Fixed packages 59
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | bpftool-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debug-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debug-devel | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debug-devel-matched | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo-common-aarch64 | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo-common-ppc64le | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo-common-s390x | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-debuginfo-common-x86_64 | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-devel | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-devel-matched | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-doc | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-tools-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-zfcpdump-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-zfcpdump-devel | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | kernel-zfcpdump-devel-matched | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | perf | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | perf-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | python3-perf-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | bpftool | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | bpftool-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-abi-stablelists | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-core | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-core | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-modules | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debug-modules-extra | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo-common-aarch64 | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo-common-ppc64le | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo-common-s390x | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-debuginfo-common-x86_64 | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-modules | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-modules-extra | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-tools | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-tools-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-tools-libs | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-core | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-modules | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | kernel-zfcpdump-modules-extra | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | perf-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | python3-perf | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::baseos | python3-perf-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | bpftool-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debug-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo-common-aarch64 | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo-common-ppc64le | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo-common-s390x | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-debuginfo-common-x86_64 | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-tools-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-tools-libs-devel | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | kernel-zfcpdump-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | perf-debuginfo | 0:5.14.0-162.6.1.el9_1 |
| Red Hat · RHEL 9 enterprise_linux:9::crb | python3-perf-debuginfo | 0:5.14.0-162.6.1.el9_1 |
Vulnerabilities 196
-
Medium 5.3
It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-…
KEV Jun 26, 2024 -
Critical 9.8
inet: fully convert sk->sk_rx_dst to RCU rules
In the Linux kernel, the following vulnerability has been resolved: inet: fully convert sk->sk_rx_dst to RCU rules syzbot reported various issues around early demux, one being included in this changelog [1] sk->sk_rx_dst is using RCU protection without clearl…
-
Critical 9.8
nvme-rdma: destroy cm id before destroy qp to avoid use after free
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: destroy cm id before destroy qp to avoid use after free We should always destroy cm_id before destroy qp to avoid to get cma event after qp was destroyed, which may lead to use aft…
-
Critical 9.8
skbuff: fix coalescing for page_pool fragment recycling
In the Linux kernel, the following vulnerability has been resolved: skbuff: fix coalescing for page_pool fragment recycling Fix a use-after-free when using page_pool with page fragments. We encountered this problem during normal RX in the hns3 driver: (1) Ini…
-
Critical 9.8
NFSv4: Fix free of uninitialized nfs4_label on referral lookup.
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix free of uninitialized nfs4_label on referral lookup. Send along the already-allocated fattr along with nfs4_fs_locations, and drop the memcpy of fattr. We end up growing two more a…
-
Critical 9.8
netfilter: conntrack: re-fetch conntrack after insertion
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: re-fetch conntrack after insertion In case the conntrack is clashing, insertion can free skb->_nfct and set skb->_nfct to the already-confirmed entry. This wasn't found …
-
High 8.8
ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() Some time ago 8965779d2c0e ("ipv6,mcast: always hold idev->lock before mca_lock") switched ipv6_get_lladdr() to __ipv6_get_lladdr(), whi…
-
High 8.8
ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855
In the Linux kernel, the following vulnerability has been resolved: ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855 Commit b4a0f54156ac ("ath11k: move peer delete after vdev stop of station for QCA6390 and WCN6855") is to fix firmwar…
-
High 8.8
Improper restriction of operations within the bounds of a memory buffer in some Intel(R) i915 Graphics drivers for linu…
-
High 8.4
firmware: arm_scmi: Fix list protocols enumeration in the base protocol
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix list protocols enumeration in the base protocol While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned…
-
High 8.2CVE-2023-2008 Public exploit
Kernel: udmabuf: improper validation of array index leading to local privilege escalation
A flaw was found in the Linux kernel's udmabuf device driver, within a fault handler. This issue occurs due to the lack of proper validation of user-supplied data, which can result in memory access past the end of an array. This may allow an attacker to escal…
-
High 7.8
veth: ensure skb entering GRO are not cloned.
In the Linux kernel, the following vulnerability has been resolved: veth: ensure skb entering GRO are not cloned. After commit d3256efd8e8b ("veth: allow enabling NAPI even without XDP"), if GRO is enabled on a veth device and TSO is disabled on the peer devi…
-
High 7.8
ethtool: do not perform operations on net devices being unregistered
In the Linux kernel, the following vulnerability has been resolved: ethtool: do not perform operations on net devices being unregistered There is a short period between a net device starts to be unregistered and when it is actually gone. In that time frame et…
-
High 7.8
KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Zap _all_ roots when unmapping gfn range in TDP MMU Zap both valid and invalid roots when zapping/unmapping a gfn range, as KVM must ensure it holds no references to the freed p…
-
High 7.8
Revert "Revert "block, bfq: honor already-setup queue merges""
In the Linux kernel, the following vulnerability has been resolved: Revert "Revert "block, bfq: honor already-setup queue merges"" A crash [1] happened to be triggered in conjunction with commit 2d52c58b9c9b ("block, bfq: honor already-setup queue merges"). T…
-
High 7.8CVE-2022-29581 Public exploit
Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to cause privilege …
-
High 7.8
ALSA: hda: Fix UAF of leds class devs at unbinding
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-…
-
High 7.8
vsock: remove vsock from connected table when connect is interrupted by a signal
In the Linux kernel, the following vulnerability has been resolved: vsock: remove vsock from connected table when connect is interrupted by a signal vsock_connect() expects that the socket could already be in the TCP_ESTABLISHED state when the connecting task…
-
High 7.8
netfilter: fix use-after-free in __nf_register_net_hook()
In the Linux kernel, the following vulnerability has been resolved: netfilter: fix use-after-free in __nf_register_net_hook() We must not dereference @new_hooks after nf_hook_mutex has been released, because other threads might have freed our allocated hooks …
-
High 7.8
mt76: mt7921: fix crash when startup fails.
