Summary
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder sonstige Auswirkungen zu verursachen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 167
-
Critical 9.8
net: esp: fix bad handling of pages from page_pool
In the Linux kernel, the following vulnerability has been resolved: net: esp: fix bad handling of pages from page_pool When the skb is reorganized during esp_output (!esp->inline), the pages coming from the original skb fragments are supposed to be released b…
-
Critical 9.8
SUNRPC: fix some memleaks in gssx_dec_option_array
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix some memleaks in gssx_dec_option_array The creds and oa->data need to be freed in the error-handling paths after their allocation. So this patch add these deallocations in the cor…
-
High 8.8
scsi: qla2xxx: Fix command flush on cable pull
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix command flush on cable pull System crash due to command failed to flush back to SCSI layer. BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 PGD 0 …
-
High 8.8
KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Write-protect L2 SPTEs in TDP MMU when clearing dirty status Check kvm_mmu_page_ad_need_write_protect() when deciding whether to write-protect or clear D-bits on TDP MMU SPTEs, …
-
High 8.8
wifi: wilc1000: fix RCU usage in connect path
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RCU usage in connect path With lockdep enabled, calls to the connect function from cfg802.11 layer lead to the following warning: ============================= WARNING: su…
-
High 8.4
crypto: iaa - Fix nr_cpus < nr_iaa case
In the Linux kernel, the following vulnerability has been resolved: crypto: iaa - Fix nr_cpus < nr_iaa case If nr_cpus < nr_iaa, the calculated cpus_per_iaa will be 0, which causes a divide-by-0 in rebalance_wq_table(). Make sure cpus_per_iaa is 1 in that cas…
-
High 8.3
ksmbd: fix potencial out-of-bounds when buffer offset is invalid
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potencial out-of-bounds when buffer offset is invalid I found potencial out-of-bounds when buffer offset fields of a few requests is invalid. This patch set the minimum value of bu…
-
High 8.2
ksmbd: validate request buffer size in smb2_allocate_rsp_buf()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate request buffer size in smb2_allocate_rsp_buf() The response buffer should be allocated in smb2_allocate_rsp_buf before validating request. But the fields in payload as well as…
-
High 8.2
ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in smb2_allocate_rsp_buf If ->ProtocolId is SMB2_TRANSFORM_PROTO_NUM, smb2 request size validation could be skipped. if request size is smaller than sizeof(struc…
-
High 8.2
netfilter: br_netfilter: skip conntrack input hook for promisc packets
In the Linux kernel, the following vulnerability has been resolved: netfilter: br_netfilter: skip conntrack input hook for promisc packets For historical reasons, when bridge device is in promisc mode, packets that are directed to the taps follow bridge input…
-
High 8.1
ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16()
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds in smb_strndup_from_utf16() If ->NameOffset of smb2_create_req is smaller than Buffer offset of smb2_create_req, slab-out-of-bounds read can happen from smb2_ope…
-
High 7.8
usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd()
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: fix double-free issue in tcpm_port_unregister_pd() When unregister pd capabilitie in tcpm, KASAN will capture below double -free issue. The root cause is the same capabiliti…
-
High 7.8
drm/i915/vma: Fix UAF on destroy against retire race
In the Linux kernel, the following vulnerability has been resolved: drm/i915/vma: Fix UAF on destroy against retire race Object debugging tools were sporadically reporting illegal attempts to free a still active i915 VMA object when parking a GT believed to b…
-
High 7.8
btrfs: zoned: fix use-after-free in do_zone_finish()
In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix use-after-free in do_zone_finish() Shinichiro reported the following use-after-free triggered by the device replace operation in fstests btrfs/070. BTRFS info (device nullb1…
-
High 7.8
wireguard: netlink: access device through ctx instead of peer
In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: access device through ctx instead of peer The previous commit fixed a bug that led to a NULL peer->device being dereferenced. It's actually easier and faster performance-w…
