Summary
In the Linux kernel, the following vulnerability has been
resolved: nfsd: fix use-after-free due to delegation race A delegation
break could arrive as soon as we've called vfs_setlease. A delegation break
runs a callback which immediately (in nfsd4_cb_recall_prepare) adds the
delegation to del_recall_lru. If we then exit nfs4_set_delegation without
hashing the delegation, it will be freed as soon as the callback is done
with it, without ever being removed from del_recall_lru. Symptoms show up
later as use-after-free or list corruption warnings, usually in the
laundromat thread. I suspect aba2072f4523 'nfsd: grant read delegations to
clients holding writes' made this bug easier to hit, but I looked as far
back as v3.0 and it looks to me it already had the same problem. So I'm not
sure where the bug was introduced; it may have been there from the
beginning.)(CVE-2021-47506)
Jann Horn discovered that the watch_queue event notification subsystem in
the Linux kernel contained an out-of-bounds write vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
escalate their privileges.)(CVE-2022-0995)
In the Linux kernel, the following vulnerability has been
resolved: net: atlantic: eliminate double free in error handling logic
Driver has a logic leak in ring data allocation/free, where aq_ring_free
could be called multiple times on same ring, if system is under stress and
got memory allocation error. Ring pointer was used as an indicator of
failure, but this is not correct since only ring data is
allocated/deallocated. Ring itself is an array member. Changing ring
allocation functions to return error code directly. This simplifies error
handling and eliminates aq_ring_free on higher layer.)(CVE-2023-52664)
In the Linux kernel, the following vulnerability has been
resolved: ceph: prevent use-after-free in encode_cap_msg() In
fs/ceph/caps.c, in encode_cap_msg(), 'use after free' error was caught by
KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies
before the refcount could be increment here, it was freed. In same file, in
'handle_cap_grant()' refcount is decremented by this line -
'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and
resource was freed by the latter line before the former line could
increment it. encode_cap_msg() is called by __send_cap() and __send_cap()
is called by ceph_check_caps() after calling __prep_cap(). __prep_cap() is
where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot
where the refcount must be increased to prevent 'use after free' error.)(CVE-2024-26689)
In the Linux kernel, the following vulnerability has been
resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break()
Skip sessions that are being teared down (status == SES_EXITING) to avoid
UAF.)(CVE-2024-35864)
In the Linux kernel, the following vulnerability has been
resolved: HID: core: zero-initialize the report buffer Since the report
buffer is used by all kinds of drivers in various ways, let's zero-
initialize it during allocation to make sure that it can't be ever used to
leak kernel memory via specially-crafted report.)(CVE-2024-50302)
In the Linux kernel, the following vulnerability has been
resolved: media: dvbdev: prevent the risk of out of memory access The
dvbdev contains a static variable used to store dvb minors. The behavior of
it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. When not set,
dvb_register_device() won't check for boundaries, as it will rely that a
previous call to dvb_register_adapter() would already be enforcing it. On a
similar way, dvb_device_open() uses the assumption that the register
functions already did the needed checks. This can be fragile if some device
ends using different calls. This also generate warnings on static check
analysers like Coverity. So, add explicit guards to prevent potential risk
of OOM issues.)(CVE-2024-53063)
In the Linux kernel, the following vulnerability has been
resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock
sources The current USB-audio driver code doesn't check bLength of each
descriptor at traversing for clock descriptors. That is, when a device
provides a bogus descriptor with a shorter bLength, the driver might hit
out-of-bounds reads. For addressing it, this patch adds sanity checks to
the validator functions for the clock descriptor traversal. When the
descriptor length is shorter than expected, it's skipped in the loop. For
the clock source and clock multiplier descriptors, we can just check
bLength against the sizeof() of each descriptor type. OTOH, the clock
selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and
two more fields at its tail, hence those have to be checked in addition to
the sizeof() check.)(CVE-2024-53150)
In the Linux kernel, the following vulnerability has been
resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG:
KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 (CVE-2024-53168)
In the Linux kernel, the following vulnerability has been
resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy
and Mbox devices A bogus device can provide a bNumConfigurations value that
exceeds the initial value used in usb_get_configuration for allocating
dev->config. This can lead to out-of-bounds accesses later, e.g. in
usb_destroy_configuration.)(CVE-2024-53197)
In the Linux kernel, the following vulnerability has been
resolved: drm/amdgpu: fix usage slab after free [ +0.000021] BUG: KASAN:
slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 (CVE-2024-56551)
In the Linux kernel, the following vulnerability has been
resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in
brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in
brcmfmac that occurs when a high 'sd_sgentry_align' value applies (e.g.