In the Linux kernel, the following vulnerability has been resolved: mt76: mt7921: fix crash when startup fails. If the nic fails to start, it is possible that the reset_work has already been scheduled. Ensure the work item is canceled so we do not have use-af…
-
High 7.8
block, bfq: don't move oom_bfqq
In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oom_bfqq Our test report a UAF: [ 2073.019181] ================================================================== [ 2073.019188] BUG: KASAN: use-after-free in __bfq_put…
-
High 7.8
xsk: Fix race at socket teardown
In the Linux kernel, the following vulnerability has been resolved: xsk: Fix race at socket teardown Fix a race in the xsk socket teardown code that can lead to a NULL pointer dereference splat. The current xsk unbind code in xsk_unbind_dev() starts by settin…
-
High 7.8
exec: Force single empty string when argv is empty
In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name o…
-
High 7.8
dm: fix use-after-free in dm_cleanup_zoned_dev()
In the Linux kernel, the following vulnerability has been resolved: dm: fix use-after-free in dm_cleanup_zoned_dev() dm_cleanup_zoned_dev() uses queue, so it must be called before blk_cleanup_disk() starts its killing: blk_cleanup_disk->blk_cleanup_queue()->k…
-
High 7.8
ALSA: pcm: Fix races among concurrent prealloc proc writes
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent prealloc proc writes We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some…
-
High 7.8
mac80211: fix potential double free on mesh join
In the Linux kernel, the following vulnerability has been resolved: mac80211: fix potential double free on mesh join While commit 6a01afcf8468 ("mac80211: mesh: Free ie data when leaving mesh") fixed a memory leak on mesh leave / teardown it introduced a pote…
-
High 7.8
ALSA: pcm: Fix races among concurrent hw_params and hw_free calls
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which…
-
High 7.8
ALSA: oss: Fix PCM OSS buffer allocation overflow
In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fix PCM OSS buffer allocation overflow We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the res…
-
High 7.8
ext4: avoid cycles in directory h-tree
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid cycles in directory h-tree A maliciously corrupted filesystem can contain cycles in the h-tree stored inside a directory. That can easily lead to the kernel corrupting tree nodes …
-
High 7.8
ext4: fix use-after-free in ext4_rename_dir_prepare
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_rename_dir_prepare We got issue as follows: EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue ext4_get_first_dir_block: bh->b_data=0…
-
High 7.8
bfq: Make sure bfqg for which we are queueing requests is online
In the Linux kernel, the following vulnerability has been resolved: bfq: Make sure bfqg for which we are queueing requests is online Bios queued into BFQ IO scheduler can be associated with a cgroup that was already offlined. This may then cause insertion of …
-
High 7.8
bfq: Avoid merging queues with different parents
In the Linux kernel, the following vulnerability has been resolved: bfq: Avoid merging queues with different parents It can happen that the parent of a bfqq changes between the moment we decide two queues are worth to merge (and set bic->stable_merge_bfqq) an…
-
High 7.8
bfq: Update cgroup information before merging bio
In the Linux kernel, the following vulnerability has been resolved: bfq: Update cgroup information before merging bio When the process is migrated to a different cgroup (or in case of writeback just starts submitting bios associated with a different cgroup) b…
-
High 7.8
iommu/arm-smmu-v3-sva: Fix mm use-after-free
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu-v3-sva: Fix mm use-after-free We currently call arm64_mm_context_put() without holding a reference to the mm, which can result in use-after-free. Call mmgrab()/mmdrop() to ensu…
-
High 7.8
blk-throttle: Set BIO_THROTTLED when bio has been throttled
In the Linux kernel, the following vulnerability has been resolved: blk-throttle: Set BIO_THROTTLED when bio has been throttled 1.In current process, all bio will set the BIO_THROTTLED flag after __blk_throtl_bio(). 2.If bio needs to be throttled, it will sta…
-
High 7.8
loop: implement ->free_disk
In the Linux kernel, the following vulnerability has been resolved: loop: implement ->free_disk Ensure that the lo_device which is stored in the gendisk private data is valid until the gendisk is freed. Currently the loop driver uses a lot of effort to make s…
-
High 7.8
ALSA: usb-audio: Cancel pending work at closing a MIDI substream
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime…
-
High 7.8
x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave)
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: KVM: Set the base guest FPU uABI size to sizeof(struct kvm_xsave) Set the starting uABI size of KVM's guest FPU to 'struct kvm_xsave', i.e. to KVM's historical uABI size. When saving…
-
High 7.8
sfc: fix use after free when disabling sriov
In the Linux kernel, the following vulnerability has been resolved: sfc: fix use after free when disabling sriov Use after free is detected by kfence when disabling sriov. What was read after being freed was vf->pci_dev: it was freed from pci_disable_sriov an…
-
High 7.8
mptcp: fix race on unaccepted mptcp sockets
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race on unaccepted mptcp sockets When the listener socket owning the relevant request is closed, it frees the unaccepted subflows and that causes later deletion of the paired MPTCP…
-
High 7.8
igb: fix a use-after-free issue in igb_clean_tx_ring
In the Linux kernel, the following vulnerability has been resolved: igb: fix a use-after-free issue in igb_clean_tx_ring Fix the following use-after-free bug in igb_clean_tx_ring routine when the NIC is running in XDP mode. The issue can be triggered redirect…
-
High 7.8
netfilter: flowtable: fix stuck flows on cleanup due to pending work
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix stuck flows on cleanup due to pending work To clear the flow table on flow table free, the following sequence normally happens in order: 1) gc_step work is stopped t…
