Summary
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Compute Acceleration Framework;
- ACPI drivers;
- Drivers core;
- Ublk userspace block driver;
- Virtio block driver;
- Bluetooth drivers;
- Buffer Sharing and Synchronization framework;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Microsoft Hyper-V drivers;
- Hardware monitoring drivers;
- I3C subsystem;
- IIO ADC drivers;
- IIO subsystem;
- InfiniBand drivers;
- IOMMU subsystem;
- LED subsystem;
- Multiple devices driver;
- Media drivers;
- Microchip PCI driver;
- MTD block device drivers;
- Network drivers;
- Mellanox network drivers;
- STMicroelectronics network drivers;
- NVME drivers;
- PCI subsystem;
- PHY drivers;
- Pin controllers subsystem;
- x86 platform drivers;
- i.MX PM domains;
- Power supply drivers;
- Voltage and Current Regulator drivers;
- SCSI subsystem;
- i.MX SoC drivers;
- SPI subsystem;
- UFS subsystem;
- USB Gadget drivers;
- TDX Guest driver;
- AFS file system;
- BTRFS file system;
- Ceph distributed file system;
- File systems infrastructure;
- F2FS file system;
- JFFS2 file system;
- JFS file system;
- Network file systems library;
- Network file system (NFS) server daemon;
- NILFS2 file system;
- File system notification infrastructure;
- Overlay file system;
- Diskquota system;
- SMB network file system;
- DRM display driver;
- BPF subsystem;
- VLANs driver;
- KASAN memory debugging framework;
- Memory management;
- StackDepot library;
- Bluetooth subsystem;
- LAPB network protocol;
- Netfilter;
- io_uring subsystem;
- Control group (cgroup);
- DMA mapping infrastructure;
- KCSAN framework;
- Scheduler infrastructure;
- Seccomp subsystem;
- Tracing infrastructure;
- Workqueue subsystem;
- KUnit library;
- CAN network layer;
- Networking core;
- DCCP (Datagram Congestion Control Protocol);
- HSR network protocol;
- IEEE802154.4 network protocol;
- IPv4 networking;
- IPv6 networking;
- MAC80211 subsystem;
- Multipath TCP;
- NET/ROM layer;
- Packet sockets;
- RDS protocol;
- Network traffic control;
- SCTP protocol;
- SMC sockets;
- TIPC protocol;
- Wireless networking;
- eXpress Data Path;
- SELinux security module;
- ALSA framework;
- Intel ASoC drivers;
- SOF drivers;
(CVE-2024-57921, CVE-2024-56614, CVE-2024-56558, CVE-2024-56589,
CVE-2024-56662, CVE-2024-56610, CVE-2024-56717, CVE-2024-57890,
CVE-2024-55639, CVE-2024-56562, CVE-2025-21633, CVE-2024-56598,
CVE-2024-47794, CVE-2024-41935, CVE-2024-57901, CVE-2024-56587,
CVE-2024-56581, CVE-2024-56783, CVE-2024-57888, CVE-2024-57809,
CVE-2024-57926, CVE-2025-21650, CVE-2024-56634, CVE-2025-21639,
CVE-2025-21656, CVE-2024-56578, CVE-2025-21632, CVE-2024-56784,
CVE-2025-21644, CVE-2024-56776, CVE-2024-56764, CVE-2024-56652,
CVE-2024-56550, CVE-2024-56569, CVE-2024-57904, CVE-2024-49569,
CVE-2024-56770, CVE-2024-56606, CVE-2024-57806, CVE-2024-56646,
CVE-2024-57895, CVE-2024-57880, CVE-2024-56650, CVE-2024-56591,
CVE-2024-56590, CVE-2024-56642, CVE-2024-56713, CVE-2025-21663,
CVE-2024-57938, CVE-2024-56760, CVE-2024-56583, CVE-2025-21662,
CVE-2024-56629, CVE-2024-47408, CVE-2024-57850, CVE-2024-56777,
CVE-2024-56626, CVE-2024-56773, CVE-2024-56647, CVE-2025-21664,
CVE-2024-56564, CVE-2024-56597, CVE-2024-56623, CVE-2024-57897,
CVE-2024-56670, CVE-2024-56567, CVE-2024-57931, CVE-2024-56761,
CVE-2024-57935, CVE-2024-53690, CVE-2025-21640, CVE-2024-56608,
CVE-2024-57878, CVE-2025-21648, CVE-2024-57898, CVE-2024-57889,
CVE-2024-56644, CVE-2024-56763, CVE-2024-57900, CVE-2024-56575,
CVE-2024-56786, CVE-2025-21635, CVE-2024-56559, CVE-2024-56659,
CVE-2024-56621, CVE-2024-57908, CVE-2024-52319, CVE-2024-43098,
CVE-2024-57838, CVE-2024-56782, CVE-2025-21631, CVE-2024-36476,
CVE-2025-21649, CVE-2024-56667, CVE-2024-49571, CVE-2024-55916,
CVE-2024-57887, CVE-2024-56640, CVE-2024-57801, CVE-2024-57886,
CVE-2024-56582, CVE-2024-56561, CVE-2024-56665, CVE-2024-57805,
CVE-2024-51729, CVE-2024-57857, CVE-2024-57876, CVE-2024-57896,
CVE-2024-57799, CVE-2024-57925, CVE-2024-57917, CVE-2024-56664,
CVE-2024-57913, CVE-2025-21660, CVE-2024-56596, CVE-2024-56671,
CVE-2024-56595, CVE-2024-56781, CVE-2024-57912, CVE-2024-56638,
CVE-2024-56636, CVE-2024-56669, CVE-2024-57945, CVE-2024-56633,
CVE-2024-56605, CVE-2024-57882, CVE-2025-21652, CVE-2024-53179,
CVE-2024-56599, CVE-2024-57892, CVE-2025-21647, CVE-2024-57910,
CVE-2024-57792, CVE-2024-56768, CVE-2024-56711, CVE-2024-47143,
CVE-2024-56577, CVE-2024-56574, CVE-2024-56765, CVE-2024-58087,
CVE-2024-53685, CVE-2024-56787, CVE-2024-56592, CVE-2024-56368,
CVE-2024-56615, CVE-2024-56712, CVE-2024-56648, CVE-2024-57874,
CVE-2024-56653, CVE-2024-56656, CVE-2024-56641, CVE-2024-56719,
CVE-2025-21658, CVE-2024-56637, CVE-2024-56709, CVE-2024-57843,
CVE-2024-56588, CVE-2024-57807, CVE-2024-57939, CVE-2024-56594,
CVE-2024-55642, CVE-2024-57841, CVE-2024-50051, CVE-2024-56663,
CVE-2024-56654, CVE-2024-56369, CVE-2024-57885, CVE-2024-56779,
CVE-2024-56772, CVE-2024-56617, CVE-2024-56624, CVE-2024-56570,
CVE-2024-56639, CVE-2025-21642, CVE-2024-56603, CVE-2024-56604,
CVE-2024-57875, CVE-2025-21653, CVE-2025-21654, CVE-2024-56645,
CVE-2024-56775, CVE-2024-52332, CVE-2024-48875, CVE-2024-41932,
CVE-2024-57804, CVE-2025-21661, CVE-2024-57932, CVE-2024-53681,
CVE-2024-56563, CVE-2024-56609, CVE-2024-57798, CVE-2025-21637,
CVE-2024-57940, CVE-2024-56675, CVE-2024-56630, CVE-2024-56565,
CVE-2024-54460, CVE-2024-56573, CVE-2025-21645, CVE-2024-56715,
CVE-2024-56632, CVE-2024-56622, CVE-2024-56673, CVE-2024-48881,
CVE-2024-56593,
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 24.04 LTS 24.04:LTS | linux-hwe-6.11 | 6.11.0-21.21~24.04.1 |
Vulnerabilities 308
-
Critical 10.0
net: stmmac: fix TSO DMA API usage causing oops
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO DMA API usage causing oops Commit 66600fac7a98 ("net: stmmac: TSO: Fix unbalanced DMA map/unmap for non-paged SKB data") moved the assignment of tx_skbuff_dma[]'s members…
-
Critical 10.0
net: stmmac: dwmac-tegra: Read iommu stream id from device tree
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: dwmac-tegra: Read iommu stream id from device tree Nvidia's Tegra MGBE controllers require the IOMMU "Stream ID" (SID) to be written to the MGBE_WRAP_AXI_ASID0_CTRL register. The…
-
Critical 9.8
RDMA/rtrs: Ensure 'ib_sge list' is accessible
In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: Ensure 'ib_sge list' is accessible Move the declaration of the 'ib_sge list' variable outside the 'always_invalidate' block to ensure it remains accessible for use throughout the f…
-
Critical 9.8
net/smc: check smcd_v2_ext_offset when receiving proposal msg
In the Linux kernel, the following vulnerability has been resolved: net/smc: check smcd_v2_ext_offset when receiving proposal msg When receiving proposal msg in server, the field smcd_v2_ext_offset in proposal msg is from the remote client and can not be full…
-
Critical 9.8
net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg
In the Linux kernel, the following vulnerability has been resolved: net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving proposal msg When receiving proposal msg in server, the fields v2_ext_offset/ eid_cnt/ism_gid_cnt in proposal msg are from the …
-
Critical 9.8
smb: client: fix use-after-free of signing key
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of signing key Customers have reported use-after-free in @ses->auth_key.response with SMB2.1 + sign mounts which occurs due to following race: task A task B ci…
-
Critical 9.8
net/smc: fix LGR and link use-after-free issue
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix LGR and link use-after-free issue We encountered a LGR/link use-after-free issue, which manifested as the LGR/link refcnt reaching 0 early and entering the clear process, making …
-
Critical 9.8
can: j1939: j1939_session_new(): fix skb reference counting
In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939_session_new(): fix skb reference counting Since j1939_session_skb_queue() does an extra skb_get() for each new skb, do the same for the initial one in j1939_session_new() to…
-
Critical 9.8
bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips
In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix aggregation ID mask to prevent oops on 5760X chips The 5760X (P7) chip's HW GRO/LRO interface is very similar to that of the previous generation (5750X or P5). However, the aggre…
-
Critical 9.8
net/smc: protect link down work from execute after lgr freed
In the Linux kernel, the following vulnerability has been resolved: net/smc: protect link down work from execute after lgr freed link down work may be scheduled before lgr freed but execute after lgr freed, which may result in crash. So it is need to hold a r…
-
Critical 9.8
nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur The action force umount(umount -f) will attempt to kill all rpc_task even umount operation may ultimately fail if some files rem…
-
Critical 9.8
virtio-net: fix overflow inside virtnet_rq_alloc
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix overflow inside virtnet_rq_alloc When the frag just got a page, then may lead to regression on VM. Specially if the sysctl net.core.high_order_alloc_disable value is 1, then t…
-
Critical 9.8
mptcp: fix TCP options overflow.
