Skip to content
OpenAdvisories
Medium WID-SEC-2024-0749 40 CVEs

Linux Kernel: Mehrere Schwachstellen

Published Apr 1, 2024 · Updated Oct 18, 2026 · Revision 131 · de-DE

Vendor: Broadcom Vendor: Debian Vendor: Dell Vendor: EMC Vendor: Fedora Vendor: IBM Vendor: Lenovo Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SolarWinds Vendor: SUSE Vendor: Ubuntu Product: Avamar Product: Brocade SANnav Product: Business Automation Workflow Product: Computer Product: Enterprise Linux Product: InfoSphere Guardium Product: Linux Product: Linux Product: Linux Product: Linux Product: Linux Product: NetWorker Product: PowerEdge Product: QRadar SIEM Product: Rocky Linux Product: Security Event Manager Product: Security Guardium +3 more

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service oder einen nicht näher spezifizierten Angriff durchzuführen.

Product

Linux ist ein verbreitetes Open Source Betriebssystem.

Vulnerabilities 40

  • Critical 9.1
    CVE-2024-26665

    tunnels: fix out of bounds access when building IPv6 PMTU error

    In the Linux kernel, the following vulnerability has been resolved: tunnels: fix out of bounds access when building IPv6 PMTU error If the ICMPv6 error is built from a non-linear skb we get the following splat, BUG: KASAN: slab-out-of-bounds in do_csum+0x220/…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.4
    CVE-2023-52629

    sh: push-switch: Reorder cleanup operations to avoid use-after-free bug

    In the Linux kernel, the following vulnerability has been resolved: sh: push-switch: Reorder cleanup operations to avoid use-after-free bug The original code puts flush_work() before timer_shutdown_sync() in switch_drv_remove(). Although we use flush_work() t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 8.2
    CVE-2023-52636

    libceph: just wait for more data to be available on the socket

    In the Linux kernel, the following vulnerability has been resolved: libceph: just wait for more data to be available on the socket A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the m…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26654

    ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs

    In the Linux kernel, the following vulnerability has been resolved: ALSA: sh: aica: reorder cleanup operations to avoid UAF bugs The dreamcastcard->timer could schedule the spu_dma_work and the spu_dma_work could also arm the dreamcastcard->timer. When the sn…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26656

    drm/amdgpu: fix use-after-free bug

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix use-after-free bug The bug can be triggered by sending a single amdgpu_gem_userptr_ioctl to the AMDGPU DRM driver on any ASICs with an invalid address and size. The bug was re…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.8
    CVE-2024-26659

    xhci: handle isoc Babble and Buffer Overrun events properly

    In the Linux kernel, the following vulnerability has been resolved: xhci: handle isoc Babble and Buffer Overrun events properly xHCI 4.9 explicitly forbids assuming that the xHC has released its ownership of a multi-TRB TD when it reports an error on one of t…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26663

    tipc: Check the bearer type before calling tipc_udp_nl_bearer_add()

    In the Linux kernel, the following vulnerability has been resolved: tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() syzbot reported the following general protection fault [1]: general protection fault, probably for non-canonical address 0x…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.8
    CVE-2024-26664

    hwmon: (coretemp) Fix out-of-bounds memory access

    In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix out-of-bounds memory access Fix a bug that pdata->cpu_map[] is set before out-of-bounds check. The problem might be triggered on systems with more than 128 cores per pac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2024-26666

    wifi: mac80211: fix RCU use in TDLS fast-xmit

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix RCU use in TDLS fast-xmit This looks up the link under RCU protection, but isn't guaranteed to actually have protection. Fix that.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • High 7.1
    CVE-2024-26672

    drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()'

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()' Fixes the below: drivers/gpu/drm/amd/amdgpu/amdgpu_mca.c:377 amdgpu_mca_smu_get_mca_ent…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • High 7.0
    CVE-2024-26660

    drm/amd/display: Implement bounds check for stream encoder creation in DCN301

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Implement bounds check for stream encoder creation in DCN301 'stream_enc_regs' array is an array of dcn10_stream_enc_registers structures. The array is initialized with four …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2023-52631

    fs/ntfs3: Fix an NULL dereference bug

    In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_attr_list(). The "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow on a 64bit …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2024-26661

    drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()'

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add NULL test for 'timing generator' in 'dcn21_set_pipe()' In "u32 otg_inst = pipe_ctx->stream_res.tg->inst;" pipe_ctx->stream_res.tg could be NULL, it is relying on the call…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2024-26662

    drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()'

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix 'panel_cntl' could be null in 'dcn21_set_backlight_level()' 'panel_cntl' structure used to control the display panel could be null, dereferencing it could lead to a null …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Medium 5.5
    CVE-2024-26670

    arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD

    In the Linux kernel, the following vulnerability has been resolved: arm64: entry: fix ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD Currently the ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD workaround isn't quite right, as it is supposed to be applied after the last …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Medium 5.5
    CVE-2024-26676

    af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC.