-
High 7.8
netfilter: nf_tables: possible module reference underflow in error path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: possible module reference underflow in error path dst->ops is set on when nft_expr_clone() fails, but module refcount has not been bumped yet, therefore nft_expr_destroy…
-
High 7.8
posix-cpu-timers: Cleanup CPU timers before freeing them during exec
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Cleanup CPU timers before freeing them during exec Commit 55e8c8eb2c7b ("posix-cpu-timers: Store a reference to a pid not a task") started looking up tasks by PID when delet…
-
High 7.8
netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table When doing lookups for chains on the same batch by using its ID, a chain from a different table can be used. If a rule is…
-
High 7.8
netfilter: nf_tables: do not allow SET_ID to refer to another table
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not allow SET_ID to refer to another table When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the tab…
-
High 7.8
bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data In tcp_bpf_send_verdict() redirection, the eval variable is assigned to __SK_REDIRECT after the apply_bytes data is sent,…
-
High 7.8
bpf, cpumap: Handle skb as well when clean up ptr_ring
In the Linux kernel, the following vulnerability has been resolved: bpf, cpumap: Handle skb as well when clean up ptr_ring The following warning was reported when running xdp_redirect_cpu with both skb-mode and stress-mode enabled: ------------[ cut here ]---…
-
High 7.5CVE-2022-36946 Public exploit
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …
-
High 7.5
net: preserve skb_end_offset() in skb_unclone_keeptruesize()
In the Linux kernel, the following vulnerability has been resolved: net: preserve skb_end_offset() in skb_unclone_keeptruesize() syzbot found another way to trigger the infamous WARN_ON_ONCE(delta < len) in skb_try_coalesce() [1] I was able to root cause the …
-
High 7.5
scsi: qla2xxx: Fix crash during module load unload test
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash during module load unload test During purex packet handling the driver was incorrectly freeing a pre-allocated structure. Fix this by skipping that entry. System cras…
-
High 7.5
tcp: add accessors to read/set tp->snd_cwnd
In the Linux kernel, the following vulnerability has been resolved: tcp: add accessors to read/set tp->snd_cwnd We had various bugs over the years with code breaking the assumption that tp->snd_cwnd is greater than zero. Lately, syzbot reported the WARN_ON_ON…
-
High 7.5
tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd
In the Linux kernel, the following vulnerability has been resolved: tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd syzbot got a new report [1] finally pointing to a very old bug, added in initial support for MTU probing. tcp_mtu_probe() has checks about st…
-
High 7.5
tipc: move bc link creation back to tipc_node_create
In the Linux kernel, the following vulnerability has been resolved: tipc: move bc link creation back to tipc_node_create Shuang Li reported a NULL pointer dereference crash: [] BUG: kernel NULL pointer dereference, address: 0000000000000068 [] RIP: 0010:tipc_…
-
High 7.1
scsi: scsi_debug: Fix type in min_t to avoid stack OOB
In the Linux kernel, the following vulnerability has been resolved: scsi: scsi_debug: Fix type in min_t to avoid stack OOB Change min_t() to use type "u32" instead of type "int" to avoid stack out of bounds. With min_t() type "int" the values get sign extende…
-
High 7.1
KVM: x86/mmu: make apf token non-zero to fix bug
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: make apf token non-zero to fix bug In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to delive…
-
High 7.1
ip_gre: test csum_start instead of transport header
In the Linux kernel, the following vulnerability has been resolved: ip_gre: test csum_start instead of transport header GRE with TUNNEL_CSUM will apply local checksum offload on CHECKSUM_PARTIAL packets. ipgre_xmit must validate csum_start after an optional s…
-
High 7.1
Kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf()
A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmx…
-
Medium 6.9
Linux Kernel LoadPin bypass via dm-verity table reload
Dm-verity is used for extending root-of-trust to root filesystems. LoadPin builds on this property to restrict module/firmware loads to just the trusted root filesystem. Device-mapper table reloads currently allow users with root privileges to switch out the …
-
Medium 6.7
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission c…
-
Medium 6.7
KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker w…
-
Medium 5.6
Arbitrary Memory Disclosure through CPU Side-Channel Attacks (Retbleed)
Intel microprocessor generations 6 to 8 are affected by a new Spectre variant that is able to bypass their retpoline mitigation in the kernel to leak arbitrary data. An attacker with unprivileged user access can hijack return instructions to achieve arbitrary…
-
Medium 5.5
drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free()
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Ensure that objs is not NULL in virtio_gpu_array_put_free() If virtio_gpu_object_shmem_init() fails (e.g. due to fault injection, as it happened in the bug report by syzbot), virt…
-
Medium 5.5
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potenti…
-
Medium 5.5
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to po…
-
Medium 5.5
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticate…
-
Medium 5.5
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…
-
Medium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv…
-
Medium 5.5
An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kf…
-
Medium 5.5
net/smc: Fix NULL pointer dereference in smc_pnet_find_ib()
In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() dev_name() was called with dev.parent as argument but without to NULL-check it before. Solve this by checking the pointer before th…
