Summary
Zheng Wang discovered that the Broadcom FullMAC WLAN driver in the Linux
kernel contained a race condition during device removal, leading to a use-
after-free vulnerability. A physically proximate attacker could possibly
use this to cause a denial of service (system crash). (CVE-2023-47233)
It was discovered that the ATA over Ethernet (AoE) driver in the Linux
kernel contained a race condition, leading to a use-after-free
vulnerability. An attacker could use this to cause a denial of service or
possibly execute arbitrary code. (CVE-2023-6270)
It was discovered that the Atheros 802.11ac wireless driver did not
properly validate certain data structures, leading to a NULL pointer
dereference. An attacker could possibly use this to cause a denial of
service. (CVE-2023-7042)
It was discovered that the HugeTLB file system component of the Linux
Kernel contained a NULL pointer dereference vulnerability. A privileged
attacker could possibly use this to to cause a denial of service.
(CVE-2024-0841)
It was discovered that the Open vSwitch implementation in the Linux kernel
could overflow its stack during recursive action operations under certain
conditions. A local attacker could use this to cause a denial of service
(system crash). (CVE-2024-1151)
Sander Wiebing, Alvise de Faveri Tron, Herbert Bos, and Cristiano Giuffrida
discovered that the Linux kernel mitigations for the initial Branch History
Injection vulnerability (CVE-2022-0001) were insufficient for Intel
processors. A local attacker could potentially use this to expose sensitive
information. (CVE-2024-2201)
Yuxuan Hu discovered that the Bluetooth RFCOMM protocol driver in the Linux
Kernel contained a race condition, leading to a NULL pointer dereference.
An attacker could possibly use this to cause a denial of service (system
crash). (CVE-2024-22099)
Chenyuan Yang discovered that the RDS Protocol implementation in the Linux
kernel contained an out-of-bounds read vulnerability. An attacker could use
this to possibly cause a denial of service (system crash). (CVE-2024-23849)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- Core kernel;
- x86 architecture;
- Block layer subsystem;
- ACPI drivers;
- Android drivers;
- Power management core;
- Bus devices;
- Hardware random number generator core;
- Clock framework and drivers;
- CPU frequency scaling framework;
- Cryptographic API;
- Device frequency scaling framework;
- DMA engine subsystem;
- ARM SCMI message protocol;
- EFI core;
- GPU drivers;
- HID subsystem;
- Hardware monitoring drivers;
- I2C subsystem;
- IIO ADC drivers;
- IIO subsystem;
- IIO Magnetometer sensors drivers;
- InfiniBand drivers;
- IOMMU subsystem;
- Multiple devices driver;
- Media drivers;
- MMC subsystem;
- Network drivers;
- NTB driver;
- NVME drivers;
- PCI subsystem;
- PCI driver for MicroSemi Switchtec;
- PHY drivers;
- MediaTek PM domains;
- Power supply drivers;
- SCSI drivers;
- SPI subsystem;
- Media staging drivers;
- TCM subsystem;
- USB subsystem;
- DesignWare USB3 driver;
- Framebuffer layer;
- AFS file system;
- File systems infrastructure;
- BTRFS file system;
- Ceph distributed file system;
- EROFS file system;
- Ext4 file system;
- F2FS file system;
- JFS file system;
- Network file system client;
- NILFS2 file system;
- NTFS3 file system;
- Pstore file system;
- Diskquota system;
- SMB network file system;
- BPF subsystem;
- Memory management;
- Netfilter;
- TLS protocol;
- io_uring subsystem;
- Bluetooth subsystem;
- Ethernet bridge;
- CAN network layer;
- Networking core;
- HSR network protocol;
- IPv4 networking;
- IPv6 networking;
- L2TP protocol;
- Logical Link layer;
- MAC80211 subsystem;
- Multipath TCP;
- Netlink;
- NET/ROM layer;
- NFC subsystem;
- Packet sockets;
- RDS protocol;
- SMC sockets;
- Sun RPC protocol;
- TIPC protocol;
- Unix domain sockets;
- Wireless networking;
- Tomoyo security module;
- Realtek audio codecs;
- USB sound devices;
(CVE-2024-26910, CVE-2024-27074, CVE-2023-52494, CVE-2023-52594,
CVE-2024-26915, CVE-2024-26766, CVE-2023-52489, CVE-2024-35845,
CVE-2024-26846, CVE-2024-26898, CVE-2024-26897, CVE-2024-26826,
CVE-2024-26798, CVE-2023-52662, CVE-2024-26856, CVE-2023-52608,
CVE-2024-26782, CVE-2024-27047, CVE-2024-27390, CVE-2024-26610,
CVE-2024-26804, CVE-2023-52638, CVE-2024-26771, CVE-2024-26752,
CVE-2024-26585, CVE-2024-26645, CVE-2024-26715, CVE-2024-27028,
CVE-2024-26809, CVE-2024-26880, CVE-2024-27432, CVE-2024-27065,
CVE-2024-26717, CVE-2023-52616, CVE-2024-26748, CVE-2024-26795,
CVE-2024-26671, CVE-2024-26743, CVE-2024-27412, CVE-2024-26802,
CVE-2024-26733, CVE-2024-26736, CVE-2023-52618, CVE-2024-27046,
CVE-2024-26688, CVE-2024-26679, CVE-2024-26769, CVE-2024-27051,
CVE-2024-26603, CVE-2024-26744, CVE-2023-52434, CVE-2024-26697,
CVE-2024-27075, CVE-2023-52583, CVE-2024-26583, CVE-2024-27403,
CVE-2024-26907, CVE-2024-26636, CVE-2024-27410, CVE-2023-52530,
CVE-2024-26840, CVE-2024-26851, CVE-2024-26862, CVE-2023-52640,
CVE-2024-35829, CVE-2024-26906, CVE-2024-26777, CVE-2024-27419,
CVE-2024-26664, CVE-2024-26627, CVE-2024-26859, CVE-2023-52486,
CVE-2023-52652, CVE-2024-26835, CVE-2024-35844, CVE-2024-26702,
CVE-2024-26635, CVE-2024-26704, CVE-2023-52633, CVE-2024-26816,
CVE-2024-26894, CVE-2024-26778, CVE-2023-52599, CVE-2024-35828,
CVE-2024-26776, CVE-2023-52493, CVE-2024-26845, CVE-2024-26594,
CVE-2024-26885, CVE-2024-26829, CVE-2023-52645, CVE-2024-26695,
CVE-2023-52615, CVE-2024-26651, CVE-2024-26843, CVE-2023-52606,
CVE-2024-26675, CVE-2024-26874, CVE-2024-26883, CVE-2024-26772,
CVE-2024-26673, CVE-2024-26737, CVE-2023-52631, CVE-2024-26640,
CVE-2023-52
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | linux-intel-iotg-5.15 | 5.15.0-1058.64~20.04.1 |
Vulnerabilities 245
-
Critical 9.8
tls: fix race between async notify and socket close
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between async notify and socket close The submitting thread (one which called recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete() so any code past tha…
-
Critical 9.8
net: tls: handle backlogging of crypto requests
In the Linux kernel, the following vulnerability has been resolved: net: tls: handle backlogging of crypto requests Since we're setting the CRYPTO_TFM_REQ_MAY_BACKLOG flag on our requests to the crypto API, crypto_aead_{encrypt,decrypt} can return -EBUSY inst…
-
Critical 9.8
tls: fix race between tx work scheduling and socket close
In the Linux kernel, the following vulnerability has been resolved: tls: fix race between tx work scheduling and socket close Similarly to previous commit, the submitting thread (recvmsg/sendmsg) may exit as soon as the async crypto handler calls complete(). …
-
Critical 9.8
ksmbd: fix UAF issue in ksmbd_tcp_new_connection()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF issue in ksmbd_tcp_new_connection() The race is between the handling of a new TCP connection and its disconnection. It leads to UAF on `struct tcp_transport` in ksmbd_tcp_new_c…
-
Critical 9.8
mptcp: fix double-free on socket dismantle
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix double-free on socket dismantle when MPTCP server accepts an incoming connection, it clones its listener socket. However, the pointer to 'inet_opt' for the new socket has the same …
-
Critical 9.8
crypto: xilinx - call finalize with bh disabled
In the Linux kernel, the following vulnerability has been resolved: crypto: xilinx - call finalize with bh disabled When calling crypto_finalize_request, BH should be disabled to avoid triggering the following calltrace: ------------[ cut here ]------------ W…
-
Critical 9.8
SUNRPC: fix some memleaks in gssx_dec_option_array
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the cor…
-
Critical 9.1CVE-2024-26594 EPSS 51%
ksmbd: validate mech token in session setup
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate mech token in session setup If client send invalid mech token in session setup request, ksmbd validate and make the error if it is invalid.