512) and a lot of queued SKBs are sent from the pkt queue. The problem is
the number o
Fixed packages 39
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux | 4.4.0-278.312 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws | 4.4.0-1190.205 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-aws-hwe | 4.15.0-1189.202~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-azure | 4.15.0-1197.212~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-gcp | 4.15.0-1182.199~16.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | linux-hwe | 4.15.0-247.259~16.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux | 4.15.0-247.259 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-aws | 4.15.0-1189.202 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-azure-4.15 | 4.15.0-1197.212 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-gcp-4.15 | 4.15.0-1182.199 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-hwe-5.4 | 5.4.0-218.238~18.04.1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | linux-oracle | 4.15.0-1151.162 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux | 5.4.0-218.238 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws | 5.4.0-1147.157 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws-5.15 | 5.15.0-1086.93~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure | 5.4.0-1152.159 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-azure-5.15 | 5.15.0-1091.100~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp | 5.4.0-1150.159 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp-5.15 | 5.15.0-1085.94~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gkeop | 5.4.0-1037.38 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-hwe-5.15 | 5.15.0-142.152~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm | 5.4.0-1093.98 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm-5.15 | 5.15.0-1078.81~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-lowlatency-hwe-5.15 | 5.15.0-142.152~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-oracle | 5.4.0-1145.155 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-oracle-5.15 | 5.15.0-1083.89~20.04.1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux | 5.15.0-141.151 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-aws | 5.15.0-1085.92 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-azure | 5.15.0-1090.99 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gcp | 5.15.0-1084.93 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-gke | 5.15.0-1082.88 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-ibm | 5.15.0-1077.80 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | linux-oracle | 5.15.0-1082.88 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux | 6.8.0-59.61 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-aws | 6.8.0-1028.30 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-azure | 6.8.0-1028.33 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-gcp | 6.8.0-1029.31 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-ibm | 6.8.0-1025.25 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | linux-oracle | 6.8.0-1025.26 |
Vulnerabilities 16
-
High 7.8
An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This…
KEV Aug 26, 2026 -
High 7.8CVE-2024-53197 Exploited
ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usb_get_configura…
KEV Apr 9, 2025 -
High 7.1CVE-2024-53150 Exploited
ALSA: usb-audio: Fix out of bounds reads when finding clock sources
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out of bounds reads when finding clock sources The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, wh…
KEV Apr 9, 2025 -
Medium 5.5CVE-2024-50302 Exploited
HID: core: zero-initialize the report buffer
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be …
KEV Mar 4, 2025 -
Critical 9.8
nfsd: fix use-after-free due to delegation race
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix use-after-free due to delegation race A delegation break could arrive as soon as we've called vfs_setlease. A delegation break runs a callback which immediately (in nfsd4_cb_recall_…
-
Critical 9.8
smb: client: fix potential UAF in smb2_is_valid_lease_break()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential UAF in smb2_is_valid_lease_break() Skip sessions that are being teared down (status == SES_EXITING) to avoid UAF.
-
High 8.8
ceph: prevent use-after-free in encode_cap_msg()
In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg() In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This imp…
-
High 8.8
Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump hci_devcd_append may lead to the release of the skb, so it cannot be accessed once it is called. ========================================…
-
High 7.8
net: atlantic: eliminate double free in error handling logic
In the Linux kernel, the following vulnerability has been resolved: net: atlantic: eliminate double free in error handling logic Driver has a logic leak in ring data allocation/free, where aq_ring_free could be called multiple times on same ring, if system is…
-
High 7.8
media: dvbdev: prevent the risk of out of memory access
In the Linux kernel, the following vulnerability has been resolved: media: dvbdev: prevent the risk of out of memory access The dvbdev contains a static variable used to store dvb minors. The behavior of it depends if CONFIG_DVB_DYNAMIC_MINORS is set or not. …
-
High 7.8
sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket
In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket BUG: KASAN: slab-use-after-free in tcp_write_timer_handler+0x156/0x3e0 Read of size 1 at addr ffff888111f322cd by task swapper/0/0…
-
High 7.8
drm/amdgpu: fix usage slab after free
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free [ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000027] Read of size 8 at addr ffff8881b8605f88 by ta…
-
High 7.8
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
In the Linux kernel, the following vulnerability has been resolved: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bai…
-
High 7.8
drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() While receiving an MST up request message from one thread in drm_dp_mst_handle_up_req(), the MST topology could b…
-
High 7.1
jfs: array-index-out-of-bounds fix in dtReadFirst
In the Linux kernel, the following vulnerability has been resolved: jfs: array-index-out-of-bounds fix in dtReadFirst The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case.
-
Medium 5.5
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' valu…
References
-
report
https://ubuntu.com/security/CVE-2021-47506
-
report
https://ubuntu.com/security/CVE-2022-0995
-
report
https://ubuntu.com/security/CVE-2023-52664
-
report
https://ubuntu.com/security/CVE-2024-26689
-
report
https://ubuntu.com/security/CVE-2024-35864
-
report
https://ubuntu.com/security/CVE-2024-50302
-
report
https://ubuntu.com/security/CVE-2024-53063
-
report
https://ubuntu.com/security/CVE-2024-53150
-
report
https://ubuntu.com/security/CVE-2024-53168
-
report
https://ubuntu.com/security/CVE-2024-53197
-
report
https://ubuntu.com/security/CVE-2024-56551
-
report
https://ubuntu.com/security/CVE-2024-56593
-
report
https://ubuntu.com/security/CVE-2024-56595
-
report
https://ubuntu.com/security/CVE-2024-56598
-
report
https://ubuntu.com/security/CVE-2024-56653
-
report
https://ubuntu.com/security/CVE-2024-57798