-
Medium 5.5
ceph: fix memory leak in ceph_readdir when note_last_dentry returns error
In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_readdir when note_last_dentry returns error Reset the last_readdir at the same time, and add a comment explaining why we don't free last_readdir when dir_emit re…
-
Medium 5.5
ath11k: Fix frames flush failure caused by deadlock
In the Linux kernel, the following vulnerability has been resolved: ath11k: Fix frames flush failure caused by deadlock We are seeing below warnings: kernel: [25393.301506] ath11k_pci 0000:01:00.0: failed to flush mgmt transmit queue 0 kernel: [25398.421509] …
-
Medium 5.5
ath11k: mhi: use mhi_sync_power_up()
In the Linux kernel, the following vulnerability has been resolved: ath11k: mhi: use mhi_sync_power_up() If amss.bin was missing ath11k would crash during 'rmmod ath11k_pci'. The reason for that was that we were using mhi_async_power_up() which does not check…
-
Medium 5.5
wireguard: socket: free skb in send6 when ipv6 is disabled
In the Linux kernel, the following vulnerability has been resolved: wireguard: socket: free skb in send6 when ipv6 is disabled I got a memory leak report: unreferenced object 0xffff8881191fc040 (size 232): comm "kworker/u17:0", pid 23193, jiffies 4295238848 (…
-
Medium 5.5
ath9k_htc: fix uninit value bugs
In the Linux kernel, the following vulnerability has been resolved: ath9k_htc: fix uninit value bugs Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing field initialization. In htc_connect_service() svc_meta_len and pad are not initializ…
-
Medium 5.5
scsi: lpfc: Address NULL pointer dereference after starget_to_rport()
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Address NULL pointer dereference after starget_to_rport() Calls to starget_to_rport() may return NULL. Add check for NULL rport before dereference.
-
Medium 5.5
mm/huge_memory: Fix xarray node memory leak
In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: Fix xarray node memory leak If xas_split_alloc() fails to allocate the necessary nodes to complete the xarray entry split, it sets the xa_state to -ENOMEM, which xas_nomem() t…
-
Medium 5.5
tipc: check attribute length for bearer name
In the Linux kernel, the following vulnerability has been resolved: tipc: check attribute length for bearer name syzbot reported uninit-value: ===================================================== BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:644 …
-
Medium 5.5
usb: usbip: fix a refcount leak in stub_probe()
In the Linux kernel, the following vulnerability has been resolved: usb: usbip: fix a refcount leak in stub_probe() usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails after that, usb_put_dev() needs to be called to release the reference. …
-
Medium 5.5
RDMA/hfi1: Fix potential integer multiplication overflow errors
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Fix potential integer multiplication overflow errors When multiplying of different types, an overflow is possible even when storing the result in a larger type. This is because the…
-
Medium 5.5
ext4: fix memory leak in parse_apply_sb_mount_options()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix memory leak in parse_apply_sb_mount_options() If processing the on-disk mount options fails after any memory was allocated in the ext4_fs_context, e.g. s_qf_names, then this memory …
-
Medium 5.5
scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Protect memory leak for NPIV ports sending PLOGI_RJT There is a potential memory leak in lpfc_ignore_els_cmpl() and lpfc_els_rsp_reject() that was allocated from NPIV PLOGI_RJT (l…
-
Medium 5.5
scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix SCSI I/O completion and abort handler deadlock During stress I/O tests with 500+ vports, hard LOCKUP call traces are observed. CPU A: native_queued_spin_lock_slowpath+0x192 _r…
-
Medium 5.5
ALSA: jack: Access input_dev under mutex
In the Linux kernel, the following vulnerability has been resolved: ALSA: jack: Access input_dev under mutex It is possible when using ASoC that input_dev is unregistered while calling snd_jack_report, which causes NULL pointer dereference. In order to preven…
-
Medium 5.5
ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error
In the Linux kernel, the following vulnerability has been resolved: ASoC: rt711-sdca: fix kernel NULL pointer dereference when IO error The initial settings will be written before the codec probe function. But, the rt711->component doesn't be assigned yet. If…
-
Medium 5.5
RDMA/cm: Fix memory leak in ib_cm_insert_listen
In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix memory leak in ib_cm_insert_listen cm_alloc_id_priv() allocates resource for the cm_id_priv. When cm_init_listen() fails it doesn't free it, leading to memory leak. Add the missi…
-
Medium 5.5
ext4: add reserved GDT blocks check
In the Linux kernel, the following vulnerability has been resolved: ext4: add reserved GDT blocks check We capture a NULL pointer issue when resizing a corrupt ext4 image which is freshly clear resize_inode feature (not run e2fsck). It could be simply reprodu…
-
Medium 5.5
In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction …
-
Medium 5.1
This vulnerability allows local attackers to disclose sensitive information on affected installations of the Linux Kern…
-
Medium 4.7
Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized …
-
Unscored —
An issue was discovered in the Linux kernel through 5.16.11. The mixed IPID assignment method with the hash-based IPID …
-
Unscored —
A flaw use-after-free in function sco_sock_sendmsg() of the Linux kernel HCI subsystem was found in the way user calls …
-
Unscored —
mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()'
In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()' DAMON debugfs interface increases the reference counts of 'struct pid's for targets from the 'target_ids' file write callb…
-
Unscored —
mm/damon/dbgfs: protect targets destructions with kdamond_lock
In the Linux kernel, the following vulnerability has been resolved: mm/damon/dbgfs: protect targets destructions with kdamond_lock DAMON debugfs interface iterates current monitoring targets in 'dbgfs_target_ids_read()' while holding the corresponding 'kdamon…