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix TCP options overflow. Syzbot reported the following splat: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN PTI KA…
-
Critical 9.8
gve: guard XDP xmit NDO on existence of xdp queues
In the Linux kernel, the following vulnerability has been resolved: gve: guard XDP xmit NDO on existence of xdp queues In GVE, dedicated XDP queues only exist when an XDP program is installed and the interface is up. As such, the NDO XDP XMIT callback should …
-
Critical 9.8
ksmbd: fix racy issue from session lookup and expire
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix racy issue from session lookup and expire Increment the session reference count within the lock for lookup to avoid racy issue with session expire.
-
Critical 9.4
netrom: check buffer length before accessing it
In the Linux kernel, the following vulnerability has been resolved: netrom: check buffer length before accessing it Syzkaller reports an uninit value read from ax25cmp when sending raw message through ieee802154 implementation. ===============================…
-
Critical 9.3
virt: tdx-guest: Just leak decrypted memory on unrecoverable errors
In the Linux kernel, the following vulnerability has been resolved: virt: tdx-guest: Just leak decrypted memory on unrecoverable errors In CoCo VMs it is possible for the untrusted host to cause set_memory_decrypted() to fail such that an error is returned an…
-
Critical 9.1
net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg
In the Linux kernel, the following vulnerability has been resolved: net/smc: check iparea_offset and ipv6_prefixes_cnt when receiving proposal msg When receiving proposal msg in server, the field iparea_offset and the field ipv6_prefixes_cnt in proposal msg a…
-
High 8.8
Bluetooth: hci_conn: Use disable_delayed_work_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Use disable_delayed_work_sync This makes use of disable_delayed_work_sync instead cancel_delayed_work_sync as it not only cancel the ongoing work but also disables new su…
-
High 8.8
ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Write in ksmbd_vfs_stream_write An offset from client could be a negative value, It could allows to write data outside the bounds of the allocated buffer. Note that t…
-
High 8.8
can: hi311x: hi3110_can_ist(): fix potential use-after-free
In the Linux kernel, the following vulnerability has been resolved: can: hi311x: hi3110_can_ist(): fix potential use-after-free The commit a22bd630cfff ("can: hi311x: do not report txerr and rxerr during bus-off") removed the reporting of rxerr and txerr even…
-
High 8.8
Bluetooth: btmtk: avoid UAF in btmtk_process_coredump
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtk: avoid UAF in btmtk_process_coredump hci_devcd_append may lead to the release of the skb, so it cannot be accessed once it is called. ========================================…
-
High 8.8
iommu/vt-d: Remove cache tags before disabling ATS
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Remove cache tags before disabling ATS The current implementation removes cache tags after disabling ATS, leading to potential memory leaks and kernel crashes. Specifically, CACHE…
-
High 8.4
net: renesas: rswitch: avoid use-after-put for a device tree node
In the Linux kernel, the following vulnerability has been resolved: net: renesas: rswitch: avoid use-after-put for a device tree node The device tree node saved in the rswitch_device structure is used at several driver locations. So passing this node to of_no…
-
High 8.2
net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets
In the Linux kernel, the following vulnerability has been resolved: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets The blamed commit disabled hardware offoad of IPv6 packets with extension headers on devices that advertise NETIF_F_IPV6_CSUM, base…
-
High 8.1
ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix Out-of-Bounds Read in ksmbd_vfs_stream_read An offset from client could be a negative value, It could lead to an out-of-bounds read from the stream_buf. Note that this issue is com…
-
High 8.1
netdev: prevent accessing NAPI instances from another namespace
In the Linux kernel, the following vulnerability has been resolved: netdev: prevent accessing NAPI instances from another namespace The NAPI IDs were not fully exposed to user space prior to the netlink API, so they were never namespaced. The netlink API must…
-
High 7.8
net: wwan: t7xx: Fix FSM command timeout issue
In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix FSM command timeout issue When driver processes the internal state change command, it use an asynchronous thread to process the command operation. If the main thread dete…
-
High 7.8
bpf: Prevent tailcall infinite loop caused by freplace
In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tailcall infinite loop caused by freplace There is a potential infinite loop issue that can occur when using a combination of tail calls and freplace. In an upcoming selftest, th…
-
High 7.8
spi: mpc52xx: Add cancel_work_sync before module remove
In the Linux kernel, the following vulnerability has been resolved: spi: mpc52xx: Add cancel_work_sync before module remove If we remove the module which will call mpc52xx_spi_remove it will free 'ms' through spi_unregister_controller. while the work ms->work…
-
High 7.8
mm: use aligned address in copy_user_gigantic_page()
In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in copy_user_gigantic_page() In current kernel, hugetlb_wp() calls copy_user_large_folio() with the fault address. Where the fault address may be not aligned with the …
-
High 7.8
mm: use aligned address in clear_gigantic_page()
In the Linux kernel, the following vulnerability has been resolved: mm: use aligned address in clear_gigantic_page() In current kernel, hugetlb_no_page() calls folio_zero_user() with the fault address. Where the fault address may be not aligned with the huge …
-
High 7.8
drm/amdgpu: fix usage slab after free
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free [ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched] [ +0.000027] Read of size 8 at addr ffff8881b8605f88 by ta…
-
High 7.8
drm/xe/guc_submit: fix race around suspend_pending
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc_submit: fix race around suspend_pending Currently in some testcases we can trigger: xe 0000:03:00.0: [drm] Assertion `exec_queue_destroyed(q)` failed! .... WARNING: CPU: 18 PID: 26…
-
High 7.8
iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer The AD7923 was updated to support devices with 8 channels, but the size of tx_buf and ring_xfer was not increased accordingly, l…
-
High 7.8
nfsd: make sure exp active before svc_export_show
In the Linux kernel, the following vulnerability has been resolved: nfsd: make sure exp active before svc_export_show The function `e_show` was called with protection from RCU. This only ensures that `exp` will not be freed. Therefore, the reference count for…
-
High 7.8
PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy() pci_epc_destroy() invokes pci_bus_release_domain_nr() to release the PCI domain ID, but there are two issues: - 'epc->dev' is pas…
-
High 7.8
ceph: fix cred leak in ceph_mds_check_access()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix cred leak in ceph_mds_check_access() get_current_cred() increments the reference counter, but the put_cred() call was missing.
-
High 7.8
media: i2c: tc358743: Fix crash in the probe error path when using polling
In the Linux kernel, the following vulnerability has been resolved: media: i2c: tc358743: Fix crash in the probe error path when using polling If an error occurs in the probe() function, we should remove the polling timer that was alarmed earlier, otherwise t…
-
High 7.8
btrfs: fix use-after-free in btrfs_encoded_read_endio()
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free in btrfs_encoded_read_endio() Shinichiro reported the following use-after free that sometimes is happening in our CI system when running fstests' btrfs/284 on a TCMU…
-
High 7.8
jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree
In the Linux kernel, the following vulnerability has been resolved: jfs: add a check to prevent array-index-out-of-bounds in dbAdjTree When the value of lp is 0 at the beginning of the for loop, it will become negative in the next assignment and we should bai…
-
High 7.8
jfs: fix array-index-out-of-bounds in jfs_readdir
In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds in jfs_readdir The stbl might contain some invalid values. Added a check to return error code in that case.
-
High 7.8
jfs: fix shift-out-of-bounds in dbSplit
In the Linux kernel, the following vulnerability has been resolved: jfs: fix shift-out-of-bounds in dbSplit When dmt_budmin is less than zero, it causes errors in the later stages. Added a check to return an error beforehand in dbAllocCtl itself.
-
High 7.8
net: inet6: do not leave a dangling sk pointer in inet6_create()
In the Linux kernel, the following vulnerability has been resolved: net: inet6: do not leave a dangling sk pointer in inet6_create() sock_init_data() attaches the allocated sk pointer to the provided sock object. If inet6_create() fails later, the sk object i…
-
High 7.8
net: inet: do not leave a dangling sk pointer in inet_create()
In the Linux kernel, the following vulnerability has been resolved: net: inet: do not leave a dangling sk pointer in inet_create() sock_init_data() attaches the allocated sk object to the provided sock object. If inet_create() fails later, the sk object is fr…
-
High 7.8
net: af_can: do not leave a dangling sk pointer in can_create()
In the Linux kernel, the following vulnerability has been resolved: net: af_can: do not leave a dangling sk pointer in can_create() On error can_create() frees the allocated sk object, but sock_init_data() has already attached it to the provided sock object. …
-
High 7.8
Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() bt_sock_alloc() attaches allocated sk object to the provided sock object. If rfcomm_dlc_alloc() fails, we release t…
-
High 7.8
Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create()
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() bt_sock_alloc() allocates the sk object and attaches it to the provided sock object. On error l2cap_sock_all…
-
High 7.8
af_packet: avoid erroring out after sock_init_data() in packet_create()
In the Linux kernel, the following vulnerability has been resolved: af_packet: avoid erroring out after sock_init_data() in packet_create() After sock_init_data() the allocated sk object is attached to the provided sock object. On error, packet_create() frees…
-
High 7.8
drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create'
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' An issue was identified in the dcn21_link_encoder_create function where an out-of-bounds access could occur when the h…
-
High 7.8
xsk: fix OOB map writes when deleting elements
In the Linux kernel, the following vulnerability has been resolved: xsk: fix OOB map writes when deleting elements Jordy says: " In the xsk_map_delete_elem function an unsigned integer (map->max_entries) is compared with a user-controlled signed integer (k). …
-
High 7.8
bpf: fix OOB devmap writes when deleting elements
In the Linux kernel, the following vulnerability has been resolved: bpf: fix OOB devmap writes when deleting elements Jordy reported issue against XSKMAP which also applies to DEVMAP - the index used for accessing map entry, due to being a signed integer, cau…
-
High 7.8
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large va…
-
High 7.8
scsi: qla2xxx: Fix use after free on unload
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix use after free on unload System crash is observed with stack trace warning of use after free. There are 2 signals to tell dpc_thread to terminate (UNLOADING flag and kthrea…
-
High 7.8
iommufd: Fix out_fput in iommufd_fault_alloc()
In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix out_fput in iommufd_fault_alloc() As fput() calls the file->f_op->release op, where fault obj and ictx are getting released, there is no need to release these two after fput() on…
-
High 7.8
scsi: sg: Fix slab-use-after-free read in sg_release()
In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Fix slab-use-after-free read in sg_release() Fix a use-after-free bug in sg_release(), detected by syzbot with KASAN: BUG: KASAN: slab-use-after-free in lock_release+0x151/0xa30 ker…
-
High 7.8
net: avoid potential UAF in default_operstate()
In the Linux kernel, the following vulnerability has been resolved: net: avoid potential UAF in default_operstate() syzbot reported an UAF in default_operstate() [1] Issue is a race between device and netns dismantles. After calling __rtnl_unlock() from netde…
-
High 7.8
tipc: Fix use-after-free of kernel socket in cleanup_bearer().
