QID 354775

A flaw was found in the linux kernel's layer 2 tunneling protocol (l2tp).
A missing lock when clearing sk_user_data can lead to a race condition and null pointer dereference.
A local user could use this flaw to potentially crash the system causing a denial of service. (
( CVE-2022-4129) in the linux kernel before 6.1.6, a null pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands.
This affects qdisc_graft in net/sched/sch_api.c. (
( CVE-2022-47929) the linux kernel does not correctly mitigate smt attacks, as discovered through a strange pattern in the kernel api using stibp as a mitigation, leaving the process exposed for a short period of time after a syscall.
The kernel also does not issue an ibpb immediately during the syscall. (
( CVE-2023-0045) a null pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the linux kernel.
This flaw causes the system to crash. (
( CVE-2023-0394) cbq_classify in net/sched/sch_cbq.c in the linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a tc_act_shot condition rather than valid classification results). (
( CVE-2023-23454) atm_tc_enqueue in net/sched/sch_atm.c in the linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confusion (non-negative numbers can sometimes indicate a tc_act_shot condition rather than valid classification results). (
( CVE-2023-23455)

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.