Summary
Supraja Sridhara, Benedict Schlüter, Mark Kuhne, Andrin Bertschi, and
Shweta Shinde discovered that the Confidential Computing framework in
the Linux kernel for x86 platforms did not properly handle 32-bit
emulation on TDX and SEV. An attacker with access to the VMM could use
this to cause a denial of service (guest crash) or possibly execute
arbitrary code. (CVE-2024-25744)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Android drivers;
- Serial ATA and Parallel ATA drivers;
- ATM drivers;
- Drivers core;
- Null block device driver;
- Character device driver;
- ARM SCMI message protocol;
- GPU drivers;
- HID subsystem;
- Hardware monitoring drivers;
- I3C subsystem;
- InfiniBand drivers;
- Input Device core drivers;
- Input Device (Miscellaneous) drivers;
- IOMMU subsystem;
- IRQ chip drivers;
- ISDN/mISDN subsystem;
- LED subsystem;
- Multiple devices driver;
- Media drivers;
- VMware VMCI Driver;
- MMC subsystem;
- Network drivers;
- Near Field Communication (NFC) drivers;
- NVME drivers;
- Device tree and open firmware driver;
- Parport drivers;
- PCI subsystem;
- Pin controllers subsystem;
- Remote Processor subsystem;
- S/390 drivers;
- SCSI drivers;
- QCOM SoC drivers;
- Direct Digital Synthesis drivers;
- Thunderbolt and USB4 drivers;
- TTY drivers;
- Userspace I/O drivers;
- DesignWare USB3 driver;
- USB Gadget drivers;
- USB Host Controller drivers;
- USB Type-C Connector System Software Interface driver;
- USB over IP driver;
- VHOST drivers;
- File systems infrastructure;
- BTRFS file system;
- Ext4 file system;
- F2FS file system;
- JFS file system;
- NILFS2 file system;
- NTFS3 file system;
- Proc file system;
- SMB network file system;
- Core kernel;
- DMA mapping infrastructure;
- RCU subsystem;
- Tracing infrastructure;
- Radix Tree data structure library;
- Kernel userspace event delivery library;
- Objagg library;
- Memory management;
- Amateur Radio drivers;
- Bluetooth subsystem;
- Ethernet bridge;
- CAN network layer;
- Networking core;
- Ethtool driver;
- IPv4 networking;
- IPv6 networking;
- IUCV driver;
- KCM (Kernel Connection Multiplexor) sockets driver;
- MAC80211 subsystem;
- Multipath TCP;
- Netfilter;
- Network traffic control;
- SCTP protocol;
- Sun RPC protocol;
- TIPC protocol;
- TLS protocol;
- Wireless networking;
- AppArmor security module;
- Landlock security;
- Simplified Mandatory Access Control Kernel framework;
- FireWire sound drivers;
- SoC audio core drivers;
- USB sound devices;
(CVE-2024-42288, CVE-2024-41098, CVE-2024-43849, CVE-2024-46689,
CVE-2024-44987, CVE-2024-40915, CVE-2024-46844, CVE-2024-45009,
CVE-2024-46780, CVE-2024-41081, CVE-2024-43817, CVE-2024-44965,
CVE-2024-46832, CVE-2024-41072, CVE-2024-45011, CVE-2024-46814,
CVE-2024-45026, CVE-2024-44982, CVE-2024-46723, CVE-2024-46771,
CVE-2024-46759, CVE-2024-41063, CVE-2024-46673, CVE-2023-52889,
CVE-2024-41020, CVE-2024-46677, CVE-2024-46798, CVE-2024-45021,
CVE-2024-46676, CVE-2024-47668, CVE-2024-42289, CVE-2024-45018,
CVE-2024-46724, CVE-2024-41090, CVE-2024-43853, CVE-2024-42272,
CVE-2024-43828, CVE-2024-42292, CVE-2024-26800, CVE-2024-43871,
CVE-2024-46758, CVE-2024-36484, CVE-2024-46755, CVE-2024-46782,
CVE-2024-43889, CVE-2024-46763, CVE-2024-41015, CVE-2024-43858,
CVE-2024-41012, CVE-2024-44960, CVE-2024-46747, CVE-2024-42311,
CVE-2024-47660, CVE-2024-42267, CVE-2024-44998, CVE-2024-43839,
CVE-2024-43914, CVE-2024-46783, CVE-2024-47659, CVE-2024-46725,
CVE-2024-46840, CVE-2024-43873, CVE-2024-46737, CVE-2024-44946,
CVE-2024-43841, CVE-2024-26669, CVE-2024-42306, CVE-2024-26661,
CVE-2024-42259, CVE-2024-41011, CVE-2024-46822, CVE-2024-42287,
CVE-2024-46746, CVE-2024-43860, CVE-2024-42246, CVE-2024-46800,
CVE-2024-45007, CVE-2024-42296, CVE-2024-47669, CVE-2024-44983,
CVE-2024-43880, CVE-2024-42284, CVE-2022-48666, CVE-2024-44990,
CVE-2024-43894, CVE-2024-44989, CVE-2023-52918, CVE-2024-42295,
CVE-2024-43869, CVE-2024-42277, CVE-2024-46818, CVE-2024-42270,
CVE-2024-45025, CVE-2024-42301, CVE-2024-43883, CVE-2024-46714,
CVE-2024-46815, CVE-2024-41073, CVE-2024-43905, CVE-2024-43882,
CVE-2024-46719, CVE-2024-42286, CVE-2024-44952, CVE-2024-42297,
CVE-2024-41022, CVE-2024-46743, CVE-2024-43829, CVE-2024-43909,
CVE-2024-42265, CVE-2024-44944, CVE-2024-46807, CVE-2024-46739,
CVE-2024-43867, CVE-2024-44958, CVE-2024-44969, CVE-2024-42271,
CVE-2024-46745, CVE-2024-42299, CVE-2024-45006, CVE-2024-43908,
CVE-2024-44966, CVE-2024-41065, CVE-2024-46777, CVE-2024-42309,
CVE-2024-38602, CVE-2024-44947, CVE-2024-43884, CVE-2024-43902,
CVE-2024-47667, CVE-2024-46750, CVE-2024-41070, CVE-2024-26893,
CVE-2024-41017, CVE-2024-46810, CVE-2024-46828, CVE-2024-43893,
CVE-2024-41077, CVE-2024-46756, CVE-2024-46740, CVE-2024-42269,
CVE-2024-43890, CVE-2024-45008, CVE-2024-46795, CVE-2024-43854,
CVE-2024-46713, CVE-2024-47663, CVE-2024-46702, CVE-2024-46781,
CVE-2024-46722, CVE-2024-42114, CVE-2024-44948, CVE-2024-44988,
CVE-2024-42302, CVE-2024-41019, CVE-2024-46731, CVE-2024-46819,
CVE-2024-44995, CVE-2024-41059, CVE-2024-43856, CVE-2024-44954,
CVE-2024-43863, CVE-2024-38577, CVE-2024-43870, CVE-2024-41068,
CVE-2024-41071, CVE-2024-38611, CVE-2024-46761, CVE-2024-42304,
CVE-2024-42310, CVE-2024-46707, CVE-2024-42290, CVE-2024-42276,
CVE-2024-44935, CVE-2024-46721, CVE-2024-46817, CVE-2024-46791,
CVE-2024-44934, CVE-2024-45028, CVE-2024-46757, CVE-2024-43879,
CVE-2024-43907, CVE-2024-43846, CVE-2024-42280, CVE-2024-44999,
CVE-2024-43861, CVE-2024-42126, CVE-2024-26607, CVE-2024-46752,
CVE-2024-42305, CVE-2024-43835, CVE-2024-41
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | linux-aws | 5.15.0-1072.78 |
Vulnerabilities 223
-
Critical 9.8
scsi: core: Fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix a use-after-free There are two .exit_cmd_priv implementations. Both implementations use resources associated with the SCSI host. Make sure that these resources are still avail…
-
Critical 9.8
tls: fix use-after-free on failed backlog decryption
In the Linux kernel, the following vulnerability has been resolved: tls: fix use-after-free on failed backlog decryption When the decrypt request goes to the backlog and crypto_aead_decrypt returns -EBUSY, tls_do_decryption will wait until all async decryptio…
-
Critical 9.8
nvme: avoid double free special payload
In the Linux kernel, the following vulnerability has been resolved: nvme: avoid double free special payload If a discard request needs to be retried, and that retry may fail before a new special payload is added, a double free will result. Clear the RQF_SPECI…
-
Critical 9.8
ila: block BH in ila_output()
In the Linux kernel, the following vulnerability has been resolved: ila: block BH in ila_output() As explained in commit 1378817486d6 ("tipc: block BH before using dst_cache"), net/core/dst_cache.c helpers need to be called with BH disabled. ila_output() is c…
-
Critical 9.8
RDMA/iwcm: Fix a use-after-free related to destroying CM IDs
In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix a use-after-free related to destroying CM IDs iw_conn_req_handler() associates a new struct rdma_id_private (conn_id) with an existing struct iw_cm_id (cm_id) as follows: conn_…
-
Critical 9.8
usb: vhci-hcd: Do not drop references before new references are gained
In the Linux kernel, the following vulnerability has been resolved: usb: vhci-hcd: Do not drop references before new references are gained At a few places the driver carries stale pointers to references that can still be used. Make sure that does not happen. …
-
Critical 9.8
ipv6: prevent possible UAF in ip6_xmit()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UAF in ip6_xmit() If skb_expand_head() returns NULL, skb has been freed and the associated dst/idev could also have been freed. We must use rcu_read_lock() to prevent a…
-
Critical 9.8
atm: idt77252: prevent use after free in dequeue_rx()
In the Linux kernel, the following vulnerability has been resolved: atm: idt77252: prevent use after free in dequeue_rx() We can't dereference "skb" after calling vcc->push() because the skb is released.