-
Critical 9.1
tunnels: fix out of bounds access when building IPv6 PMTU error
In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/…
-
Critical 9.1
wifi: iwlwifi: dbg-tlv: ensure NUL termination
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: dbg-tlv: ensure NUL termination The iwl_fw_ini_debug_info_tlv is used as a string, so we must ensure the string is terminated correctly before using it.
-
High 8.8
wifi: mac80211: fix potential key use-after-free
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix potential key use-after-free When ieee80211_key_link() is called by ieee80211_gtk_rekey_add() but returns 0 due to KRACK protection (identical key reinstall), ieee80211_gt…
-
High 8.8
ceph: prevent use-after-free in encode_cap_msg()
In the Linux kernel, the following vulnerability has been resolved: ceph: prevent use-after-free in encode_cap_msg() In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This imp…
-
High 8.8
wifi: mac80211: fix race condition on enabling fast-xmit
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix race condition on enabling fast-xmit fast-xmit must only be enabled after the sta has been uploaded to the driver, otherwise it could end up passing the not-yet-uploaded s…
-
High 8.8
Bluetooth: Avoid potential use-after-free in hci_error_reset
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Avoid potential use-after-free in hci_error_reset While handling the HCI_EV_HARDWARE_ERROR event, if the underlying BT controller is not responding, the GPIO reset mechanism would …
-
High 8.8
net: sparx5: Fix use after free inside sparx5_del_mact_entry
In the Linux kernel, the following vulnerability has been resolved: net: sparx5: Fix use after free inside sparx5_del_mact_entry Based on the static analyzis of the code it looks like when an entry from the MAC table was removed, the entry was still used afte…
-
High 8.8
wifi: wilc1000: fix RCU usage in connect path
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: su…
-
High 8.8
netfilter: bridge: confirm multicast packets before passing them up the stack
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: confirm multicast packets before passing them up the stack conntrack nf_confirm logic cannot handle cloned skbs referencing the same nf_conn entry, which will happen for mu…
-
High 8.8
Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix handling of HCI_EV_IO_CAPA_REQUEST If we received HCI_EV_IO_CAPA_REQUEST while HCI_OP_READ_REMOTE_EXT_FEATURES is yet to be responded assume the remote does support …
-
High 8.8
wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach This is the candidate patch of CVE-2023-47233 : https://nvd.nist.gov/vuln/detail/CVE-2023-47233 In brcm80211 driver,it starts w…
-
High 8.6
ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv() syzbot found __ip6_tnl_rcv() could access unitiliazed data [1]. Call pskb_inet_may_pull() to fix this, and initialize ipv6h varia…
-
High 8.1
smb: client: fix potential OOBs in smb2_parse_contexts()
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix potential OOBs in smb2_parse_contexts() Validate offsets and lengths before dereferencing create contexts in smb2_parse_contexts(). This fixes following oops when accessing i…
-
High 8.1
afs: Increase buffer size in afs_update_volume_status()
In the Linux kernel, the following vulnerability has been resolved: afs: Increase buffer size in afs_update_volume_status() The max length of volume->vid value is 20 characters. So increase idbuf[] size up to 24 to avoid overflow. Found by Linux Verification …
-
High 7.8
bpf: Defer the free of inner map when necessary
In the Linux kernel, the following vulnerability has been resolved: bpf: Defer the free of inner map when necessary When updating or deleting an inner map in map array or map htab, the map may still be accessed by non-sleepable program or sleepable program. H…
-
High 7.8
drm: Don't unref the same fb many times by mistake due to deadlock handling
In the Linux kernel, the following vulnerability has been resolved: drm: Don't unref the same fb many times by mistake due to deadlock handling If we get a deadlock after the fb lookup in drm_mode_page_flip_ioctl() we proceed to unref the fb and then retry th…
-
High 7.8
media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run
In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix use after free bug due to error path handling in mtk_jpeg_dec_device_run In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with mtk_jpeg_job_timeout_work. In mtk_jpeg_d…
-
High 7.8
jfs: fix array-index-out-of-bounds in diNewExt
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in diNewExt [Syz report] UBSAN: array-index-out-of-bounds in fs/jfs/jfs_imap.c:2360:2 index -878706688 is out of range for type 'struct iagctl[128]' CPU: 1 …
-
High 7.8
jfs: fix array-index-out-of-bounds in dbAdjTree
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in dbAdjTree Currently there is a bound check missing in the dbAdjTree while accessing the dmt_stree. To add the required check added the bool is_ctl which …
-
High 7.8
jfs: fix slab-out-of-bounds Read in dtSearch
In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds Read in dtSearch Currently while searching for current page in the sorted entry table of the page there is a out of bound access. Added a bound check to fix the er…
-
High 7.8
FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree
In the Linux kernel, the following vulnerability has been resolved: FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree Syzkaller reported the following issue: UBSAN: array-index-out-of-bounds in fs/jfs/jfs_dmap.c:2867:6 index 196694 is out of range for type …
-
High 7.8
powerpc/lib: Validate size for vector operations
In the Linux kernel, the following vulnerability has been resolved: powerpc/lib: Validate size for vector operations Some of the fp/vmx code in sstep.c assume a certain maximum size for the instructions being emulated. The size of those operations however is …
-
High 7.8
PM / devfreq: Fix buffer overflow in trans_stat_show
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Fix buffer overflow in trans_stat_show Fix buffer overflow in trans_stat_show(). Convert simple snprintf to the more secure scnprintf with size of PAGE_SIZE. Add condition check…
-
High 7.8
crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init
In the Linux kernel, the following vulnerability has been resolved: crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init When the mpi_ec_ctx structure is initialized, some fields are not cleared, causing a crash when referencing the field when the s…
-
High 7.8
netfilter: nf_tables: disallow timeout for anonymous sets
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: disallow timeout for anonymous sets Never used from userspace, disallow these parameters.
-
High 7.8
SUNRPC: Fix a suspicious RCU usage warning
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix a suspicious RCU usage warning I received the following warning while running cthon against an ontap server running pNFS: [ 57.202521] ============================= [ 57.202522] W…
-
High 7.8
can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER)
In the Linux kernel, the following vulnerability has been resolved: can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) Lock jsk->sk to prevent UAF when setsockopt(..., SO_J1939_FILTER, ...) modifies jsk->filters while receiving pa…
-
High 7.8
io_uring: drop any code related to SCM_RIGHTS
In the Linux kernel, the following vulnerability has been resolved: io_uring: drop any code related to SCM_RIGHTS This is dead code after we dropped support for passing io_uring fds over SCM_RIGHTS, get rid of it.
-
High 7.8
drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node When ida_alloc_max fails, resources allocated before should be freed, including *res allocated by kmalloc and ttm_resource_init.
