Summary
Chenyuan Yang discovered that the USB Gadget subsystem in the Linux
kernel did not properly check for the device to be enabled before
writing. A local attacker could possibly use this to cause a denial of
service. (CVE-2024-25741)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- MIPS architecture;
- PA-RISC architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Cryptographic API;
- Serial ATA and Parallel ATA drivers;
- Null block device driver;
- Bluetooth drivers;
- Cdrom driver;
- Clock framework and drivers;
- Hardware crypto device drivers;
- CXL (Compute Express Link) drivers;
- Cirrus firmware drivers;
- GPIO subsystem;
- GPU drivers;
- I2C subsystem;
- IIO subsystem;
- InfiniBand drivers;
- ISDN/mISDN subsystem;
- LED subsystem;
- Multiple devices driver;
- Media drivers;
- Fastrpc Driver;
- Network drivers;
- Microsoft Azure Network Adapter (MANA) driver;
- Near Field Communication (NFC) drivers;
- NVME drivers;
- NVMEM (Non Volatile Memory) drivers;
- PCI subsystem;
- Pin controllers subsystem;
- x86 platform drivers;
- S/390 drivers;
- SCSI drivers;
- Thermal drivers;
- TTY drivers;
- UFS subsystem;
- USB DSL drivers;
- USB core drivers;
- DesignWare USB3 driver;
- USB Gadget drivers;
- USB Serial drivers;
- VFIO drivers;
- VHOST drivers;
- File systems infrastructure;
- BTRFS file system;
- GFS2 file system;
- JFFS2 file system;
- JFS file system;
- Network file systems library;
- Network file system client;
- NILFS2 file system;
- NTFS3 file system;
- SMB network file system;
- Memory management;
- Netfilter;
- Tracing infrastructure;
- io_uring subsystem;
- BPF subsystem;
- Core kernel;
- Bluetooth subsystem;
- CAN network layer;
- Ceph Core library;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- IUCV driver;
- MAC80211 subsystem;
- Network traffic control;
- Sun RPC protocol;
- Wireless networking;
- AMD SoC Alsa drivers;
- SoC Audio for Freescale CPUs drivers;
- MediaTek ASoC drivers;
- SoC audio core drivers;
- SOF drivers;
- Sound sequencer drivers;
(CVE-2024-41064, CVE-2024-41087, CVE-2023-52888, CVE-2024-42098,
CVE-2024-42111, CVE-2024-42076, CVE-2024-42088, CVE-2024-42135,
CVE-2024-42145, CVE-2024-42142, CVE-2024-41036, CVE-2024-41071,
CVE-2024-41012, CVE-2024-42091, CVE-2024-42253, CVE-2024-42119,
CVE-2024-42097, CVE-2024-42243, CVE-2024-39487, CVE-2024-42235,
CVE-2024-42120, CVE-2024-42149, CVE-2024-41015, CVE-2024-41074,
CVE-2024-42067, CVE-2024-42090, CVE-2024-42128, CVE-2024-41038,
CVE-2024-42113, CVE-2024-42102, CVE-2024-42231, CVE-2024-42080,
CVE-2024-42241, CVE-2024-42106, CVE-2024-42130, CVE-2024-42073,
CVE-2024-42153, CVE-2024-42156, CVE-2024-42118, CVE-2024-41007,
CVE-2024-41049, CVE-2024-39486, CVE-2024-42240, CVE-2024-41018,
CVE-2024-42251, CVE-2024-42280, CVE-2024-42096, CVE-2024-42121,
CVE-2024-42246, CVE-2024-42092, CVE-2024-41090, CVE-2024-42157,
CVE-2024-43858, CVE-2024-42150, CVE-2024-42110, CVE-2024-41010,
CVE-2024-41081, CVE-2024-41061, CVE-2024-41078, CVE-2024-41094,
CVE-2024-41039, CVE-2024-42114, CVE-2024-42109, CVE-2024-41030,
CVE-2024-42066, CVE-2024-41035, CVE-2024-42146, CVE-2024-42131,
CVE-2024-41059, CVE-2024-41067, CVE-2024-42138, CVE-2024-41050,
CVE-2024-41034, CVE-2024-41077, CVE-2024-41076, CVE-2024-41088,
CVE-2024-41096, CVE-2024-41073, CVE-2024-41037, CVE-2024-42232,
CVE-2024-41063, CVE-2024-42117, CVE-2024-42155, CVE-2024-41080,
CVE-2024-42132, CVE-2024-42084, CVE-2024-42136, CVE-2024-42223,
CVE-2024-41068, CVE-2024-42225, CVE-2024-42065, CVE-2024-41051,
CVE-2024-43855, CVE-2024-42238, CVE-2024-42250, CVE-2024-42112,
CVE-2024-41070, CVE-2023-52887, CVE-2024-42094, CVE-2024-42095,
CVE-2024-41086, CVE-2024-41020, CVE-2024-41082, CVE-2024-42115,
CVE-2024-42152, CVE-2024-42239, CVE-2024-42093, CVE-2024-42126,
CVE-2024-41022, CVE-2024-41017, CVE-2024-41092, CVE-2024-41044,
CVE-2024-42140, CVE-2024-41029, CVE-2024-41054, CVE-2024-42158,
CVE-2024-41066, CVE-2024-42244, CVE-2024-42070, CVE-2024-41025,
CVE-2024-42229, CVE-2024-42085, CVE-2024-41084, CVE-2024-41060,
CVE-2024-41062, CVE-2024-42105, CVE-2024-42124, CVE-2024-41045,
CVE-2024-42227, CVE-2024-41047, CVE-2024-41042, CVE-2024-42100,
CVE-2024-42247, CVE-2024-41041, CVE-2024-42087, CVE-2024-42252,
CVE-2024-41058, CVE-2024-42063, CVE-2024-42271, CVE-2024-41027,
CVE-2024-42079, CVE-2024-42104, CVE-2024-41098, CVE-2024-41033,
CVE-2024-41072, CVE-2024-41031, CVE-2024-42089, CVE-2024-41032,
CVE-2024-42127, CVE-2024-41093, CVE-2024-42082, CVE-2024-41023,
CVE-2024-41075, CVE-2024-42151, CVE-2024-42141, CVE-2024-42108,
CVE-2024-42068, CVE-2024-41085, CVE-2024-42103, CVE-2024-41057,
CVE-2024-42064, CVE-2024-42161, CVE-2024-41052, CVE-2024-41053,
CVE-2024-42069, CVE-2024-41021, CVE-2024-42147, CVE-2024-41065,
CVE-2024-41091, CVE-2024-41079, CVE-2024-42086, CVE-2024-42234,
CVE-2024-41055, CVE-2024-41083, CVE-2024-42101, CVE-2024-42230,
CVE-2024-41095, CVE-2024-41019, CVE-2024-42245, CVE-2024-42129,
CVE-2024-42144, CVE-2024-42236, CVE-2024-41028, CVE-2024-42077,
CVE-2024-42248, CVE-2024-41046, CVE-2024-42133, CVE-2024-42074,
CVE-2024-41089, CVE-2024-42237, CVE-2024-41056, CVE-2024-41048,
CVE-2024-42137, CVE-2024-41069, CVE-2024-41097)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | linux-oem-6.8 | 6.8.0-1016.16 |
Vulnerabilities 196
-
Critical 9.8
nvme: avoid double free special payload
In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECI…
-
Critical 9.8
ila: block BH in ila_output()
In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is c…
-
Critical 9.8
net: rswitch: Avoid use-after-free in rswitch_poll()
In the Linux kernel, the following vulnerability has been resolved: net: rswitch: Avoid use-after-free in rswitch_poll() The use-after-free is actually in rswitch_tx_free(), which is inlined in rswitch_poll(). Since `skb` and `gq->skbs[gq->dirty]` are in fact…
-
Critical 9.8
libceph: fix race between delayed_work() and ceph_monc_stop()
In the Linux kernel, the following vulnerability has been resolved: libceph: fix race between delayed_work() and ceph_monc_stop() The way the delayed work is handled in ceph_monc_stop() is prone to races with mon_fault() and possibly also finish_hunting(). Bo…
-
High 8.8
net: ethernet: lantiq_etop: fix double free in detach
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix double free in detach The number of the currently released descriptor is never incremented which results in the same skb being released multiple times.