-
High 7.8
wireguard: netlink: check for dangling peer via is_dead instead of empty list
In the Linux kernel, the following vulnerability has been resolved: wireguard: netlink: check for dangling peer via is_dead instead of empty list If all peers are removed via wg_peer_remove_all(), rather than setting peer_list to empty, the peer is added to a…
-
High 7.8
s390/zcrypt: fix reference counting on zcrypt card objects
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: fix reference counting on zcrypt card objects Tests with hot-plugging crytpo cards on KVM guests with debug kernel build revealed an use after free for the load field of the stru…
-
High 7.8
nfs: fix UAF in direct writes
In the Linux kernel, the following vulnerability has been resolved: nfs: fix UAF in direct writes In production we have been hitting the following warning consistently ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1…
-
High 7.8
clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-apq8084: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays wher…
-
High 7.8
crypto: qat - resolve race condition during AER recovery
In the Linux kernel, the following vulnerability has been resolved: crypto: qat - resolve race condition during AER recovery During the PCI AER system's error recovery process, the kernel driver may encounter a race condition with freeing the reset_data struc…
-
High 7.8
KVM: Always flush async #PF workqueue when vCPU is being destroyed
In the Linux kernel, the following vulnerability has been resolved: KVM: Always flush async #PF workqueue when vCPU is being destroyed Always flush the per-vCPU async #PF workqueue when a vCPU is clearing its completion queue, e.g. when a VM and all its vCPUs…
-
High 7.8
bootconfig: use memblock_free_late to free xbc memory to buddy
In the Linux kernel, the following vulnerability has been resolved: bootconfig: use memblock_free_late to free xbc memory to buddy On the time to free xbc memory in xbc_exit(), memblock may has handed over memory to buddy allocator. So it doesn't make sense t…
-
High 7.8
speakup: Avoid crash on very long word
In the Linux kernel, the following vulnerability has been resolved: speakup: Avoid crash on very long word In case a console is set up really large and contains a really long word (> 256 characters), we have to stop before the length of the word buffer.
-
High 7.8
usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb ep transport error When ncm function is working and then stop usb0 interface for link down, eth_stop() is called. At this piont, ac…
-
High 7.8
interconnect: Don't access req_list while it's being manipulated
In the Linux kernel, the following vulnerability has been resolved: interconnect: Don't access req_list while it's being manipulated The icc_lock mutex was split into separate icc_lock and icc_bw_lock mutexes in [1] to avoid lockdep splats. However, this didn…
-
High 7.8
userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE
In the Linux kernel, the following vulnerability has been resolved: userfaultfd: change src_folio after ensuring it's unpinned in UFFDIO_MOVE Commit d7a08838ab74 ("mm: userfaultfd: fix unexpected change to src_folio when UFFDIO_MOVE fails") moved the src_foli…
-
High 7.8
netfilter: nf_tables: restore set elements when delete set fails
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: restore set elements when delete set fails From abort path, nft_mapelem_activate() needs to restore refcounters to the original state. Currently, it uses the set->ops->w…
-
High 7.8
netfilter: nft_set_pipapo: walk over current view on netlink dump
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: walk over current view on netlink dump The generation mask can be updated while netlink dump is in progress. The pipapo set backend walk iterator cannot rely on it …
-
High 7.8
netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() nft_unregister_obj() can concurrent with __nft_obj_type_get(), and there is not any protection when iterate over nf_table…
-
High 7.8
netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() nft_unregister_expr() can concurrent with __nft_expr_type_get(), and there is not any protection when iterate over nf_ta…
-
High 7.8
fork: defer linking file vma until vma is fully initialized