    In the Linux kernel, the following vulnerability has been resolved: af_unix: Call kfree_skb() for dead unix_(sk)->oob_skb in GC. syzbot reported a warning [0] in __unix_gc() with a repro, which creates a socketpair and sends one socket's fd to itself using th…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52630 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

    linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu
  • Unscored —
    CVE-2023-52632

    drm/amdkfd: Fix lock dependency warning with srcu

    In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix lock dependency warning with srcu ====================================================== WARNING: possible circular locking dependency detected 6.5.0-kfd-yangp #2289 Not taint…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2023-52633

    um: time-travel: fix time corruption

    In the Linux kernel, the following vulnerability has been resolved: um: time-travel: fix time corruption In 'basic' time-travel mode (without =inf-cpu or =ext), we still get timer interrupts. These can happen at arbitrary points in time, i.e. while in timer_r…

    Linux Linux linux-azure linux-gcp Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52634

    drm/amd/display: Fix disable_otg_wa logic

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix disable_otg_wa logic [Why] When switching to another HDMI mode, we are unnecesarilly disabling/enabling FIFO causing both HPO and DIG registers to be set at the same time…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2023-52635

    PM / devfreq: Synchronize devfreq_monitor_[start/stop]

    In the Linux kernel, the following vulnerability has been resolved: PM / devfreq: Synchronize devfreq_monitor_[start/stop] There is a chance if a frequent switch of the governor done in a loop result in timer list corruption where timer cancel being done from…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26653

    usb: misc: ljca: Fix double free in error handling path

    In the Linux kernel, the following vulnerability has been resolved: usb: misc: ljca: Fix double free in error handling path When auxiliary_device_add() returns error and then calls auxiliary_device_uninit(), callback function ljca_auxdev_release calls kfree(a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26655

    Fix memory leak in posix_clock_open()

    In the Linux kernel, the following vulnerability has been resolved: Fix memory leak in posix_clock_open() If the clk ops.open() function returns an error, we don't release the pccontext we allocated for this clock. Re-organize the code slightly to make it all…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26657

    drm/sched: fix null-ptr-deref in init entity

    In the Linux kernel, the following vulnerability has been resolved: drm/sched: fix null-ptr-deref in init entity The bug can be triggered by sending an amdgpu_cs_wait_ioctl to the AMDGPU DRM driver on any ASICs with valid context. The bug was reported by Joon…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26658

    bcachefs: grab s_umount only if snapshotting

    In the Linux kernel, the following vulnerability has been resolved: bcachefs: grab s_umount only if snapshotting When I was testing mongodb over bcachefs with compression, there is a lockdep warning when snapshotting mongodb data volume. $ cat test.sh prog=bc…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26667

    drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup

    In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: check for valid hw_pp in dpu_encoder_helper_phys_cleanup The commit 8b45a26f2ba9 ("drm/msm/dpu: reserve cdm blocks for writeback in case of YUV output") introduced a smatch warni…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26668

    netfilter: nft_limit: reject configurations that cause integer overflow

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_limit: reject configurations that cause integer overflow Reject bogus configs where internal token counter wraps around. This only occurs with very very large requests, such as…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26669

    net/sched: flower: Fix chain template offload

    In the Linux kernel, the following vulnerability has been resolved: net/sched: flower: Fix chain template offload When a qdisc is deleted from a net device the stack instructs the underlying driver to remove its flow offload callback from the associated filte…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-26671

    blk-mq: fix IO hang from sbitmap wakeup race

    In the Linux kernel, the following vulnerability has been resolved: blk-mq: fix IO hang from sbitmap wakeup race In blk_mq_mark_tag_wait(), __add_wait_queue() may be re-ordered with the following blk_mq_get_driver_tag() in case of getting driver tag failure. …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-26673

    netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations

    In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations - Disallow families other than NFPROTO_{IPV4,IPV6,INET}. - Disallow layer 4 protocol with no ports, since dest…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26674