-
High 8.8
bluetooth/l2cap: sync sock recv cb and release
In the Linux kernel, the following vulnerability has been resolved: bluetooth/l2cap: sync sock recv cb and release The problem occurs between the system call to close the sock and hci_rx_work, where the former releases the sock and the latter accesses it with…
-
High 8.8
tap: add missing verification for short frame
In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be…
-
High 8.8
tun: add missing verification for short frame
In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent…
-
High 8.3
wifi: mt76: replace skb_put with skb_put_zero
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: replace skb_put with skb_put_zero Avoid potentially reusing uninitialized data
-
High 7.8
drm/drm_file: Fix pid refcounting race
In the Linux kernel, the following vulnerability has been resolved: drm/drm_file: Fix pid refcounting race <maarten.lankhorst@linux.intel.com>, Maxime Ripard <mripard@kernel.org>, Thomas Zimmermann <tzimmermann@suse.de> filp->pid is supposed to be a refcounte…
-
High 7.8
bpf: Fix too early release of tcx_entry
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix too early release of tcx_entry Pedro Pinto and later independently also Hyunwoo Kim and Wongi Lee reported an issue that the tcx_entry can be released too early leading to a use afte…
-
High 7.8
filelock: Remove locks reliably when fcntl/close race is detected
In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the firs…
-
High 7.8
ocfs2: add bounds checking to ocfs2_check_dir_entry()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: add bounds checking to ocfs2_check_dir_entry() This adds sanity checks for ocfs2_dir_entry to make sure all members of ocfs2_dir_entry don't stray beyond valid memory region.
-
High 7.8
jfs: don't walk off the end of ealist
In the Linux kernel, the following vulnerability has been resolved: jfs: don't walk off the end of ealist Add a check before visiting the members of ea to make sure each ea stays within the ealist.
-
High 7.8
fs/ntfs3: Add a check for attr_names and oatbl
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add a check for attr_names and oatbl Added out-of-bound checking for *ane (ATTR_NAME_ENTRY).
-
High 7.8
fs/ntfs3: Validate ff offset
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate ff offset This adds sanity checks for ff offset. There is a check on rt->first_free at first, but walking through by ff without any check. If the second ff is a large offse…
-
High 7.8
filelock: Fix fcntl/close race recovery compat path
In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies …
-
High 7.8
mm: vmalloc: check if a hash-index is in cpu_possible_mask
In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc: check if a hash-index is in cpu_possible_mask The problem is that there are systems where cpu_possible_mask has gaps between set CPUs, for example SPARC. In this scenario addr_to…
-
High 7.8
nilfs2: fix kernel bug on rename operation of broken directory
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix kernel bug on rename operation of broken directory Syzbot reported that in rename directory operation on broken directory on nilfs2, __block_write_begin_int() called to prepare bl…
-
High 7.8
firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers Check that all fields of a V2 algorithm header fit into the available firmware data buffer. The wmfw V2 format introduc…
-
High 7.8
udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port().
In the Linux kernel, the following vulnerability has been resolved: udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). syzkaller triggered the warning [0] in udp_v4_early_demux(). In udp_v[46]_early_demux() and sk_lookup(), we do not touch the refcount of …
-
High 7.8
bpf: Defer work in bpf_timer_cancel_and_free
In the Linux kernel, the following vulnerability has been resolved: bpf: Defer work in bpf_timer_cancel_and_free Currently, the same case as previous patch (two timer callbacks trying to cancel each other) can be invoked through bpf_map_update_elem as well, o…
-
High 7.8
filelock: fix potential use-after-free in posix_lock_inode
In the Linux kernel, the following vulnerability has been resolved: filelock: fix potential use-after-free in posix_lock_inode Light Hsieh reported a KASAN UAF warning in trace_posix_lock_inode(). The request pointer had been changed earlier to point to a loc…
-
High 7.8
cachefiles: wait for ondemand_object_worker to finish when dropping object
In the Linux kernel, the following vulnerability has been resolved: cachefiles: wait for ondemand_object_worker to finish when dropping object When queuing ondemand_object_worker() to re-open the object, cachefiles_object is not pinned. The cachefiles_object …
-
High 7.8
cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie()
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() We got the following issue in our fault injection stress test: ============================================================…
-
High 7.8
hfsplus: fix uninit-value in copy_name
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 hfsplus_lis…
-
High 7.8
drm/radeon: check bo_va->bo is non-NULL before using it
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check bo_va->bo is non-NULL before using it The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it.
-
High 7.8
powerpc/eeh: avoid possible crash when edev->pdev changes
In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock…
-
High 7.8
ASoC: topology: Fix references to freed memory
In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Fix references to freed memory Most users after parsing a topology file, release memory used by it, so having pointer references directly into topology file contents is wrong.…
-
High 7.8
KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() Al reported a possible use-after-free (UAF) in kvm_spapr_tce_attach_iommu_group(). It looks up `stt` from tablefd, but t…
-
High 7.8
cachefiles: add consistency check for copen/cread
In the Linux kernel, the following vulnerability has been resolved: cachefiles: add consistency check for copen/cread This prevents malicious processes from completing random copen/cread requests and crashing the system. Added checks are listed below: * Gener…
-
High 7.8
bcachefs: Fix sb_field_downgrade validation
In the Linux kernel, the following vulnerability has been resolved: bcachefs: Fix sb_field_downgrade validation - bch2_sb_downgrade_validate() wasn't checking for a downgrade entry extending past the end of the superblock section - for_each_downgrade_entry() …
-
High 7.8
ata: libata-core: Fix double free on error
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix double free on error If e.g. the ata_port_alloc() call in ata_host_alloc() fails, we will jump to the err_out label, which will call devres_release_group(). devres_relea…
-
High 7.8
drm/i915/gt: Fix potential UAF by revoke of fence registers
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Fix potential UAF by revoke of fence registers CI has been sporadically reporting the following issue triggered by igt@i915_selftest@live@hangcheck on ADL-P and similar machines:…
-
High 7.8
PCI/MSI: Fix UAF in msi_capability_init
In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Fix UAF in msi_capability_init KFENCE reports the following UAF: BUG: KFENCE: use-after-free read in __pci_enable_msi_range+0x2c0/0x488 Use-after-free read at 0x0000000024629571 (in …
-
High 7.8
drm/amd/display: Skip pipe if the pipe idx not set properly
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip pipe if the pipe idx not set properly [why] Driver crashes when pipe idx not set properly [how] Add code to skip the pipe that idx not set properly
-
High 7.8
drm/xe: Fix potential integer overflow in page size calculation
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix potential integer overflow in page size calculation Explicitly cast tbo->page_alignment to u64 before bit-shifting to prevent overflow when assigning to min_page_size.