-
Critical 9.1
tipc: Return non-zero value from tipc_udp_addr2str() on error
In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipc_udp_addr2str() on error tipc_udp_addr2str() should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occ…
-
Critical 9.1
smack: tcp: ipv4, fix incorrect labeling
In the Linux kernel, the following vulnerability has been resolved: smack: tcp: ipv4, fix incorrect labeling Currently, Smack mirrors the label of incoming tcp/ipv4 connections: when a label 'foo' connects to a label 'bar' with tcp/ipv4, 'foo' always gets 'fo…
-
High 8.8
In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. This is relat…
-
High 8.8
tap: add missing verification for short frame
In the Linux kernel, the following vulnerability has been resolved: tap: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tap_get_user_xdp() path, which could cause a corrupted skb to be…
-
High 8.8
tun: add missing verification for short frame
In the Linux kernel, the following vulnerability has been resolved: tun: add missing verification for short frame The cited commit missed to check against the validity of the frame length in the tun_xdp_one() path, which could cause a corrupted skb to be sent…
-
High 8.8
scsi: qla2xxx: Complete command early within lock
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Complete command early within lock A crash was observed while performing NPIV and FW reset, BUG: kernel NULL pointer dereference, address: 000000000000001c #PF: supervisor read…
-
High 8.8
landlock: Don't lose track of restrictions on cred_transfer
In the Linux kernel, the following vulnerability has been resolved: landlock: Don't lose track of restrictions on cred_transfer When a process' cred struct is replaced, this _almost_ always invokes the cred_prepare LSM hook; but in one special case (when KEYC…
-
High 8.8
net: dsa: mv88e6xxx: Fix out-of-bound access
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: Fix out-of-bound access If an ATU violation was caused by a CPU Load operation, the SPID could be larger than DSA_MAX_PORTS (the size of mv88e6xxx_chip.ports[] array).
-
High 8.8
wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id()
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() mwifiex_get_priv_by_id() returns the priv pointer corresponding to the bss_num and bss_type, but without checking if the p…
-
High 8.2
mptcp: pm: only decrement add_addr_accepted for MPJ req
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: only decrement add_addr_accepted for MPJ req Adding the following warning ... WARN_ON_ONCE(msk->pm.add_addr_accepted == 0) ... before decrementing the add_addr_accepted counter hel…
-
High 8.1
ipv6: fix possible UAF in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in ip6_finish_output2() If skb_expand_head() returns NULL, skb has been freed and associated dst/idev could also have been freed. We need to hold rcu_read_lock() to mak…
-
High 7.8
drm/amdkfd: don't allow mapping the MMIO HDP page with large pages
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: don't allow mapping the MMIO HDP page with large pages We don't get the right offset in that case. The GPU has an unused 4K area of the register BAR space into which you can remap…
-
High 7.8
filelock: Remove locks reliably when fcntl/close race is detected
In the Linux kernel, the following vulnerability has been resolved: filelock: Remove locks reliably when fcntl/close race is detected When fcntl_setlk() races with close(), it removes the created lock with do_lock_file_wait(). However, LSMs can allow the firs…
-
High 7.8
ocfs2: add bounds checking to ocfs2_check_dir_entry()
In the Linux kernel, the following vulnerability has been resolved: ocfs2: add bounds checking to ocfs2_check_dir_entry() This adds sanity checks for ocfs2_dir_entry to make sure all members of ocfs2_dir_entry don't stray beyond valid memory region.
-
High 7.8
jfs: don't walk off the end of ealist
In the Linux kernel, the following vulnerability has been resolved: jfs: don't walk off the end of ealist Add a check before visiting the members of ea to make sure each ea stays within the ealist.
-
High 7.8
fs/ntfs3: Validate ff offset
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate ff offset This adds sanity checks for ff offset. There is a check on rt->first_free at first, but walking through by ff without any check. If the second ff is a large offse…
-
High 7.8
filelock: Fix fcntl/close race recovery compat path
In the Linux kernel, the following vulnerability has been resolved: filelock: Fix fcntl/close race recovery compat path When I wrote commit 3cad1bc01041 ("filelock: Remove locks reliably when fcntl/close race is detected"), I missed that there are two copies …
-
High 7.8
hfsplus: fix uninit-value in copy_name
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix uninit-value in copy_name [syzbot reported] BUG: KMSAN: uninit-value in sized_strscpy+0xc4/0x160 sized_strscpy+0xc4/0x160 copy_name+0x2af/0x320 fs/hfsplus/xattr.c:411 hfsplus_lis…
-
High 7.8
drm/radeon: check bo_va->bo is non-NULL before using it
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: check bo_va->bo is non-NULL before using it The call to radeon_vm_clear_freed might clear bo_va->bo, so we have to check it before dereferencing it.
-
High 7.8
powerpc/eeh: avoid possible crash when edev->pdev changes
In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: avoid possible crash when edev->pdev changes If a PCI device is removed during eeh_pe_report_edev(), edev->pdev will change and can cause a crash, hold the PCI rescan/remove lock…
-
High 7.8
KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group()
In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: Prevent UAF in kvm_spapr_tce_attach_iommu_group() Al reported a possible use-after-free (UAF) in kvm_spapr_tce_attach_iommu_group(). It looks up `stt` from tablefd, but t…
-
High 7.8
drm/i915/gem: Fix Virtual Memory mapping boundaries calculation
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Fix Virtual Memory mapping boundaries calculation Calculating the size of the mapped area as the lesser value between the requested size and the actual size does not consider th…
-
High 7.8
net/iucv: fix use after free in iucv_sock_close()
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use after free in iucv_sock_close() iucv_sever_path() is called from process context and from bh context. iucv->path is used as indicator whether somebody else is taking care of…
-
High 7.8
sched: act_ct: take care of padding in struct zones_ht_key
In the Linux kernel, the following vulnerability has been resolved: sched: act_ct: take care of padding in struct zones_ht_key Blamed commit increased lookup key size from 2 bytes to 16 bytes, because zones_ht_key got a struct net pointer. Make sure rhashtabl…
-
High 7.8
nvme-pci: add missing condition check for existence of mapped data
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: add missing condition check for existence of mapped data nvme_map_data() is called when request has physical segments, hence the nvme_unmap_data() should have same condition to avoi…
-
High 7.8
mISDN: Fix a use after free in hfcmulti_tx()
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix a use after free in hfcmulti_tx() Don't dereference *sp after calling dev_kfree_skb(*sp).