-
High 7.8
ext4: regenerate buddy after block freeing failed if under fc replay
In the Linux kernel, the following vulnerability has been resolved: ext4: regenerate buddy after block freeing failed if under fc replay This mostly reverts commit 6bd97bf273bd ("ext4: remove redundant mb_regenerate_buddy()") and reintroduces mb_regenerate_bu…
-
High 7.8
ksmbd: fix global oob in ksmbd_nl_policy
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix global oob in ksmbd_nl_policy Similar to a reported issue (check the commit b33fb5b801c6 ("net: qualcomm: rmnet: fix global oob in rmnet_policy"), my local fuzzer finds another glo…
-
High 7.8
wifi: iwlwifi: fix a memory corruption
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix a memory corruption iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in bytes, we…
-
High 7.8
tcp: make sure init the accept_queue's spinlocks once
In the Linux kernel, the following vulnerability has been resolved: tcp: make sure init the accept_queue's spinlocks once When I run syz's reproduction C program locally, it causes the following issue: pvqspinlock: lock 0xffff9d181cd5c660 has corrupted value …
-
High 7.8
llc: call sock_orphan() at release time
In the Linux kernel, the following vulnerability has been resolved: llc: call sock_orphan() at release time syzbot reported an interesting trace [1] caused by a stale sk->sk_wq pointer in a closed llc socket. In commit ff7b11aa481f ("net: socket: set sock->sk…
-
High 7.8
tcp: add sanity checks to rx zerocopy
In the Linux kernel, the following vulnerability has been resolved: tcp: add sanity checks to rx zerocopy TCP rx zerocopy intent is to map pages initially allocated from NIC drivers, not pages owned by a fs. This patch adds to can_map_frag() these additional …
-
High 7.8
xhci: handle isoc Babble and Buffer Overrun events properly
In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of t…
-
High 7.8
tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()
In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0x…
-
High 7.8
hwmon: (coretemp) Fix out-of-bounds memory access
In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix out-of-bounds memory access Fix a bug that pdata->cpu_map[] is set before out-of-bounds check. The problem might be triggered on systems with more than 128 cores per pac…
-
High 7.8
nilfs2: fix data corruption in dsync block recovery for small block sizes
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix data corruption in dsync block recovery for small block sizes The helper function nilfs_recovery_copy_block() of nilfs_recovery_dsync_blocks(), which recovers data from logs creat…
-
High 7.8
ext4: fix double-free of blocks due to wrong extents moved_len
In the Linux kernel, the following vulnerability has been resolved: ext4: fix double-free of blocks due to wrong extents moved_len In ext4_move_extents(), moved_len is only updated when all moves are successfully executed, and only discards orig_inode and don…
-
High 7.8
powerpc/kasan: Fix addr error caused by page alignment
In the Linux kernel, the following vulnerability has been resolved: powerpc/kasan: Fix addr error caused by page alignment In kasan_init_region, when k_start is not page aligned, at the begin of for loop, k_cur = k_start & PAGE_MASK is less than k_start, and …
-
High 7.8
bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel The following race is possible between bpf_timer_cancel_and_free and bpf_timer_cancel. It will lead a UAF on the timer->…
-
High 7.8
usb: cdns3: fix memory double free when handle zero packet
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix memory double free when handle zero packet 829 if (request->complete) { 830 spin_unlock(&priv_dev->lock); 831 usb_gadget_giveback_request(&priv_ep->endpoint, 832 request); 833…
-
High 7.8
IB/hfi1: Fix sdma.h tx->num_descs off-by-one error
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix sdma.h tx->num_descs off-by-one error Unfortunately the commit `fd8958efe877` introduced another error causing the `descs` array to overflow. This reults in further crashes easil…
-
High 7.8
ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() Places the logic for checking if the group's block bitmap is corrupt under the protection of the group lock to avo…
-
High 7.8
ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found()
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() Determine if the group block bitmap is corrupted before using ac_b_ex in ext4_mb_try_best_found() to avoid alloc…
-
High 7.8
btrfs: fix double free of anonymous device after snapshot creation failure
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix double free of anonymous device after snapshot creation failure When creating a snapshot we may do a double free of an anonymous device in case there's an error committing the tran…
-
High 7.8
gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_newlink() The gtp_link_ops operations structure for the subsystem must be registered after registering the gtp_net_ops pernet operations stru…
-
High 7.8
riscv: Sparse-Memory/vmemmap out-of-bounds fix
In the Linux kernel, the following vulnerability has been resolved: riscv: Sparse-Memory/vmemmap out-of-bounds fix Offset vmemmap so that the first page of vmemmap will be mapped to the first page of physical memory in order to ensure that vmemmap’s bounds wi…
-
High 7.8
stmmac: Clear variable when destroying workqueue
In the Linux kernel, the following vulnerability has been resolved: stmmac: Clear variable when destroying workqueue Currently when suspending driver and stopping workqueue it is checked whether workqueue is not NULL and if so, it is destroyed. Function destr…
-
High 7.8
net: ip_tunnel: prevent perpetual headroom growth
In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: prevent perpetual headroom growth syzkaller triggered following kasan splat: BUG: KASAN: use-after-free in __skb_flow_dissect+0x19d1/0x7a50 net/core/flow_dissector.c:1170 Read…
-
High 7.8
netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_chain_filter: handle NETDEV_UNREGISTER for inet/ingress basechain Remove netdevice from inet/ingress basechain in case NETDEV_UNREGISTER event is reported, otherwise a stale re…
-
High 7.8
netfilter: nft_set_pipapo: release elements in clone only from destroy path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: release elements in clone only from destroy path Clone already always provides a current view of the lookup table, use it to destroy the set, otherwise it is possib…
-
High 7.8
RDMA/irdma: Fix KASAN issue with tasklet
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix KASAN issue with tasklet KASAN testing revealed the following issue assocated with freeing an IRQ. [50006.466686] Call Trace: [50006.466691] <IRQ> [50006.489538] dump_stack+0x…
-
High 7.8
net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6_route_mpath_notify() syzbot found another use-after-free in ip6_route_mpath_notify() [1] Commit f7225172f25a ("net/ipv6: prevent use after free in ip6_rout…
-
High 7.8
NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102
In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 A call to listxattr() with a buffer size = 0 returns the actual size of the buffer needed for a subsequent call. When size > 0, nfs…
-
High 7.8
RDMA/srpt: Do not register event handler until srpt device is fully setup
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Do not register event handler until srpt device is fully setup Upon rare occasions, KASAN reports a use-after-free Write in srpt_refresh_port(). This seems to be because an event h…
-
High 7.8
dm: call the resume method on internal suspend
In the Linux kernel, the following vulnerability has been resolved: dm: call the resume method on internal suspend There is this reported crash when experimenting with the lvm2 testsuite. The list corruption is caused by the fact that the postsuspend and resu…
-
High 7.8
bpf: Fix stackmap overflow check on 32-bit arches
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check on 32-bit arches The stackmap code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the res…
-
High 7.8
bpf: Fix hashtab overflow check on 32-bit arches
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix hashtab overflow check on 32-bit arches The hashtab code relies on roundup_pow_of_two() to compute the number of hash buckets, and contains an overflow check by checking if the resul…
-
High 7.8
bpf: Fix DEVMAP_HASH overflow check on 32-bit arches
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix DEVMAP_HASH overflow check on 32-bit arches The devmap code allocates a number hash buckets equal to the next power of two of the max_entries value provided when creating the map. Wh…
-
High 7.8
wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: prevent use-after-free on vif when cleaning up all interfaces wilc_netdev_cleanup currently triggers a KASAN warning, which can be observed on interface registration error pat…
-
High 7.8
aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts This patch is against CVE-2023-6270. The description of cve is: A flaw was found in the ATA over Ethernet (AoE) driver in the …
-
High 7.8
RDMA/mlx5: Fix fortify source warning while accessing Eth segment
In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix fortify source warning while accessing Eth segment ------------[ cut here ]------------ memcpy: detected field-spanning write (size 56) of single field "eseg->inline_hdr.start"…
-
High 7.8
octeontx2-af: Use separate handlers for interrupts
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Use separate handlers for interrupts For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts …
-
High 7.8
f2fs: compress: fix to cover normal cluster write with cp_rwsem
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover normal cluster write with cp_rwsem When we overwrite compressed cluster w/ normal cluster, we should not unlock cp_rwsem during f2fs_write_raw_pages(), otherwise …
-
High 7.8
media: edia: dvbdev: fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved: media: edia: dvbdev: fix a use-after-free In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after d…
-
High 7.8
wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().