In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free of kernel socket in cleanup_bearer(). syzkaller reported a use-after-free of UDP kernel socket in cleanup_bearer() without repro. [0][1] When bearer_disable() calls t…
-
High 7.8
drm/xe/reg_sr: Remove register pool
In the Linux kernel, the following vulnerability has been resolved: drm/xe/reg_sr: Remove register pool That pool implementation doesn't really work: if the krealloc happens to move the memory and return another address, the entries in the xarray become inval…
-
High 7.8
Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: Fix using rcu_read_(un)lock while iterating The usage of rcu_read_(un)lock while inside list_for_each_entry_rcu is not safe since for the most part entries fetched this …
-
High 7.8
netfilter: nf_tables: do not defer rule destruction via call_rcu
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not defer rule destruction via call_rcu nf_tables_chain_destroy can sleep, it can't be used from call_rcu callbacks. Moreover, nf_tables_rule_release() is only safe f…
-
High 7.8
acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl
In the Linux kernel, the following vulnerability has been resolved: acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl Fix an issue detected by syzbot with KASAN: BUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/ core.c:416 [inline] BUG…
-
High 7.8
wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one
In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one Since the netlink attribute range validation provides inclusive checking, the *max* of attribute NL80211_ATTR_MLO_LINK_ID should be IEEE…
-
High 7.8
bpf, sockmap: Fix race between element replace and close()
In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix race between element replace and close() Element replace (with a socket different from the one stored) may race with socket's close() link popping & unlinking. __sock_map_de…
-
High 7.8
bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors Uprobes always use bpf_prog_run_array_uprobe() under tasks-trace-RCU protection. But it is possible to attach a non-sleepable BPF …
-
High 7.8
io_uring: check if iowq is killed before queuing
In the Linux kernel, the following vulnerability has been resolved: io_uring: check if iowq is killed before queuing task work can be executed after the task has gone through io_uring termination, whether it's the final task_work run or the fallback path. In …
-
High 7.8
ionic: Fix netdev notifier unregister on failure
In the Linux kernel, the following vulnerability has been resolved: ionic: Fix netdev notifier unregister on failure If register_netdev() fails, then the driver leaks the netdev notifier. Fix this by calling ionic_lif_unregister() on register_netdev() failure…
-
High 7.8
Bluetooth: btusb: mediatek: add intf release flow when usb disconnect
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: add intf release flow when usb disconnect MediaTek claim an special usb intr interface for ISO data transmission. The interface need to be released before unregist…
-
High 7.8
btrfs: fix use-after-free when COWing tree bock and tracing is enabled
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when COWing tree bock and tracing is enabled When a COWing a tree block, at btrfs_cow_block(), and we have the tracepoint trace_btrfs_cow_block() enabled and preempt…
-
High 7.8
ublk: detach gendisk from ublk device if add_disk() fails
In the Linux kernel, the following vulnerability has been resolved: ublk: detach gendisk from ublk device if add_disk() fails Inside ublk_abort_requests(), gendisk is grabbed for aborting all inflight requests. And ublk_abort_requests() is called when exiting…
-
High 7.8
powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries/vas: Add close() callback in vas_vm_ops struct The mapping VMA address is saved in VAS window struct when the paste address is mapped. This VMA address is used during migratio…
-
High 7.8
kunit: string-stream: Fix a UAF bug in kunit_init_suite()
In the Linux kernel, the following vulnerability has been resolved: kunit: string-stream: Fix a UAF bug in kunit_init_suite() In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the kunit_suite_for_each_test_case() loop, the "suite->log = strea…
-
High 7.8
drm/amd/display: Fix handling of plane refcount
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix handling of plane refcount [Why] The mechanism to backup and restore plane states doesn't maintain refcount, which can cause issues if the refcount of the plane changes i…
-
High 7.8
drm/amd/display: Adding array index check to prevent memory corruption
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Adding array index check to prevent memory corruption [Why & How] Array indices out of bound caused memory corruption. Adding checks to ensure that array index stays in bound.
-
High 7.8
RDMA/rxe: Remove the direct link to net_device
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Remove the direct link to net_device The similar patch in siw is in the link: https://git.kernel.org/rdma/rdma/c/16b87037b48889 This problem also occurred in RXE. The following anal…
-
High 7.8
drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req()
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() While receiving an MST up request message from one thread in drm_dp_mst_handle_up_req(), the MST topology could b…
-
High 7.8
net/mlx5e: Skip restore TC rules for vport rep without loaded flag
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Skip restore TC rules for vport rep without loaded flag During driver unload, unregister_netdev is called after unloading vport rep. So, the mlx5e_rep_priv is already freed while t…
-
High 7.8
s390/cpum_sf: Handle CPU hotplug remove during sampling
In the Linux kernel, the following vulnerability has been resolved: s390/cpum_sf: Handle CPU hotplug remove during sampling CPU hotplug remove handling triggers the following function call sequence: CPUHP_AP_PERF_S390_SF_ONLINE --> s390_pmu_sf_offline_cpu() .…
-
High 7.8
jffs2: Prevent rtime decompress memory corruption
In the Linux kernel, the following vulnerability has been resolved: jffs2: Prevent rtime decompress memory corruption The rtime decompression routine does not fully check bounds during the entirety of the decompression pass and can corrupt memory outside the …
-
High 7.8
RDMA/siw: Remove direct link to net_device
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Remove direct link to net_device Do not manage a per device direct link to net_device. Rely on associated ib_devices net_device management, not doubling the effort locally. A badly …
-
High 7.8
block: RCU protect disk->conv_zones_bitmap
In the Linux kernel, the following vulnerability has been resolved: block: RCU protect disk->conv_zones_bitmap Ensure that a disk revalidation changing the conventional zones bitmap of a disk does not cause invalid memory references when using the disk_zone_i…
-
High 7.8
mm: hugetlb: independent PMD page table shared count
In the Linux kernel, the following vulnerability has been resolved: mm: hugetlb: independent PMD page table shared count The folio refcount may be increased unexpectly through try_get_folio() by caller such as split_huge_pages. In huge_pmd_unshare(), we use r…
-
High 7.8
drm: adv7511: Fix use-after-free in adv7533_attach_dsi()
In the Linux kernel, the following vulnerability has been resolved: drm: adv7511: Fix use-after-free in adv7533_attach_dsi() The host_node pointer was assigned and freed in adv7533_parse_dt(), and later, adv7533_attach_dsi() uses the same. Fix this use-after-…
-
High 7.8
ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix slab-use-after-free due to dangling pointer dqi_priv When mounting ocfs2 and then remounting it as read-only, a slab-use-after-free occurs after the user uses a syscall to quota_ge…
-
High 7.8
ALSA: seq: oss: Fix races at processing SysEx messages
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix races at processing SysEx messages OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the da…
-
High 7.8
btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
In the Linux kernel, the following vulnerability has been resolved: btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which fre…
-
High 7.8
ila: serialize calls to nf_register_net_hooks()
In the Linux kernel, the following vulnerability has been resolved: ila: serialize calls to nf_register_net_hooks() syzbot found a race in ila_add_mapping() [1] commit 031ae72825ce ("ila: call nf_unregister_net_hooks() sooner") attempted to fix a similar issu…
-
High 7.8
drm/amd/display: fix page fault due to max surface definition mismatch
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix page fault due to max surface definition mismatch DC driver is using two different values to define the maximum number of surfaces: MAX_SURFACES and MAX_SURFACE_NUM. Cons…
-
High 7.8
drm/amdgpu: Add a lock when accessing the buddy trim function
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add a lock when accessing the buddy trim function When running YouTube videos and Steam games simultaneously, the tester found a system hang / race condition issue with the multi-…
-
High 7.8
drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err
In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err The pointer need to be set to NULL, otherwise KASAN complains about use-after-free. Because in mtk_drm_b…
-
High 7.8
dm array: fix releasing a faulty array block twice in dm_array_cursor_end
In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving…
-
High 7.8
riscv: mm: Fix the out of bound issue of vmemmap address
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Fix the out of bound issue of vmemmap address In sparse vmemmap model, the virtual address of vmemmap is calculated as: ((struct page *)VMEMMAP_START - (phys_ram_base >> PAGE_SHIFT…
-
High 7.8
block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()
In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read…
-
High 7.8
ipvlan: Fix use-after-free in ipvlan_get_iflink().
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix use-after-free in ipvlan_get_iflink(). syzbot presented an use-after-free report [0] regarding ipvlan and linkwatch. ipvlan does not hold a refcnt of the lower device unlike vlan …
-
High 7.8
io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period
In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_signal() is invoked from an RCU callback, but when dropping the reference to the io_ev_fd, it calls io_eve…
-
High 7.8
gpio: virtuser: fix missing lookup table cleanups
In the Linux kernel, the following vulnerability has been resolved: gpio: virtuser: fix missing lookup table cleanups When a virtuser device is created via configfs and the probe fails due to an incorrect lookup table, the table is not removed. This prevents …
-
High 7.8
dm thin: make get_first_thin use rcu-safe list first function
In the Linux kernel, the following vulnerability has been resolved: dm thin: make get_first_thin use rcu-safe list first function The documentation in rculist.h explains the absence of list_empty_rcu() and cautions programmers against relying on a list_empty(…
-
High 7.6
Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet This fixes not checking if skb really contains an ACL header otherwise the code may attempt to access some uninitilized/…
-
High 7.6
wifi: mac80211: fix mbss changed flags corruption on 32 bit systems
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mbss changed flags corruption on 32 bit systems On 32-bit systems, the size of an unsigned long is 4 bytes, while a u64 is 8 bytes. Therefore, when using or_each_set_bit(b…
-
High 7.5
nvme-rdma: unquiesce admin_q before destroy it
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: unquiesce admin_q before destroy it Kernel will hang on destroy admin_q while we create ctrl failed, such as following calltrace: PID: 23644 TASK: ff2d52b40f439fc0 CPU: 2 COMMAND: …
-
High 7.5
nvme-tcp: fix the memleak while create new ctrl failed
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix the memleak while create new ctrl failed Now while we create new ctrl failed, we have not free the tagset occupied by admin_q, here try to fix it.