-
High 7.8
scsi: qla2xxx: Fix for possible memory corruption
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix for possible memory corruption Init Control Block is dereferenced incorrectly. Correctly dereference ICB
-
High 7.8
f2fs: fix return value of f2fs_convert_inline_inode()
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fs_convert_inline_inode() If device is readonly, make f2fs_convert_inline_inode() return EROFS instead of zero, otherwise it may trigger panic during writeback of …
-
High 7.8
f2fs: fix to don't dirty inode for readonly filesystem
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to don't dirty inode for readonly filesystem syzbot reports f2fs bug as below: kernel BUG at fs/f2fs/inode.c:933! RIP: 0010:f2fs_evict_inode+0x1576/0x1590 fs/f2fs/inode.c:933 Call T…
-
High 7.8
fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Update log->page_{mask,bits} if log->page_size changed If an NTFS file system is mounted to another system with different PAGE_SIZE from the original system, log->page_size will cha…
-
High 7.8
dev/parport: fix the array out-of-bounds risk
In the Linux kernel, the following vulnerability has been resolved: dev/parport: fix the array out-of-bounds risk Fixed array out-of-bounds issues caused by sprintf by replacing it with snprintf for safer data copying, ensuring the destination buffer is not o…
-
High 7.8
ext4: make sure the first directory block is not a hole
In the Linux kernel, the following vulnerability has been resolved: ext4: make sure the first directory block is not a hole The syzbot constructs a directory that has no dirblock but is non-inline, i.e. the first directory block is a hole. And no errors are r…
-
High 7.8
udf: Avoid using corrupted block bitmap buffer
In the Linux kernel, the following vulnerability has been resolved: udf: Avoid using corrupted block bitmap buffer When the filesystem block bitmap is corrupted, we detect the corruption while loading the bitmap and fail the allocation with error. However the…
-
High 7.8
hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode()
In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ================…
-
High 7.8
media: venus: fix use after free in vdec_close
In the Linux kernel, the following vulnerability has been resolved: media: venus: fix use after free in vdec_close There appears to be a possible use after free with vdec_close(). The firmware will add buffer release work to the work queue through HFI callbac…
-
High 7.8
leds: trigger: Unregister sysfs attributes before calling deactivate()
In the Linux kernel, the following vulnerability has been resolved: leds: trigger: Unregister sysfs attributes before calling deactivate() Triggers which have trigger specific sysfs attributes typically store related data in trigger-data allocated by the acti…
-
High 7.8
lib: objagg: Fix general protection fault
In the Linux kernel, the following vulnerability has been resolved: lib: objagg: Fix general protection fault The library supports aggregation of objects into other objects only if the parent object does not have a parent itself. That is, nesting is not suppo…
-
High 7.8
dma: fix call order in dmam_free_coherent
In the Linux kernel, the following vulnerability has been resolved: dma: fix call order in dmam_free_coherent dmam_free_coherent() frees a DMA allocation, which makes the freed vaddr available for reuse, then calls devres_destroy() to remove and free the data…
-
High 7.8
jfs: Fix array-index-out-of-bounds in diFree
In the Linux kernel, the following vulnerability has been resolved: jfs: Fix array-index-out-of-bounds in diFree
-
High 7.8
mlxsw: spectrum_acl_erp: Fix object nesting warning
In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_acl_erp: Fix object nesting warning ACLs in Spectrum-2 and newer ASICs can reside in the algorithmic TCAM (A-TCAM) or in the ordinary circuit TCAM (C-TCAM). The former can con…
-
High 7.8
exec: Fix ToCToU between perm check and set-uid/gid usage
In the Linux kernel, the following vulnerability has been resolved: exec: Fix ToCToU between perm check and set-uid/gid usage When opening a file for exec via do_filp_open(), permission checking is done against the file's metadata at that moment, and on succe…
-
High 7.8
memcg: protect concurrent access to mem_cgroup_idr
In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to mem_cgroup_idr Commit 73f576c04b94 ("mm: memcontrol: fix cgroup creation failure after many small jobs") decoupled the memcg IDs from the CSS ID space to f…
-
High 7.8
net: bridge: mcast: wait for previous gc cycles when removing port
In the Linux kernel, the following vulnerability has been resolved: net: bridge: mcast: wait for previous gc cycles when removing port syzbot hit a use-after-free[1] which is caused because the bridge doesn't make sure that all previous garbage has been colle…
-
High 7.8CVE-2024-44946 Public exploit
kcm: Serialise kcm_sendmsg() for the same socket.
In the Linux kernel, the following vulnerability has been resolved: kcm: Serialise kcm_sendmsg() for the same socket. syzkaller reported UAF in kcm_release(). [0] The scenario is 1. Thread A builds a skb with MSG_MORE and sets kcm->seq_skb. 2. Thread A resume…
-
High 7.8
ALSA: line6: Fix racy access to midibuf
In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: Fix racy access to midibuf There can be concurrent accesses to line6 midibuf from both the URB completion callback and the rawmidi API access. This could be a cause of KMSAN warn…
-
High 7.8
binfmt_flat: Fix corruption when not offsetting data start
In the Linux kernel, the following vulnerability has been resolved: binfmt_flat: Fix corruption when not offsetting data start Commit 04d82a6d0881 ("binfmt_flat: allow not offsetting data start") introduced a RISC-V specific variant of the FLAT format which d…
-
High 7.8
mptcp: pm: avoid possible UaF when selecting endp
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: avoid possible UaF when selecting endp select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a …
-
High 7.8
ipv6: prevent UAF in ip6_send_skb()
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent UAF in ip6_send_skb() syzbot reported an UAF in ip6_send_skb() [1] After ip6_local_out() has returned, we no longer can safely dereference rt, unless we hold rcu_read_lock(). A …
-
High 7.8
net: hns3: fix a deadlock problem when config TC during resetting
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix a deadlock problem when config TC during resetting When config TC during the reset process, may cause a deadlock, the flow is as below: pf reset start │ ▼ ...... setup tc │ │ ▼…
-
High 7.8
scsi: aacraid: Fix double-free on probe failure
In the Linux kernel, the following vulnerability has been resolved: scsi: aacraid: Fix double-free on probe failure aac_probe_one() calls hardware-specific init functions through the aac_driver_ident::init pointer, all of which eventually call down to aac_ini…
-
High 7.8
perf/aux: Fix AUX buffer serialization
In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix AUX buffer serialization Ole reported that event->mmap_mutex is strictly insufficient to serialize the AUX buffer, add a per RB mutex to fully serialize it. Note that in the loc…
-
High 7.8
drm/amdgpu: Fix out-of-bounds write warning
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds write warning Check the ring type value to fix the out-of-bounds write warning
-
High 7.8
VMCI: Fix use-after-free when removing resource in vmci_resource_remove()
In the Linux kernel, the following vulnerability has been resolved: VMCI: Fix use-after-free when removing resource in vmci_resource_remove() When removing a resource from vmci_resource_table in vmci_resource_remove(), the search is performed using the resour…
-
High 7.8
binder: fix UAF caused by offsets overwrite
In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF caused by offsets overwrite Binder objects are processed and copied individually into the target buffer during transactions. Any raw data in-between these objects is copied as…
-
High 7.8
HID: amd_sfh: free driver_data after destroying hid device
In the Linux kernel, the following vulnerability has been resolved: HID: amd_sfh: free driver_data after destroying hid device HID driver callbacks aren't called anymore once hid_destroy_device() has been called. Hence, hid driver_data should be freed only af…
-
High 7.8
PCI: Add missing bridge lock to pci_bus_lock()
In the Linux kernel, the following vulnerability has been resolved: PCI: Add missing bridge lock to pci_bus_lock() One of the true positives that the cfg_access_lock lockdep effort identified is this sequence: WARNING: CPU: 14 PID: 1 at drivers/pci/pci.c:4886…
-
High 7.8
can: bcm: Remove proc entry when dev is unregistered.
