Summary
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: GSM multiplexing race condition leads to privilege escalation (CVE-2023-6546)
* kernel: multiple use-after-free vulnerabilities (CVE-2024-1086, CVE-2023-3567, CVE-2023-4133, CVE-2023-6932, CVE-2023-39198, CVE-2023-51043, CVE-2023-51779, CVE-2023-51780, CVE-2024-1085, CVE-2024-26582)
* kernel: Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555)
* kernel: memcg does not limit the number of POSIX file locks allowing memory exhaustion (CVE-2022-0480)
* kernel: multiple NULL pointer dereference vulnerabilities (CVE-2022-38096, CVE-2023-6622, CVE-2023-6915, CVE-2023-42754, CVE-2023-46862, CVE-2023-52574, CVE-2024-0841, CVE-2023-52448)
* kernel: integer overflow in l2cap_config_req() in net/bluetooth/l2cap_core.c (CVE-2022-45934)
* kernel: netfilter: nf_tables: out-of-bounds access in nf_tables_newtable() (CVE-2023-6040)
* kernel: GC's deletion of an SKB races with unix_stream_read_generic() leading to UAF (CVE-2023-6531)
* kernel: Out of boundary write in perf_read_group() as result of overflow a perf_event's read_size (CVE-2023-6931)
* kernel: Bluetooth Forward and Future Secrecy Attacks and Defenses (CVE-2023-24023)
* kernel: irdma: Improper access control (CVE-2023-25775)
* Kernel: double free in hci_conn_cleanup of the bluetooth subsystem (CVE-2023-28464)
* kernel: Bluetooth: HCI: global out-of-bounds access in net/bluetooth/hci_sync.c (CVE-2023-28866)
* kernel: race condition between HCIUARTSETPROTO and HCIUARTGETPROTO in hci_uart_tty_ioctl (CVE-2023-31083)
* kernel: multiple out-of-bounds read vulnerabilities (CVE-2023-37453, CVE-2023-39189, CVE-2023-39193, CVE-2023-6121, CVE-2023-39194)
* kernel: netfilter: race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP (CVE-2023-42756)
* kernel: lib/kobject.c vulnerable to fill_kobj_path out-of-bounds write (CVE-2023-45863)
* kernel: smb: client: fix potential OOBs in smb2_parse_contexts() (CVE-2023-52434)
* kernel: mm/sparsemem: fix race in accessing memory_section->usage (CVE-2023-52489)
* kernel: net: fix possible store tearing in neigh_periodic_work() (CVE-2023-52522)
* kernel: multiple memory leak vulnerabilities (CVE-2023-52529, CVE-2023-52581)
* kernel: net: bridge: data races indata-races in br_handle_frame_finish() (CVE-2023-52578)
* kernel: net/core: kernel crash in ETH_P_1588 flow dissector (CVE-2023-52580)
* kernel: net/sched: act_ct: fix skb leak and crash on ooo frags (CVE-2023-52610)
* kernel: CIFS Filesystem Decryption Improper Input Validation Remote Code Execution Vulnerability in function receive_encrypted_standard of client (CVE-2024-0565)
* kernel: tls: race between async notify and socket close (CVE-2024-26583)
* kernel: tls: handle backlogging of crypto requests (CVE-2024-26584)
* kernel: tls: race between tx work scheduling and socket close (CVE-2024-26585)
* kernel: mlxsw: spectrum_acl_tcam: Fix stack corruption (CVE-2024-26586)
* kernel: i2c: i801: Fix block process call transactions (CVE-2024-26593)
* kernel: sched/membarrier: reduce the ability to hammer on sys_membarrier (CVE-2024-26602)
* kernel: netfilter: nf_tables: reject QUEUE/DROP verdict parameters (CVE-2024-26609)
* kernel: local dos vulnerability in scatterwalk_copychunks (CVE-2023-6176)
* kernel: perf/x86/lbr: Filter vsyscall addresses (CVE-2023-52476)
* kernel: netfilter: nf_tables: disallow timeout for anonymous sets (CVE-2023-52620)
* kernel: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 62
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | bpftool | 7.3.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-debug | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-debug-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-debug-devel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-debug-devel-matched | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-debug-modules | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-debug-modules-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-debug-modules-extra | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-devel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-devel-matched | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-modules | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-modules-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-64k-modules-extra | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-abi-stablelists | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-cross-headers | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-debug | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-debug-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-debug-devel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-debug-devel-matched | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-debug-modules | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-debug-modules-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-debug-modules-extra | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-debug-uki-virt | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-devel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-devel-matched | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-doc | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-headers | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-modules | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-modules-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-modules-extra | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-debug | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-debug-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-debug-devel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-debug-modules | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-debug-modules-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-debug-modules-extra | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-devel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-modules | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-modules-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-rt-modules-extra | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-tools | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-tools-libs | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-tools-libs-devel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-uki-virt | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-zfcpdump | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-zfcpdump-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-zfcpdump-devel | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-zfcpdump-devel-matched | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-zfcpdump-modules | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-zfcpdump-modules-core | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | kernel-zfcpdump-modules-extra | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | libperf | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | perf | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | python3-perf | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | rtla | 5.14.0-427.13.1.el9_4 |
| AlmaLinux · 9 | rv | 5.14.0-427.13.1.el9_4 |
Vulnerabilities 61
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slo…
KEV May 30, 2024 -
Critical 9.8
net: tls: fix use-after-free with partial reads and async decrypt
In the Linux kernel, the following vulnerability has been resolved: net: tls: fix use-after-free with partial reads and async decrypt tls_decrypt_sg doesn't take a reference on the pages from clear_skb, so the put_page() in tls_decrypt_done releases them, and…
-
Critical 9.8
tls: fix race between async notify and socket close
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past tha…
-
Critical 9.8
net: tls: handle backlogging of crypto requests
In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY inst…
-
Critical 9.8
tls: fix race between tx work scheduling and socket close
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). …
-
High 8.8
net: fix possible store tearing in neigh_periodic_work()
In the Linux kernel, the following vulnerability has been resolved: net: fix possible store tearing in neigh_periodic_work() While looking at a related syzbot report involving neigh_periodic_work(), I found that I forgot to add an annotation when deleting an …
-
High 8.8
In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is relat…
-
High 8.1
smb: client: fix potential OOBs in smb2_parse_contexts()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing i…
-
High 7.8CVE-2022-45934 Public exploit
An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integ…
-
High 7.8
team: fix null-ptr-deref when team device type is changed
In the Linux kernel, the following vulnerability has been resolved: team: fix null-ptr-deref when team device type is changed Get a null-ptr-deref bug as follows with reproducer [1]. BUG: kernel NULL pointer dereference, address: 0000000000000228 ... RIP: 001…
-
High 7.8
netfilter: nf_tables: disallow timeout for anonymous sets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.
-
High 7.8
An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family)
An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family); While creating a new netfilter table, lack of a safeguard against invalid nf_tables family (pf) valu…
-
High 7.8CVE-2023-6931 Public exploit
Out-of-bounds write in Linux kernel's Performance Events system component
A heap out-of-bounds write vulnerability in the Linux kernel's Performance Events system component can be exploited to achieve local privilege escalation. A perf_event's read_size can overflow, leading to an heap out-of-bounds increment or write in perf_read_…
-
High 7.8
Use-after-free in Linux kernel's ipv4: igmp component
A use-after-free vulnerability in the Linux kernel's ipv4: igmp component can be exploited to achieve local privilege escalation. A race condition can be exploited to cause a timer be mistakenly registered on a RCU read locked object which is freed by another…
-
High 7.8
Use-after-free in Linux kernel's netfilter: nf_tables component
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_setelem_catchall_deactivate() function checks whether the catch-all set element is active in the current genera…
-
High 7.8
mlxsw: spectrum_acl_tcam: Fix stack corruption
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_tcam: Fix stack corruption When tc filters are first added to a net device, the corresponding local port gets bound to an ACL group in the device. The group contains a lis…
-
High 7.5
Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()
A race condition was found in the QXL driver in the Linux kernel. The qxl_mode_dumb_create() function dereferences the qobj returned by the qxl_gem_object_create_with_handle(), but the handle is the only one holding a reference to it. This flaw allows an atta…
-
High 7.5
net/sched: act_ct: fix skb leak and crash on ooo frags
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix skb leak and crash on ooo frags act_ct adds skb->users before defragmentation. If frags arrive in order, the last frag's reference is reset in: inet_frag_reasm_prepare …
-
High 7.1
Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
-
High 7.0
In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a n…
-
High 7.0
bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_…
-
High 7.0
Kernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uaf
A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
-
High 7.0CVE-2023-6546 Public exploit
Kernel: gsm multiplexing race condition leads to privilege escalation
A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem …
-
Medium 6.8
Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of client
An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.