In the Linux kernel, the following vulnerability has been resolved: fork: defer linking file vma until vma is fully initialized Thorvald reported a WARNING [1]. And the root cause is below race: CPU 1 CPU 2 fork hugetlbfs_fallocate dup_mmap hugetlbfs_punch_ho…
-
High 7.8
octeontx2-af: Use separate handlers for interrupts
In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: Use separate handlers for interrupts For PF to AF interrupt vector and VF to AF vector same interrupt handler is registered which is causing race condition. When two interrupts …
-
High 7.8
f2fs: compress: fix to cover normal cluster write with cp_rwsem
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to cover normal cluster write with cp_rwsem When we overwrite compressed cluster w/ normal cluster, we should not unlock cp_rwsem during f2fs_write_raw_pages(), otherwise …
-
High 7.8
media: edia: dvbdev: fix a use-after-free
In the Linux kernel, the following vulnerability has been resolved: media: edia: dvbdev: fix a use-after-free In dvb_register_device, *pdvbdev is set equal to dvbdev, which is freed in several error-handling paths. However, *pdvbdev is not set to NULL after d…
-
High 7.8
libbpf: Use OPTS_SET() macro in bpf_xdp_query()
In the Linux kernel, the following vulnerability has been resolved: libbpf: Use OPTS_SET() macro in bpf_xdp_query() When the feature_flags and xdp_zc_max_segs fields were added to the libbpf bpf_xdp_query_opts, the code writing them did not use the OPTS_SET()…
-
High 7.8
wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work
In the Linux kernel, the following vulnerability has been resolved: wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work The workqueue might still be running, when the driver is stopped. To avoid a use-after-free, call cancel_work_sync() in rtl8xxxu_stop().
-
High 7.8
wifi: iwlwifi: mvm: ensure offloading TID queue exists
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: ensure offloading TID queue exists The resume code path assumes that the TX queue for the offloading TID has been configured. At resume time it then tries to sync the writ…
-
High 7.8
tmpfs: fix race on handling dquot rbtree
In the Linux kernel, the following vulnerability has been resolved: tmpfs: fix race on handling dquot rbtree A syzkaller reproducer found a race while attempting to remove dquot information from the rb tree. Fetching the rb_tree root node must also be protect…
-
High 7.8
crypto: sun8i-ce - Fix use after free in unprepare
In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce - Fix use after free in unprepare sun8i_ce_cipher_unprepare should be called before crypto_finalize_skcipher_request, because client callbacks may immediately free memory, th…
-
High 7.8
nouveau: lock the client object tree.
In the Linux kernel, the following vulnerability has been resolved: nouveau: lock the client object tree. It appears the client object tree has no locking unless I've missed something else. Fix races around adding/removing client objects, mostly vram bar mapp…
-
High 7.8
media: ttpci: fix two memleaks in budget_av_attach
In the Linux kernel, the following vulnerability has been resolved: media: ttpci: fix two memleaks in budget_av_attach When saa7146_register_device and saa7146_vv_init fails, budget_av_attach should free the resources it allocates, like the error-handling of …
-
High 7.8
pstore: inode: Only d_invalidate() is needed
In the Linux kernel, the following vulnerability has been resolved: pstore: inode: Only d_invalidate() is needed Unloading a modular pstore backend with records in pstorefs would trigger the dput() double-drop warning: WARNING: CPU: 0 PID: 2569 at fs/dcache.c…
-
High 7.8
nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse()
In the Linux kernel, the following vulnerability has been resolved: nvme: host: fix double-free of struct nvme_id_ns in ns_update_nuse() When nvme_identify_ns() fails, it frees the pointer to the struct nvme_id_ns before it returns. However, ns_update_nuse() …
-
High 7.5
vmxnet3: Fix missing reserved tailroom
In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix missing reserved tailroom Use rbi->len instead of rcd->len for non-dataring packet. Found issue: XDP_WARN: xdp_update_frame_from_buff(line:278): Driver BUG: missing reserved tail…
-
High 7.5
virtio: packed: fix unmap leak for indirect desc table
In the Linux kernel, the following vulnerability has been resolved: virtio: packed: fix unmap leak for indirect desc table When use_dma_api and premapped are true, then the do_unmap is false. Because the do_unmap is false, vring_unmap_extra_packed is not call…