-
Unscored —
irqchip/gic-v3-its: Fix potential VPE leak on error
In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v3-its: Fix potential VPE leak on error In its_vpe_irq_domain_alloc, when its_vpe_init() returns an error, there is an off-by-one in the number of VPEs to be freed. Fix it by simp…
-
Unscored —
ptp: Fix possible memory leak in ptp_clock_register()
In the Linux kernel, the following vulnerability has been resolved: ptp: Fix possible memory leak in ptp_clock_register() I got memory leak as follows when doing fault injection test: unreferenced object 0xffff88800906c618 (size 8): comm "i2c-idt82p33931", pi…
-
Unscored —
ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce()
In the Linux kernel, the following vulnerability has been resolved: ethtool: ioctl: fix potential NULL deref in ethtool_set_coalesce() ethtool_set_coalesce() now uses both the .get_coalesce() and .set_coalesce() callbacks. But the check for their availability…
-
Unscored —
net: nexthop: fix null pointer dereference when IPv6 is not enabled
In the Linux kernel, the following vulnerability has been resolved: net: nexthop: fix null pointer dereference when IPv6 is not enabled When we try to add an IPv6 nexthop and IPv6 is not enabled (!CONFIG_IPV6) we'll hit a NULL pointer dereference[1] in the er…
-
Unscored —
udmabuf: validate ubuf->pagecount
In the Linux kernel, the following vulnerability has been resolved: udmabuf: validate ubuf->pagecount Syzbot has reported GPF in sg_alloc_append_table_from_pages(). The problem was in ubuf->pages == ZERO_PTR. ubuf->pagecount is calculated from arguments passe…
-
Unscored —
A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c…
-
Unscored —
A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers ud…
-
Unscored —
A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw al…
-
Unscored —
A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. …
-
Unscored —
A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PC…
-
Unscored —
A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get th…
-
Unscored —
A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. Th…
-
Unscored —
A NULL pointer dereference issue was found in KVM when releasing a vCPU with dirty ring support enabled. This flaw allo…
-
Unscored —
A use-after-free vulnerability was found in drm_lease_held in drivers/gpu/drm/drm_lease.c in the Linux kernel due to a …
-
Unscored —
A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a lo…
-
Unscored —CVE-2022-1679 Public exploit
A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9…
-
Unscored —
A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in th…
-
Unscored —
A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_reco…
-
Unscored —
Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel
-
Unscored —
A flaw was found in the Linux kernel’s KVM when attempting to set a SynIC IRQ. This issue makes it possible for a misbe…
-
Unscored —CVE-2022-23816 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate is unused by its CNA. Notes: none.
-
Unscored —
Aliases in the branch predictor may cause some AMD processors to predict the wrong branch type potentially leading to i…
-
Unscored —
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag,…
-
Unscored —CVE-2022-2639 Public exploit
An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of actions, whi…
-
Unscored —
ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free.
-
Unscored —
The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets are in the i…
-
Unscored —CVE-2022-29900 Public exploit
Mis-trained branch predictions for return instructions may allow arbitrary speculative code execution under certain mic…
-
Unscored —
A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for …
-
Unscored —
An issue was discovered in net/netfilter/nf_tables_api.c in the Linux kernel before 5.19.6. A denial of service can occ…
-
Unscored —
ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and r…
-
Unscored —
KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
In the Linux kernel, the following vulnerability has been resolved: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC The below warning is splatting during guest reboot. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x8…
-
Unscored —
HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual n…
-
Unscored —
ibmvnic: free reset-work-item when flushing
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: free reset-work-item when flushing Fix a tiny memory leak when flushing the reset work queue.
-
Unscored —
iwlwifi: mvm: check debugfs_dir ptr before use
In the Linux kernel, the following vulnerability has been resolved: iwlwifi: mvm: check debugfs_dir ptr before use When "debugfs=off" is used on the kernel command line, iwiwifi's mvm module uses an invalid/unchecked debugfs_dir pointer and causes a BUG: BUG:…
-
Unscored —
sched/fair: Fix fault in reweight_entity
In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix fault in reweight_entity Syzbot found a GPF in reweight_entity. This has been bisected to commit 4ef0c5c6b5ba ("kernel/sched: Fix sched_fork() access an invalid sched_task_gro…
-
Unscored —CVE-2022-48936 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
block: null_blk: end timed out poll request
In the Linux kernel, the following vulnerability has been resolved: block: null_blk: end timed out poll request When poll request is timed out, it is removed from the poll list, but not completed, so the request is leaked, and never get chance to complete. Fi…
-
Unscored —
veth: Ensure eth header is in skb's linear part
In the Linux kernel, the following vulnerability has been resolved: veth: Ensure eth header is in skb's linear part After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which …
-
Unscored —
net: openvswitch: fix leak of nested actions
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix leak of nested actions While parsing user-provided actions, openvswitch module may dynamically allocate memory and store pointers in the internal copy of the actions. So…
-
Unscored —