-
Medium 6.6
Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function
A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
-
Medium 6.4
Bluetooth BR/EDR devices with Secure Simple Pairing and Secure Connections pairing in Bluetooth Core Specification 4.2 …
-
Medium 6.3
There is a NULL pointer vulnerability in vmwgfx driver
A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system t…
-
Medium 6.3
netfilter: nf_tables: fix memleak when more than 255 elements expired
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak when more than 255 elements expired When more than 255 elements expired we're supposed to switch to a new gc container structure. This never happens: u8 type…
-
Medium 6.2
Kernel: null pointer dereference vulnerability in ida_free in lib/idr.c
A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.
-
Medium 6.1
Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()
A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosu…
-
Medium 6.0
HID: sony: Fix a potential memory leak in sony_probe()
In the Linux kernel, the following vulnerability has been resolved: HID: sony: Fix a potential memory leak in sony_probe() If an error occurs after a successful usb_alloc_urb() call, usb_free_urb() should be called.
-
Medium 5.6
Improper access control in the Intel(R) Ethernet Controller RDMA driver for linux before version 1.9.30 may allow an un…
-
Medium 5.5
Kernel: cxgb4: use-after-free in ch_flower_stats_cb()
A use-after-free vulnerability was found in the cxgb4 driver in the Linux kernel. The bug occurs when the cxgb4 device is detaching due to a possible rearming of the flower_stats_timer from the work queue. This flaw allows a local user to crash the system, ca…
-
Medium 5.5
Kernel: ipv4: null pointer dereference in ipv4_send_dest_unreach()
A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allo…
-
Medium 5.5
Kernel: null pointer dereference vulnerability in nft_dynset_init()
A null pointer dereference vulnerability was found in nft_dynset_init() in net/netfilter/nft_dynset.c in nf_tables in the Linux kernel. This issue may allow a local attacker with CAP_NET_ADMIN user privilege to trigger a denial of service.
-
Medium 5.5
ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken. Reading frag_off can only be done if we pulled enough…
-
Medium 5.3
In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_ini…
-
Medium 5.1
Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()
A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading…
-
Medium 4.7
Kernel: local dos vulnerability in scatterwalk_copychunks
A null pointer dereference flaw was found in the Linux kernel API for the cryptographic algorithm scatterwalk functionality. This issue occurs when a user constructs a malicious packet with specific socket configuration, which could allow a local user to cras…
-
Medium 4.6
An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2. There is an out-of-bounds and crash in …
-
Medium 4.4
Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swap
A flaw was found in the Netfilter subsystem of the Linux kernel. A race condition between IPSET_CMD_ADD and IPSET_CMD_SWAP can lead to a kernel panic due to the invocation of `__ip_set_put` on a wrong `set`. This issue may allow a local user to crash the syst…
-
Medium 4.3
Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_get
An out-of-bounds read vulnerability was found in the NVMe-oF/TCP subsystem in the Linux kernel. This issue may allow a remote attacker to send a crafted TCP packet, triggering a heap-based buffer overflow that results in kmalloc data being printed and potenti…
-
Medium 4.0
KVM: s390: fix setting of fpc register
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control (fpc) register of a guest cpu. The new value is tested for validity by temporaril…
-
Low 3.2
Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()
A flaw was found in the XFRM subsystem in the Linux kernel. The specific flaw exists within the processing of state filters, which can result in a read past the end of an allocated buffer. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigge…
-
Unscored —
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated…
