|
KASAN: use-after-free Read in filemap_map_pages
prio:high
actionable
bridge
|
19 |
C |
|
|
5 |
69d |
158d
|
2/29 |
never |
xarray: fix index jumping backwards in xas_find()
|
|
KASAN: slab-use-after-free Write in usb_free_urb
prio:high
actionable
usb
|
22 |
syz, C |
|
|
11 |
9d11h |
97d
|
26/29 |
never |
402a9d6aab7a
ALSA: caiaq: Decoupling ep1_in_urb in caiaq dev
6802ad4b6b26
media: hackrf: fix use-after-free in hackrf_alloc_urbs() error path
|
|
KASAN: slab-use-after-free Read in snd_card_free
actionable
prio:high
sound
|
19 |
|
|
|
1 |
71d |
50d
|
26/29 |
never |
fbaccb1b19c7
ALSA: hda: intel: Don't free card in the probe work
|
|
KASAN: slab-use-after-free Read in add_to_unconfirmed
prio:high
actionable
nfs
|
19 |
|
|
|
2 |
33d |
28d
|
2/29 |
never |
NFSD: Don't start nfsd threads from a pool_threads write
|
|
KASAN: slab-use-after-free Read in usa49_glocont_callback
prio:high
actionable
usb
|
19 |
C |
|
|
7 |
43d |
85d
|
26/29 |
never |
33c920f7c595
USB: serial: fix port tear down use-after-free
|
|
KASAN: slab-use-after-free Read in add_root_to_dirty_list
prio:normal
actionable
btrfs
|
19 |
|
|
|
4 |
25d |
30d
|
22/29 |
never |
58e844c3ba38
btrfs: fix use-after-free on quota enable allocation failure
btrfs: fix use-after-free on quota enable allocation failure
|
|
KASAN: slab-use-after-free Write in dev_config
usb
prio:normal
actionable
|
22 |
|
|
|
2 |
47d |
1d00h
|
0/29 |
never |
cb3b441f2698 ("usb: gadget: fix refcount underflow in gadgetfs_bind() error path")
|
|
KASAN: slab-use-after-free Read in fuse_dev_do_write
prio:high
actionable
fuse
|
19 |
|
|
|
1 |
93d |
86d
|
27/29 |
never |
64b0b5cacbd2
fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
|
|
KASAN: slab-use-after-free Read in gfs2_remove_from_ail
prio:high
actionable
gfs2
|
19 |
|
|
|
7 |
16d |
58d
|
2/29 |
never |
gfs2: keep glocks alive while AIL entries exist
|
|
KASAN: slab-use-after-free Write in ms_read_bytes
prio:high
actionable
mmc
|
22 |
|
|
|
36 |
14d |
45d
|
26/29 |
never |
aa0a37b5024d
memstick: core: wait for request completion before freeing card
|
|
KASAN: slab-use-after-free Read in nvmf_free_options
prio:normal
actionable
nvme
|
19 |
|
|
|
4 |
64d |
87d
|
27/29 |
never |
56e6279266f6
nvme-fc: fix double free of fabrics options when nvme_add_ctrl() fails
|
|
KASAN: slab-use-after-free Read in dentry_name
prio:normal
actionable
overlayfs
|
19 |
|
|
|
2 |
41d |
47d
|
26/29 |
never |
ae146bc1abde
ovl: fix UAF in ovl_do_mkdir() debug print
|
|
KASAN: slab-use-after-free Read in ring_buffer_iter_advance
prio:normal
actionable
trace
|
19 |
|
|
|
1 |
99d |
95d
|
28/29 |
never |
bf98d7b0d5a9
ring-buffer: Prevent subbuf order change when resizing is disabled
|
|
KASAN: slab-use-after-free Read in serial_core_unregister_port
prio:high
actionable
serial
|
19 |
C |
|
|
3 |
67d |
100d
|
26/29 |
never |
499485a67fba
serial: core: fix NULL pointer dereference in serial_core_unregister_port()
|
|
KASAN: slab-use-after-free Read in smb2_reconnect_server
prio:high
actionable
cifs
|
19 |
|
|
|
2 |
56d |
56d
|
26/29 |
never |
c65eae6f61d1