-
High 7.8
bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()
In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro() set_memory_rox() can fail, leaving memory unprotected. Check return and bail out when bpf_jit_binary_lock_ro(…
-
High 7.8
bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro()
In the Linux kernel, the following vulnerability has been resolved: bpf: Take return from set_memory_ro() into account with bpf_prog_lock_ro() set_memory_ro() can fail, leaving memory unprotected. Check its return and take it into account as an error.
-
High 7.8
net: mana: Fix possible double free in error handling path
In the Linux kernel, the following vulnerability has been resolved: net: mana: Fix possible double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function adev_release calls kfree(madev…
-
High 7.8
ALSA: emux: improve patch ioctl data validation
In the Linux kernel, the following vulnerability has been resolved: ALSA: emux: improve patch ioctl data validation In load_data(), make the validation of and skipping over the main info block match that in load_guspatch(). In load_guspatch(), add checking th…
-
High 7.8
btrfs: fix adding block group to a reclaim list and the unused list during reclaim
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix adding block group to a reclaim list and the unused list during reclaim There is a potential parallel list adding for retrying in btrfs_reclaim_bgs_work and adding to the unused li…
-
High 7.8
nilfs2: add missing check for inode numbers on directory entries
In the Linux kernel, the following vulnerability has been resolved: nilfs2: add missing check for inode numbers on directory entries Syzbot reported that mounting and unmounting a specific pattern of corrupted nilfs2 filesystem images causes a use-after-free …
-
High 7.8
nilfs2: fix inode number range checks
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix inode number range checks Patch series "nilfs2: fix potential issues related to reserved inodes". This series fixes one use-after-free issue reported by syzbot, caused by nilfs2's…
-
High 7.8
netfilter: nf_tables: unconditionally flush pending work before notifier
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: unconditionally flush pending work before notifier syzbot reports: KASAN: slab-uaf in nft_ctx_update include/net/netfilter/nf_tables.h:1831 KASAN: slab-uaf in nft_commit…
-
High 7.8
btrfs: always do the basic checks for btrfs_qgroup_inherit structure
In the Linux kernel, the following vulnerability has been resolved: btrfs: always do the basic checks for btrfs_qgroup_inherit structure [BUG] Syzbot reports the following regression detected by KASAN: BUG: KASAN: slab-out-of-bounds in btrfs_qgroup_inherit+0x…
-
High 7.8
net: txgbe: free isb resources at the right time
In the Linux kernel, the following vulnerability has been resolved: net: txgbe: free isb resources at the right time When using MSI/INTx interrupt, the shared interrupts are still being handled in the device remove routine, before free IRQs. So isb memory is …
-
High 7.8
jffs2: Fix potential illegal address access in jffs2_free_inode
In the Linux kernel, the following vulnerability has been resolved: jffs2: Fix potential illegal address access in jffs2_free_inode During the stress testing of the jffs2 file system,the following abnormal printouts were found: [ 2430.649000] Unable to handle…
-
High 7.8
drm/amd/display: ASSERT when failing to find index by plane/stream id
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: ASSERT when failing to find index by plane/stream id [WHY] find_disp_cfg_idx_by_plane_id and find_disp_cfg_idx_by_stream_id returns an array index and they return -1 when not…
-
High 7.8
drm/amd/display: Check pipe offset before setting vblank
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check pipe offset before setting vblank pipe_ctx has a size of MAX_PIPES so checking its index before accessing the array. This fixes an OVERRUN issue reported by Coverity.
-
High 7.8
mm: fix crashes from deferred split racing folio migration
In the Linux kernel, the following vulnerability has been resolved: mm: fix crashes from deferred split racing folio migration Even on 6.10-rc6, I've been seeing elusive "Bad page state"s (often on flags when freeing, yet the flags shown are not bad: PG_locke…
-
High 7.8
s390/mm: Add NULL pointer check to crst_table_free() base_crst_free()
In the Linux kernel, the following vulnerability has been resolved: s390/mm: Add NULL pointer check to crst_table_free() base_crst_free() crst_table_free() used to work with NULL pointers before the conversion to ptdescs. Since crst_table_free() can be called…
-
High 7.8
usb: gadget: configfs: Prevent OOB read/write in usb_string_copy()
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Prevent OOB read/write in usb_string_copy() Userspace provided string 's' could trivially have the length zero. Left unchecked this will firstly result in an OOB read i…
-
High 7.8
cachefiles: add missing lock protection when polling
In the Linux kernel, the following vulnerability has been resolved: cachefiles: add missing lock protection when polling Add missing lock protection in poll routine when iterating xarray, otherwise: Even with RCU read lock held, only the slot of the radix tre…
-
High 7.8
gpio: pca953x: fix pca953x_irq_bus_sync_unlock race
In the Linux kernel, the following vulnerability has been resolved: gpio: pca953x: fix pca953x_irq_bus_sync_unlock race Ensure that `i2c_lock' is held when setting interrupt latch and mask in pca953x_irq_bus_sync_unlock() in order to avoid races. The other (n…
-
High 7.8
net/iucv: fix use after free in iucv_sock_close()
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of…
-
High 7.8
mISDN: Fix a use after free in hfcmulti_tx()
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix a use after free in hfcmulti_tx() Don't dereference *sp after calling dev_kfree_skb(*sp).