-
High 7.5
net/smc: initialize close_work early to avoid warning
In the Linux kernel, the following vulnerability has been resolved: net/smc: initialize close_work early to avoid warning We encountered a warning that close_work was canceled before initialization. WARNING: CPU: 7 PID: 111103 at kernel/workqueue.c:3047 __flu…
-
High 7.5
net/ipv6: release expired exception dst cached in socket
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: release expired exception dst cached in socket Dst objects get leaked in ip6_negative_advice() when this function is executed for an expired IPv6 route located in the exception tabl…
-
High 7.5
net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic()
In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: fix incorrect IFH SRC_PORT field in ocelot_ifh_set_basic() Packets injected by the CPU should have a SRC_PORT field equal to the CPU port module index in the Analyzer block…
-
High 7.5
net/smc: check return value of sock_recvmsg when draining clc data
In the Linux kernel, the following vulnerability has been resolved: net/smc: check return value of sock_recvmsg when draining clc data When receiving clc msg, the field length in smc_clc_msg_hdr indicates the length of msg should be received from network and …
-
High 7.5
afs: Fix the maximum cell name length
In the Linux kernel, the following vulnerability has been resolved: afs: Fix the maximum cell name length The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a director…
-
High 7.3
netfilter: ipset: Hold module reference while requesting a module
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Hold module reference while requesting a module User space may unload ip_set.ko while it is itself requesting a set type backend module, leading to a kernel crash. The race …
-
High 7.3
power: supply: gpio-charger: Fix set charge current limits
In the Linux kernel, the following vulnerability has been resolved: power: supply: gpio-charger: Fix set charge current limits Fix set charge current limits for devices which allow to set the lowest charge current limit to be greater zero. If requested charge…
-
High 7.3
scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs
In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs The driver, through the SAS transport, exposes a sysfs interface to enable/disable PHYs in a controller/expander setup. W…
-
High 7.3
af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK
In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot. Rework vlan_get_protocol_dgram() to not touch skb at all, so …
-
High 7.3
af_packet: fix vlan_get_tci() vs MSG_PEEK
In the Linux kernel, the following vulnerability has been resolved: af_packet: fix vlan_get_tci() vs MSG_PEEK Blamed commit forgot MSG_PEEK case, allowing a crash [1] as found by syzbot. Rework vlan_get_tci() to not touch skb at all, so that it can be used fr…
-
High 7.3
sched: sch_cake: add bounds checks to host bulk flow fairness counts
In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host…
-
High 7.1
ring-buffer: Fix overflow in __rb_map_vma
In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix overflow in __rb_map_vma An overflow occurred when performing the following calculation: nr_pages = ((nr_subbufs + 1) << subbuf_order) - pgoff; Add a check before the calcula…
-
High 7.1
jfs: array-index-out-of-bounds fix in dtReadFirst
In the Linux kernel, the following vulnerability has been resolved: jfs: array-index-out-of-bounds fix in dtReadFirst The value of stbl can be sometimes out of bounds due to a bad filesystem. Added a check with appopriate return of error code in that case.
-
High 7.1
netfilter: x_tables: fix LED ID check in led_tg_check()
In the Linux kernel, the following vulnerability has been resolved: netfilter: x_tables: fix LED ID check in led_tg_check() Syzbot has reported the following BUG detected by KASAN: BUG: KASAN: slab-out-of-bounds in strlen+0x58/0x70 Read of size 1 at addr ffff…
-
High 7.1
ksmbd: set ATTR_CTIME flags when setting mtime
In the Linux kernel, the following vulnerability has been resolved: ksmbd: set ATTR_CTIME flags when setting mtime David reported that the new warning from setattr_copy_mgtime is coming like the following. [ 113.215316] ------------[ cut here ]------------ [ …
-
High 7.1
iio: adc: ti-ads1119: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix information leak in triggered buffer The 'scan' local struct is used to push data to user space from a triggered buffer, but it has a hole between the sample (unsign…
-
High 7.1
iio: adc: ti-ads8688: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive cha…
-
High 7.1
iio: adc: rockchip_saradc: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: adc: rockchip_saradc: fix information leak in triggered buffer The 'data' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive…
-
High 7.1
iio: imu: kmx61: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: imu: kmx61: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels…
-
High 7.1
iio: light: vcnl4035: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the…
-
High 7.1
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, bu…
-
High 7.1
iio: pressure: zpa2326: fix information leak in triggered buffer
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: zpa2326: fix information leak in triggered buffer The 'sample' local struct is used to push data to user space from a triggered buffer, but it has a hole between the temperatur…
-
High 7.1
ksmbd: fix a missing return value check bug
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix a missing return value check bug In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() fails to allocate a node, it returns a NULL pointer to the in_work pointer. This can …
-
High 7.1
sctp: sysctl: udp_port: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inco…
-
High 7.1
sctp: sysctl: auth_enable: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - I…
-
High 7.1
sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:…
-
High 7.1
net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs 1024-1279 are in different BAR space addresses.…
-
High 7.0
efi/libstub: Free correct pointer on failure
In the Linux kernel, the following vulnerability has been resolved: efi/libstub: Free correct pointer on failure cmdline_ptr is an out parameter, which is not allocated by the function itself, and likely points into the caller's stack. cmdline refers to the p…
-
High 7.0
btrfs: ref-verify: fix use-after-free after invalid ref action
In the Linux kernel, the following vulnerability has been resolved: btrfs: ref-verify: fix use-after-free after invalid ref action At btrfs_ref_tree_mod() after we successfully inserted the new ref entry (local variable 'ref') into the respective block entry'…
-
High 7.0
net: ieee802154: do not leave a dangling sk pointer in ieee802154_create()
In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() sock_init_data() attaches the allocated sk object to the provided sock object. If ieee802154_create() fails later, t…
-
Medium 6.1
arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_TAGGED_ADDR_CTRL Currently tagged_addr_ctrl_set() doesn't initialize the temporary 'ctrl' variable, and a SETREGSET call with a length of zero …
-
Medium 6.1
arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR
In the Linux kernel, the following vulnerability has been resolved: arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR Currently fpmr_set() doesn't initialize the temporary 'fpmr' variable, and a SETREGSET call with a length of zero will leave this uninitia…
-
Medium 5.5
i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock
In the Linux kernel, the following vulnerability has been resolved: i3c: Use i3cdev->desc->info instead of calling i3c_device_get_info() to avoid deadlock A deadlock may happen since the i3c_master_register() acquires &i3cbus->lock twice. See the log below. U…
-
Medium 5.5
i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request
In the Linux kernel, the following vulnerability has been resolved: i3c: mipi-i3c-hci: Mask ring interrupts before ring stop request Bus cleanup path in DMA mode may trigger a RING_OP_STAT interrupt when the ring is being stopped. Depending on timing between …
-
Medium 5.5
pinmux: Use sequential access to access desc->pinmux data
In the Linux kernel, the following vulnerability has been resolved: pinmux: Use sequential access to access desc->pinmux data When two client of the same gpio call pinctrl_select_state() for the same functionality, we are seeing NULL pointer issue while acces…
-
Medium 5.5
dma-debug: fix a possible deadlock on radix_lock
In the Linux kernel, the following vulnerability has been resolved: dma-debug: fix a possible deadlock on radix_lock radix_lock() shouldn't be held while holding dma_hash_entry[idx].lock otherwise, there's a possible deadlock scenario when dma debug API is ca…
-
Medium 5.5
dlm: fix possible lkb_resource null dereference
In the Linux kernel, the following vulnerability has been resolved: dlm: fix possible lkb_resource null dereference This patch fixes a possible null pointer dereference when this function is called from request_lock() as lkb->lkb_resource is not assigned yet,…
-
Medium 5.5
wifi: rtw89: check return value of ieee80211_probereq_get() for RNR
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: check return value of ieee80211_probereq_get() for RNR The return value of ieee80211_probereq_get() might be NULL, so check it before using to avoid NULL pointer access. Addresse…
-
Medium 5.5
btrfs: don't take dev_replace rwsem on task already holding it
In the Linux kernel, the following vulnerability has been resolved: btrfs: don't take dev_replace rwsem on task already holding it Running fstests btrfs/011 with MKFS_OPTIONS="-O rst" to force the usage of the RAID stripe-tree, we get the following splat from…
-
Medium 5.5
bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again
In the Linux kernel, the following vulnerability has been resolved: bcache: revert replacing IS_ERR_OR_NULL with IS_ERR again Commit 028ddcac477b ("bcache: Remove unnecessary NULL point check in node allocations") leads a NULL pointer deference in cache_set_f…
-
Medium 5.5
Bluetooth: iso: Fix circular lock in iso_conn_big_sync
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: iso: Fix circular lock in iso_conn_big_sync This fixes the circular locking dependency warning below, by reworking iso_sock_recvmsg, to ensure that the socket lock is always releas…
-
Medium 5.5
Bluetooth: iso: Fix circular lock in iso_listen_bis
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: iso: Fix circular lock in iso_listen_bis This fixes the circular locking dependency warning below, by releasing the socket lock before enterning iso_listen_bis, to avoid any potent…
-
Medium 5.5
netfilter: IDLETIMER: Fix for possible ABBA deadlock
In the Linux kernel, the following vulnerability has been resolved: netfilter: IDLETIMER: Fix for possible ABBA deadlock Deletion of the last rule referencing a given idletimer may happen at the same time as a read of its file in sysfs: | ====================…
-
Medium 5.5
block: Prevent potential deadlocks in zone write plug error recovery
In the Linux kernel, the following vulnerability has been resolved: block: Prevent potential deadlocks in zone write plug error recovery Zone write plugging for handling writes to zones of a zoned block device always execute a zone report whenever a write BIO…
-
Medium 5.5
Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet If the KVP (or VSS) daemon starts before the VMBus channel's ringbuffer is fully initialized, we can hit the panic below: h…
-
Medium 5.5