-
High 7.8
media: ttpci: fix two memleaks in budget_av_attach
In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks in budget_av_attach When saa7146_register_device and saa7146_vv_init fails, budget_av_attach should free the resources it allocates, like the error-handling of …
-
High 7.8
netfilter: nft_flow_offload: reset dst in route object after setting up flow
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: reset dst in route object after setting up flow dst is transferred to the flow object, route object does not own it anymore. Reset dst in route object, otherwise …
-
High 7.8
wifi: nl80211: reject iftype change with mesh ID change
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject iftype change with mesh ID change It's currently possible to change the mesh ID when the interface isn't yet in mesh mode, at the same time as changing it into mesh mode…
-
High 7.8
rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: fix error logic of IFLA_BRIDGE_FLAGS writing back In the commit d73ef2d69c0d ("rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length"), an adjustment was made to the ol…
-
High 7.8
cpumap: Zero-initialise xdp_rxq_info struct before running XDP program
In the Linux kernel, the following vulnerability has been resolved: cpumap: Zero-initialise xdp_rxq_info struct before running XDP program When running an XDP program that is attached to a cpumap entry, we don't initialise the xdp_rxq_info data structure bein…
-
High 7.8
media: tc358743: register v4l2 async device only after successful setup
In the Linux kernel, the following vulnerability has been resolved: media: tc358743: register v4l2 async device only after successful setup Ensure the device has been setup correctly before registering the v4l2 async device, thus allowing userspace to access.
-
High 7.5
nvmet-fc: avoid deadlock on delete association path
In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: avoid deadlock on delete association path When deleting an association the shutdown path is deadlocking because we try to flush the nvmet_wq nested. Avoid this by deadlock by deferr…
-
High 7.5
mptcp: fix data re-injection from stale subflow
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix data re-injection from stale subflow When the MPTCP PM detects that a subflow is stale, all the packet scheduler must re-inject all the mptcp-level unacked data. To avoid acquiring…
-
High 7.5
scsi: target: core: Add TMF to tmr_list handling
In the Linux kernel, the following vulnerability has been resolved: scsi: target: core: Add TMF to tmr_list handling An abort that is responded to by iSCSI itself is added to tmr_list but does not go to target core. A LUN_RESET that goes through tmr_list take…
-
High 7.5
netfilter: nf_conntrack_h323: Add protection for bmp length out of range
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_h323: Add protection for bmp length out of range UBSAN load reports an exception of BRK#5515 SHIFT_ISSUE:Bitwise shifts that are out of bounds for their data type. vml…
-
High 7.5
net: hns3: fix kernel crash when 1588 is received on HIP08 devices
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is received on HIP08 devices The HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL, but the hardware can receive 1588 messages, a…
-
High 7.5
usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs It is observed sometimes when tethering is used over NCM with Windows 11 as host, at some instances, the gadget_giveback has…
-
High 7.3
f2fs: fix to tag gcing flag on page during block migration
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to tag gcing flag on page during block migration It needs to add missing gcing flag on page during block migration, in order to garantee migrated data be persisted during checkpoint…
-
High 7.3
geneve: make sure to pull inner header in geneve_rx()
In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneve_rx() syzbot triggered a bug in geneve_rx() [1] Issue is similar to the one I fixed in commit 8d975c15c0cd ("ip6_tunnel: make sure to pull inne…
-
High 7.3
net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv()
In the Linux kernel, the following vulnerability has been resolved: net: ip_tunnel: make sure to pull inner header in ip_tunnel_rcv() Apply the same fix than ones found in : 8d975c15c0cd ("ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()") 1ca1ba…
-
High 7.1
erofs: fix lz4 inplace decompression
In the Linux kernel, the following vulnerability has been resolved: erofs: fix lz4 inplace decompression Currently EROFS can map another compressed buffer for inplace decompression, that was used to handle the cases that some pages of compressed data are actu…
-
High 7.1
fs/ntfs3: Fix oob in ntfs_listxattr
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix oob in ntfs_listxattr The length of name cannot exceed the space occupied by ea.
-
High 7.1
dm-crypt: don't modify the data when using authenticated encryption
In the Linux kernel, the following vulnerability has been resolved: dm-crypt: don't modify the data when using authenticated encryption It was said that authenticated encryption could produce invalid tag when the data that is being encrypted is modified [1]. …
-
High 7.0
Kernel: aoe: improper reference count leads to use-after-free vulnerability
A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access thro…
-
High 7.0
drm/amd/display: Implement bounds check for stream encoder creation in DCN301
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structures. The array is initialized with four …
-
High 7.0
drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' Tell snprintf() to store at most 10 bytes in the output buffer instead of 30. Fixes the below: drivers/gpu/drm/amd…
-
Medium 6.6
Kernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function
A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
-
Medium 6.5
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler The TX buffer in spi_transfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause …
-
Medium 6.4
media: pvrusb2: fix uaf in pvr2_context_set_notify
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix uaf in pvr2_context_set_notify [Syzbot reported] BUG: KASAN: slab-use-after-free in pvr2_context_set_notify+0x2c4/0x310 drivers/media/usb/pvrusb2/pvrusb2-context.c:35 Read…
-
Medium 6.3
NULL pointer deference in rfcomm_check_security in Linux kernel
NULL Pointer Dereference vulnerability in Linux Linux kernel kernel on Linux, x86, ARM (net, bluetooth modules) allows Overflow Buffers. This vulnerability is associated with program files /net/bluetooth/rfcomm/core.C. This issue affects Linux kernel: v2.6.12…
-
Medium 6.0
efi: runtime: Fix potential overflow of soft-reserved region size
In the Linux kernel, the following vulnerability has been resolved: efi: runtime: Fix potential overflow of soft-reserved region size md_size will have been narrowed if we have >= 4GB worth of pages in a soft-reserved region.
-
Medium 6.0
ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit()
In the Linux kernel, the following vulnerability has been resolved: ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() After unregistering the CPU idle device, the memory associated with it is not freed, leading to a memory leak: unreference…
-
Medium 5.5
powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
In the Linux kernel, the following vulnerability has been resolved: powerpc/mm: Fix null-pointer dereference in pgtable_cache_add kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation was successfu…
-
Medium 5.5
iio: adc: ad7091r: Allow users to configure device events
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7091r: Allow users to configure device events AD7091R-5 devices are supported by the ad7091r-5 driver together with the ad7091r-base driver. Those drivers declared iio events for …
-
Medium 5.5
fs/ntfs3: Fix an NULL dereference bug
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_attr_list(). The "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow on a 64bit …
-
Medium 5.5
Kernel: stack overflow problem in open vswitch kernel module leading to dos
A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and ca…
-
Medium 5.5
In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RD…
-
Medium 5.5
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler Inside scsi_eh_wakeup(), scsi_host_busy() is called & checked with host lock every time for deciding if error handl…
-
Medium 5.5
af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. syzbot reported a warning [0] in __unix_gc() with a repro, which creates a socketpair and sends one socket's fd to itself using th…
-
Medium 5.5
nilfs2: fix potential bug in end_buffer_async_write
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential bug in end_buffer_async_write According to a syzbot report, end_buffer_async_write(), which handles the completion of block device writes, may detect abnormal condition …
-
Medium 5.5
iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC
In the Linux kernel, the following vulnerability has been resolved: iio: magnetometer: rm3100: add boundary check for the value read from RM3100_REG_TMRC Recently, we encounter kernel crash in function rm3100_common_probe caused by out of bound access of arra…
-
Medium 5.5
RDMA/srpt: Support specifying the srpt_service_guid parameter
In the Linux kernel, the following vulnerability has been resolved: RDMA/srpt: Support specifying the srpt_service_guid parameter Make loading ib_srpt with this parameter set work. The current behavior is that setting that parameter while loading the ib_srpt …
-
Medium 5.5
Bluetooth: hci_core: Fix possible buffer overflow
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix possible buffer overflow struct hci_dev_info has a fixed size name[8] field so in the event that hdev->name is bigger than that strcpy would attempt to write past its…
-
Medium 5.5
Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security During our fuzz testing of the connection and disconnection process at the RFCOMM layer, we discovered this bug. By comparing th…
-
Medium 5.5
drm/amdgpu: Reset IH OVERFLOW_CLEAR bit
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Reset IH OVERFLOW_CLEAR bit Allows us to detect subsequent IH ring buffer overflows as well.