-
High 7.8
jfs: Fix array-index-out-of-bounds in diFree
In the Linux kernel, the following vulnerability has been resolved: jfs: Fix array-index-out-of-bounds in diFree
-
High 7.6
bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX
In the Linux kernel, the following vulnerability has been resolved: bluetooth/hci: disallow setting handle bigger than HCI_CONN_HANDLE_MAX Syzbot hit warning in hci_conn_del() caused by freeing handle that was not allocated using ida allocator. This is caused…
-
High 7.6
Bluetooth: Ignore too large handle values in BIG
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Ignore too large handle values in BIG hci_le_big_sync_established_evt is necessary to filter out cases where the handle value is belonging to ida id range, otherwise ida will be er…
-
High 7.5
net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new
In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new This patch enhances error handling in scenarios with RTS (Request to Send) messages arrivi…
-
High 7.5
tcp: avoid too many retransmit packets
In the Linux kernel, the following vulnerability has been resolved: tcp: avoid too many retransmit packets If a TCP socket is using TCP_USER_TIMEOUT, and the other peer retracted its window to zero, tcp_retransmit_timer() can retransmit a packet every two jif…
-
High 7.5
net: ks8851: Fix deadlock with the SPI chip variant
In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Fix deadlock with the SPI chip variant When SMP is enabled and spinlocks are actually functional then there is a deadlock with the 'statelock' spinlock between ks8851_start_xmit_…
-
High 7.5
skmsg: Skip zero length skb in sk_msg_recvmsg
In the Linux kernel, the following vulnerability has been resolved: skmsg: Skip zero length skb in sk_msg_recvmsg When running BPF selftests (./test_progs -t sockmap_basic) on a Loongarch platform, the following kernel panic occurs: [...] Oops[#1]: CPU: 22 PI…
-
High 7.5
ibmvnic: Add tx check to prevent skb leak
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Add tx check to prevent skb leak Below is a summary of how the driver stores a reference to an skb during transmit: tx_buff[free_map[consumer_index]]->skb = new_skb; free_map[consume…
-
High 7.5
nvmet: always initialize cqe.result
In the Linux kernel, the following vulnerability has been resolved: nvmet: always initialize cqe.result The spec doesn't mandate that the first two double words (aka results) for the command queue entry need to be set to 0 when they are not used (not specifie…
-
High 7.5
net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx()
In the Linux kernel, the following vulnerability has been resolved: net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() The following is emitted when using idxd (DSA) dmanegine as the data mover for ntb_transport that ntb_netdev…
-
High 7.5
IB/core: Implement a limit on UMAD receive List
In the Linux kernel, the following vulnerability has been resolved: IB/core: Implement a limit on UMAD receive List The existing behavior of ib_umad, which maintains received MAD packets in an unbounded list, poses a risk of uncontrolled growth. As user-space…
-
High 7.5
nvmet: fix a possible leak when destroy a ctrl during qp establishment
In the Linux kernel, the following vulnerability has been resolved: nvmet: fix a possible leak when destroy a ctrl during qp establishment In nvmet_sq_destroy we capture sq->ctrl early and if it is non-NULL we know that a ctrl was allocated (in the admin conn…
-
High 7.5
wireguard: allowedips: avoid unaligned 64-bit memory accesses
In the Linux kernel, the following vulnerability has been resolved: wireguard: allowedips: avoid unaligned 64-bit memory accesses On the parisc platform, the kernel issues kernel warnings because swap_endian() tries to load a 128-bit IPv6 address from an unal…
-
High 7.3
firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files. In V1 wmfw files the na…
-
High 7.3
ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link Commit e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link") removed the codec entry for…
-
High 7.1
bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set()
In the Linux kernel, the following vulnerability has been resolved: bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() In function bond_option_arp_ip_targets_set(), if newval->string is an empty string, newval->string+1 will point to the byte…
-
High 7.1
platform/x86: toshiba_acpi: Fix array out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_acpi: Fix array out-of-bounds access In order to use toshiba_dmi_quirks[] together with the standard DMI matching functions, it must be terminated by a empty entry. Sinc…
-
High 7.0
drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() The "instance" variable needs to be signed for the error handling to work.
-
Medium 5.5
printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_e…
-
Unscored —
media: mediatek: vcodec: Only free buffer VA that is not NULL
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Only free buffer VA that is not NULL In the MediaTek vcodec driver, while mtk_vcodec_mem_free() is mostly called only when the buffer to free exists, there are some i…
-
Unscored —
s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception()
In the Linux kernel, the following vulnerability has been resolved: s390/mm: Fix VM_FAULT_HWPOISON handling in do_exception() There is no support for HWPOISON, MEMORY_FAILURE, or ARCH_HAS_COPY_MC on s390. Therefore we do not expect to see VM_FAULT_HWPOISON in…
-
Unscored —
sched/deadline: Fix task_struct reference leak
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix task_struct reference leak During the execution of the following stress test with linux-rt: stress-ng --cyclic 30 --timeout 30 --minimize --quiet kmemleak frequently repor…
-
Unscored —
misc: fastrpc: Fix memory leak in audio daemon attach operation
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix memory leak in audio daemon attach operation Audio PD daemon send the name as part of the init IOCTL call. This name needs to be copied to kernel for which memory is alloca…
-
Unscored —
Fix userfaultfd_api to return EINVAL as expected
In the Linux kernel, the following vulnerability has been resolved: Fix userfaultfd_api to return EINVAL as expected Currently if we request a feature that is not set in the Kernel config we fail silently and return all the available features. However, the ma…
-
Unscored —
nvmem: core: limit cell sysfs permissions to main attribute ones
In the Linux kernel, the following vulnerability has been resolved: nvmem: core: limit cell sysfs permissions to main attribute ones The cell sysfs attribute should not provide more access to the nvmem data than the main attribute itself. For example if nvme_…
-
Unscored —
ksmbd: discard write access to the directory open
In the Linux kernel, the following vulnerability has been resolved: ksmbd: discard write access to the directory open may_open() does not allow a directory to be opened with the write access. However, some writing flags set by client result in adding write ac…
-
Unscored —
mm/filemap: skip to create PMD-sized page cache if needed
In the Linux kernel, the following vulnerability has been resolved: mm/filemap: skip to create PMD-sized page cache if needed On ARM64, HPAGE_PMD_ORDER is 13 when the base page size is 64KB. The PMD-sized page cache can't be supported by xarray as the followi…
-
Unscored —
cachestat: do not flush stats in recency check
In the Linux kernel, the following vulnerability has been resolved: cachestat: do not flush stats in recency check syzbot detects that cachestat() is flushing stats, which can sleep, in its RCU read section (see [1]). This is done in the workingset_test_recen…
-
Unscored —
USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved…
-
Unscored —
ASoC: SOF: Intel: hda: fix null deref on system suspend entry
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: fix null deref on system suspend entry When system enters suspend with an active stream, SOF core calls hw_params_upon_resume(). On Intel platforms with HDA DMA used to…
-
Unscored —
firmware: cs_dsp: Fix overflow checking of wmfw header
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix overflow checking of wmfw header Fix the checking that firmware file buffer is large enough for the wmfw header, to prevent overrunning the buffer. The original code tes…
-
Unscored —
netfilter: nf_tables: prefer nft_chain_validate
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It…
-
Unscored —
ppp: reject claimed-as-LCP but actually malformed packets