arch/arm64: Fix topology initialization for core scheduling
In the Linux kernel, the following vulnerability has been resolved: arch/arm64: Fix topology initialization for core scheduling Arm64 systems rely on store_cpu_topology() to call update_siblings_masks() to transfer the toplogy to the various cpu masks. This n…
-
Unscored —
Drivers: hv: vmbus: Fix potential crash on module unload
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix potential crash on module unload The vmbus driver relies on the panic notifier infrastructure to perform some operations when a panic event is detected. Since vmbus ca…
-
Unscored —
ceph: fix inode reference leakage in ceph_get_snapdir()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix inode reference leakage in ceph_get_snapdir() The ceph_get_inode() will search for or insert a new inode into the hash for the given vino, and return a reference to it. If new is no…
-
Unscored —
dm ioctl: prevent potential spectre v1 gadget
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevent potential spectre v1 gadget It appears like cmd could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory fro…
-
Unscored —
ACPI: CPPC: Avoid out of bounds access when parsing _CPC data
In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Avoid out of bounds access when parsing _CPC data If the NumEntries field in the _CPC return package is less than 2, do not attempt to access the "Revision" element of that packag…
-
Unscored —
block: Fix the maximum minor value is blk_alloc_ext_minor()
In the Linux kernel, the following vulnerability has been resolved: block: Fix the maximum minor value is blk_alloc_ext_minor() ida_alloc_range(..., min, max, ...) returns values from min to max, inclusive. So, NR_EXT_DEVT is a valid idx returned by blk_alloc…
-
Unscored —
XArray: Fix xas_create_range() when multi-order entry present
In the Linux kernel, the following vulnerability has been resolved: XArray: Fix xas_create_range() when multi-order entry present If there is already an entry present that is of order >= XA_CHUNK_SHIFT when we call xas_create_range(), xas_create_range() will …
-
Unscored —
scsi: qla2xxx: Fix scheduling while atomic
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix scheduling while atomic The driver makes a call into midlayer (fc_remote_port_delete) which can put the thread to sleep. The thread that originates the call is in interrupt…
-
Unscored —
scsi: qla2xxx: Fix warning message due to adisc being flushed
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix warning message due to adisc being flushed Fix warning message due to adisc being flushed. Linux kernel triggered a warning message where a different error code type is not…
-
Unscored —
PM: core: keep irq flags in device_pm_check_callbacks()
In the Linux kernel, the following vulnerability has been resolved: PM: core: keep irq flags in device_pm_check_callbacks() The function device_pm_check_callbacks() can be called under the spin lock (in the reported case it happens from genpd_add_device() -> …
-
Unscored —
LSM: general protection fault in legacy_parse_param
In the Linux kernel, the following vulnerability has been resolved: LSM: general protection fault in legacy_parse_param The usual LSM hook "bail on fail" scheme doesn't work for cases where a security module may return an error code indicating that it does no…
-
Unscored —
remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region
In the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_q6v5_mss: Fix some leaks in q6v5_alloc_memory_region The device_node pointer is returned by of_parse_phandle() or of_get_child_by_name() with refcount incremented. We should …
-
Unscored —
RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit()
In the Linux kernel, the following vulnerability has been resolved: RDMA/nldev: Prevent underflow in nldev_stat_set_counter_dynamic_doit() This code checks "index" for an upper bound but it does not check for negatives. Change the type to unsigned to prevent …
-
Unscored —
igc: avoid kernel warning when changing RX ring parameters
In the Linux kernel, the following vulnerability has been resolved: igc: avoid kernel warning when changing RX ring parameters Calling ethtool changing the RX ring parameters like this: $ ethtool -G eth0 rx 1024 on igc triggers kernel warnings like this: [ 22…
-
Unscored —
bpf: Fix a btf decl_tag bug when tagging a function
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a btf decl_tag bug when tagging a function syzbot reported a btf decl_tag bug with stack trace below: general protection fault, probably for non-canonical address 0xdffffc0000000000:…
-
Unscored —
ptp: unregister virtual clocks when unregistering physical clock.
In the Linux kernel, the following vulnerability has been resolved: ptp: unregister virtual clocks when unregistering physical clock. When unregistering a physical clock which has some virtual clocks, unregister the virtual clocks with it. This fixes the foll…
-
Unscored —
media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
In the Linux kernel, the following vulnerability has been resolved: media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED If the callback 'start_streaming' fails, then all queued buffers in the driver should be returned with state 'V…
-
Unscored —
media: usb: go7007: s2250-board: fix leak in probe()
In the Linux kernel, the following vulnerability has been resolved: media: usb: go7007: s2250-board: fix leak in probe() Call i2c_unregister_device(audio) on this error path.
-
Unscored —
block: don't delete queue kobject before its children
In the Linux kernel, the following vulnerability has been resolved: block: don't delete queue kobject before its children kobjects aren't supposed to be deleted before their child kobjects are deleted. Apparently this is usually benign; however, a WARN will b…
-
Unscored —
brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path
In the Linux kernel, the following vulnerability has been resolved: brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path This avoids leaking memory if brcmf_chip_get_raminfo fails. Note that the CLM blob is released in the device remove path.