-
High 7.3
clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: mmcc-msm8974: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays wher…
-
High 7.3
clk: qcom: camcc-sc8280xp: fix terminating of frequency table arrays
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: camcc-sc8280xp: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays wh…
-
High 7.3
clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq9574: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where…
-
High 7.3
clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq8074: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where…
-
High 7.3
clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq5018: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where…
-
High 7.3
KVM: x86/pmu: Disable support for adaptive PEBS
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/pmu: Disable support for adaptive PEBS Drop support for virtualizing adaptive PEBS, as KVM's implementation is architecturally broken without an obvious/easy path forward, and becaus…
-
High 7.3
f2fs: compress: fix to guarantee persisting compressed blocks by CP
In the Linux kernel, the following vulnerability has been resolved: f2fs: compress: fix to guarantee persisting compressed blocks by CP If data block in compressed cluster is not persisted with metadata during checkpoint, after SPOR, the data may be corrupted…
-
High 7.1
In the Linux kernel through 6.9, an untrusted hypervisor can inject virtual interrupts 0 and 14 at any point in time an…
-
High 7.1
netfilter: flowtable: validate pppoe header
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: validate pppoe header Ensure there is sufficient room to access the protocol field of the PPPoe header. Validate it once before the flowtable lookup, then use a helper f…
-
High 7.1
drm/amdgpu: fix mmhub client id out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix mmhub client id out-of-bounds access Properly handle cid 0x140.
-
High 7.1
f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid use-after-free issue in f2fs_filemap_fault syzbot reports a f2fs bug as below: BUG: KASAN: slab-use-after-free in f2fs_filemap_fault+0xd1/0x2c0 fs/f2fs/file.c:49 Read of si…
-
High 7.0
scsi: qla2xxx: Fix double free of the ha->vp_map pointer
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix double free of the ha->vp_map pointer Coverity scan reported potential risk of double free of the pointer ha->vp_map. ha->vp_map was freed in qla2x00_mem_alloc(), and again…
-
High 7.0
mm: swap: fix race between free_swap_and_cache() and swapoff()
In the Linux kernel, the following vulnerability has been resolved: mm: swap: fix race between free_swap_and_cache() and swapoff() There was previously a theoretical window where swapoff() could run and teardown a swap_info_struct while a call to free_swap_an…
-
High 7.0
mac802154: fix llsec key resources release in mac802154_llsec_key_del
In the Linux kernel, the following vulnerability has been resolved: mac802154: fix llsec key resources release in mac802154_llsec_key_del mac802154_llsec_key_del() can free resources of a key directly without following the RCU rules for waiting before the end…
-
High 7.0
drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' Tell snprintf() to store at most 10 bytes in the output buffer instead of 30. Fixes the below: drivers/gpu/drm/amd…
-
Medium 6.5
In the Linux kernel before 6.9, an untrusted hypervisor can inject virtual interrupt 29 (#VC) at any point in time and …
-
Medium 6.5
spi: spi-mt65xx: Fix NULL pointer access in interrupt handler
In the Linux kernel, the following vulnerability has been resolved: spi: spi-mt65xx: Fix NULL pointer access in interrupt handler The TX buffer in spi_transfer can be a NULL pointer, so the interrupt handler may end up writing to the invalid memory and cause …
-
Medium 6.3
f2fs: fix to avoid potential panic during recovery
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid potential panic during recovery During recovery, if FAULT_BLOCK is on, it is possible that f2fs_reserve_new_block() will return -ENOSPC during recovery, then it may trigger…
-
Medium 5.5
powerpc/pseries: Fix potential memleak in papr_get_attr()
In the Linux kernel, the following vulnerability has been resolved: powerpc/pseries: Fix potential memleak in papr_get_attr() `buf` is allocated in papr_get_attr(), and krealloc() of `buf` could fail. We need to free the original `buf` in the case of failure.