In the Linux kernel, the following vulnerability has been resolved: ppp: reject claimed-as-LCP but actually malformed packets Since 'ppp_async_encode()' assumes valid LCP packets (with code from 1 to 7 inclusive), add 'ppp_check_packet()' to ensure that LCP p…
-
Unscored —
i40e: Fix XDP program unloading while removing the driver
In the Linux kernel, the following vulnerability has been resolved: i40e: Fix XDP program unloading while removing the driver The commit 6533e558c650 ("i40e: Fix reset path while removing the driver") introduced a new PF state "__I40E_IN_REMOVE" to block modi…
-
Unscored —
cachefiles: cyclic allocation of msg_id to avoid reuse
In the Linux kernel, the following vulnerability has been resolved: cachefiles: cyclic allocation of msg_id to avoid reuse Reusing the msg_id after a maliciously completed reopen request may cause a read request to remain unprocessed and result in a hung, as …
-
Unscored —
vfio/pci: Init the count variable in collecting hot-reset devices
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Init the count variable in collecting hot-reset devices The count variable is used without initialization, it results in mistakes in the device counting and crashes the userspace if…
-
Unscored —
scsi: ufs: core: Fix ufshcd_abort_one racing issue
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix ufshcd_abort_one racing issue When ufshcd_abort_one is racing with the completion ISR, the completed tag of the request's mq_hctx pointer will be set to NULL by ISR. Retu…
-
Unscored —
scsi: ufs: core: Fix ufshcd_clear_cmd racing issue
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix ufshcd_clear_cmd racing issue When ufshcd_clear_cmd is racing with the completion ISR, the completed tag of the request's mq_hctx pointer will be set to NULL by the ISR. …
-
Unscored —
mm: prevent derefencing NULL ptr in pfn_section_valid()
In the Linux kernel, the following vulnerability has been resolved: mm: prevent derefencing NULL ptr in pfn_section_valid() Commit 5ec8e8ea8b77 ("mm/sparsemem: fix race in accessing memory_section->usage") changed pfn_section_valid() to add a READ_ONCE() call…
-
Unscored —
cachefiles: fix slab-use-after-free in fscache_withdraw_volume()
In the Linux kernel, the following vulnerability has been resolved: cachefiles: fix slab-use-after-free in fscache_withdraw_volume() We got the following issue in our fault injection stress test: ===============================================================…
-
Unscored —
drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix array-index-out-of-bounds in dml2/FCLKChangeSupport [Why] Potential out of bounds access in dml2_calculate_rq_and_dlg_params() because the value of out_lowest_state_idx u…
-
Unscored —
Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause…
-
Unscored —
powerpc/pseries: Whitelist dtl slub object for copying to userspace
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist dtl slub object for copying to userspace Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_…
-
Unscored —
btrfs: scrub: handle RST lookup error correctly
In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: handle RST lookup error correctly [BUG] When running btrfs/060 with forced RST feature, it would crash the following ASSERT() inside scrub_read_endio(): ASSERT(sector_nr < strip…
-
Unscored —
s390/sclp: Fix sclp_init() cleanup on failure
In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix sclp_init() cleanup on failure If sclp_init() fails it only partially cleans up: if there are multiple failing calls to sclp_init() sclp_state_change_event will be added severa…
-
Unscored —CVE-2024-41071 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check In 'cfg80211_wext_siwscan()', add extra check whether number of channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed IW_MA…
-
Unscored —
cachefiles: Set object to close if ondemand_id < 0 in copen
In the Linux kernel, the following vulnerability has been resolved: cachefiles: Set object to close if ondemand_id < 0 in copen If copen is maliciously called in the user mode, it may delete the request corresponding to the random id. And the request may have…
-
Unscored —
NFSv4: Fix memory leak in nfs4_set_security_label
In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix memory leak in nfs4_set_security_label We leak nfs_fattr and nfs4_label every time we set a security xattr.
-
Unscored —
null_blk: fix validation of block size
In the Linux kernel, the following vulnerability has been resolved: null_blk: fix validation of block size Block size should be between 512 and PAGE_SIZE and be a power of 2. The current check does not validate this, so update the check. Without this patch, n…
-
Unscored —
btrfs: qgroup: fix quota root leak after quota disable failure
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'o…
-
Unscored —
io_uring: fix possible deadlock in io_register_iowq_max_workers()
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix possible deadlock in io_register_iowq_max_workers() The io_register_iowq_max_workers() function calls io_put_sq_data(), which acquires the sqd->lock without releasing the uring_…
-
Unscored —
nvme-fabrics: use reserved tag for reg read/write command
In the Linux kernel, the following vulnerability has been resolved: nvme-fabrics: use reserved tag for reg read/write command In some scenarios, if too many commands are issued by nvme command in the same time by user tasks, this may exhaust all tags of admin…
-
Unscored —
netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfs_page_mkwrite() to check folio->mapping is valid Fix netfs_page_mkwrite() to check that folio->mapping is valid once it has taken the folio lock (as filemap_page_mkwrite() doe…
-
Unscored —
cxl/region: Avoid null pointer dereference in region lookup
In the Linux kernel, the following vulnerability has been resolved: cxl/region: Avoid null pointer dereference in region lookup cxl_dpa_to_region() looks up a region based on a memdev and DPA. It wrongly assumes an endpoint found mapping the DPA is also of a …
-
Unscored —
cxl/mem: Fix no cxl_nvd during pmem region auto-assembling
In the Linux kernel, the following vulnerability has been resolved: cxl/mem: Fix no cxl_nvd during pmem region auto-assembling When CXL subsystem is auto-assembling a pmem region during cxl endpoint port probing, always hit below calltrace. BUG: kernel NULL p…
-
Unscored —
can: mcp251xfd: fix infinite loop when xmit fails
In the Linux kernel, the following vulnerability has been resolved: can: mcp251xfd: fix infinite loop when xmit fails When the mcp251xfd_start_xmit() function fails, the driver stops processing messages, and the interrupt routine does not return, running inde…
-
Unscored —
drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes In nv17_tv_get_hd_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possib…
-
Unscored —
drm/amdgpu: avoid using null object of framebuffer
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid using null object of framebuffer Instead of using state->fb->obj[0] directly, get object from framebuffer by calling drm_gem_fb_get_obj() and return error code when object i…
-
Unscored —
drm/fbdev-dma: Only set smem_start is enable per module option
In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only set smem_start is enable per module option Only export struct fb_info.fix.smem_start if that is required by the user and the memory does not come from vmalloc(). Setting s…
-
Unscored —
drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes In nv17_tv_get_ld_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possib…
-
Unscored —
usb: atm: cxacru: fix endpoint checking in cxacru_bind()
In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix endpoint checking in cxacru_bind() Syzbot is still reporting quite an old issue [1] that occurs due to incomplete checking of present usb endpoints. As such, wrong endpo…
-
Unscored —
ata: libata-core: Fix null pointer dereference on error
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error If the ata_port_alloc() call in ata_host_alloc() fails, ata_host_release() will get called. However, the code in ata_host_release() tri…
-
Unscored —
bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode
In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpf prog stack with kmsan_unposion_memory in interpreter mode syzbot reported uninit memory usages during map_{lookup,delete}_elem. ========== BUG: KMSAN: uninit-value in __dev_map_…
-
Unscored —
drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add a NULL check in xe_ttm_stolen_mgr_init Add an explicit check to ensure that the mgr is not NULL.