-
Unscored —
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory ex…
-
Unscored —
hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_co…
-
Unscored —
An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2. In hci_uart_tty_ioctl, there is a rac…
-
Unscored —
An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a …
-
Unscored —
An issue was discovered in the Linux kernel through 6.5.9. During a race with SQ thread exit, an io_uring/fdinfo.c io_u…
-
Unscored —
An issue was discovered in the Linux kernel before 6.6.8. do_vcc_ioctl in net/atm/ioctl.c has a use-after-free because …
-
Unscored —
gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Syzkaller has reported a NULL pointer dereference when accessing rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating rgd…
-
Unscored —
perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() Get logical socket id instead of physical id in discover_upi_topology() to avoid out-of-bound access on 'upi =…
-
Unscored —
perf/x86/lbr: Filter vsyscall addresses
In the Linux kernel, the following vulnerability has been resolved: perf/x86/lbr: Filter vsyscall addresses We found that a panic can occur when a vsyscall is made while LBR sampling is active. If the vsyscall is interrupted (NMI) for perf sampling, this call…
-
Unscored —
mm/sparsemem: fix race in accessing memory_section->usage
In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are su…
-
Unscored —
net: bridge: use DEV_STATS_INC()
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use DEV_STATS_INC() syzbot/KCSAN reported data-races in br_handle_frame_finish() [1] This function can run from multiple cpus without mutual exclusion. Adopt SMP safe DEV_STATS_I…
-
Unscored —
net/core: Fix ETH_P_1588 flow dissector
In the Linux kernel, the following vulnerability has been resolved: net/core: Fix ETH_P_1588 flow dissector When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to __skb_flow_dissect, nhoff value calculation is w…
-
Unscored —
i2c: i801: Fix block process call transactions
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the…
-
Unscored —
sched/membarrier: reduce the ability to hammer on sys_membarrier
In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in …
-
Unscored —CVE-2024-26609 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
blk-mq: fix IO hang from sbitmap wakeup race
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. …
References
-
report
https://bugzilla.redhat.com/1918601
-
report
https://bugzilla.redhat.com/2049700
-
report
https://bugzilla.redhat.com/2133452
-
report
https://bugzilla.redhat.com/2151959
-
report
https://bugzilla.redhat.com/2177759
-
report
https://bugzilla.redhat.com/2185519
-
report
https://bugzilla.redhat.com/2188102
-
report
https://bugzilla.redhat.com/2210024
-
report
https://bugzilla.redhat.com/2213132
-
report
https://bugzilla.redhat.com/2218332
-
report
https://bugzilla.redhat.com/2219359
-
report
https://bugzilla.redhat.com/2221039
-
report
https://bugzilla.redhat.com/2221463
-
report
https://bugzilla.redhat.com/2221702
-
report
https://bugzilla.redhat.com/2226777
-
report
https://bugzilla.redhat.com/2226787
-
report
https://bugzilla.redhat.com/2226788
-
report
https://bugzilla.redhat.com/2231410
-
report
https://bugzilla.redhat.com/2239845
-
report
https://bugzilla.redhat.com/2239848
-
report
https://bugzilla.redhat.com/2244720
-
report
https://bugzilla.redhat.com/2246980
-
report
https://bugzilla.redhat.com/2250043
-
report
https://bugzilla.redhat.com/2252731
-
report
https://bugzilla.redhat.com/2253034
-
report
https://bugzilla.redhat.com/2253632
-
report
https://bugzilla.redhat.com/2254961
-
report
https://bugzilla.redhat.com/2254982
-
report
https://bugzilla.redhat.com/2255283
-
report
https://bugzilla.redhat.com/2255498
-
report
https://bugzilla.redhat.com/2256490
-
report
https://bugzilla.redhat.com/2256822
-
report
https://bugzilla.redhat.com/2257682
-
report
https://bugzilla.redhat.com/2258013
-
report
https://bugzilla.redhat.com/2258518
-
report
https://bugzilla.redhat.com/2260005
-
report
https://bugzilla.redhat.com/2262126
-
report
https://bugzilla.redhat.com/2262127
-
report
https://bugzilla.redhat.com/2265285