-
Medium 5.5
SUNRPC: fix a memleak in gss_import_v2_context
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gss_import_v2_context The ctx->mech_used.data allocated by kmemdup is not freed in neither gss_import_v2_context nor it only caller gss_krb5_import_sec_context, which…
-
Medium 5.5
drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed The driver creates /sys/kernel/debug/dri/0/mob_ttm even when the corresponding ttm_resource_manager is not allocated. This…
-
Medium 5.5
net: phy: qcom: at803x: fix kernel panic with at8031_probe
In the Linux kernel, the following vulnerability has been resolved: net: phy: qcom: at803x: fix kernel panic with at8031_probe On reworking and splitting the at803x driver, in splitting function of at803x PHYs it was added a NULL dereference bug where priv is…
-
Medium 5.5
nilfs2: fix failure to detect DAT corruption in btree and direct mappings
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix failure to detect DAT corruption in btree and direct mappings Patch series "nilfs2: fix kernel bug at submit_bh_wbc()". This resolves a kernel BUG reported by syzbot. Since there …
-
Medium 5.5
clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays
In the Linux kernel, the following vulnerability has been resolved: clk: qcom: gcc-ipq6018: fix terminating of frequency table arrays The frequency table arrays are supposed to be terminated with an empty element. Add such entry to the end of the arrays where…
-
Medium 5.5
pci_iounmap(): Fix MMIO mapping leak
In the Linux kernel, the following vulnerability has been resolved: pci_iounmap(): Fix MMIO mapping leak The #ifdef ARCH_HAS_GENERIC_IOPORT_MAP accidentally also guards iounmap(), which means MMIO mappings are leaked. Move the guard so we call iounmap() for M…
-
Medium 5.5
nouveau: fix instmem race condition around ptr stores
In the Linux kernel, the following vulnerability has been resolved: nouveau: fix instmem race condition around ptr stores Running a lot of VK CTS in parallel against nouveau, once every few hours you might see something like this crash. BUG: kernel NULL point…
-
Medium 5.5
KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes
In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: x86: Don't overflow lpage_info when checking attributes Fix KVM_SET_MEMORY_ATTRIBUTES to not overflow lpage_info array and trigger KASAN splat, as seen in the private_mem_conver…
-
Medium 5.5
clk: zynq: Prevent null pointer dereference caused by kmalloc failure
In the Linux kernel, the following vulnerability has been resolved: clk: zynq: Prevent null pointer dereference caused by kmalloc failure The kmalloc() in zynq_clk_setup() will return null if the physical memory has run out. As a result, if we use snprintf() …
-
Medium 5.5
drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini()
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix NULL checks for adev->dm.dc in amdgpu_dm_fini() Since 'adev->dm.dc' in amdgpu_dm_fini() might turn out to be NULL before the call to dc_enable_dmub_notifications(), check…
-
Medium 5.5
s390/dasd: fix double module refcount decrement
In the Linux kernel, the following vulnerability has been resolved: s390/dasd: fix double module refcount decrement Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on t…
-
Medium 5.5
media: usbtv: Remove useless locks in usbtv_video_free()
In the Linux kernel, the following vulnerability has been resolved: media: usbtv: Remove useless locks in usbtv_video_free() Remove locks calls in usbtv_video_free() because are useless and may led to a deadlock as reported here: https://syzkaller.appspot.com…
-
Medium 4.7
drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()'
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add 'replay' NULL check in 'edp_set_replay_allow_active()' In the first if statement, we're checking if 'replay' is NULL. But in the second if statement, we're not checking i…
-
Unscored —
media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access
In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Check whether crossbar pad is non-NULL before access When translating source to sink streams in the crossbar subdev, the driver tries to locate the remote subdev connect…
-
Unscored —
drm/vmwgfx: Unmap the surface before resetting it on a plane state
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Unmap the surface before resetting it on a plane state Switch to a new plane state requires unreferencing of all held surfaces. In the work required for mob cursors the mapped sur…
-
Unscored —
drm/vkms: Avoid reading beyond LUT array
In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Avoid reading beyond LUT array When the floor LUT index (drm_fixp2int(lut_index) is the last index of the array the ceil LUT index will point to an entry beyond the array. Make sure…