-
Medium 5.5
clk: zynq: Prevent null pointer dereference caused by kmalloc failure
In the Linux kernel, the following vulnerability has been resolved: clk: zynq: Prevent null pointer dereference caused by kmalloc failure The kmalloc() in zynq_clk_setup() will return null if the physical memory has run out. As a result, if we use snprintf() …
-
Medium 5.5
s390/dasd: fix double module refcount decrement
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix double module refcount decrement Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on t…
-
Medium 5.5
power: supply: bq27xxx-i2c: Do not free non existing IRQ
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq27xxx-i2c: Do not free non existing IRQ The bq27xxx i2c-client may not have an IRQ, in which case client->irq will be 0. bq27xxx_battery_i2c_probe() already has an if (client…
-
Medium 5.5
drm/lima: fix a memleak in lima_heap_alloc
In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix a memleak in lima_heap_alloc When lima_vm_map_bo fails, the resources need to be deallocated, or there will be memleaks.
-
Medium 5.3
block/rnbd-srv: Check for unlikely string overflow
In the Linux kernel, the following vulnerability has been resolved: block/rnbd-srv: Check for unlikely string overflow Since "dev_search_path" can technically be as large as PATH_MAX, there was a risk of truncation when copying it and a second string into "fu…
-
Medium 5.3
do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
In the Linux kernel, the following vulnerability has been resolved: do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak syzbot identified a kernel information leak vulnerability in do_sys_name_to_handle() and issued the following report [1]. [1] "BU…
-
Medium 5.3
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Stop parsing channels bits when all channels are found. If a usb audio device sets more bits than the amount of channels it could write outside of the map array.
-
Medium 4.7
CVE-2024-2201
A cross-privilege Spectre v2 vulnerability allows attackers to bypass all deployed mitigations, including the recent Fine(IBT), and to leak arbitrary Linux kernel memory on Intel systems.
-
Medium 4.4
dmaengine: fix NULL pointer in channel unregistration function
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix NULL pointer in channel unregistration function __dma_async_device_channel_register() can fail. In case of failure, chan->local is freed (with free_percpu()), and chan->local i…
-
Medium 4.4
PCI: switchtec: Fix stdev_release() crash after surprise hot remove
In the Linux kernel, the following vulnerability has been resolved: PCI: switchtec: Fix stdev_release() crash after surprise hot remove A PCI device hot removal may occur while stdev->cdev is held open. The call to stdev_release() then happens during close or…
-
Medium 4.4
Kernel: null pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev()
A null pointer dereference vulnerability was found in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() in drivers/net/wireless/ath/ath10k/wmi-tlv.c in the Linux kernel. This issue could be exploited to trigger a denial of service.
-
Medium 4.4
usb: roles: fix NULL pointer issue when put module's reference
In the Linux kernel, the following vulnerability has been resolved: usb: roles: fix NULL pointer issue when put module's reference In current design, usb role class driver will get usb_role_switch parent's module reference after the user get usb_role_switch d…
-
Medium 4.4
nvme-fc: do not wait in vain when unloading module
In the Linux kernel, the following vulnerability has been resolved: nvme-fc: do not wait in vain when unloading module The module exit path has race between deleting all controllers and freeing 'left over IDs'. To prevent double free a synchronization between…
-
Medium 4.3
The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unp…
-
Medium 4.0
KVM: s390: fix setting of fpc register
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: fix setting of fpc register kvm_arch_vcpu_ioctl_set_fpu() allows to set the floating point control (fpc) register of a guest cpu. The new value is tested for validity by temporaril…
-
Unscored —
net: prevent mss overflow in skb_segment()
In the Linux kernel, the following vulnerability has been resolved: net: prevent mss overflow in skb_segment() Once again syzbot is able to crash the kernel in skb_segment() [1] GSO_BY_FRAGS is a forbidden value, but unfortunately the following computation in…
-
Unscored —
mm/sparsemem: fix race in accessing memory_section->usage
In the Linux kernel, the following vulnerability has been resolved: mm/sparsemem: fix race in accessing memory_section->usage The below race is observed on a PFN which falls into the device memory region with the system memory configuration where PFN's are su…
-
Unscored —
bus: mhi: host: Drop chan lock before queuing buffers
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Drop chan lock before queuing buffers Ensure read and write locks for the channel are not taken in succession by dropping the read lock from parse_xfer_event() such that a cal…
-
Unscored —
bus: mhi: host: Add alignment check for event ring read pointer
In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Add alignment check for event ring read pointer Though we do check the event ring read pointer by "is_valid_ring_ptr" to make sure it is in the buffer range, but there is anot…
-
Unscored —
PM: sleep: Fix possible deadlocks in core system-wide PM code
In the Linux kernel, the following vulnerability has been resolved: PM: sleep: Fix possible deadlocks in core system-wide PM code It is reported that in low-memory situations the system-wide resume core code deadlocks, because async_schedule_dev() executes it…
-
Unscored —
ceph: fix deadlock or deadcode of misusing dget()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix deadlock or deadcode of misusing dget() The lock order is incorrect between denty and its parent, we should always make sure that the parent get the lock first. But since this deadc…
-
Unscored —
IB/ipoib: Fix mcast list locking
In the Linux kernel, the following vulnerability has been resolved: IB/ipoib: Fix mcast list locking Releasing the `priv->lock` while iterating the `priv->multicast_list` in `ipoib_mcast_join_task()` opens a window for `ipoib_mcast_dev_flush()` to remove the …
-
Unscored —
wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() Fix an array-index-out-of-bounds read in ath9k_htc_txstatus(). The bug occurs when txs->cnt, data from a URB …
-
Unscored —
wifi: rt2x00: restart beacon queue when hardware reset
In the Linux kernel, the following vulnerability has been resolved: wifi: rt2x00: restart beacon queue when hardware reset When a hardware reset is triggered, all registers are reset, so all queues are forced to stop in hardware interface. However, mac80211 w…
-
Unscored —
s390/ptrace: handle setting of fpc register correctly
In the Linux kernel, the following vulnerability has been resolved: s390/ptrace: handle setting of fpc register correctly If the content of the floating point control (fpc) register of a traced process is modified with the ptrace interface the new value is te…
-
Unscored —
firmware: arm_scmi: Check mailbox/SMT channel for consistency
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Check mailbox/SMT channel for consistency On reception of a completion interrupt the shared memory area is accessed to retrieve the message header at first and then, if th…
-
Unscored —
hwrng: core - Fix page fault dead lock on mmap-ed hwrng
In the Linux kernel, the following vulnerability has been resolved: hwrng: core - Fix page fault dead lock on mmap-ed hwrng There is a dead-lock in the hwrng device read path. This triggers when the user reads from /dev/hwrng into memory also mmap-ed from /de…
-
Unscored —
pstore/ram: Fix crash when setting number of cpus to an odd number
In the Linux kernel, the following vulnerability has been resolved: pstore/ram: Fix crash when setting number of cpus to an odd number When the number of cpu cores is adjusted to 7 or other odd numbers, the zone size will become an odd number. The address of …
-
Unscored —
ext4: avoid online resizing failures due to oversized flex bg
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid online resizing failures due to oversized flex bg When we online resize an ext4 filesystem with a oversized flexbg_size, mkfs.ext4 -F -G 67108864 $dev -b 4096 100M mount $dev $dir…
-
Unscored —
um: time-travel: fix time corruption
In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_r…
-
Unscored —
PM / devfreq: Synchronize devfreq_monitor_[start/stop]
In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from…
-
Unscored —
can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock
In the Linux kernel, the following vulnerability has been resolved: can: j1939: prevent deadlock by changing j1939_socks_lock to rwlock The following 3 locks would race against each other, causing the deadlock situation in the Syzbot bug report: - j1939_socks…
-
Unscored —
fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame()
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame() It is preferable to exit through the out: label because internal debugging functions are located there.