-
Unscored —
netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers register store validation for NFT_DATA_VALUE is conditional, however, the datatype is always either NFT_DATA_VAL…
-
Unscored —
mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems The following two shared buffer operations make use of the Shared Buffer Status Register (SBSR): # devlink sb occupancy s…
-
Unscored —
ASoC: amd: acp: add a null check for chip_pdev structure
In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: acp: add a null check for chip_pdev structure When acp platform device creation is skipped, chip->chip_pdev value will remain NULL. Add NULL check for chip->chip_pdev structure in …
-
Unscored —
net: can: j1939: Initialize unused data in j1939_send_one()
In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: Initialize unused data in j1939_send_one() syzbot reported kernel-infoleak in raw_recvmsg() [1]. j1939_send_one() creates full frame including unused data, but it doesn't ini…
-
Unscored —
ocfs2: fix DIO failure due to insufficient transaction credits
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix DIO failure due to insufficient transaction credits The code in ocfs2_dio_end_io_write() estimates number of necessary transaction credits using ocfs2_calc_extend_credits(). This h…
-
Unscored —
gfs2: Fix NULL pointer dereference in gfs2_log_flush
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix NULL pointer dereference in gfs2_log_flush In gfs2_jindex_free(), set sdp->sd_jdesc to NULL under the log flush lock to provide exclusion against gfs2_log_flush(). In gfs2_log_flush…
-
Unscored —
RDMA/restrack: Fix potential invalid address access
In the Linux kernel, the following vulnerability has been resolved: RDMA/restrack: Fix potential invalid address access struct rdma_restrack_entry's kern_name was set to KBUILD_MODNAME in ib_create_cq(), while if the module exited but forgot del this rdma_res…
-
Unscored —
xdp: Remove WARN() from __xdp_reg_mem_model()
In the Linux kernel, the following vulnerability has been resolved: xdp: Remove WARN() from __xdp_reg_mem_model() syzkaller reports a warning in __xdp_reg_mem_model(). The warning occurs only if __mem_id_init_hash_table() returns an error. It returns the erro…
-
Unscored —
ftruncate: pass a signed offset
In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative…
-
Unscored —
usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: remove lock of otg mode during gadget suspend/resume to avoid deadlock When config CONFIG_USB_DWC3_DUAL_ROLE is selected, and trigger system to enter suspend status with belo…
-
Unscored —
iio: chemical: bme680: Fix overflows in compensate() functions
In the Linux kernel, the following vulnerability has been resolved: iio: chemical: bme680: Fix overflows in compensate() functions There are cases in the compensate functions of the driver that there could be overflows of variables due to bit shifting ops. Th…
-
Unscored —
drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep
In the Linux kernel, the following vulnerability has been resolved: drm/panel: ilitek-ili9881c: Fix warning with GPIO controllers that sleep The ilitek-ili9881c controls the reset GPIO using the non-sleeping gpiod_set_value() function. This complains loudly w…
-
Unscored —
ASoC: fsl-asoc-card: set priv->pdev before using it
In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl-asoc-card: set priv->pdev before using it priv->pdev pointer was set after being used in fsl_asoc_card_audmux_init(). Move this assignment at the start of the probe function, so sub…
-
Unscored —
pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER
In the Linux kernel, the following vulnerability has been resolved: pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER In create_pinctrl(), pinctrl_maps_mutex is acquired before calling add_setting(). If add_setting() returns -EPROBE_DEFER,…
-
Unscored —
drm/xe: Check pat.ops before dumping PAT settings
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Check pat.ops before dumping PAT settings We may leave pat.ops unset when running on brand new platform or when running as a VF. While the former is unlikely, the latter is valid (fut…
-
Unscored —
gpio: davinci: Validate the obtained number of IRQs
In the Linux kernel, the following vulnerability has been resolved: gpio: davinci: Validate the obtained number of IRQs Value of pdata->gpio_unbanked is taken from Device Tree. In case of broken DT due to any error this value can be any. Without this value va…
-
Unscored —
net/dpaa2: Avoid explicit cpumask var allocation on stack
In the Linux kernel, the following vulnerability has been resolved: net/dpaa2: Avoid explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potentia…
-
Unscored —
net/iucv: Avoid explicit cpumask var allocation on stack
In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit cpumask var allocation on stack For CONFIG_CPUMASK_OFFSTACK=y kernel, explicit allocation of cpumask variable on stack is not recommended since it can cause potential…
-
Unscored —
serial: 8250_omap: Implementation of Errata i2310
In the Linux kernel, the following vulnerability has been resolved: serial: 8250_omap: Implementation of Errata i2310 As per Errata i2310[0], Erroneous timeout can be triggered, if this Erroneous interrupt is not cleared then it may leads to storm of interrup…
-
Unscored —
x86: stop playing stack games in profile_pc()
In the Linux kernel, the following vulnerability has been resolved: x86: stop playing stack games in profile_pc() The 'profile_pc()' function is used for timer-based profiling, which isn't really all that relevant any more to begin with, but it also ends up m…
-
Unscored —
crypto: ecdh - explicitly zeroize private_key
In the Linux kernel, the following vulnerability has been resolved: crypto: ecdh - explicitly zeroize private_key private_key is overwritten with the key parameter passed in by the caller (if present), or alternatively a newly generated private key. However, …
-
Unscored —
clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common
In the Linux kernel, the following vulnerability has been resolved: clk: sunxi-ng: common: Don't call hw_to_ccu_common on hw without common In order to set the rate range of a hw sunxi_ccu_probe calls hw_to_ccu_common() assuming all entries in desc->ccu_clks …
-
Unscored —
drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes In nouveau_connector_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a p…
-
Unscored —
Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again"
In the Linux kernel, the following vulnerability has been resolved: Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" Patch series "mm: Avoid possible overflows in dirty throttling". Dirty throttling logic assumes dirty limits in …
-
Unscored —
inet_diag: Initialize pad field in struct inet_diag_req_v2
In the Linux kernel, the following vulnerability has been resolved: inet_diag: Initialize pad field in struct inet_diag_req_v2 KMSAN reported uninit-value access in raw_lookup() [1]. Diag for raw sockets uses the pad field in struct inet_diag_req_v2 for the u…
-
Unscored —
net: txgbe: initialize num_q_vectors for MSI/INTx interrupts
In the Linux kernel, the following vulnerability has been resolved: net: txgbe: initialize num_q_vectors for MSI/INTx interrupts When using MSI/INTx interrupts, wx->num_q_vectors is uninitialized. Thus there will be kernel panic in wx_alloc_q_vectors() to all…
-
Unscored —
wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit d…
-
Unscored —
drm/amd/display: Do not return negative stream id for array