drm/modes: Avoid divide by zero harder in drm_mode_vrefresh()
In the Linux kernel, the following vulnerability has been resolved: drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() drm_mode_vrefresh() is trying to avoid divide by zero by checking whether htotal or vtotal are zero. But we may still end up with…
-
Medium 5.5
ad7780: fix division by zero in ad7780_write_raw()
In the Linux kernel, the following vulnerability has been resolved: ad7780: fix division by zero in ad7780_write_raw() In the ad7780_write_raw() , val2 can be zero, which might lead to a division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw() is…
-
Medium 5.5
ftrace: Fix regression with module command in stack_trace_filter
In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix regression with module command in stack_trace_filter When executing the following command: # echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter The current mod comman…
-
Medium 5.5
media: ts2020: fix null-ptr-deref in ts2020_probe()
In the Linux kernel, the following vulnerability has been resolved: media: ts2020: fix null-ptr-deref in ts2020_probe() KASAN reported a null-ptr-deref issue when executing the following command: # echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new_device KASA…
-
Medium 5.5
media: imx-jpeg: Ensure power suppliers be suspended before detach them
In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Ensure power suppliers be suspended before detach them The power suppliers are always requested to suspend asynchronously, dev_pm_domain_detach() requires the caller to ensur…
-
Medium 5.5
media: mtk-jpeg: Fix null-ptr-deref during unload module
In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: Fix null-ptr-deref during unload module The workqueue should be destroyed in mtk_jpeg_core.c since commit 09aea13ecf6f ("media: mtk-jpeg: refactor some variables"), otherwise…
-
Medium 5.5
media: imx-jpeg: Set video drvdata before register video device
In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Set video drvdata before register video device The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() …
-
Medium 5.5
media: amphion: Set video drvdata before register video device
In the Linux kernel, the following vulnerability has been resolved: media: amphion: Set video drvdata before register video device The video drvdata should be set before the video device is registered, otherwise video_drvdata() may return NULL in the open() f…
-
Medium 5.5
media: qcom: camss: fix error path on configuration of power domains
In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: fix error path on configuration of power domains There is a chance to meet runtime issues during configuration of CAMSS power domains, because on the error path dev_pm_dom…
-
Medium 5.5
leds: class: Protect brightness_show() with led_cdev->led_access mutex
In the Linux kernel, the following vulnerability has been resolved: leds: class: Protect brightness_show() with led_cdev->led_access mutex There is NULL pointer issue observed if from Process A where hid device being added which results in adding a led_cdev a…
-
Medium 5.5
wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw()
In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() This patch fixes a NULL pointer dereference bug in brcmfmac that occurs when a high 'sd_sgentry_align' valu…
-
Medium 5.5
mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM
In the Linux kernel, the following vulnerability has been resolved: mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM We currently assume that there is at least one VMA in a MM, which isn't true. So we might end up having find_vma…
-
Medium 5.5
sched/numa: fix memory leak due to the overwritten vma->numab_state
In the Linux kernel, the following vulnerability has been resolved: sched/numa: fix memory leak due to the overwritten vma->numab_state [Problem Description] When running the hackbench program of LTP, the following memory leak is reported by kmemleak. # /opt/…
-
Medium 5.5
cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU
In the Linux kernel, the following vulnerability has been resolved: cacheinfo: Allocate memory during CPU hotplug if not done from the primary CPU Commit 5944ce092b97 ("arch_topology: Build cacheinfo from primary CPU") adds functionality that architectures ca…
-
Medium 5.5
pmdomain: imx: gpcv2: Adjust delay after power up handshake
In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx: gpcv2: Adjust delay after power up handshake The udelay(5) is not enough, sometimes below kernel panic still be triggered: [ 4.012973] Kernel panic - not syncing: Asynchronous …
-
Medium 5.5
scsi: ufs: core: sysfs: Prevent div by zero
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: sysfs: Prevent div by zero Prevent a division by 0 when monitoring is not enabled.
-
Medium 5.5
HID: wacom: fix when get product name maybe null pointer
In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix when get product name maybe null pointer Due to incorrect dev->product reporting by certain devices, null pointer dereferences occur when dev->product is empty, leading to pot…
-
Medium 5.5
gpio: grgpio: Add NULL check in grgpio_probe
In the Linux kernel, the following vulnerability has been resolved: gpio: grgpio: Add NULL check in grgpio_probe devm_kasprintf() can return a NULL pointer on failure,but this returned value in grgpio_probe is not checked. Add NULL check in grgpio_probe, to h…
-
Medium 5.5
ipv6: avoid possible NULL deref in modify_prefix_route()
In the Linux kernel, the following vulnerability has been resolved: ipv6: avoid possible NULL deref in modify_prefix_route() syzbot found a NULL deref [1] in modify_prefix_route(), caused by one fib6_info without a fib6_table pointer set. This can happen for …
-
Medium 5.5
net: Fix icmp host relookup triggering ip_rt_bug
In the Linux kernel, the following vulnerability has been resolved: net: Fix icmp host relookup triggering ip_rt_bug arp link failure may trigger ip_rt_bug while xfrm enabled, call trace is: WARNING: CPU: 0 PID: 0 at net/ipv4/route.c:1241 ip_rt_bug+0x14/0x20 …
-
Medium 5.5
net: hsr: avoid potential out-of-bound access in fill_frame_info()
In the Linux kernel, the following vulnerability has been resolved: net: hsr: avoid potential out-of-bound access in fill_frame_info() syzbot is able to feed a packet with 14 bytes, pretending it is a vlan one. Since fill_frame_info() is relying on skb->mac_l…
-
Medium 5.5
net: enetc: Do not configure preemptible TCs if SIs do not support
In the Linux kernel, the following vulnerability has been resolved: net: enetc: Do not configure preemptible TCs if SIs do not support Both ENETC PF and VF drivers share enetc_setup_tc_mqprio() to configure MQPRIO. And enetc_setup_tc_mqprio() calls enetc_chan…
-
Medium 5.5
ALSA: control: Avoid WARN() for symlink errors
In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Avoid WARN() for symlink errors Using WARN() for showing the error of symlink creations don't give more information than telling that something goes wrong, since the usual code…
-
Medium 5.5
net: lapb: increase LAPB_HEADER_LEN
In the Linux kernel, the following vulnerability has been resolved: net: lapb: increase LAPB_HEADER_LEN It is unclear if net/lapb code is supposed to be ready for 8021q. We can at least avoid crashes like the following : skbuff: skb_under_panic: text:ffffffff…
-
Medium 5.5
net/mlx5: DR, prevent potential error pointer dereference
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: DR, prevent potential error pointer dereference The dr_domain_add_vport_cap() function generally returns NULL on error but sometimes we want it to return ERR_PTR(-EBUSY) so the call…
-
Medium 5.5
bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog
In the Linux kernel, the following vulnerability has been resolved: bpf,perf: Fix invalid prog_array access in perf_event_detach_bpf_prog Syzbot reported [1] crash that happens for following tracing scenario: - create tracepoint perf event with attr.inherit=1…
-
Medium 5.5
drm/i915: Fix NULL pointer dereference in capture_engine
In the Linux kernel, the following vulnerability has been resolved: drm/i915: Fix NULL pointer dereference in capture_engine When the intel_context structure contains NULL, it raises a NULL pointer dereference error in drm_info(). (cherry picked from commit 7…
-
Medium 5.5
usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix the issue that gs_start_io crashed due to accessing null pointer Considering that in some extreme cases, when u_serial driver is accessed by multiple threads, Threa…
-
Medium 5.5
gpio: graniterapids: Fix vGPIO driver crash
In the Linux kernel, the following vulnerability has been resolved: gpio: graniterapids: Fix vGPIO driver crash Move setting irq_chip.name from probe() function to the initialization of "irq_chip" struct in order to fix vGPIO driver crash during bootup. Crash…
-
Medium 5.5
riscv: mm: Do not call pmd dtor on vmemmap page table teardown
In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Do not call pmd dtor on vmemmap page table teardown The vmemmap's, which is used for RV64 with SPARSEMEM_VMEMMAP, page tables are populated using pmd (page middle directory) hugeta…
-
Medium 5.5
drm/panel: himax-hx83102: Add a check to prevent NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: drm/panel: himax-hx83102: Add a check to prevent NULL pointer dereference drm_mode_duplicate() could return NULL due to lack of memory, which will then call NULL pointer dereference. Add a ch…
-
Medium 5.5
netdevsim: prevent bad user input in nsim_dev_health_break_write()
In the Linux kernel, the following vulnerability has been resolved: netdevsim: prevent bad user input in nsim_dev_health_break_write() If either a zero count or a large one is provided, kernel can crash.
-
Medium 5.5
PCI/MSI: Handle lack of irqdomain gracefully
In the Linux kernel, the following vulnerability has been resolved: PCI/MSI: Handle lack of irqdomain gracefully Alexandre observed a warning emitted from pci_msi_setup_msi_irqs() on a RISCV platform which does not provide PCI/MSI support: WARNING: CPU: 1 PID…
-
Medium 5.5
bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpf_get_smp_processor_id() on !CONFIG_SMP On x86-64 calling bpf_get_smp_processor_id() in a kernel with CONFIG_SMP disabled can trigger the following bug, as pcpu_hot is unavailable:…
-
Medium 5.5
net/sched: netem: account for backlog updates from child qdisc
In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: account for backlog updates from child qdisc In general, 'qlen' of any classful qdisc should keep track of the number of packets that the qdisc itself and all of its childre…
-
Medium 5.5
mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information These four chips: * W25N512GW * W25N01GW * W25N01JW * W25N02JW all require a single bit of ECC strength and thus feature …
-
Medium 5.5
kunit: Fix potential null dereference in kunit_device_driver_test()
In the Linux kernel, the following vulnerability has been resolved: kunit: Fix potential null dereference in kunit_device_driver_test() kunit_kzalloc() may return a NULL pointer, dereferencing it without NULL check may lead to NULL dereference. Add a NULL che…
-
Medium 5.5
btrfs: add a sanity check for btrfs root in btrfs_search_slot()
In the Linux kernel, the following vulnerability has been resolved: btrfs: add a sanity check for btrfs root in btrfs_search_slot() Syzbot reports a null-ptr-deref in btrfs_search_slot(). The reproducer is using rescue=ibadroots, and the extent tree root is c…
-
Medium 5.5
drm/sti: avoid potential dereference of error pointers
In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' in case of the failure.