-
Unscored —
media: rc: bpf attach/detach requires write permission
In the Linux kernel, the following vulnerability has been resolved: media: rc: bpf attach/detach requires write permission Note that bpf attach/detach also requires CAP_NET_ADMIN.
-
Unscored —
iio: core: fix memleak in iio_device_register_sysfs
In the Linux kernel, the following vulnerability has been resolved: iio: core: fix memleak in iio_device_register_sysfs When iio_device_register_sysfs_group() fails, we should free iio_dev_opaque->chan_attr_group.attrs to prevent potential memleak.
-
Unscored —
wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled
In the Linux kernel, the following vulnerability has been resolved: wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is disabled When QoS is disabled, the queue priority value will not map to the correct ieee80211 queue since there is only one queue…
-
Unscored —
pmdomain: mediatek: fix race conditions with genpd
In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix race conditions with genpd If the power domains are registered first with genpd and *after that* the driver attempts to power them on in the probe sequence, then it is…
-
Unscored —
drm/tegra: dsi: Add missing check for of_find_device_by_node
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: dsi: Add missing check for of_find_device_by_node Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer derefer…
-
Unscored —
NTB: fix possible name leak in ntb_register_device()
In the Linux kernel, the following vulnerability has been resolved: NTB: fix possible name leak in ntb_register_device() If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in de…
-
Unscored —
i2c: i801: Fix block process call transactions
In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Fix block process call transactions According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the…
-
Unscored —
phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP
In the Linux kernel, the following vulnerability has been resolved: phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP If the external phy working together with phy-omap-usb2 does not implement send_srp(), we may still attempt to call it. This can h…
-
Unscored —
sched/membarrier: reduce the ability to hammer on sys_membarrier
In the Linux kernel, the following vulnerability has been resolved: sched/membarrier: reduce the ability to hammer on sys_membarrier On some systems, sys_membarrier can be very expensive, causing overall slowdowns for everything. So put a lock on the path in …
-
Unscored —
x86/fpu: Stop relying on userspace for info to fault in xsave buffer
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Stop relying on userspace for info to fault in xsave buffer Before this change, the expected size of the user space buffer was taken from fx_sw->xstate_size. fx_sw->xstate_size can b…
-
Unscored —
binder: signal epoll threads of self-work
In the Linux kernel, the following vulnerability has been resolved: binder: signal epoll threads of self-work In (e)poll mode, threads often depend on I/O events to determine when data is ready for consumption. Within binder, a thread may initiate a command v…
-
Unscored —
net/smc: fix illegal rmb_desc access in SMC-D connection dump
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix illegal rmb_desc access in SMC-D connection dump A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx sm…
-
Unscored —
tomoyo: fix UAF write bug in tomoyo_write_control()
In the Linux kernel, the following vulnerability has been resolved: tomoyo: fix UAF write bug in tomoyo_write_control() Since tomoyo_write_control() updates head->write_buf when write() of long lines is requested, we need to fetch head->write_buf after head->…
-
Unscored —
llc: Drop support for ETH_P_TR_802_2.
In the Linux kernel, the following vulnerability has been resolved: llc: Drop support for ETH_P_TR_802_2. syzbot reported an uninit-value bug below. [0] llc supports ETH_P_802_2 (0x0004) and used to support ETH_P_TR_802_2 (0x0011), and syzbot abused the latte…
-
Unscored —
llc: make llc_ui_sendmsg() more robust against bonding changes
In the Linux kernel, the following vulnerability has been resolved: llc: make llc_ui_sendmsg() more robust against bonding changes syzbot was able to trick llc_ui_sendmsg(), allocating an skb with no headroom, but subsequently trying to push 14 bytes of Ether…
-
Unscored —
btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't abort filesystem when attempting to snapshot deleted subvolume If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRF…
-
Unscored —
tracing: Ensure visibility when inserting an element into tracing_map
In the Linux kernel, the following vulnerability has been resolved: tracing: Ensure visibility when inserting an element into tracing_map Running the following two commands in parallel on a multi-processor AArch64 machine can sporadically produce an unexpecte…
-
Unscored —
sr9800: Add check for usbnet_get_endpoints
In the Linux kernel, the following vulnerability has been resolved: sr9800: Add check for usbnet_get_endpoints Add check for usbnet_get_endpoints() and return the error if it fails in order to transfer the error.
-
Unscored —
netfilter: nft_limit: reject configurations that cause integer overflow
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as…
-
Unscored —
blk-mq: fix IO hang from sbitmap wakeup race
In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. …
-
Unscored —
netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since dest…
-
Unscored —
ppp_async: limit MRU to 64K
In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit M…
-
Unscored —
inet: read sk->sk_family once in inet_recv_error()
In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a…
-
Unscored —
net: stmmac: xgmac: fix handling of DPP safety error for DMA channels
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handling of DPP safety error for DMA channels Commit 56e58d6c8a56 ("net: stmmac: Implement Safety Features in XGMAC core") checks and reports safety errors, but leaves…
-
Unscored —
fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super
In the Linux kernel, the following vulnerability has been resolved: fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super When configuring a hugetlb filesystem via the fsconfig() syscall, there is a possible NULL dereference in hugetlbfs_fill_super(…
-
Unscored —
crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix null pointer dereference in __sev_platform_shutdown_locked The SEV platform device can be shutdown with a null psp_master, e.g., using DEBUG_TEST_DRIVER_REMOVE. Found using …
-
Unscored —
nilfs2: fix hang in nilfs_lookup_dirty_data_buffers()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() Syzbot reported a hang issue in migrate_pages_batch() called by mbind() and nilfs_lookup_dirty_data_buffers() called in the log writer of…
-
Unscored —
hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove In commit ac5047671758 ("hv_netvsc: Disable NAPI before closing the VMBus channel"), napi_disable was getting called for a…
-
Unscored —
net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame()
In the Linux kernel, the following vulnerability has been resolved: net: hsr: remove WARN_ONCE() in send_hsr_supervision_frame() Syzkaller reported [1] hitting a warning after failing to allocate resources for skb in hsr_init_skb(). Since a WARN_ONCE() call w…
-
Unscored —
usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: Fix NULL pointer dereference in dwc3_gadget_suspend In current scenario if Plug-out and Plug-In performed continuously there could be a chance while checking for dwc->gadge…
-
Unscored —
HID: i2c-hid-of: fix NULL-deref on failed power up
In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid-of: fix NULL-deref on failed power up A while back the I2C HID implementation was split in an ACPI and OF part, but the new OF driver never initialises the client pointer which i…
-
Unscored —CVE-2024-26720 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work()
In the Linux kernel, the following vulnerability has been resolved: ASoC: rt5645: Fix deadlock in rt5645_jack_detect_work() There is a path in rt5645_jack_detect_work(), where rt5645->jd_mutex is left locked forever. That may lead to deadlock when rt5645_jack…
-
Unscored —
arp: Prevent overflow in arp_req_get().
In the Linux kernel, the following vulnerability has been resolved: arp: Prevent overflow in arp_req_get(). syzkaller reported an overflown write in arp_req_get(). [0] When ioctl(SIOCGARP) is issued, arp_req_get() looks up an neighbour entry and copies neigh-…
-
Unscored —
ipv6: sr: fix possible use-after-free and null-ptr-deref
In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: fix possible use-after-free and null-ptr-deref The pernet operations structure for the subsystem must be registered before registering the generic netlink family.
-
Unscored —
RDMA/qedr: Fix qedr_create_user_qp error flow
In the Linux kernel, the following vulnerability has been resolved: RDMA/qedr: Fix qedr_create_user_qp error flow Avoid the following warning by making sure to free the allocated resources in case that qedr_init_user_queue() fail. -----------[ cut here ]-----…
-
Unscored —
usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable()
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fixed memory use after free at cdns3_gadget_ep_disable() ... cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request); list_del_init(&priv_req->list); ... 'priv_req' a…
-
Unscored —
af_unix: Drop oob_skb ref before purging queue in GC.