-
Unscored —
PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove()
In the Linux kernel, the following vulnerability has been resolved: PM: domains: Fix sleep-in-atomic bug caused by genpd_debug_remove() When a genpd with GENPD_FLAG_IRQ_SAFE gets removed, the following sleep-in-atomic bug will be seen, as genpd_debug_remove()…
-
Unscored —
ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: Fix NULL ptr dereference when ENOMEM Do not call snd_dma_free_pages() when snd_dma_alloc_pages() returns -ENOMEM because it leads to a NULL pointer dereference bug. The dmes…
-
Unscored —
ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recen…
-
Unscored —
cifs: fix handlecache and multiuser
In the Linux kernel, the following vulnerability has been resolved: cifs: fix handlecache and multiuser In multiuser each individual user has their own tcon structure for the share and thus their own handle for a cached directory. When we umount such a share …
-
Unscored —
nbd: fix io hung while disconnecting device
In the Linux kernel, the following vulnerability has been resolved: nbd: fix io hung while disconnecting device In our tests, "qemu-nbd" triggers a io hung: INFO: task qemu-nbd:11445 blocked for more than 368 seconds. Not tainted 5.18.0-rc3-next-20220422-0000…
-
Unscored —
usb: dwc3: host: Stop setting the ACPI companion
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: host: Stop setting the ACPI companion It is no longer needed. The sysdev pointer is now used when assigning the ACPI companions to the xHCI ports and USB devices. Assigning the ACP…
-
Unscored —
ext4: fix bug_on in ext4_writepages
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in ext4_writepages we got issue as follows: EXT4-fs error (device loop0): ext4_mb_generate_buddy:1141: group 0, block bitmap and bg descriptor inconsistent: 25 vs 31513 free …
-
Unscored —
ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state
In the Linux kernel, the following vulnerability has been resolved: ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state The EXT4_FC_REPLAY bit in sbi->s_mount_state is used to indicate that we are in the middle of replay the fast commit jour…
-
Unscored —
sfc: fix considering that all channels have TX queues
In the Linux kernel, the following vulnerability has been resolved: sfc: fix considering that all channels have TX queues Normally, all channels have RX and TX queues, but this is not true if modparam efx_separate_tx_channels=1 is used. In that cases, some ch…
-
Unscored —
blk-iolatency: Fix inflight count imbalances and IO hangs on offline
In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: Fix inflight count imbalances and IO hangs on offline iolatency needs to track the number of inflight IOs per cgroup. As this tracking can be expensive, it is disabled when no …
-
Unscored —
usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Replace list_for_each_entry_safe() if using giveback The list_for_each_entry_safe() macro saves the current item (n) and the item after (n+1), so that n can be safely remov…
-
Unscored —
ext4: fix bug_on in __es_tree_search
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on in __es_tree_search Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/extents_status.c:199! [...] RIP: 00…
-
Unscored —
RDMA/hfi1: Prevent use of lock before it is initialized
In the Linux kernel, the following vulnerability has been resolved: RDMA/hfi1: Prevent use of lock before it is initialized If there is a failure during probe of hfi1 before the sdma_map_lock is initialized, the call to hfi1_free_devdata() will attempt to use…
-
Unscored —
powerpc/rtas: Keep MSR[RI] set when calling RTAS
In the Linux kernel, the following vulnerability has been resolved: powerpc/rtas: Keep MSR[RI] set when calling RTAS RTAS runs in real mode (MSR[DR] and MSR[IR] unset) and in 32-bit big endian mode (MSR[SF,LE] unset). The change in MSR is done in enter_rtas()…
-
Unscored —
scsi: lpfc: Inhibit aborts if external loopback plug is inserted
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Inhibit aborts if external loopback plug is inserted After running a short external loopback test, when the external loopback is removed and a normal cable inserted that is direct…
-
Unscored —
ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t
In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t The CS35L41_NUM_OTP_ELEM is 100, but only 99 entries are defined in the array otp_map_1/2[CS35L41_NUM_OTP_ELEM], this will t…
-
Unscored —
scsi: lpfc: Fix call trace observed during I/O with CMF enabled
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix call trace observed during I/O with CMF enabled The following was seen with CMF enabled: BUG: using smp_processor_id() in preemptible code: systemd-udevd/31711 kernel: caller …
-
Unscored —
ath11k: fix the warning of dev_wake in mhi_pm_disable_transition()
In the Linux kernel, the following vulnerability has been resolved: ath11k: fix the warning of dev_wake in mhi_pm_disable_transition() When test device recovery with below command, it has warning in message as below. echo assert > /sys/kernel/debug/ath11k/wcn…
-
Unscored —
KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Drop WARNs that assert a triple fault never "escapes" from L2 Remove WARNs that sanity check that KVM never lets a triple fault for L2 escape and incorrectly end up in L1. In normal…
-
Unscored —
ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero
In the Linux kernel, the following vulnerability has been resolved: ixgbe: Add locking to prevent panic when setting sriov_numvfs to zero It is possible to disable VFs while the PF driver is processing requests from the VF driver. This can result in a panic. …
-
Unscored —
igc: Reinstate IGC_REMOVED logic and implement it properly
In the Linux kernel, the following vulnerability has been resolved: igc: Reinstate IGC_REMOVED logic and implement it properly The initially merged version of the igc driver code (via commit 146740f9abc4, "igc: Add support for PF") contained the following IGC…
-
Unscored —
RDMA/irdma: Fix sleep from invalid context BUG
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix sleep from invalid context BUG Taking the qos_mutex to process RoCEv2 QP's on netdev events causes a kernel splat. Fix this by removing the handling for RoCEv2 in irdma_cm_tea…
-
Unscored —
sfc: fix kernel panic when creating VF
In the Linux kernel, the following vulnerability has been resolved: sfc: fix kernel panic when creating VF When creating VFs a kernel panic can happen when calling to efx_ef10_try_update_nic_stats_vf. When releasing a DMA coherent buffer, sometimes, I don't k…
-
Unscored —
tunnels: do not assume mac header is set in skb_tunnel_check_pmtu()
In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume mac header is set in skb_tunnel_check_pmtu() Recently added debug in commit f9aefd6b2aa3 ("net: warn if mac header was not set") caught a bug in skb_tunnel_check_pmtu()…
-
Unscored —
dm raid: fix KASAN warning in raid5_add_disks
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix KASAN warning in raid5_add_disks There's a KASAN warning in raid5_add_disk when running the LVM testsuite. The warning happens in the test lvconvert-raid-reshape-linear_to_raid6-…
-
Unscored —
erspan: do not assume transport header is always set