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Do not return negative stream id for array [WHY] resource_stream_to_stream_idx returns an array index and it return -1 when not found; however, -1 is not a valid array index …
-
Unscored —
drm/amd/display: Skip finding free audio for unknown engine_id
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip finding free audio for unknown engine_id [WHY] ENGINE_ID_UNKNOWN = -1 and can not be used as an array index. Plus, it also means it is uninitialized and does not need fr…
-
Unscored —
drm/amd/display: Check index msg_id before read or write
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check index msg_id before read or write [WHAT] msg_id is used as an array index and it cannot be a negative value, and therefore cannot be equal to MOD_HDCP_MESSAGE_ID_INVALI…
-
Unscored —
scsi: qedf: Make qedf_execute_tmf() non-preemptible
In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Make qedf_execute_tmf() non-preemptible Stop calling smp_processor_id() from preemptible code in qedf_execute_tmf90. This results in BUG_ON() when running an RT kernel. [ 659.3432…
-
Unscored —
powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
In the Linux kernel, the following vulnerability has been resolved: powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. nmi_enter()/nmi_exit() touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling (e.g…
-
Unscored —
drm/lima: fix shared irq handling on driver remove
In the Linux kernel, the following vulnerability has been resolved: drm/lima: fix shared irq handling on driver remove lima uses a shared interrupt, so the interrupt handlers must be prepared to be called at any time. At driver removal time, the clocks are di…
-
Unscored —
leds: an30259a: Use devm_mutex_init() for mutex initialization
In the Linux kernel, the following vulnerability has been resolved: leds: an30259a: Use devm_mutex_init() for mutex initialization In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered after module's remo…
-
Unscored —
leds: mlxreg: Use devm_mutex_init() for mutex initialization
In the Linux kernel, the following vulnerability has been resolved: leds: mlxreg: Use devm_mutex_init() for mutex initialization In this driver LEDs are registered using devm_led_classdev_register() so they are automatically unregistered after module's remove…
-
Unscored —CVE-2024-42130 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
mm: avoid overflows in dirty throttling logic
In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications…
-
Unscored —
vhost_task: Handle SIGKILL by flushing work and exiting
In the Linux kernel, the following vulnerability has been resolved: vhost_task: Handle SIGKILL by flushing work and exiting Instead of lingering until the device is closed, this has us handle SIGKILL by: 1. marking the worker as killed so we no longer try to …
-
Unscored —
cdrom: rearrange last_media_change check to avoid unintentional overflow
In the Linux kernel, the following vulnerability has been resolved: cdrom: rearrange last_media_change check to avoid unintentional overflow When running syzkaller with the newly reintroduced signed integer wrap sanitizer we encounter this splat: [ 366.015950…
-
Unscored —
Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: Fix BT enable failure again for QCA6390 after warm reboot Commit 272970be3dab ("Bluetooth: hci_qca: Fix driver shutdown on closed serdev") will cause below regression issue: B…
-
Unscored —
mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file
In the Linux kernel, the following vulnerability has been resolved: mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file In case of invalid INI file mlxsw_linecard_types_init() deallocates memory but doesn't reset pointer to NULL …
-
Unscored —
riscv: kexec: Avoid deadlock in kexec crash path
In the Linux kernel, the following vulnerability has been resolved: riscv: kexec: Avoid deadlock in kexec crash path If the kexec crash code is called in the interrupt context, the machine_kexec_mask_interrupts() function will trigger a deadlock while trying …
-
Unscored —
Bluetooth: ISO: Check socket flag instead of hcon
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Check socket flag instead of hcon This fixes the following Smatch static checker warning: net/bluetooth/iso.c:1364 iso_sock_recvmsg() error: we previously assumed 'pi->conn->h…
-
Unscored —
net/mlx5: E-switch, Create ingress ACL when needed
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-switch, Create ingress ACL when needed Currently, ingress acl is used for three features. It is created only when vport metadata match and prio tag are enabled. But active-backup …
-
Unscored —
thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data
In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/mediatek/lvts_thermal: Check NULL ptr on lvts_data Verify that lvts_data is not NULL before using it.
-
Unscored —
drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Add outer runtime_pm protection to xe_live_ktest@xe_dma_buf Any kunit doing any memory access should get their own runtime_pm outer references since they don't use the standard driver…
-
Unscored —
crypto: hisilicon/debugfs - Fix debugfs uninit process issue
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/debugfs - Fix debugfs uninit process issue During the zip probe process, the debugfs failure does not stop the probe. When debugfs initialization fails, jumping to the error…
-
Unscored —
fs: don't misleadingly warn during thaw operations
In the Linux kernel, the following vulnerability has been resolved: fs: don't misleadingly warn during thaw operations The block device may have been frozen before it was claimed by a filesystem. Concurrently another process might try to mount that frozen blo…
-
Unscored —
net: txgbe: remove separate irq request for MSI and INTx
In the Linux kernel, the following vulnerability has been resolved: net: txgbe: remove separate irq request for MSI and INTx When using MSI or INTx interrupts, request_irq() for pdev->irq will conflict with request_threaded_irq() for txgbe->misc.irq, to cause…
-
Unscored —
bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable
In the Linux kernel, the following vulnerability has been resolved: bpf: mark bpf_dummy_struct_ops.test_1 parameter as nullable Test case dummy_st_ops/dummy_init_ret_value passes NULL as the first parameter of the test_1() function. Mark this parameter as nul…
-
Unscored —
i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr
In the Linux kernel, the following vulnerability has been resolved: i2c: pnx: Fix potential deadlock warning from del_timer_sync() call in isr When del_timer_sync() is called in an interrupt context it throws a warning because of potential deadlock. The timer…
-
Unscored —
s390/pkey: Wipe copies of protected- and secure-keys
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of protected- and secure-keys Although the clear-key of neither protected- nor secure-keys is accessible, this key material should only be visible to the calling proces…
-
Unscored —
s390/pkey: Wipe copies of clear-key structures on failure
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe copies of clear-key structures on failure Wipe all sensitive data from stack for all IOCTLs, which convert a clear-key into a protected- or secure-key.
-
Unscored —
s390/pkey: Wipe sensitive data on failure
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Wipe sensitive data on failure Wipe sensitive data from stack also if the copy_to_user() fails.