-
Medium 5.5
drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state' …
-
Medium 5.5
drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
In the Linux kernel, the following vulnerability has been resolved: drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check The return value of drm_atomic_get_crtc_state() needs to be checked. To avoid use of error pointer 'crtc_state…
-
Medium 5.5
quota: flush quota_release_work upon quota writeback
In the Linux kernel, the following vulnerability has been resolved: quota: flush quota_release_work upon quota writeback One of the paths quota writeback is called from is: freeze_super() sync_filesystem() ext4_sync_fs() dquot_writeback_dquots() Since we curr…
-
Medium 5.5
ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration()
In the Linux kernel, the following vulnerability has been resolved: ACPI: x86: Add adev NULL check to acpi_quirk_skip_serdev_enumeration() acpi_dev_hid_match() does not check for adev == NULL, dereferencing it unconditional. Add a check for adev being NULL be…
-
Medium 5.5
netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_socket: remove WARN_ON_ONCE on maximum cgroup level cgroup maximum depth is INT_MAX by default, there is a cgroup toggle to restrict this maximum depth to a more reasonable val…
-
Medium 5.5
MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a
In the Linux kernel, the following vulnerability has been resolved: MIPS: Loongson64: DTS: Really fix PCIe port nodes for ls7a Fix the dtc warnings: arch/mips/boot/dts/loongson/ls7a-pch.dtsi:68.16-416.5: Warning (interrupt_provider): /bus@10000000/pci@1a00000…
-
Medium 5.5
soc: imx8m: Probe the SoC driver as platform driver
In the Linux kernel, the following vulnerability has been resolved: soc: imx8m: Probe the SoC driver as platform driver With driver_async_probe=* on kernel command line, the following trace is produced because on i.MX8M Plus hardware because the soc-imx8m.c d…
-
Medium 5.5
phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PM
In the Linux kernel, the following vulnerability has been resolved: phy: rockchip: samsung-hdptx: Set drvdata before enabling runtime PM In some cases, rk_hdptx_phy_runtime_resume() may be invoked before platform_set_drvdata() is executed in ->probe(), leadin…
-
Medium 5.5
scsi: megaraid_sas: Fix for a potential deadlock
In the Linux kernel, the following vulnerability has been resolved: scsi: megaraid_sas: Fix for a potential deadlock This fixes a 'possible circular locking dependency detected' warning CPU0 CPU1 ---- ---- lock(&instance->reset_mutex); lock(&shost->scan_mutex…
-
Medium 5.5
net: fix memory leak in tcp_conn_request()
In the Linux kernel, the following vulnerability has been resolved: net: fix memory leak in tcp_conn_request() If inet_csk_reqsk_queue_hash_add() return false, tcp_conn_request() will return without free the dst memory, which allocated in af_ops->route_req. H…
-
Medium 5.5
scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove()
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: pltfrm: Dellocate HBA during ufshcd_pltfrm_remove() This will ensure that the scsi host is cleaned up properly using scsi_host_dev_release(). Otherwise, it may lead to memory leaks.
-
Medium 5.5
mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy()
In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: don't call pfn_to_page() on possibly non-existent PFN in split_large_buddy() In split_large_buddy(), we might call pfn_to_page() on a PFN that might not exist. In corner cases,…
-
Medium 5.5
RDMA/uverbs: Prevent integer overflow issue
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wr…
-
Medium 5.5
misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling
In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling Resolve kernel panic caused by improper handling of IRQs while accessing GPIO values. This is done by replacing generi…
-
Medium 5.5
drm/amd/display: fix divide error in DM plane scale calcs
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix divide error in DM plane scale calcs dm_get_plane_scale doesn't take into account plane scaled size equal to zero, leading to a kernel oops due to division by zero. Fix b…
-
Medium 5.5
gve: guard XSK operations on the existence of queues
In the Linux kernel, the following vulnerability has been resolved: gve: guard XSK operations on the existence of queues This patch predicates the enabling and disabling of XSK pools on the existence of queues. As it stands, if the interface is down, disablin…
-
Medium 5.5
net/sctp: Prevent autoclose integer overflow in sctp_association_init()
In the Linux kernel, the following vulnerability has been resolved: net/sctp: Prevent autoclose integer overflow in sctp_association_init() While by default max_autoclose equals to INT_MAX / HZ, one may set net.sctp.max_autoclose to UINT_MAX. There is code in…
-
Medium 5.5
riscv: Fix sleeping in invalid context in die()
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix sleeping in invalid context in die() die() can be called in exception handler, and therefore cannot sleep. However, die() takes spinlock_t which can sleep with PREEMPT_RT enabled. …
-
Medium 5.5
iio: adc: ti-ads1298: Add NULL check in ads1298_init
In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1298: Add NULL check in ads1298_init devm_kasprintf() can return a NULL pointer on failure. A check on the return value of such a call in ads1298_init() is missing. Add it.
-
Medium 5.5
virtio-blk: don't keep queue frozen during system suspend
In the Linux kernel, the following vulnerability has been resolved: virtio-blk: don't keep queue frozen during system suspend Commit 4ce6e2db00de ("virtio-blk: Ensure no requests in virtqueues before deleting vqs.") replaces queue quiesce with queue freeze in…
-
Medium 5.5
cgroup/cpuset: remove kernfs active break
In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: remove kernfs active break A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs…
-
Medium 5.5
rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reas…
-
Medium 5.5
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different r…
-
Medium 5.5
sctp: sysctl: rto_min/max: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - I…
-
Medium 5.5
mptcp: sysctl: sched: avoid using current->nsproxy
In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: sched: avoid using current->nsproxy Using the 'net' structure via 'current' is not recommended for different reasons. First, if the goal is to use it to read or write per-netns…
-
Medium 5.5
drm/xe: Fix tlb invalidation when wedging
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix tlb invalidation when wedging If GuC fails to load, the driver wedges, but in the process it tries to do stuff that may not be initialized yet. This moves the xe_gt_tlb_invalidati…
-
Medium 5.5
net: hns3: fix kernel crash when 1588 is sent on HIP08 devices
In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL. But the tx process would still try to set …
-
Medium 5.5
btrfs: avoid NULL pointer dereference if no valid extent tree
In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid extent tree [BUG] Syzbot reported a crash with the following call trace: BTRFS info (device loop0): scrub: started on devid 1 BUG: kernel NUL…
-
Medium 4.7
iommu/arm-smmu: Defer probe of clients after smmu device bound
In the Linux kernel, the following vulnerability has been resolved: iommu/arm-smmu: Defer probe of clients after smmu device bound Null pointer dereference occurs due to a race between smmu driver probe and client driver probe, when of_dma_configure() for cli…
-
Medium 4.7
usb: gadget: f_fs: Remove WARN_ON in functionfs_bind
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind This commit addresses an issue related to below kernel panic where panic_on_warn is enabled. It is caused by the unnecessary use of WARN_O…
-
Medium 4.7
fgraph: Add READ_ONCE() when accessing fgraph_array[]
In the Linux kernel, the following vulnerability has been resolved: fgraph: Add READ_ONCE() when accessing fgraph_array[] In __ftrace_return_to_handler(), a loop iterates over the fgraph_array[] elements, which are fgraph_ops. The loop checks if an element is…
-
Low 3.3
media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
In the Linux kernel, the following vulnerability has been resolved: media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() The buffer in the loop should be released under the exception path, otherwise there may be a memory leak …
-
Low 3.3
dccp: Fix memory leak in dccp_feat_change_recv
In the Linux kernel, the following vulnerability has been resolved: dccp: Fix memory leak in dccp_feat_change_recv If dccp_feat_push_confirm() fails after new value for SP feature was accepted without reconciliation ('entry == NULL' branch), memory allocated …
-
Low 3.3
ceph: fix memory leak in ceph_direct_read_write()
In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_direct_read_write() The bvecs array which is allocated in iter_get_bvecs_alloc() is leaked and pages remain pinned if ceph_alloc_sparse_ext_map() fails. There is…
-
Low 3.3
udmabuf: fix memory leak on last export_udmabuf() error path
In the Linux kernel, the following vulnerability has been resolved: udmabuf: fix memory leak on last export_udmabuf() error path In export_udmabuf(), if dma_buf_fd() fails because the FD table is full, a dma_buf owning the udmabuf has already been created; bu…
-
Unscored —
sched: fix warning in sched_setaffinity
In the Linux kernel, the following vulnerability has been resolved: sched: fix warning in sched_setaffinity Commit 8f9ea86fdf99b added some logic to sched_setaffinity that included a WARN when a per-task affinity assignment races with a cpuset update. Specifi…
-
Unscored —
f2fs: fix to shrink read extent node in batches
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to shrink read extent node in batches We use rwlock to protect core structure data of extent tree during its shrink, however, if there is a huge number of extent nodes in extent tre…
-
Unscored —
stackdepot: fix stack_depot_save_flags() in NMI context
In the Linux kernel, the following vulnerability has been resolved: stackdepot: fix stack_depot_save_flags() in NMI context Per documentation, stack_depot_save_flags() was meant to be usable from NMI context if STACK_DEPOT_FLAG_CAN_ALLOC is unset. However, it…
-
Unscored —
igb: Fix potential invalid memory access in igb_init_module()
In the Linux kernel, the following vulnerability has been resolved: igb: Fix potential invalid memory access in igb_init_module() The pci_register_driver() can fail and when this happened, the dca_notifier needs to be unregistered, otherwise the dca_notifier …
-
Unscored —
ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init()
In the Linux kernel, the following vulnerability has been resolved: ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() Under certain kernel configurations when building with Clang/LLVM, the compiler does not generate a return or jump as t…
-
Unscored —
nvmet: Don't overflow subsysnqn
In the Linux kernel, the following vulnerability has been resolved: nvmet: Don't overflow subsysnqn nvmet_root_discovery_nqn_store treats the subsysnqn string like a fixed size buffer, even though it is dynamically allocated to the size of the string. Create …
-
Unscored —
regulator: axp20x: AXP717: set ramp_delay
In the Linux kernel, the following vulnerability has been resolved: regulator: axp20x: AXP717: set ramp_delay AXP717 datasheet says that regulator ramp delay is 15.625 us/step, which is 10mV in our case. Add a AXP_DESC_RANGES_DELAY macro and update AXP_DESC_R…
-
Unscored —
ceph: give up on paths longer than PATH_MAX
In the Linux kernel, the following vulnerability has been resolved: ceph: give up on paths longer than PATH_MAX If the full path to be built by ceph_mdsc_build_path() happens to be longer than PATH_MAX, then this function will enter an endless (retry) loop, e…
-
Unscored —
riscv: Fix IPIs usage in kfence_protect_page()
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix IPIs usage in kfence_protect_page() flush_tlb_kernel_range() may use IPIs to flush the TLBs of all the cores, which triggers the following warning when the irqs are disabled: [ 3.4…
-
Unscored —
nilfs2: prevent use of deleted inode
In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent use of deleted inode syzbot reported a WARNING in nilfs_rmdir. [1] Because the inode bitmap is corrupted, an inode with an inode number that should exist as a ".nilfs" file wa…
-
Unscored —
accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal()
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix WARN in ivpu_ipc_send_receive_internal() Move pm_runtime_set_active() to ivpu_pm_init() so when ivpu_ipc_send_receive_internal() is executed before ivpu_pm_enable() it already…
-
Unscored —
accel/ivpu: Fix general protection fault in ivpu_bo_list()
In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix general protection fault in ivpu_bo_list() Check if ctx is not NULL before accessing its fields.