In the Linux kernel, the following vulnerability has been resolved: af_unix: Drop oob_skb ref before purging queue in GC. syzbot reported another task hung in __unix_gc(). [0] The current while loop assumes that all of the left candidates have oob_skb and cal…
-
Unscored —
ARM: ep93xx: Add terminator to gpiod_lookup_table
In the Linux kernel, the following vulnerability has been resolved: ARM: ep93xx: Add terminator to gpiod_lookup_table Without the terminator, if a con_id is passed to gpio_find() that does not exist in the lookup table the function will not stop looping corre…
-
Unscored —
l2tp: pass correct message length to ip6_append_data
In the Linux kernel, the following vulnerability has been resolved: l2tp: pass correct message length to ip6_append_data l2tp_ip6_sendmsg needs to avoid accounting for the transport header twice when splicing more data into an already partially-occupied skbuf…
-
Unscored —
gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp()
In the Linux kernel, the following vulnerability has been resolved: gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() The gtp_net_ops pernet operations structure for the subsystem must be registered before registering the generic netlink famil…
-
Unscored —
fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio
In the Linux kernel, the following vulnerability has been resolved: fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio If kiocb_set_cancel_fn() is called for I/O submitted via io_uring, the following kernel warning appears: WARNING: CPU: 3 PID…
-
Unscored —
dmaengine: ti: edma: Add some null pointer checks to the edma_probe
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: edma: Add some null pointer checks to the edma_probe devm_kasprintf() returns a pointer to dynamically allocated memory which can be NULL upon failure. Ensure the allocation wa…
-
Unscored —
ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt
In the Linux kernel, the following vulnerability has been resolved: ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt Determine if bb_fragments is 0 instead of determining bb_free to eliminate the risk of dividing by zero wh…
-
Unscored —
spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected
In the Linux kernel, the following vulnerability has been resolved: spi: hisi-sfc-v3xx: Return IRQ_NONE if no interrupts were detected Return IRQ_NONE from the interrupt handler when no interrupt was detected. Because an empty interrupt will cause a null poin…
-
Unscored —
fbdev: sis: Error out if pixclock equals zero
In the Linux kernel, the following vulnerability has been resolved: fbdev: sis: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may ca…
-
Unscored —
fbdev: savage: Error out if pixclock equals zero
In the Linux kernel, the following vulnerability has been resolved: fbdev: savage: Error out if pixclock equals zero The userspace program could pass any values to the driver through ioctl() interface. If the driver doesn't check the value of pixclock, it may…
-
Unscored —
mmc: mmci: stm32: fix DMA API overlapping mappings warning
In the Linux kernel, the following vulnerability has been resolved: mmc: mmci: stm32: fix DMA API overlapping mappings warning Turning on CONFIG_DMA_API_DEBUG_SG results in the following warning: DMA-API: mmci-pl18x 48220000.mmc: cacheline tracking EEXIST, ov…
-
Unscored —
dmaengine: fsl-qdma: init irq after reg initialization
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: init irq after reg initialization Initialize the qDMA irqs after the registers are configured so that interrupts that may have been pending from a primary kernel don't ge…
-
Unscored —
dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read
In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-qdma: fix SoC may hang on 16 byte unaligned read There is chip (ls1028a) errata: The SoC may hang on 16 byte unaligned read transactions by QDMA. Unaligned read transactions in…
-
Unscored —
btrfs: dev-replace: properly validate device names
In the Linux kernel, the following vulnerability has been resolved: btrfs: dev-replace: properly validate device names There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead t…
-
Unscored —
fbcon: always restore the old font data in fbcon_do_set_font()
In the Linux kernel, the following vulnerability has been resolved: fbcon: always restore the old font data in fbcon_do_set_font() Commit a5a923038d70 (fbdev: fbcon: Properly revert changes when vc_resize() failed) started restoring old font data upon failure…
-
Unscored —
net: veth: clear GRO when clearing XDP even when down
In the Linux kernel, the following vulnerability has been resolved: net: veth: clear GRO when clearing XDP even when down veth sets NETIF_F_GRO automatically when XDP is enabled, because both features use the same NAPI machinery. The logic to clear NETIF_F_GR…
-
Unscored —
netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter syzbot reported the following uninit-value access issue [1]: netlink_to_full_skb() creates a new `skb` and puts the `skb->data` …
-
Unscored —
x86, relocs: Ignore relocations in .notes section
In the Linux kernel, the following vulnerability has been resolved: x86, relocs: Ignore relocations in .notes section When building with CONFIG_XEN_PV=y, .text symbols are emitted into the .notes section so that Xen can find the "startup_xen" entry point. Thi…
-
Unscored —
hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed If hv_netvsc driver is unloaded and reloaded, the NET_DEVICE_REGISTER handler cannot perform VF register successfully as t…
-
Unscored —
nfc: nci: free rx_data_reassembly skb on NCI device cleanup
In the Linux kernel, the following vulnerability has been resolved: nfc: nci: free rx_data_reassembly skb on NCI device cleanup rx_data_reassembly skb is stored during NCI data exchange for processing fragmented packets. It is dropped only when the last fragm…
-
Unscored —
media: ir_toy: fix a memleak in irtoy_tx
In the Linux kernel, the following vulnerability has been resolved: media: ir_toy: fix a memleak in irtoy_tx When irtoy_command fails, buf should be freed since it is allocated by irtoy_tx, or there is a memleak.
-
Unscored —
drm/amd/display: Fix memory leak in dm_sw_fini()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix memory leak in dm_sw_fini() After destroying dmub_srv, the memory associated with it is not freed, causing a memory leak: unreferenced object 0xffff896302b45800 (size 102…
-
Unscored —
netfilter: nf_tables: set dormant flag on hook register failure
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: set dormant flag on hook register failure We need to set the dormant flag again if we fail to register the hooks. During memory pressure hook registration can fail and w…
-
Unscored —
IB/hfi1: Fix a memleak in init_credit_return
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix a memleak in init_credit_return When dma_alloc_coherent fails to allocate dd->cr_base[i].va, init_credit_return should deallocate dd->cr_base and dd->cr_base[i] that allocated be…
-
Unscored —
cachefiles: fix memory leak in cachefiles_add_cache()
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix memory leak in cachefiles_add_cache() The following memory leak was reported after unbinding /dev/cachefiles: =================================================================…
-
Unscored —
net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink()
In the Linux kernel, the following vulnerability has been resolved: net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() The function ice_bridge_setlink() may encounter a NULL pointer dereference if nlmsg_find_attr() returns NULL and br_sp…
-
Unscored —
net/bnx2x: Prevent access to a freed page in page_pool
In the Linux kernel, the following vulnerability has been resolved: net/bnx2x: Prevent access to a freed page in page_pool Fix race condition leading to system crash during EEH error handling During EEH error recovery, the bnx2x driver's transmit timeout logi…
-
Unscored —
wireguard: receive: annotate data-race around receiving_counter.counter
In the Linux kernel, the following vulnerability has been resolved: wireguard: receive: annotate data-race around receiving_counter.counter Syzkaller with KCSAN identified a data-race issue when accessing keypair->receiving_counter.counter. Use READ_ONCE() an…
-
Unscored —
packet: annotate data-races around ignore_outgoing
In the Linux kernel, the following vulnerability has been resolved: packet: annotate data-races around ignore_outgoing ignore_outgoing is read locklessly from dev_queue_xmit_nit() and packet_getsockopt() Add appropriate READ_ONCE()/WRITE_ONCE() annotations. s…
-
Unscored —
hsr: Fix uninit-value access in hsr_get_node()
In the Linux kernel, the following vulnerability has been resolved: hsr: Fix uninit-value access in hsr_get_node() KMSAN reported the following uninit-value access issue [1]: ===================================================== BUG: KMSAN: uninit-value in hs…
-
Unscored —
drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix a null pointer crash in mtk_drm_crtc_finish_page_flip It's possible that mtk_crtc->event is NULL in mtk_drm_crtc_finish_page_flip(). pending_needs_vblank value is set by mtk…
-
Unscored —
quota: Fix potential NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: quota: Fix potential NULL pointer dereference Below race may cause NULL pointer dereference P1 P2 dquot_free_inode quota_off drop_dquot_ref remove_dquot_ref dquots = i_dquot(inode) dquots = i…
-
Unscored —
clk: meson: Add missing clocks to axg_clk_regmaps
In the Linux kernel, the following vulnerability has been resolved: clk: meson: Add missing clocks to axg_clk_regmaps Some clocks were missing from axg_clk_regmaps, which caused kernel panic during cat /sys/kernel/debug/clk/clk_summary [ 57.349402] Unable to …
-
Unscored —
iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected For those endpoint devices connect to system via hotplug capable ports, users could request a hot reset to the dev…
-
Unscored —
wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete
In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete The ath9k_wmi_event_tasklet() used in ath9k_htc assumes that all the data structures have been fully initialised by …
-
Unscored —
x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault()
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() When trying to use copy_from_kernel_nofault() to read vsyscall page through a bpf program, the following oops was reported: …
-
Unscored —
netfilter: ipset: fix performance regression in swap operation
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix performance regression in swap operation The patch "netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test", commit 28628fa9 fixes a race…
-
Unscored —
Revert "drm/amd: flush any delayed gfxoff on suspend entry"
In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amd: flush any delayed gfxoff on suspend entry" commit ab4750332dbe ("drm/amdgpu/sdma5.2: add begin/end_use ring callbacks") caused GFXOFF control to be used more heavily and the …
-
Unscored —
tracing/trigger: Fix to return error if failed to alloc snapshot
In the Linux kernel, the following vulnerability has been resolved: tracing/trigger: Fix to return error if failed to alloc snapshot Fix register_snapshot_trigger() to return error code if it failed to allocate a snapshot instead of 0 (success). Unless that, …
-
Unscored —
net/rds: fix WARNING in rds_conn_connect_if_down
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rds_conn_connect_if_down If connection isn't established yet, get_mr() will fail, trigger connection after get_mr().