In the Linux kernel, the following vulnerability has been resolved: can: bcm: Remove proc entry when dev is unregistered. syzkaller reported a warning in bcm_connect() below. [0] The repro calls connect() to vxcan1, removes vxcan1, and calls connect() with if…
-
High 7.8
udf: Avoid excessive partition lengths
In the Linux kernel, the following vulnerability has been resolved: udf: Avoid excessive partition lengths Avoid mounting filesystems where the partition would overflow the 32-bits used for block number. Also refuse to mount filesystems where the partition le…
-
High 7.8
nilfs2: protect references to superblock parameters exposed in sysfs
In the Linux kernel, the following vulnerability has been resolved: nilfs2: protect references to superblock parameters exposed in sysfs The superblock buffers of nilfs2 can not only be overwritten at runtime for modifications/repairs, but they are also regul…
-
High 7.8
nilfs2: fix missing cleanup on rollforward recovery error
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix missing cleanup on rollforward recovery error In an error injection test of a routine for mount-time recovery, KASAN found a use-after-free bug. It turned out that if data recover…
-
High 7.8
ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object
In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object When using kernel with the following extra config, - CONFIG_KASAN=y - CONFIG_KASAN_GENERIC=y - CONFIG_KASAN_INLINE=y - CONFIG_KASAN_VMALLOC=…
-
High 7.8
sch/netem: fix use after free in netem_dequeue
In the Linux kernel, the following vulnerability has been resolved: sch/netem: fix use after free in netem_dequeue If netem_dequeue() enqueues packet to inner qdisc and that qdisc returns __NET_XMIT_STOLEN. The packet is dropped but qdisc_tree_reduce_backlog(…
-
High 7.8
drm/amd/display: Check gpio_id before used as array index
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check gpio_id before used as array index [WHY & HOW] GPIO_ID_UNKNOWN (-1) is not a valid value for array index and therefore should be checked in advance. This fixes 5 OVERRU…
-
High 7.8
lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()
In the Linux kernel, the following vulnerability has been resolved: lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() If we need to increase the tree depth, allocate a new node, and then race with another thread that increased the tree depth b…
-
High 7.5
scsi: qla2xxx: validate nvme_local_port correctly
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: validate nvme_local_port correctly The driver load failed with error message, qla2xxx [0000:04:00.0]-ffff:0: register_localport failed: ret=ffffffef and with a kernel crash, BU…
-
High 7.5
nvmet-tcp: fix kernel crash if commands allocation fails
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: fix kernel crash if commands allocation fails If the commands allocation fails in nvmet_tcp_alloc_cmds() the kernel crashes in nvmet_tcp_release_queue_work() because of a NULL poin…
-
High 7.5
fou: Fix null-ptr-deref in GRO.
In the Linux kernel, the following vulnerability has been resolved: fou: Fix null-ptr-deref in GRO. We observed a null-ptr-deref in fou_gro_receive() while shutting down a host. [0] The NULL pointer is sk->sk_user_data, and the offset 8 is of protocol in stru…
-
High 7.4
drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 [Why] Coverity reports OVERRUN warning. Should abort amdgpu_dm initialize. [How] Return failure to amdgpu_dm_init.
-
High 7.3
media: i2c: et8ek8: Don't strip remove function when driver is builtin
In the Linux kernel, the following vulnerability has been resolved: media: i2c: et8ek8: Don't strip remove function when driver is builtin Using __exit for the remove function results in the remove callback being discarded with CONFIG_VIDEO_ET8EK8=y. When suc…
-
High 7.3
xfs: fix log recovery buffer allocation for the legacy h_size fixup
In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy h_size fixup Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values use…
-
High 7.3
of/irq: Prevent device address out-of-bounds read in interrupt map walk
In the Linux kernel, the following vulnerability has been resolved: of/irq: Prevent device address out-of-bounds read in interrupt map walk When of_irq_parse_raw() is invoked with a device address smaller than the interrupt parent node (from #address-cells pr…
-
High 7.3
PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)
In the Linux kernel, the following vulnerability has been resolved: PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0) Errata #i2037 in AM65x/DRA80xM Processors Silicon Revision 1.0 (SPRZ452D_July 2018_Revised December 2019 [1]) mentions when an i…
-
High 7.3
nilfs2: fix state management in error path of log writing function
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix state management in error path of log writing function After commit a694291a6211 ("nilfs2: separate wait function from nilfs_segctor_write") was applied, the log writing function …
-
High 7.1
memcg_write_event_control(): fix a user-triggerable oops
In the Linux kernel, the following vulnerability has been resolved: memcg_write_event_control(): fix a user-triggerable oops we are *not* guaranteed that anything past the terminating NUL is mapped (let alone initialized with anything sane).
-
High 7.1
drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[]
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] [WHY & HOW] num_valid_sets needs to be checked to avoid a negative index when accessing reader_wm_sets[num_valid_sets -…
-
High 7.1
sched: sch_cake: fix bulk flow accounting logic for host fairness
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: fix bulk flow accounting logic for host fairness In sch_cake, we keep track of the count of active bulk flows per host, when running in dst/src host fairness mode, which is u…
-
High 7.1
um: line: always fill *error_out in setup_one_line()
In the Linux kernel, the following vulnerability has been resolved: um: line: always fill *error_out in setup_one_line() The pointer isn't initialized by callers, but I have encountered cases where it's still printed; initialize it in all possible cases in se…
-
High 7.0
rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow
In the Linux kernel, the following vulnerability has been resolved: rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow There is a possibility of buffer overflow in show_rcu_tasks_trace_gp_kthread() if counters, passed to sprintf() are huge. Counte…
-
High 7.0
drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq()
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() The "instance" variable needs to be signed for the error handling to work.
-
High 7.0
cgroup/cpuset: Prevent UAF in proc_cpuset_show()
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Prevent UAF in proc_cpuset_show() An UAF can happen when /proc/cpuset is read as reported in [1]. This can be reproduced by the following methods: 1.add an mdelay(1000) before …
-
High 7.0
s390/dasd: fix error recovery leading to data corruption on ESE devices
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix error recovery leading to data corruption on ESE devices Extent Space Efficient (ESE) or thin provisioned volumes need to be formatted on demand during usual IO processing. The…
-
Medium 5.5
drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the call…
-
Medium 5.5
i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup
In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup Definitely condition dma_get_cache_alignment * defined value > 256 during driver initialization is not reason to BUG_ON(). Tu…
-
Unscored —
apparmor: Fix null pointer deref when receiving skb during sock creation
In the Linux kernel, the following vulnerability has been resolved: apparmor: Fix null pointer deref when receiving skb during sock creation The panic below is observed when receiving ICMP packets with secmark set while an ICMP raw socket is being created. SK…
-
Unscored —
media: pci: cx23885: check cx23885_vdev_init() return
In the Linux kernel, the following vulnerability has been resolved: media: pci: cx23885: check cx23885_vdev_init() return cx23885_vdev_init() can return a NULL pointer, but that pointer is used in the next line without a check. Add a NULL pointer check and go…
-
Unscored —
drm/bridge: sii902x: Fix probing race issue
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: sii902x: Fix probing race issue A null pointer dereference crash has been observed rarely on TI platforms using sii9022 bridge: [ 53.271356] sii902x_get_edid+0x34/0x70 [sii902x] […
-
Unscored —
net/sched: flower: Fix chain template offload
In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filte…
-
Unscored —
firmware: arm_scmi: Fix double free in SMC transport cleanup path
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix double free in SMC transport cleanup path When the generic SCMI code tears down a channel, it calls the chan_free callback function, defined by each transport. Since m…
-
Unscored —
net: relax socket state check at accept time.