In the Linux kernel, the following vulnerability has been resolved: erspan: do not assume transport header is always set Rewrite tests in ip6erspan_tunnel_xmit() and erspan_fb_xmit() to not assume transport header is set. syzbot reported: WARNING: CPU: 0 PID:…
-
Unscored —
bpf: Fix request_sock leak in sk lookup helpers
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix request_sock leak in sk lookup helpers A customer reported a request_socket leak in a Calico cloud environment. We found that a BPF program was doing a socket lookup with takes a ref…
-
Unscored —
netfilter: use get_random_u32 instead of prandom
In the Linux kernel, the following vulnerability has been resolved: netfilter: use get_random_u32 instead of prandom bh might occur while updating per-cpu rnd_state from user context, ie. local_out path. BUG: using smp_processor_id() in preemptible [00000000]…
-
Unscored —
ext4: fix bug_on ext4_mb_use_inode_pa
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bug_on ext4_mb_use_inode_pa Hulk Robot reported a BUG_ON: ================================================================== kernel BUG at fs/ext4/mballoc.c:3211! [...] RIP: 0010:ex…
-
Unscored —
dm mirror log: round up region bitmap size to BITS_PER_LONG
In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITS_PER_LONG The code in dm-log rounds up bitset_size to 32 bits. It then uses find_next_zero_bit_le on the allocated region. find_next_zero_bit…
-
Unscored —
sock: redo the psock vs ULP protection check
In the Linux kernel, the following vulnerability has been resolved: sock: redo the psock vs ULP protection check Commit 8a59f9d1e3d4 ("sock: Introduce sk->sk_prot->psock_update_sk_prot()") has moved the inet_csk_has_ulp(sk) check from sk_psock_init() to the n…
-
Unscored —
netfilter: nft_tproxy: restrict to prerouting hook
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_tproxy: restrict to prerouting hook TPROXY is only allowed from prerouting, but nft_tproxy doesn't check this. This fixes a crash (null dereference) when using tproxy from e.g.…
-
Unscored —
scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Fix possible memory leak when failing to issue CMF WQE There is no corresponding free routine if lpfc_sli4_issue_wqe fails to issue the CMF WQE in lpfc_issue_cmf_sync_wqe. If ret_…
-
Unscored —
scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input
In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Malformed user input to debugfs results in buffer overflow crashes. Adapt input string lengths to fit within i…
-
Unscored —
dm raid: fix address sanitizer warning in raid_status
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_status There is this warning when using a kernel with the address sanitizer and running this testsuite: https://gitlab.com/cki-project/kernel-te…
-
Unscored —
dm raid: fix address sanitizer warning in raid_resume
In the Linux kernel, the following vulnerability has been resolved: dm raid: fix address sanitizer warning in raid_resume There is a KASAN warning in raid_resume when running the lvm test lvconvert-raid.sh. The reason for the warning is that mddev->raid_disks…
-
Unscored —
dm thin: fix use-after-free crash in dm_sm_register_threshold_callback
In the Linux kernel, the following vulnerability has been resolved: dm thin: fix use-after-free crash in dm_sm_register_threshold_callback Fault inject on pool metadata device reports: BUG: KASAN: use-after-free in dm_pool_register_metadata_threshold+0x40/0x8…
-
Unscored —
ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Prevent double freeing of ipc_control_data via load_bytes We have sanity checks for byte controls and if any of the fail the locally allocated scontrol->ipc_control_…
-
Unscored —
wifi: rtw89: 8852a: rfk: fix div 0 exception
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: 8852a: rfk: fix div 0 exception The DPK is a kind of RF calibration whose algorithm is to fine tune parameters and calibrate, and check the result. If the result isn't good enoug…
-
Unscored —
ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
In the Linux kernel, the following vulnerability has been resolved: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb Syzbot reported use-after-free Read in ath9k_hif_usb_rx_cb() [0]. The problem was in incorrect htc_handle->drv_priv initialization. Probable c…
-
Unscored —
ath11k: fix netdev open race
In the Linux kernel, the following vulnerability has been resolved: ath11k: fix netdev open race Make sure to allocate resources needed before registering the device. This specifically avoids having a racing open() trigger a BUG_ON() in mod_timer() when ath11…
-
Unscored —
drbd: only clone bio if we have a backing device
In the Linux kernel, the following vulnerability has been resolved: drbd: only clone bio if we have a backing device Commit c347a787e34cb (drbd: set ->bi_bdev in drbd_req_new) moved a bio_set_dev call (which has since been removed) to "earlier", from drbd_req…
-
Unscored —
dma-buf/dma-resv: Stop leaking on krealloc() failure
In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-resv: Stop leaking on krealloc() failure Currently dma_resv_get_fences() will leak the previously allocated array if the fence iteration got restarted and the krealloc_array() fai…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index
-
article
https://access.redhat.com/solutions/6971358
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1905809
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1951971
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1952053
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1980646
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2006399
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2009423
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2025985
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2028370
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2037386
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2038794
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2046624
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2051444
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2052312
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2053632
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2053991
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2054023
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2058395
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2059928
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066297
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066614
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066706
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066819
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2070205
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2071022
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2073064
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2074208
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2074315
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2076304
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2083580
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2084125
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2084183
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2084479
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2088021
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2089815
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2090226
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2090237