smb: client: cancel reconnect work in clean_demultiplex_info()
|
|
KASAN: slab-use-after-free Read in cifs_crypto_secmech_release
prio:normal
actionable
cifs
|
19 |
|
|
|
1 |
22d |
18d
|
26/29 |
never |
482c117c6dbe
smb: client: hold server info until cifsd exits
|
|
KASAN: slab-use-after-free Write in release_tty
prio:normal
actionable
serial
|
22 |
syz, C |
error |
|
7 |
31d |
87d
|
2/29 |
never |
usb: gadget: u_serial: pin ports while TTYs are installed
|
|
KASAN: use-after-free Read in ptdump_pte_entry (2)
actionable
prio:normal
mm
|
19 |
|
|
|
1 |
156d |
150d
|
29/29 |
53d |
26444eb71465
mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF
|
|
KASAN: slab-use-after-free Read in netdev_register_kobject (2)
prio:high
actionable
driver-core
|
19 |
|
|
|
3 |
153d |
158d
|
29/29 |
81d |
bb067a99a035
Bluetooth: bnep: pin L2CAP connection during netdev registration
|
|
KASAN: slab-use-after-free Write in bt_accept_dequeue
prio:high
actionable
bluetooth
|
22 |
|
|
|
3 |
140d |
140d
|
29/29 |
81d |
4bd0b274054f
Bluetooth: fix UAF in bt_accept_dequeue()
|
|
KASAN: slab-use-after-free Write in btrfs_put_root
prio:high
actionable
btrfs
|
22 |
|
|
|
4 |
146d |
157d
|
29/29 |
90d |
83201804efa4
btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()
|
|
KASAN: slab-use-after-free Write in iowarrior_write_callback (2)
actionable
prio:high
usb
|
22 |
|
|
|
1 |
183d |
171d
|
29/29 |
100d |
bc0e4f16c44e
USB: iowarrior: fix use-after-free on disconnect
|
|
KASAN: slab-use-after-free Read in bnep_add_connection
actionable
prio:normal
bluetooth
|
19 |
|
|
|
1 |
171d |
164d
|
29/29 |
113d |
59e932ded949
Bluetooth: bnep: Fix UAF read of dev->name
|
|
KASAN: slab-use-after-free Read in shrink_dcache_tree
prio:high
actionable
fs
|
19 |
|
|
|
2 |
141d |
142d
|
29/29 |
114d |
89038cc87d80
locking/rt: Fix the incorrect RCU protection in rt_spin_unlock()
|
|
KASAN: slab-use-after-free Read in dma_buf_fd
actionable
prio:high
dri
media
|
19 |
|
|
|
21 |
172d |
240d
|
29/29 |
114d |
ead6680f354f
dma-buf: fix UAF in dma_buf_fd() tracepoint
|
|
KASAN: slab-use-after-free Read in fb_mode_is_equal
actionable
prio:high
fbdev
|
19 |
|
|
|
3 |
154d |
149d
|
29/29 |
114d |
2c1c805c65fb
fbdev: fix use-after-free in store_modes()
|
|
KASAN: slab-use-after-free Read in ipvlan_hard_header (4)
prio:high
actionable
net
|
19 |
|
|
|
2 |
186d |
147d
|
29/29 |
114d |
f4c3d89fc986
tipc: fix UAF in tipc_l2_send_msg()
|
|
KASAN: slab-use-after-free Read in replace_file_extents
actionable
prio:high
btrfs
|
19 |
|
|
|
1 |
172d |
158d
|
29/29 |
114d |
ae2eb64bfd97
btrfs: fix use-after-free after relocation failure with concurrent COW
|
|
KASAN: slab-use-after-free Write in rsi_91x_deinit
actionable
prio:high
wireless
|
22 |
|
|
|
1 |
206d |
200d
|
29/29 |
168d |
db57a1aa54ff
wifi: rsi: fix kthread lifetime race between self-exit and external-stop
|
|
KASAN: use-after-free Write in ocfs2_write_end_nolock
actionable
prio:high
ocfs2
|
22 |
|
|
|
26 |
180d |
218d
|
29/29 |
169d |
7bc5da4842be
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
|