In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. Christoph reported the following splat: WARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0 Modules linked in: CPU: 1 PI…
-
Unscored —
ax25: Fix reference count leak issues of ax25_dev
In the Linux kernel, the following vulnerability has been resolved: ax25: Fix reference count leak issues of ax25_dev The ax25_addr_ax25dev() and ax25_dev_device_down() exist a reference count leak issue of the object "ax25_dev". Memory leak issue in ax25_add…
-
Unscored —
riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context
In the Linux kernel, the following vulnerability has been resolved: riscv: rewrite __kernel_map_pages() to fix sleeping in invalid context __kernel_map_pages() is a debug function which clears the valid bit in page table entry for deallocated pages to detect …
-
Unscored —
netfilter: nf_tables: prefer nft_chain_validate
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It…
-
Unscored —
Bluetooth: hci_core: cancel all works upon hci_unregister_dev()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: cancel all works upon hci_unregister_dev() syzbot is reporting that calling hci_release_dev() from hci_error_reset() due to hci_dev_put() from hci_error_reset() can cause…
-
Unscored —
powerpc/pseries: Whitelist dtl slub object for copying to userspace
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Whitelist dtl slub object for copying to userspace Reading the dispatch trace log from /sys/kernel/debug/powerpc/dtl/cpu-* results in a BUG() when the config CONFIG_HARDENED_…
-
Unscored —
s390/sclp: Fix sclp_init() cleanup on failure
In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Fix sclp_init() cleanup on failure If sclp_init() fails it only partially cleans up: if there are multiple failing calls to sclp_init() sclp_state_change_event will be added severa…
-
Unscored —CVE-2024-41071 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
wifi: cfg80211: wext: add extra SIOCSIWSCAN data check
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: wext: add extra SIOCSIWSCAN data check In 'cfg80211_wext_siwscan()', add extra check whether number of channels passed via 'ioctl(sock, SIOCSIWSCAN, ...)' doesn't exceed IW_MA…
-
Unscored —
null_blk: fix validation of block size
In the Linux kernel, the following vulnerability has been resolved: null_blk: fix validation of block size Block size should be between 512 and PAGE_SIZE and be a power of 2. The current check does not validate this, so update the check. Without this patch, n…
-
Unscored —
btrfs: qgroup: fix quota root leak after quota disable failure
In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix quota root leak after quota disable failure If during the quota disable we fail when cleaning the quota tree or when deleting the root from the root tree, we jump to the 'o…
-
Unscored —
ata: libata-core: Fix null pointer dereference on error
In the Linux kernel, the following vulnerability has been resolved: ata: libata-core: Fix null pointer dereference on error If the ata_port_alloc() call in ata_host_alloc() fails, ata_host_release() will get called. However, the code in ata_host_release() tri…
-
Unscored —
wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values syzbot is able to trigger softlockups, setting NL80211_ATTR_TXQ_QUANTUM to 2^31. We had a similar issue in sch_fq, fixed with commit d…
-
Unscored —
powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt.
In the Linux kernel, the following vulnerability has been resolved: powerpc: Avoid nmi_enter/nmi_exit in real mode interrupt. nmi_enter()/nmi_exit() touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling (e.g…
-
Unscored —
net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket
In the Linux kernel, the following vulnerability has been resolved: net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket When using a BPF program on kernel_connect(), the call can return -EPERM. This causes xs_tcp_setup_socket() to lo…
-
Unscored —
protect the fetch of ->fd[fd] in do_dup2() from mispredictions
In the Linux kernel, the following vulnerability has been resolved: protect the fetch of ->fd[fd] in do_dup2() from mispredictions both callers have verified that fd is not greater than ->max_fds; however, misprediction might end up with tofree = fdt->fd[fd];…
-
Unscored —
riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error()
In the Linux kernel, the following vulnerability has been resolved: riscv/mm: Add handling for VM_FAULT_SIGSEGV in mm_fault_error() Handle VM_FAULT_SIGSEGV in the page fault path so that we correctly kill the process and we don't BUG() the kernel.
-
Unscored —
netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init().
In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix potential null-ptr-deref in ip6table_nat_table_init(). ip6table_nat_table_init() accesses net->gen->ptr[ip6table_nat_net_ops.id], but the function is exposed to user …
-
Unscored —
netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init().
In the Linux kernel, the following vulnerability has been resolved: netfilter: iptables: Fix null-ptr-deref in iptable_nat_table_init(). We had a report that iptables-restore sometimes triggered null-ptr-deref at boot time. [0] The problem is that iptable_nat…
-
Unscored —
Revert "ALSA: firewire-lib: operate for period elapse event in process context"
In the Linux kernel, the following vulnerability has been resolved: Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") removed the proc…
-
Unscored —
iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en
In the Linux kernel, the following vulnerability has been resolved: iommu: sprd: Avoid NULL deref in sprd_iommu_hw_en In sprd_iommu_cleanup() before calling function sprd_iommu_hw_en() dom->sdev is equal to NULL, which leads to null dereference. Found by Linu…
-
Unscored —
bpf: Fix a segment issue when downgrading gso_size
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix a segment issue when downgrading gso_size Linearize the skb when downgrading gso_size because it may trigger a BUG_ON() later when the skb is segmented as described in [1,2].
-
Unscored —
net: nexthop: Initialize all fields in dumped nexthops
In the Linux kernel, the following vulnerability has been resolved: net: nexthop: Initialize all fields in dumped nexthops struct nexthop_grp contains two reserved fields that are not initialized by nla_put_nh_group(), and carry garbage. This can be observed …
-
Unscored —
scsi: qla2xxx: During vport delete send async logout explicitly
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: During vport delete send async logout explicitly During vport delete, it is observed that during unload we hit a crash because of stale entries in outstanding command array. Fo…
-
Unscored —
irqchip/imx-irqsteer: Handle runtime power management correctly
In the Linux kernel, the following vulnerability has been resolved: irqchip/imx-irqsteer: Handle runtime power management correctly The power domain is automatically activated from clk_prepare(). However, on certain platforms like i.MX8QM and i.MX8QXP, the po…
-
Unscored —
kobject_uevent: Fix OOB access within zap_modalias_env()
In the Linux kernel, the following vulnerability has been resolved: kobject_uevent: Fix OOB access within zap_modalias_env() zap_modalias_env() wrongly calculates size of memory block to move, so will cause OOB memory access issue if variable MODALIAS is not …
-
Unscored —
nilfs2: handle inconsistent state in nilfs_btnode_create_block()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: handle inconsistent state in nilfs_btnode_create_block() Syzbot reported that a buffer state inconsistency was detected in nilfs_btnode_create_block(), triggering a kernel bug. It is …
-
Unscored —
PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal
In the Linux kernel, the following vulnerability has been resolved: PCI/DPC: Fix use-after-free on concurrent DPC and hot-removal Keith reports a use-after-free when a DPC event occurs concurrently to hot-removal of the same portion of the hierarchy: The dpc_…
-
Unscored —
ext4: check dot and dotdot of dx_root before making dir indexed
In the Linux kernel, the following vulnerability has been resolved: ext4: check dot and dotdot of dx_root before making dir indexed Syzbot reports a issue as follows: ============================================ BUG: unable to handle page fault for address: f…
-
Unscored —
drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes
In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in psb_intel_lvds_get_modes In psb_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a possible…
-
Unscored —
drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes
In the Linux kernel, the following vulnerability has been resolved: drm/gma500: fix null pointer dereference in cdv_intel_lvds_get_modes In cdv_intel_lvds_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL poi…
-
Unscored —
sysctl: always initialize i_uid/i_gid
In the Linux kernel, the following vulnerability has been resolved: sysctl: always initialize i_uid/i_gid Always initialize i_uid/i_gid inside the sysfs core so set_ownership() can safely skip setting them. Commit 5ec27ec735ba ("fs/proc/proc_sysctl.c: fix the…
-
Unscored —
net: missing check virtio
In the Linux kernel, the following vulnerability has been resolved: net: missing check virtio Two missing check in virtio_net_hdr_to_skb() allowed syzbot to crash kernels again 1. After the skb_segment function the buffer may become non-linear (nr_frags != 0)…
-
Unscored —
ext4: fix infinite loop when replaying fast_commit
In the Linux kernel, the following vulnerability has been resolved: ext4: fix infinite loop when replaying fast_commit When doing fast_commit replay an infinite loop may occur due to an uninitialized extent_status struct. ext4_ext_determine_insert_hole() does…
-
Unscored —
drm/qxl: Add check for drm_cvt_mode
In the Linux kernel, the following vulnerability has been resolved: drm/qxl: Add check for drm_cvt_mode Add check for the return value of drm_cvt_mode() and return the error if it fails in order to avoid NULL pointer dereference.