-
Unscored —
clk: Fix clk_core_get NULL dereference
In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dereference It is possible for clk_core_get to dereference a NULL in the following sequence: clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provid…
-
Unscored —
clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
In the Linux kernel, the following vulnerability has been resolved: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() 'p_clk' is an array allocated just before the for loop for all clk that need to be registered. It is incremented at each loop iteration.…
-
Unscored —
drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is…
-
Unscored —
nfp: flower: handle acti_netdevs allocation failure
In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_n…
-
Unscored —
net: phy: fix phy_get_internal_delay accessing an empty array
In the Linux kernel, the following vulnerability has been resolved: net: phy: fix phy_get_internal_delay accessing an empty array The phy_get_internal_delay function could try to access to an empty array in the case that the driver is calling phy_get_internal…
-
Unscored —
cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
In the Linux kernel, the following vulnerability has been resolved: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it and return 0 in case of error. Found by Linux Ve…
-
Unscored —
netfilter: nf_tables: do not compare internal table flags on updates
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not compare internal table flags on updates Restore skipping transaction if table update does not modify flags.
-
Unscored —
media: go7007: fix a memleak in go7007_load_encoder
In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain: saa7134_g…
-
Unscored —
media: dvb-frontends: avoid stack overflow warnings with clang
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: avoid stack overflow warnings with clang A previous patch worked around a KASAN issue in stv0367, now a similar problem showed up with clang: drivers/media/dvb-frontends…
-
Unscored —
media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
In the Linux kernel, the following vulnerability has been resolved: media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak Free the memory allocated in v4l2_ctrl_handler_init on release.
-
Unscored —
media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity but isn't freed in its following error-handling paths. Thi…
-
Unscored —
media: v4l2-tpg: fix some memleaks in tpg_alloc
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: fix some memleaks in tpg_alloc In tpg_alloc, resources should be deallocated in each and every error-handling paths, since they are allocated in for statements. Otherwise the…
-
Unscored —
ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()")) I th…
-
Unscored —
efi/capsule-loader: fix incorrect allocation size
In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect allocation size gcc-14 notices that the allocation with sizeof(void) on 32-bit architectures is not enough for a 64-bit phys_addr_t: drivers/firmware/efi/cap…
-
Unscored —
ipv6: fix potential "struct net" leak in inet6_rtm_getaddr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix potential "struct net" leak in inet6_rtm_getaddr() It seems that if userspace provides a correct IFA_TARGET_NETNSID value but no IFA_ADDRESS and IFA_LOCAL attributes, inet6_rtm_geta…
-
Unscored —
netrom: Fix data-races around sysctl_net_busy_read
In the Linux kernel, the following vulnerability has been resolved: netrom: Fix data-races around sysctl_net_busy_read We need to protect the reader reading the sysctl value because the value can be changed concurrently.
-
Unscored —
net: ethernet: mtk_eth_soc: fix PPE hanging issue
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk_eth_soc: fix PPE hanging issue A patch to resolve an issue was found in MediaTek's GPL-licensed SDK: In the mtk_ppe_stop() function, the PPE scan mode is not disabled befor…
-
Unscored —
wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer() In the for statement of lbs_allocate_cmd_buffer(), if the allocation of cmdarray[i].cmdbuf fails, both cmdarray and cmdarray[i].…
-
Unscored —
f2fs: compress: fix reserve_cblocks counting error when out of space
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix reserve_cblocks counting error when out of space When a file only needs one direct_node, performing the following operations will cause the file to be unrepairable: unisoc…
References
-
report
https://ubuntu.com/security/CVE-2023-6270
-
report
https://ubuntu.com/security/CVE-2023-7042
-
report
https://ubuntu.com/security/CVE-2023-47233
-
report
https://ubuntu.com/security/CVE-2023-52434
-
report
https://ubuntu.com/security/CVE-2023-52435
-
report
https://ubuntu.com/security/CVE-2023-52447
-
report
https://ubuntu.com/security/CVE-2023-52486
-
report
https://ubuntu.com/security/CVE-2023-52489
-
report
https://ubuntu.com/security/CVE-2023-52491
-
report
https://ubuntu.com/security/CVE-2023-52492
-
report
https://ubuntu.com/security/CVE-2023-52493
-
report
https://ubuntu.com/security/CVE-2023-52494
-
report
https://ubuntu.com/security/CVE-2023-52497
-
report
https://ubuntu.com/security/CVE-2023-52498
-
report
https://ubuntu.com/security/CVE-2023-52530
-
report
https://ubuntu.com/security/CVE-2023-52583
-
report
https://ubuntu.com/security/CVE-2023-52587
-
report
https://ubuntu.com/security/CVE-2023-52588
-
report
https://ubuntu.com/security/CVE-2023-52594
-
report
https://ubuntu.com/security/CVE-2023-52595
-
report
https://ubuntu.com/security/CVE-2023-52597
-
report
https://ubuntu.com/security/CVE-2023-52598
-
report
https://ubuntu.com/security/CVE-2023-52599
-
report
https://ubuntu.com/security/CVE-2023-52601
-
report
https://ubuntu.com/security/CVE-2023-52602
-
report
https://ubuntu.com/security/CVE-2023-52604
-
report
https://ubuntu.com/security/CVE-2023-52606
-
report
https://ubuntu.com/security/CVE-2023-52607
-
report
https://ubuntu.com/security/CVE-2023-52608
-
report
https://ubuntu.com/security/CVE-2023-52614
-
report
https://ubuntu.com/security/CVE-2023-52615
-
report
https://ubuntu.com/security/CVE-2023-52616
-
report
https://ubuntu.com/security/CVE-2023-52617
-
report
https://ubuntu.com/security/CVE-2023-52618
-
report
https://ubuntu.com/security/CVE-2023-52619
-
report
https://ubuntu.com/security/CVE-2023-52620
-
report
https://ubuntu.com/security/CVE-2023-52622
-
report
https://ubuntu.com/security/CVE-2023-52623
-
report
https://ubuntu.com/security/CVE-2023-52627