-
Unscored —CVE-2024-54680 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
xfs: unlock inodes when erroring out of xfs_trans_alloc_dir
In the Linux kernel, the following vulnerability has been resolved: xfs: unlock inodes when erroring out of xfs_trans_alloc_dir Debugging a filesystem patch with generic/475 caused the system to hang after observing the following sequences in dmesg: XFS (dm-0…
-
Unscored —
KVM: x86: Play nice with protected guests in complete_hypercall_exit()
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Play nice with protected guests in complete_hypercall_exit() Use is_64_bit_hypercall() instead of is_64_bit_mode() to detect a 64-bit hypercall when completing said hypercall. For g…
-
Unscored —
net: tun: fix tun_napi_alloc_frags()
In the Linux kernel, the following vulnerability has been resolved: net: tun: fix tun_napi_alloc_frags() syzbot reported the following crash [1] Issue came with the blamed commit. Instead of going through all the iov components, we keep using the first one an…
-
Unscored —
s390/stacktrace: Use break instead of return statement
In the Linux kernel, the following vulnerability has been resolved: s390/stacktrace: Use break instead of return statement arch_stack_walk_user_common() contains a return statement instead of a break statement in case store_ip() fails while trying to store a …
-
Unscored —
mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation When compiling kernel source 'make -j $(nproc)' with the up-and-running KASAN-enabled kernel on…
-
Unscored —
i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
In the Linux kernel, the following vulnerability has been resolved: i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() if (dev->boardinfo && dev->boardinfo->init_dyn_addr) ^^^ here check "init_dyn_addr" i3c_bus_set_addr_slot_status(&master…
-
Unscored —
ceph: pass cred pointer to ceph_mds_auth_match()
In the Linux kernel, the following vulnerability has been resolved: ceph: pass cred pointer to ceph_mds_auth_match() This eliminates a redundant get_current_cred() call, because ceph_mds_check_access() has already obtained this pointer. As a side effect, this…
-
Unscored —
f2fs: fix to drop all discards after creating snapshot on lvm device
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to drop all discards after creating snapshot on lvm device Piergiorgio reported a bug in bugzilla as below: ------------[ cut here ]------------ WARNING: CPU: 2 PID: 969 at fs/f2fs/…
-
Unscored —
mm/slub: Avoid list corruption when removing a slab from the full list
In the Linux kernel, the following vulnerability has been resolved: mm/slub: Avoid list corruption when removing a slab from the full list Boot with slub_debug=UFPZ. If allocated object failed in alloc_consistency_checks, all objects of the slab will be marke…
-
Unscored —
ovl: Filter invalid inodes with missing lookup function
In the Linux kernel, the following vulnerability has been resolved: ovl: Filter invalid inodes with missing lookup function Add a check to the ovl_dentry_weird() function to prevent the processing of directory inodes that lack the lookup function. This is imp…
-
Unscored —
sched/deadline: Fix warning in migrate_enable for boosted tasks
In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix warning in migrate_enable for boosted tasks When running the following command: while true; do stress-ng --cyclic 30 --timeout 30s --minimize --quiet done a warning is eve…
-
Unscored —
io_uring/tctx: work around xa_store() allocation error issue
In the Linux kernel, the following vulnerability has been resolved: io_uring/tctx: work around xa_store() allocation error issue syzbot triggered the following WARN_ON: WARNING: CPU: 0 PID: 16 at io_uring/tctx.c:51 __io_uring_free+0xfa/0x140 io_uring/tctx.c:5…
-
Unscored —
f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode.
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix f2fs_bug_on when uninstalling filesystem call f2fs_evict_inode. creating a large files during checkpoint disable until it runs out of space and then delete it, then remount to enabl…
-
Unscored —
scsi: hisi_sas: Create all dump files during debugfs initialization
In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Create all dump files during debugfs initialization For the current debugfs of hisi_sas, after user triggers dump, the driver allocate memory space to save the register inform…
-
Unscored —
scsi: hisi_sas: Add cond_resched() for no forced preemption model
In the Linux kernel, the following vulnerability has been resolved: scsi: hisi_sas: Add cond_resched() for no forced preemption model For no forced preemption model kernel, in the scenario where the expander is connected to 12 high performance SAS SSDs, the f…
-
Unscored —
bpf: Call free_htab_elem() after htab_unlock_bucket()
In the Linux kernel, the following vulnerability has been resolved: bpf: Call free_htab_elem() after htab_unlock_bucket() For htab of maps, when the map is removed from the htab, it may hold the last reference of the map. bpf_map_fd_put_ptr() will invoke bpf_…
-
Unscored —
drm/amdgpu: set the right AMDGPU sg segment limitation
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: set the right AMDGPU sg segment limitation The driver needs to set the correct max_segment_size; otherwise debug_dma_map_sg() will complain about the over-mapping of the AMDGPU sg…
-
Unscored —
wifi: ath10k: avoid NULL pointer error during sdio remove
In the Linux kernel, the following vulnerability has been resolved: wifi: ath10k: avoid NULL pointer error during sdio remove When running 'rmmod ath10k', ath10k_sdio_remove() will free sdio workqueue by destroy_workqueue(). But if CONFIG_INIT_ON_FREE_DEFAULT…
-
Unscored —
wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask()
In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix atomic calls in ath12k_mac_op_set_bitrate_mask() When I try to manually set bitrates: iw wlan0 set bitrates legacy-2.4 1 I get sleeping from invalid context error, see below…
-
Unscored —
wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb
In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: use ieee80211_purge_tx_queue() to purge TX skb When removing kernel modules by: rmmod rtw88_8723cs rtw88_8703b rtw88_8723x rtw88_sdio rtw88_core Driver uses skb_queue_purge() to …
-
Unscored —
kcsan: Turn report_filterlist_lock into a raw_spinlock
In the Linux kernel, the following vulnerability has been resolved: kcsan: Turn report_filterlist_lock into a raw_spinlock Ran Xiaokai reports that with a KCSAN-enabled PREEMPT_RT kernel, we can see splats like: | BUG: sleeping function called from invalid co…
-
Unscored —
drm/dp_mst: Fix MST sideband message body length check
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix MST sideband message body length check Fix the MST sideband message body length check, which must be at least 1 byte accounting for the message body CRC (aka message data CRC)…
-
Unscored —
scsi: ufs: qcom: Only free platform MSIs when ESI is enabled
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: qcom: Only free platform MSIs when ESI is enabled Otherwise, it will result in a NULL pointer dereference as below: Unable to handle kernel NULL pointer dereference at virtual addr…
-
Unscored —
scsi: ufs: core: Cancel RTC work during ufshcd_remove()
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Cancel RTC work during ufshcd_remove() Currently, RTC work is only cancelled during __ufshcd_wl_suspend(). When ufshcd is removed in ufshcd_remove(), RTC work is not cancelle…
-
Unscored —
can: dev: can_set_termination(): allow sleeping GPIOs
In the Linux kernel, the following vulnerability has been resolved: can: dev: can_set_termination(): allow sleeping GPIOs In commit 6e86a1543c37 ("can: dev: provide optional GPIO based termination support") GPIO based termination support was added. For no par…
-
Unscored —
ocfs2: free inode when ocfs2_get_init_inode() fails
In the Linux kernel, the following vulnerability has been resolved: ocfs2: free inode when ocfs2_get_init_inode() fails syzbot is reporting busy inodes after unmount, for commit 9c89fe0af826 ("ocfs2: Handle error from dquot_initialize()") forgot to call iput(…
-
Unscored —
tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg
In the Linux kernel, the following vulnerability has been resolved: tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg The current sk memory accounting logic in __SK_REDIRECT is pre-uncharging tosend bytes, which is either msg->sg.size or a smaller val…
-
Unscored —
geneve: do not assume mac header is set in geneve_xmit_skb()
In the Linux kernel, the following vulnerability has been resolved: geneve: do not assume mac header is set in geneve_xmit_skb() We should not assume mac header is set in output path. Use skb_eth_hdr() instead of eth_hdr() to fix the issue. sysbot reported th…
-
Unscored —
netfilter: nft_inner: incorrect percpu area handling under softirq
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_inner: incorrect percpu area handling under softirq Softirq can interrupt ongoing packet from process context that is walking over the percpu area that contains inner header of…
-
Unscored —
net: hsr: must allocate more bytes for RedBox support
In the Linux kernel, the following vulnerability has been resolved: net: hsr: must allocate more bytes for RedBox support Blamed commit forgot to change hsr_init_skb() to allocate larger skb for RedBox case. Indeed, send_hsr_supervision_frame() will add two a…
-
Unscored —
net: netdevsim: fix nsim_pp_hold_write()
In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: fix nsim_pp_hold_write() nsim_pp_hold_write() has two problems: 1) It may return with rtnl held, as found by syzbot. 2) Its return value does not propagate an error if any.
-
Unscored —
ionic: no double destroy workqueue
In the Linux kernel, the following vulnerability has been resolved: ionic: no double destroy workqueue There are some FW error handling paths that can cause us to try to destroy the workqueue more than once, so let's be sure we're checking for that. The case …
-
Unscored —
btrfs: check folio mapping after unlock in relocate_one_folio()
In the Linux kernel, the following vulnerability has been resolved: btrfs: check folio mapping after unlock in relocate_one_folio() When we call btrfs_read_folio() to bring a folio uptodate, we unlock the folio. The result of that is that a different thread c…
-
Unscored —
x86/fred: Clear WFE in missing-ENDBRANCH #CPs
In the Linux kernel, the following vulnerability has been resolved: x86/fred: Clear WFE in missing-ENDBRANCH #CPs An indirect branch instruction sets the CPU indirect branch tracker (IBT) into WAIT_FOR_ENDBRANCH (WFE) state and WFE stays asserted across the i…
-
Unscored —
tracing: Prevent bad count for tracing_cpumask_write
In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent bad count for tracing_cpumask_write If a large count is provided, it will trigger a warning in bitmap_parse_user. Also check zero for it.