-
Unscored —
xdp: fix invalid wait context of page_pool_destroy()
In the Linux kernel, the following vulnerability has been resolved: xdp: fix invalid wait context of page_pool_destroy() If the driver uses a page pool, it creates a page pool with page_pool_create(). The reference count of page pool is 1 as default. A page p…
-
Unscored —
virtio_net: Fix napi_skb_cache_put warning
In the Linux kernel, the following vulnerability has been resolved: virtio_net: Fix napi_skb_cache_put warning After the commit bdacf3e34945 ("net: Use nested-BH locking for napi_alloc_cache.") was merged, the following warning began to appear: WARNING: CPU: …
-
Unscored —
bna: adjust 'name' buf size of bna_tcb and bna_ccb structures
In the Linux kernel, the following vulnerability has been resolved: bna: adjust 'name' buf size of bna_tcb and bna_ccb structures To have enough space to write all possible sprintf() args. Currently 'name' size is 16, but the first '%s' specifier may already …
-
Unscored —
wifi: virt_wifi: avoid reporting connection success with wrong SSID
In the Linux kernel, the following vulnerability has been resolved: wifi: virt_wifi: avoid reporting connection success with wrong SSID When user issues a connection with a different SSID than the one virt_wifi has advertised, the __cfg80211_connect_result() …
-
Unscored —
soc: qcom: pdr: protect locator_addr with the main mutex
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: pdr: protect locator_addr with the main mutex If the service locator server is restarted fast enough, the PDR can rewrite locator_addr fields concurrently. Protect them by placing …
-
Unscored —
block: initialize integrity buffer to zero before writing it to media
In the Linux kernel, the following vulnerability has been resolved: block: initialize integrity buffer to zero before writing it to media Metadata added by bio_integrity_prep is using plain kmalloc, which leads to random kernel memory being written media. For…
-
Unscored —
remoteproc: imx_rproc: Skip over memory region when node value is NULL
In the Linux kernel, the following vulnerability has been resolved: remoteproc: imx_rproc: Skip over memory region when node value is NULL In imx_rproc_addr_init() "nph = of_count_phandle_with_args()" just counts number of phandles. But phandles may be empty.…
-
Unscored —
net: usb: qmi_wwan: fix memory leak for not ip packets
In the Linux kernel, the following vulnerability has been resolved: net: usb: qmi_wwan: fix memory leak for not ip packets Free the unused skb when not ip packets arrive.
-
Unscored —
drm/vmwgfx: Fix a deadlock in dma buf fence polling
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix…
-
Unscored —
drm/nouveau: prime: fix refcount underflow
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: prime: fix refcount underflow Calling nouveau_bo_ref() on a nouveau_bo without initializing it (and hence the backing ttm_bo) leads to a refcount underflow. Instead of calling no…
-
Unscored —
perf: Fix event leak upon exec and file release
In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release The perf pending task work is never waited upon the matching event release. In the case of a child event, released via free_event() directly, t…
-
Unscored —
perf: Fix event leak upon exit
In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding a…
-
Unscored —
devres: Fix memory leakage caused by driver API devm_free_percpu()
In the Linux kernel, the following vulnerability has been resolved: devres: Fix memory leakage caused by driver API devm_free_percpu() It will cause memory leakage when use driver API devm_free_percpu() to free memory allocated by devm_alloc_percpu(), fixed b…
-
Unscored —
vhost/vsock: always initialize seqpacket_allow
In the Linux kernel, the following vulnerability has been resolved: vhost/vsock: always initialize seqpacket_allow There are two issues around seqpacket_allow: 1. seqpacket_allow is not initialized when socket is created. Thus if features are never set, it wi…
-
Unscored —
PCI: endpoint: Clean up error handling in vpci_scan_bus()
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Clean up error handling in vpci_scan_bus() Smatch complains about inconsistent NULL checking in vpci_scan_bus(): drivers/pci/endpoint/functions/pci-epf-vntb.c:1024 vpci_scan_bu…
-
Unscored —
wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he()
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() Currently NL80211_RATE_INFO_HE_RU_ALLOC_2x996 is not handled in cfg80211_calculate_bitrate_he(), leading to below…
-
Unscored —
Bluetooth: MGMT: Add error handling to pair_device()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Add error handling to pair_device() hci_conn_params_add() never checks for a NULL value and could lead to a NULL pointer dereference causing a crash. Fixed by adding error ha…
-
Unscored —
padata: Fix possible divide-by-0 panic in padata_mt_helper()
In the Linux kernel, the following vulnerability has been resolved: padata: Fix possible divide-by-0 panic in padata_mt_helper() We are hit with a not easily reproducible divide-by-0 panic in padata.c at bootup time. [ 10.017908] Oops: divide error: 0000 1 PR…
-
Unscored —
tracing: Fix overflow in get_free_elt()
In the Linux kernel, the following vulnerability has been resolved: tracing: Fix overflow in get_free_elt() "tracing_map->next_elt" in get_free_elt() is at risk of overflowing. Once it overflows, new elements can still be inserted into the tracing_map even th…
-
Unscored —
serial: core: check uartclk for zero to avoid divide by zero
In the Linux kernel, the following vulnerability has been resolved: serial: core: check uartclk for zero to avoid divide by zero Calling ioctl TIOCSSERIAL with an invalid baud_base can result in uartclk being zero, which will result in a divide by zero error …
-
Unscored —
drm/client: fix null pointer dereference in drm_client_modeset_probe
In the Linux kernel, the following vulnerability has been resolved: drm/client: fix null pointer dereference in drm_client_modeset_probe In drm_client_modeset_probe(), the return value of drm_mode_duplicate() is assigned to modeset->mode, which will lead to a…
-
Unscored —
drm/amd/display: Add null checker before passing variables
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add null checker before passing variables Checks null pointer before passing variables to functions. This fixes 3 NULL_RETURNS issues reported by Coverity.
-
Unscored —
drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: Fix the null pointer dereference for vega10_hwmgr Check return value and conduct null pointer handling to avoid null pointer dereference.
-
Unscored —
drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix the null pointer dereference in apply_state_adjust_rules Check the pointer value to fix potential null pointer dereference
-
Unscored —
drm/amdgpu: Fix the null pointer dereference to ras_manager
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix the null pointer dereference to ras_manager Check ras_manager before using it
-
Unscored —
drm/amdgpu/pm: Fix the null pointer dereference for smu7
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix the null pointer dereference for smu7 optimize the code to avoid pass a null pointer (hwmgr->backend) to function smu7_update_edc_leakage_table.
-
Unscored —
md/raid5: avoid BUG_ON() while continue reshape after reassembling
In the Linux kernel, the following vulnerability has been resolved: md/raid5: avoid BUG_ON() while continue reshape after reassembling Currently, mdadm support --revert-reshape to abort the reshape while reassembling, as the test 07revert-grow. However, follo…
-
Unscored —
sctp: Fix null-ptr-deref in reuseport_add_sock().