    x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups

    In the Linux kernel, the following vulnerability has been resolved: x86/lib: Revert to _ASM_EXTABLE_UA() for {get,put}_user() fixups During memory error injection test on kernels >= v6.4, the kernel panics like below. However, this issue couldn't be reproduce…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26675

    ppp_async: limit MRU to 64K

    In the Linux kernel, the following vulnerability has been resolved: ppp_async: limit MRU to 64K syzbot triggered a warning [1] in __alloc_pages(): WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp) Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit M…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26677

    rxrpc: Fix delayed ACKs to not set the reference serial number

    In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix delayed ACKs to not set the reference serial number Fix the construction of delayed ACKs to not set the reference serial number as they can't be used as an RTT reference.

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-26678

    x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section

    In the Linux kernel, the following vulnerability has been resolved: x86/efistub: Use 1:1 file:memory mapping for PE/COFF .compat section The .compat section is a dummy PE section that contains the address of the 32-bit entrypoint of the 64-bit kernel image if…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26679

    inet: read sk->sk_family once in inet_recv_error()

    In the Linux kernel, the following vulnerability has been resolved: inet: read sk->sk_family once in inet_recv_error() inet_recv_error() is called without holding the socket lock. IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM socket option and trigger a…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26680

    net: atlantic: Fix DMA mapping for PTP hwts ring

    In the Linux kernel, the following vulnerability has been resolved: net: atlantic: Fix DMA mapping for PTP hwts ring Function aq_ring_hwts_rx_alloc() maps extra AQ_CFG_RXDS_DEF bytes for PTP HWTS ring but then generic aq_ring_free() does not take this into ac…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu Azure Linux
  • Unscored —
    CVE-2024-26681

    netdevsim: avoid potential loop in nsim_dev_trap_report_work()

    In the Linux kernel, the following vulnerability has been resolved: netdevsim: avoid potential loop in nsim_dev_trap_report_work() Many syzbot reports include the following trace [1] If nsim_dev_trap_report_work() can not grab the mutex, it should rearm itsel…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26682

    wifi: mac80211: improve CSA/ECSA connection refusal

    In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: improve CSA/ECSA connection refusal As mentioned in the previous commit, we pretty quickly found that some APs have ECSA elements stuck in their probe response, so using that …

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26683

    wifi: cfg80211: detect stuck ECSA element in probe resp

    In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: detect stuck ECSA element in probe resp We recently added some validation that we don't try to connect to an AP that is currently in a channel switch process, since that might…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2024-26684

    net: stmmac: xgmac: fix handling of DPP safety error for DMA channels

    In the Linux kernel, the following vulnerability has been resolved: net: stmmac: xgmac: fix handling of DPP safety error for DMA channels Commit 56e58d6c8a56 ("net: stmmac: Implement Safety Features in XGMAC core") checks and reports safety errors, but leaves…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #131

    Neue Updates von Debian aufgenommen

  2. #130

    Neue Updates von Oracle Linux aufgenommen

  3. #129

    Neue Updates von Oracle Linux aufgenommen

  4. #128

    Neue Updates von Oracle Linux aufgenommen

  5. #127

    Neue Updates von SUSE aufgenommen

  6. #126

    Neue Updates von SUSE aufgenommen

  7. #125

    Neue Updates von SUSE aufgenommen

  8. #124

    Neue Updates von SUSE aufgenommen

  9. #123

    Neue Updates von SUSE aufgenommen

  10. #122

    Neue Updates von SUSE aufgenommen

  11. #121

    Neue Updates von SUSE aufgenommen

  12. #120

    Neue Updates von SUSE aufgenommen

  13. #119

    Neue Updates von SUSE aufgenommen

  14. #118

    Neue Updates von SUSE aufgenommen

  15. #117

    Neue Updates von Red Hat aufgenommen

  16. #116

    Neue Updates von Red Hat aufgenommen

  17. #115

    Neue Updates aufgenommen

  18. #114

    Neue Updates von Red Hat aufgenommen

  19. #113

    Neue Updates von SUSE aufgenommen

  20. #112

    Neue Updates von Debian aufgenommen

  21. #111

    Neue Updates von Debian aufgenommen

  22. #110

    Neue Updates von LENOVO aufgenommen

  23. #109

    Neue Updates von Dell aufgenommen

  24. #108

    Neue Updates von BROCADE aufgenommen

  25. #107

    Neue Updates von Ubuntu aufgenommen

References