-
Unscored —
mtd: rawnand: fix double free in atmel_pmecc_create_user()
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: fix double free in atmel_pmecc_create_user() The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will …
-
Unscored —
dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset
In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_xdmac: avoid null_prt_deref in at_xdmac_prep_dma_memset The at_xdmac_memset_create_desc may return NULL, which will lead to a null pointer dereference. For example, the len inpu…
-
Unscored —
media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: dib3000mb: fix uninit-value in dib3000_write_reg Syzbot reports [1] an uninitialized value issue found by KMSAN in dib3000_read_reg(). Local u8 rb[2] is used in i2c_tran…
-
Unscored —CVE-2024-56781 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —CVE-2024-56786 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda-dai: Do not release the link DMA on STOP The linkDMA should not be released on stop trigger since a stream re-start might happen without closing of the stream. This leav…
-
Unscored —
btrfs: fix transaction atomicity bug when enabling simple quotas
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction atomicity bug when enabling simple quotas Set squota incompat bit before committing the transaction that enables the feature. With the config CONFIG_BTRFS_ASSERT enable…
-
Unscored —
PCI: imx6: Fix suspend/resume support on i.MX6QDL
In the Linux kernel, the following vulnerability has been resolved: PCI: imx6: Fix suspend/resume support on i.MX6QDL The suspend/resume functionality is currently broken on the i.MX6QDL platform, as documented in the NXP errata (ERR005723): https://www.nxp.c…
-
Unscored —
s390/entry: Mark IRQ entries to fix stack depot warnings
In the Linux kernel, the following vulnerability has been resolved: s390/entry: Mark IRQ entries to fix stack depot warnings The stack depot filters out everything outside of the top interrupt context as an uninteresting or irrelevant part of the stack traces…
-
Unscored —
Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()"
In the Linux kernel, the following vulnerability has been resolved: Revert "readahead: properly shorten readahead when falling back to do_page_cache_ra()" This reverts commit 7c877586da3178974a8a94577b6045a48377ff25. Anders and Philippe have reported that rec…
-
Unscored —
drm/dp_mst: Fix resetting msg rx state after topology removal
In the Linux kernel, the following vulnerability has been resolved: drm/dp_mst: Fix resetting msg rx state after topology removal If the MST topology is removed during the reception of an MST down reply or MST up request sideband message, the drm_dp_mst_topol…
-
Unscored —
Bluetooth: iso: Always release hdev at the end of iso_listen_bis
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: iso: Always release hdev at the end of iso_listen_bis Since hci_get_route holds the device before returning, the hdev should be released with hci_dev_put at the end of iso_listen_b…
-
Unscored —
ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array
In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: sof_sdw: Add space for a terminator into DAIs array The code uses the initialised member of the asoc_sdw_dailink struct to determine if a member of the array is in use. However i…
-
Unscored —
mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim()
In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() The task sometimes continues looping in throttle_direct_reclaim() because allow_direct_reclaim(pgdat) …
-
Unscored —
mm/kmemleak: fix sleeping function called from invalid context at print message
In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: fix sleeping function called from invalid context at print message Address a bug in the kernel that triggers a "sleeping function called from invalid context" warning when /sys/k…
-
Unscored —
mm/damon/core: fix new damon_target objects leaks on damon_commit_targets()
In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix new damon_target objects leaks on damon_commit_targets() Patch series "mm/damon/core: fix memory leaks and ignored inputs from damon_commit_ctx()". Due to two bugs in damon…
-
Unscored —
workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker
In the Linux kernel, the following vulnerability has been resolved: workqueue: Do not warn when cancelling WQ_MEM_RECLAIM work from !WQ_MEM_RECLAIM worker After commit 746ae46c1113 ("drm/sched: Mark scheduler work queues with WQ_MEM_RECLAIM") amdgpu started s…
-
Unscored —
pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking
In the Linux kernel, the following vulnerability has been resolved: pinctrl: mcp23s08: Fix sleeping in atomic context due to regmap locking If a device uses MCP23xxx IO expander to receive IRQs, the following bug can happen: BUG: sleeping function called from…
-
Unscored —CVE-2024-57894 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
drm/amdkfd: Correct the migration DMA map direction
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Correct the migration DMA map direction The SVM DMA device map direction should be set the same as the DMA unmap setting, otherwise the DMA core will report the following warning.…
-
Unscored —
wifi: cfg80211: clear link ID from bitmap during link delete after clean up
In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: clear link ID from bitmap during link delete after clean up Currently, during link deletion, the link ID is first removed from the valid_links bitmap before performing any cle…
-
Unscored —
net: restrict SO_REUSEPORT to inet sockets
In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_REUSEPORT to inet sockets After blamed commit, crypto sockets could accidentally be destroyed from RCU call back, as spotted by zyzbot [1]. Trying to acquire a mutex in RCU c…
-
Unscored —
iio: adc: at91: call input_free_device() on allocated iio_dev
In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91: call input_free_device() on allocated iio_dev Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached bef…
-
Unscored —
topology: Keep the cpumask unchanged when printing cpumap
In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the following warning was discovered: different return values (15 and 11) from vsnprintf("%*pbl ", ...) test:key…
-
Unscored —
fs: relax assertions on failure to encode file handles
In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of ex…
-
Unscored —
selinux: ignore unknown extended permissions
In the Linux kernel, the following vulnerability has been resolved: selinux: ignore unknown extended permissions When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be adde…
-
Unscored —
RDMA/hns: Fix accessing invalid dip_ctx during destroying QP
In the Linux kernel, the following vulnerability has been resolved: RDMA/hns: Fix accessing invalid dip_ctx during destroying QP If it fails to modify QP to RTR, dip_ctx will not be attached. And during detroying QP, the invalid dip_ctx pointer will be access…
-
Unscored —
exfat: fix the infinite loop in exfat_readdir()
In the Linux kernel, the following vulnerability has been resolved: exfat: fix the infinite loop in exfat_readdir() If the file system is corrupted so that a cluster is linked to itself in the cluster chain, and there is an unused directory entry in the clust…
-
Unscored —
x86/fpu: Ensure shadow stack is active before "getting" registers
In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state …
-
Unscored —CVE-2025-21633 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
netfs: Fix kernel async DIO
In the Linux kernel, the following vulnerability has been resolved: netfs: Fix kernel async DIO Netfslib needs to be able to handle kernel-initiated asynchronous DIO that is supplied with a bio_vec[] array. Currently, because of the async flag, this gets pass…
-
Unscored —
platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it
In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it Wakeup for IRQ1 should be disabled only in cases where i8042 had actually enabled it, otherwise "wake_depth" for…
-
Unscored —
netfilter: conntrack: clamp maximum hashtable size to INT_MAX
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof(…
-
Unscored —
net: hns3: don't auto enable misc vector
In the Linux kernel, the following vulnerability has been resolved: net: hns3: don't auto enable misc vector Currently, there is a time window between misc irq enabled and service task inited. If an interrupte is reported at this time, it will cause warning l…
-
Unscored —
net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute
In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSA…
-
Unscored —
ovl: support encoding fid from inode with no alias
In the Linux kernel, the following vulnerability has been resolved: ovl: support encoding fid from inode with no alias Dmitry Safonov reported that a WARN_ON() assertion can be trigered by userspace when calling inotify_show_fdinfo() for an overlayfs watched …
-
Unscored —
hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur
In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur scsi_execute_cmd() function can return both negative (linux codes) and positive (scsi_cmnd result field) error code…
-
Unscored —
ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix unexpectedly changed path in ksmbd_vfs_kern_path_locked When `ksmbd_vfs_kern_path_locked` met an error and it is not the last entry, it will exit without restoring changed path buf…
-
Unscored —
net/mlx5: Fix variable not being completed when function returns
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix variable not being completed when function returns When cmd_alloc_index(), fails cmd_work_handler() needs to complete ent->slotted before returning early. Otherwise the task whi…
-
Unscored —
seccomp: passthrough uretprobe systemcall without filtering
In the Linux kernel, the following vulnerability has been resolved: seccomp: passthrough uretprobe systemcall without filtering When attaching uretprobes to processes running inside docker, the attached process is segfaulted when encountering the retprobe. Th…
References
-
report
https://ubuntu.com/security/CVE-2024-36476
-
report
https://ubuntu.com/security/CVE-2024-39282
-
report
https://ubuntu.com/security/CVE-2024-41932
-
report
https://ubuntu.com/security/CVE-2024-41935
-
report
https://ubuntu.com/security/CVE-2024-43098
-
report
https://ubuntu.com/security/CVE-2024-45828
-
report
https://ubuntu.com/security/CVE-2024-47141
-
report
https://ubuntu.com/security/CVE-2024-47143
-
report
https://ubuntu.com/security/CVE-2024-47408
-
report
https://ubuntu.com/security/CVE-2024-47794
-
report
https://ubuntu.com/security/CVE-2024-47809
-
report
https://ubuntu.com/security/CVE-2024-48873
-
report
https://ubuntu.com/security/CVE-2024-48875
-
report
https://ubuntu.com/security/CVE-2024-48876
-
report
https://ubuntu.com/security/CVE-2024-48881
-
report
https://ubuntu.com/security/CVE-2024-49568
-
report
https://ubuntu.com/security/CVE-2024-49569
-
report
https://ubuntu.com/security/CVE-2024-49571
-
report
https://ubuntu.com/security/CVE-2024-50051
-
report
https://ubuntu.com/security/CVE-2024-51729
-
report
https://ubuntu.com/security/CVE-2024-52319
-
report
https://ubuntu.com/security/CVE-2024-52332
-
report
https://ubuntu.com/security/CVE-2024-53179
-
report
https://ubuntu.com/security/CVE-2024-53680
-
report
https://ubuntu.com/security/CVE-2024-53681
-
report
https://ubuntu.com/security/CVE-2024-53682
-
report
https://ubuntu.com/security/CVE-2024-53685
-
report
https://ubuntu.com/security/CVE-2024-53687
-
report
https://ubuntu.com/security/CVE-2024-53690
-
report
https://ubuntu.com/security/CVE-2024-54191
-
report
https://ubuntu.com/security/CVE-2024-54193
-
report
https://ubuntu.com/security/CVE-2024-54455
-
report
https://ubuntu.com/security/CVE-2024-54460
-
report
https://ubuntu.com/security/CVE-2024-54680
-
report
https://ubuntu.com/security/CVE-2024-54683
-
report
https://ubuntu.com/security/CVE-2024-55639
-
report
https://ubuntu.com/security/CVE-2024-55641
-
report
https://ubuntu.com/security/CVE-2024-55642
-
report
https://ubuntu.com/security/CVE-2024-55881