In the Linux kernel, the following vulnerability has been resolved: sctp: Fix null-ptr-deref in reuseport_add_sock(). syzbot reported a null-ptr-deref while accessing sk2->sk_reuseport_cb in reuseport_add_sock(). [0] The repro first creates a listener with SO…
-
Unscored —
netfilter: ctnetlink: use helper function to calculate expect ID
In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missing a call to the nf_expect_get_id() helper function to calculate the expectation ID, otherwise…
-
Unscored —CVE-2024-44947 Public exploit
fuse: Initialize beyond-EOF page contents before setting uptodate
In the Linux kernel, the following vulnerability has been resolved: fuse: Initialize beyond-EOF page contents before setting uptodate fuse_notify_store(), unlike fuse_do_readpage(), does not enable page zeroing (because it can be used to change partial page c…
-
Unscored —
x86/mtrr: Check if fixed MTRRs exist before saving them
In the Linux kernel, the following vulnerability has been resolved: x86/mtrr: Check if fixed MTRRs exist before saving them MTRRs have an obsolete fixed variant for fine grained caching control of the 640K-1MB region that uses separate MSRs. This fixed varian…
-
Unscored —CVE-2024-44952 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
sched/smt: Fix unbalance sched_smt_present dec/inc
In the Linux kernel, the following vulnerability has been resolved: sched/smt: Fix unbalance sched_smt_present dec/inc I got the following warn report while doing stress test: jump label: negative count! WARNING: CPU: 3 PID: 38 at kernel/jump_label.c:263 stat…
-
Unscored —
usb: gadget: core: Check for unset descriptor
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: core: Check for unset descriptor Make sure the descriptor has been set before looking at maxpacket. This fixes a null pointer panic in this case. This may happen if the gadget do…
-
Unscored —
x86/mm: Fix pti_clone_pgtable() alignment assumption
In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix pti_clone_pgtable() alignment assumption Guenter reported dodgy crashes on an i386-nosmp build using GCC-11 that had the form of endless traps until entry stack exhaust and then #…
-
Unscored —
s390/sclp: Prevent release of buffer in I/O
In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Prevent release of buffer in I/O When a task waiting for completion of a Store Data operation is interrupted, an attempt is made to halt this operation. If this attempt fails due t…
-
Unscored —
net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register()
In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: Fix a possible memory leak in bcm_sf2_mdio_register() bcm_sf2_mdio_register() calls of_phy_find_device() and then phy_device_remove() in a loop to remove existing PHY devic…
-
Unscored —
drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: cleanup FB if dpu_format_populate_layout fails If the dpu_format_populate_layout() fails, then FB is prepared, but not cleaned up. This ends up leaking the pin_count on the GEM o…
-
Unscored —
netfilter: flowtable: validate vlan header
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate vlan header Ensure there is sufficient room to access the protocol field of the VLAN header, validate it once before the flowtable lookup. =====================…
-
Unscored —
bonding: fix xfrm real_dev null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: bonding: fix xfrm real_dev null pointer dereference We shouldn't set real_dev to NULL because packets can be in transit and xfrm might call xdo_dev_offload_ok() in parallel. All callbacks ass…
-
Unscored —
bonding: fix null pointer deref in bond_ipsec_offload_ok
In the Linux kernel, the following vulnerability has been resolved: bonding: fix null pointer deref in bond_ipsec_offload_ok We must check if there is an active slave before dereferencing the pointer.
-
Unscored —
gtp: pull network headers in gtp_dev_xmit()
In the Linux kernel, the following vulnerability has been resolved: gtp: pull network headers in gtp_dev_xmit() syzbot/KMSAN reported use of uninit-value in get_dev_xmit() [1] We must make sure the IPv4 or Ipv6 header is pulled in skb->head before accessing f…
-
Unscored —
vfs: Don't evict inode under the inode lru traversing context
In the Linux kernel, the following vulnerability has been resolved: vfs: Don't evict inode under the inode lru traversing context The inode reclaiming process(See function prune_icache_sb) collects all reclaimable inodes and mark them with I_FREEING flag at f…
-
Unscored —
xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration
In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed devices after a failed address device command can trigger a NULL pointer dereference. Full-sp…
-
Unscored —
char: xillybus: Don't destroy workqueue from work item running on it
In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Don't destroy workqueue from work item running on it Triggered by a kref decrement, destroy_workqueue() may be called from within a work item for destroying its own workqueue.…
-
Unscored —
Input: MT - limit max slots
In the Linux kernel, the following vulnerability has been resolved: Input: MT - limit max slots syzbot is reporting too large allocation at input_mt_init_slots(), for num_slots is supplied from userspace using ioctl(UI_DEV_CREATE). Since nobody knows possible…
-
Unscored —
char: xillybus: Check USB endpoints when probing device
In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Check USB endpoints when probing device Ensure, as the driver probes the device, that all endpoints that the driver may attempt to access exist and are of the correct type. Al…
-
Unscored —
netfilter: flowtable: initialise extack before use
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: initialise extack before use Fix missing initialisation of extack in flow offload.
-
Unscored —
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
In the Linux kernel, the following vulnerability has been resolved: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE copy_fd_bitmaps(new, old, count) is expected to copy the first count/BITS_PER_LONG bits from old->full_fds_bits[] and fill the …
-
Unscored —
mmc: mmc_test: Fix NULL dereference on allocation failure
In the Linux kernel, the following vulnerability has been resolved: mmc: mmc_test: Fix NULL dereference on allocation failure If the "test->highmem = alloc_pages()" allocation fails then calling __free_pages(test->highmem) will result in a NULL dereference. A…
-
Unscored —
usb: dwc3: core: Prevent USB core invalid event buffer address access
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: core: Prevent USB core invalid event buffer address access This commit addresses an issue where the USB core could access an invalid event buffer address during runtime suspend, po…
-
Unscored —
nfc: pn533: Add poll mod list filling check
In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: Add poll mod list filling check In case of im_protocols value is 1 and tm_protocols value is 0 this combination successfully passes the check 'if (!im_protocols && !tm_protocols)'…
-
Unscored —
gtp: fix a potential NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: gtp: fix a potential NULL pointer dereference When sockfd_lookup() fails, gtp_encap_enable_socket() returns a NULL pointer, but its callers only check for error pointers thus miss the NULL po…
-
Unscored —
ethtool: check device is present when getting link settings
In the Linux kernel, the following vulnerability has been resolved: ethtool: check device is present when getting link settings A sysfs reader can race with a device reset or removal, attempting to read device state when the device is not actually present. eg…
-
Unscored —
pinctrl: single: fix potential NULL dereference in pcs_get_function()
In the Linux kernel, the following vulnerability has been resolved: pinctrl: single: fix potential NULL dereference in pcs_get_function() pinmux_generic_get_function() can return NULL and the pointer 'function' was dereferenced without checking against NULL. …
-
Unscored —
soc: qcom: cmd-db: Map shared memory as WC, not WB
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region. This region of memory is write protected by XPU. XPU may sometime falsely detect clean cache evicti…
-
Unscored —
thunderbolt: Mark XDomain as unplugged when router is removed
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Mark XDomain as unplugged when router is removed I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware…
-
Unscored —
KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICC_*SGI*_EL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a w…
-
Unscored —
drm/amd/display: Skip wbscl_set_scaler_filter if filter is null
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Skip wbscl_set_scaler_filter if filter is null Callers can pass null in filter (i.e. from returned from the function wbscl_get_filter_coeffs_16p) and a null check is added to…
-
Unscored —
usb: typec: ucsi: Fix null pointer dereference in trace
In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix null pointer dereference in trace ucsi_register_altmode checks IS_ERR for the alt pointer and treats NULL as valid. When CONFIG_TYPEC_DP_ALTMODE is not enabled, ucsi_reg…
-
Unscored —
apparmor: fix possible NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: apparmor: fix possible NULL pointer dereference profile->parent->dents[AAFS_PROF_DIR] could be NULL only if its parent is made from __create_missing_ancestors(..) and 'ent->old' is NULL in aa…
-
Unscored —
drm/amdgpu: fix mc_data out-of-bounds read warning
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mc_data out-of-bounds read warning Clear warning that read mc_data[i-1] may out-of-bounds.
-
Unscored —
drm/amdgpu: fix ucode out-of-bounds read warning
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ucode out-of-bounds read warning Clear warning that read ucode[] may out-of-bounds.
-
Unscored —
drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number Check the fb_channel_number range to avoid the array out-of-bounds read error
-
Unscored —
drm/amd/pm: fix the Out-of-bounds read warning
In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm: fix the Out-of-bounds read warning using index i - 1U may beyond element index for mc_data[] when i = 0.
