_dec_exit_dvb() in media/usb/ttusb-dec/ttusb_dec.c kernel: speculative pointer dereference in do_prlimit() in kernel/sys.c kernel: use-after-free due to race condition in qdisc_graft() kernel: x86/mm: Randomize per-cpu entry area kernel: HID: check empty report_list in hid_validate_values() kernel: sctp: fail if no bound addresses can be used for a given scope kernel: net/tls: tls_is_tx_ready() checked list_entry kernel: hid: Use After Free in asus_remove() kernel: use-after-free in drivers/media/rc/ene_ir.c due to race condition kernel: hash collisions in the IPv6 connection lookup table kernel: ovl: fix use after free in struct ovl_aio_req kernel: denial of service in tipc_conn_close kernel: use-after-free bug in remove function xgene_hwmon_remove kernel: U…</p> https://cve.radiocsirt.org/vuln/rhsa-2023:6901 https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-4207 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:Pro:16.04:LTS: linux-kvm and 139 more</p> <p>A use-after-free vulnerability in the Linux kernel&#39;s net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe, Ubuntu:Pro:16.04:LTS: linux-kvm and 139 more</p> <p>A use-after-free vulnerability in the Linux kernel&#39;s net/sched: cls_fw component can be exploited to achieve local privilege escalation. When fw_change() is called on an existing filter, the whole tcf_result struct is always copied into the new instance of the filter. This causes a problem when updating a filter bound to a class, as tcf_unbind_filter() is always called on the old instance in the success path, decreasing filter_cnt of the still referenced class and allowing it to be deleted, leading to a use-after-free. We recommend upgrading past commit 76e42ae831991c828cffa8c37736ebfb831ad5ec.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2023-4207 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2284 <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um seine Privilegien zu erhöhen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um seine Privilegien zu erhöhen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2284