-
Unscored —
s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Use kfree_sensitive() to fix Coccinelle warnings Replace memzero_explicit() and kfree() with kfree_sensitive() to fix warnings reported by Coccinelle: WARNING opportunity for kfree…
-
Unscored —
bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD
In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD [Changes from V1: - Use a default branch in the switch statement to initialize `val'.] GCC warns that `val' may be used uninitialized …
-
Unscored —
media: dvb-frontends: tda10048: Fix integer overflow
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: tda10048: Fix integer overflow state->xtal_hz can be up to 16M, so it can overflow a 32 bit integer when multiplied by pll_mfactor. Create a new 64 bit variable to hold …
-
Unscored —
drm/amd/display: Fix overlapping copy within dml_core_mode_programming
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix overlapping copy within dml_core_mode_programming [WHY] &mode_lib->mp.Watermark and &locals->Watermark are the same address. memcpy may lead to unexpected behavior. [HOW]…
-
Unscored —
crypto: aead,cipher - zeroize key buffer after use
In the Linux kernel, the following vulnerability has been resolved: crypto: aead,cipher - zeroize key buffer after use I.G 9.7.B for FIPS 140-3 specifies that variables temporarily holding cryptographic information should be zeroized once they are no longer n…
-
Unscored —
powerpc/pseries: Fix scv instruction crash with kexec
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix scv instruction crash with kexec kexec on pseries disables AIL (reloc_on_exc), required for scv instruction support, before other CPUs have been shut down. This means the…
-
Unscored —
btrfs: zoned: fix calc_available_free_space() for zoned mode
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix calc_available_free_space() for zoned mode calc_available_free_space() returns the total size of metadata (or system) block groups, which can be allocated from unallocated d…
-
Unscored —
firmware: cs_dsp: Validate payload length before processing block
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Validate payload length before processing block Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load() to be done before the block is processed. The check th…
-
Unscored —
firmware: cs_dsp: Return error if block header overflows file
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Return error if block header overflows file Return an error from cs_dsp_power_up() if a block header is longer than the amount of data left in the file. The previous code in…
-
Unscored —
bpf: Fail bpf_timer_cancel when callback is being cancelled
In the Linux kernel, the following vulnerability has been resolved: bpf: Fail bpf_timer_cancel when callback is being cancelled Given a schedule: timer1 cb timer2 cb bpf_timer_cancel(timer2); bpf_timer_cancel(timer1); Both bpf_timer_cancel calls would wait fo…
-
Unscored —
x86/bhi: Avoid warning in #DB handler due to BHI mitigation
In the Linux kernel, the following vulnerability has been resolved: x86/bhi: Avoid warning in #DB handler due to BHI mitigation When BHI mitigation is enabled, if SYSENTER is invoked with the TF flag set then entry_SYSENTER_compat() uses CLEAR_BRANCH_HISTORY …
-
Unscored —
mm/shmem: disable PMD-sized page cache if needed
In the Linux kernel, the following vulnerability has been resolved: mm/shmem: disable PMD-sized page cache if needed For shmem files, it's possible that PMD-sized page cache can't be supported by xarray. For example, 512MB page cache on ARM64 when the base pa…
-
Unscored —
mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray
In the Linux kernel, the following vulnerability has been resolved: mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray Patch series "mm/filemap: Limit page cache size to that supported by xarray", v2. Currently, xarray can't support arbitrary page cach…
-
Unscored —
USB: serial: mos7840: fix crash on resume
In the Linux kernel, the following vulnerability has been resolved: USB: serial: mos7840: fix crash on resume Since commit c49cfa917025 ("USB: serial: use generic method if no alternative is provided in usb serial layer"), USB serial core calls the generic re…
-
Unscored —
Revert "sched/fair: Make sure to try to detach at least one movable task"
In the Linux kernel, the following vulnerability has been resolved: Revert "sched/fair: Make sure to try to detach at least one movable task" This reverts commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. b0defa7ae03ec changed the load balancing logic to ignor…
-
Unscored —
net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to lo…
-
Unscored —
tty: serial: ma35d1: Add a NULL check for of_node
In the Linux kernel, the following vulnerability has been resolved: tty: serial: ma35d1: Add a NULL check for of_node The pdev->dev.of_node can be NULL if the "serial" node is absent. Add a NULL check to return an error in such cases.
-
Unscored —
mm: page_ref: remove folio_try_get_rcu()
In the Linux kernel, the following vulnerability has been resolved: mm: page_ref: remove folio_try_get_rcu() The below bug was reported on a non-SMP kernel: [ 275.267158][ T4335] ------------[ cut here ]------------ [ 275.267949][ T4335] kernel BUG at include…
-
Unscored —
closures: Change BUG_ON() to WARN_ON()
In the Linux kernel, the following vulnerability has been resolved: closures: Change BUG_ON() to WARN_ON() If a BUG_ON() can be hit in the wild, it shouldn't be a BUG_ON() For reference, this has popped up once in the CI, and we'll need more info to debug it:…
-
Unscored —
md: fix deadlock between mddev_suspend and flush bio
In the Linux kernel, the following vulnerability has been resolved: md: fix deadlock between mddev_suspend and flush bio Deadlock occurs when mddev is being suspended while some flush bio is in progress. It is a complex issue. T1. the first flush is at the en…
References
-
report
https://ubuntu.com/security/CVE-2023-52887
-
report
https://ubuntu.com/security/CVE-2023-52888
-
report
https://ubuntu.com/security/CVE-2024-25741
-
report
https://ubuntu.com/security/CVE-2024-39486
-
report
https://ubuntu.com/security/CVE-2024-39487
-
report
https://ubuntu.com/security/CVE-2024-41007
-
report
https://ubuntu.com/security/CVE-2024-41010
-
report
https://ubuntu.com/security/CVE-2024-41012
-
report
https://ubuntu.com/security/CVE-2024-41015
-
report
https://ubuntu.com/security/CVE-2024-41017
-
report
https://ubuntu.com/security/CVE-2024-41018
-
report
https://ubuntu.com/security/CVE-2024-41019
-
report
https://ubuntu.com/security/CVE-2024-41020
-
report
https://ubuntu.com/security/CVE-2024-41021
-
report
https://ubuntu.com/security/CVE-2024-41022
-
report
https://ubuntu.com/security/CVE-2024-41023
-
report
https://ubuntu.com/security/CVE-2024-41025
-
report
https://ubuntu.com/security/CVE-2024-41027
-
report
https://ubuntu.com/security/CVE-2024-41028
-
report
https://ubuntu.com/security/CVE-2024-41029
-
report
https://ubuntu.com/security/CVE-2024-41030
-
report
https://ubuntu.com/security/CVE-2024-41031
-
report
https://ubuntu.com/security/CVE-2024-41032
-
report
https://ubuntu.com/security/CVE-2024-41033
-
report
https://ubuntu.com/security/CVE-2024-41034
-
report
https://ubuntu.com/security/CVE-2024-41035
-
report
https://ubuntu.com/security/CVE-2024-41036
-
report
https://ubuntu.com/security/CVE-2024-41037
-
report
https://ubuntu.com/security/CVE-2024-41038
-
report
https://ubuntu.com/security/CVE-2024-41039
-
report
https://ubuntu.com/security/CVE-2024-41041
-
report
https://ubuntu.com/security/CVE-2024-41042
-
report
https://ubuntu.com/security/CVE-2024-41044
-
report
https://ubuntu.com/security/CVE-2024-41045
-
report
https://ubuntu.com/security/CVE-2024-41046
-
report
https://ubuntu.com/security/CVE-2024-41047
-
report
https://ubuntu.com/security/CVE-2024-41048
-
report
https://ubuntu.com/security/CVE-2024-41049
-
report
https://ubuntu.com/security/CVE-2024-41050