-
Unscored —
drm/amd/display: Assign linear_pitch_alignment even for VM
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Assign linear_pitch_alignment even for VM [Description] Assign linear_pitch_alignment so we don't cause a divide by 0 error in VM environments
-
Unscored —
uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind
In the Linux kernel, the following vulnerability has been resolved: uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind For primary VM Bus channels, primary_channel pointer is always NULL. This pointer is valid only for the secondary channel…
-
Unscored —
Squashfs: sanity check symbolic link size
In the Linux kernel, the following vulnerability has been resolved: Squashfs: sanity check symbolic link size Syzkiller reports a "KMSAN: uninit-value in pick_link" bug. This is caused by an uninitialised page, which is ultimately caused by a corrupted symbol…
-
Unscored —
Input: uinput - reject requests with unreasonable number of slots
In the Linux kernel, the following vulnerability has been resolved: Input: uinput - reject requests with unreasonable number of slots When exercising uinput interface syzkaller may try setting up device with a really large number of slots, which causes memory…
-
Unscored —
HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup
In the Linux kernel, the following vulnerability has been resolved: HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup report_fixup for the Cougar 500k Gaming Keyboard was not verifying that the report descriptor size was correct before accessing…
-
Unscored —
btrfs: replace BUG_ON() with error handling at update_ref_for_cow()
In the Linux kernel, the following vulnerability has been resolved: btrfs: replace BUG_ON() with error handling at update_ref_for_cow() Instead of a BUG_ON() just return an error, log an error message and abort the transaction in case we find an extent buffer…
-
Unscored —CVE-2024-46756 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —CVE-2024-46757 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —CVE-2024-46758 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
hwmon: (adc128d818) Fix underflows seen when writing limit attributes
In the Linux kernel, the following vulnerability has been resolved: hwmon: (adc128d818) Fix underflows seen when writing limit attributes DIV_ROUND_CLOSEST() after kstrtol() results in an underflow if a large negative number such as -9223372036854775808 is pr…
-
Unscored —
pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv
In the Linux kernel, the following vulnerability has been resolved: pci/hotplug/pnv_php: Fix hotplug driver crash on Powernv The hotplug driver for powerpc (pci/hotplug/pnv_php.c) causes a kernel crash when we try to hot-unplug/disable the PCIe switch/bridge …
-
Unscored —
ila: call nf_unregister_net_hooks() sooner
In the Linux kernel, the following vulnerability has been resolved: ila: call nf_unregister_net_hooks() sooner syzbot found an use-after-free Read in ila_nf_input [1] Issue here is that ila_xlat_exit_net() frees the rhashtable, then call nf_unregister_net_hoo…
-
Unscored —
tcp_bpf: fix return value of tcp_bpf_sendmsg()
In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: fix return value of tcp_bpf_sendmsg() When we cork messages in psock->cork, the last message triggers the flushing will result in sending a sk_msg larger than the current message siz…
-
Unscored —
can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open
In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open The mcp251x_hw_wake() function is called with the mpc_lock mutex held and disables the interrupt handler so that no inter…
-
Unscored —
ksmbd: unset the binding mark of a reused connection
In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset the binding mark of a reused connection Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reu…
-
Unscored —
drm/amd/display: Add array index check for hdcp ddc access
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add array index check for hdcp ddc access [Why] Coverity reports OVERRUN warning. Do not check if array index valid. [How] Check msg_id valid and valid array index.
-
Unscored —
drm/amdgpu: fix the waring dereferencing hive
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix the waring dereferencing hive Check the amdgpu_hive_info *hive that maybe is NULL.
-
Unscored —
drm/amd/amdgpu: Check tbo resource pointer
In the Linux kernel, the following vulnerability has been resolved: drm/amd/amdgpu: Check tbo resource pointer Validate tbo resource pointer, skip if NULL
-
Unscored —
drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ
In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: Check if fully initialized before signalling HPD event via IRQ Make sure the connector is fully initialized before signalling any HPD events via drm_kms_helper_hotplug_e…
-
Unscored —
drm/amd/display: Check msg_id before processing transcation
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check msg_id before processing transcation [WHY & HOW] HDCP_MESSAGE_ID_INVALID (-1) is not a valid msg_id nor is it a valid array index, and it needs checking before used. Th…
-
Unscored —
drm/amdgpu: the warning dereferencing obj for nbio_v7_4
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: the warning dereferencing obj for nbio_v7_4 if ras_manager obj null, don't print NBIO err data
-
Unscored —
arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry
In the Linux kernel, the following vulnerability has been resolved: arm64: acpi: Harden get_cpu_for_acpi_id() against missing CPU entry In a review discussion of the changes to support vCPU hotplug where a check was added on the GICC being enabled if was onli…
-
Unscored —
rtmutex: Drop rt_mutex::wait_lock before scheduling
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Drop rt_mutex::wait_lock before scheduling rt_mutex_handle_deadlock() is called with rt_mutex::wait_lock held. In the good case it returns with the lock held and in the deadlock case…
-
Unscored —
MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed
In the Linux kernel, the following vulnerability has been resolved: MIPS: cevt-r4k: Don't call get_c0_compare_int if timer irq is installed This avoids warning: [ 0.118053] BUG: sleeping function called from invalid context at kernel/locking/mutex.c:283 Cause…
-
Unscored —
btrfs: clean up our handling of refs == 0 in snapshot delete
In the Linux kernel, the following vulnerability has been resolved: btrfs: clean up our handling of refs == 0 in snapshot delete In reada we BUG_ON(refs == 0), which could be unkind since we aren't holding a lock on the extent leaf and thus could get a transi…
-
Unscored —
fsnotify: clear PARENT_WATCHED flags lazily
In the Linux kernel, the following vulnerability has been resolved: fsnotify: clear PARENT_WATCHED flags lazily In some setups directories can have many (usually negative) dentries. Hence __fsnotify_update_child_dentry_flags() function can take a significant …
-
Unscored —
staging: iio: frequency: ad9834: Validate frequency parameter value
In the Linux kernel, the following vulnerability has been resolved: staging: iio: frequency: ad9834: Validate frequency parameter value In ad9834_write_frequency() clk_get_rate() can return 0. In such case ad9834_calc_freqreg() call will lead to division by z…
References
-
report
https://ubuntu.com/security/CVE-2022-48666
-
report
https://ubuntu.com/security/CVE-2023-52889
-
report
https://ubuntu.com/security/CVE-2023-52918
-
report
https://ubuntu.com/security/CVE-2024-25744
-
report
https://ubuntu.com/security/CVE-2024-26607
-
report
https://ubuntu.com/security/CVE-2024-26661
-
report
https://ubuntu.com/security/CVE-2024-26669
-
report
https://ubuntu.com/security/CVE-2024-26800
-
report
https://ubuntu.com/security/CVE-2024-26893
-
report
https://ubuntu.com/security/CVE-2024-36484
-
report
https://ubuntu.com/security/CVE-2024-38577
-
report
https://ubuntu.com/security/CVE-2024-38602
-
report
https://ubuntu.com/security/CVE-2024-38611
-
report
https://ubuntu.com/security/CVE-2024-39472
-
report
https://ubuntu.com/security/CVE-2024-40915
-
report
https://ubuntu.com/security/CVE-2024-41011
-
report
https://ubuntu.com/security/CVE-2024-41012
-
report
https://ubuntu.com/security/CVE-2024-41015
-
report
https://ubuntu.com/security/CVE-2024-41017
-
report
https://ubuntu.com/security/CVE-2024-41019
-
report
https://ubuntu.com/security/CVE-2024-41020
-
report
https://ubuntu.com/security/CVE-2024-41022
-
report
https://ubuntu.com/security/CVE-2024-41042
-
report
https://ubuntu.com/security/CVE-2024-41059
-
report
https://ubuntu.com/security/CVE-2024-41060
-
report
https://ubuntu.com/security/CVE-2024-41063
-
report
https://ubuntu.com/security/CVE-2024-41064
-
report
https://ubuntu.com/security/CVE-2024-41065
-
report
https://ubuntu.com/security/CVE-2024-41068
-
report
https://ubuntu.com/security/CVE-2024-41070
-
report
https://ubuntu.com/security/CVE-2024-41071
-
report
https://ubuntu.com/security/CVE-2024-41072
-
report
https://ubuntu.com/security/CVE-2024-41073
-
report
https://ubuntu.com/security/CVE-2024-41077
-
report
https://ubuntu.com/security/CVE-2024-41078
-
report
https://ubuntu.com/security/CVE-2024-41081
-
report
https://ubuntu.com/security/CVE-2024-41090
-
report
https://ubuntu.com/security/CVE-2024-41091
-
report
https://ubuntu.com/security/CVE-2024-41098