-
Unscored —
drm/tegra: dsi: Add missing check for of_find_device_by_node
In the Linux kernel, the following vulnerability has been resolved: drm/tegra: dsi: Add missing check for of_find_device_by_node Add check for the return value of of_find_device_by_node() and return the error if it fails in order to avoid NULL pointer derefer…
-
Unscored —CVE-2023-52651 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
NTB: fix possible name leak in ntb_register_device()
In the Linux kernel, the following vulnerability has been resolved: NTB: fix possible name leak in ntb_register_device() If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in de…
-
Unscored —CVE-2024-26929 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
USB: core: Fix deadlock in port "disable" sysfs attribute
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in port "disable" sysfs attribute The show and store callback routines for the "disable" sysfs attribute file in port.c acquire the device lock for the port's parent h…
-
Unscored —
USB: core: Fix deadlock in usb_deauthorize_interface()
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix deadlock in usb_deauthorize_interface() Among the attribute file callback routines in drivers/usb/core/sysfs.c, the interface_authorized_store() function is the only one which …
-
Unscored —
scsi: core: Fix unremoved procfs host directory regression
In the Linux kernel, the following vulnerability has been resolved: scsi: core: Fix unremoved procfs host directory regression Commit fc663711b944 ("scsi: core: Remove the /proc/scsi/${proc_name} directory earlier") fixed a bug related to modules loading/unlo…
-
Unscored —
drm/i915/gt: Reset queue_priority_hint on parking
In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Reset queue_priority_hint on parking Originally, with strict in order execution, we could complete execution only when the queue was empty. Preempt-to-busy allows replacement of …
-
Unscored —
drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode()
In the Linux kernel, the following vulnerability has been resolved: drm/i915/bios: Tolerate devdata==NULL in intel_bios_encoder_supports_dp_dual_mode() If we have no VBT, or the VBT didn't declare the encoder in question, we won't have the 'devdata' for the e…
-
Unscored —
drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau
In the Linux kernel, the following vulnerability has been resolved: drm/dp: Fix divide-by-zero regression on DP MST unplug with nouveau Fix a regression when using nouveau and unplugging a StarTech MSTDP122DP DisplayPort 1.2 MST hub (the same regression does …
-
Unscored —
nouveau/dmem: handle kcalloc() allocation failure
In the Linux kernel, the following vulnerability has been resolved: nouveau/dmem: handle kcalloc() allocation failure The kcalloc() in nouveau_dmem_evict_chunk() will return null if the physical memory has run out. As a result, if we dereference src_pfns, dst…
-
Unscored —
kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address
In the Linux kernel, the following vulnerability has been resolved: kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address Read from an unsafe address with copy_from_kernel_nofault() in arch_adjust_kprobe_addr() because this function is used …
-
Unscored —
ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses
In the Linux kernel, the following vulnerability has been resolved: ARM: 9359/1: flush: check if the folio is reserved for no-mapping addresses Since commit a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memory map alignment") changes the sem…
-
Unscored —
drm/amd/display: Add a dc_state NULL check in dc_state_release
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add a dc_state NULL check in dc_state_release [How] Check wheather state is NULL before releasing it.
-
Unscored —
drm/amdgpu/pm: Fix NULL pointer dereference when get power limit
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm: Fix NULL pointer dereference when get power limit Because powerplay_table initialization is skipped under sriov case, We check and set default lower and upper OD value if power…
-
Unscored —
nilfs2: prevent kernel bug at submit_bh_wbc()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent kernel bug at submit_bh_wbc() Fix a bug where nilfs_get_block() returns a successful status when searching and inserting the specified block both fail inconsistently. If this …
-
Unscored —
Bluetooth: btnxpuart: Fix btnxpuart_close
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix btnxpuart_close Fix scheduling while atomic BUG in btnxpuart_close(), properly purge the transmit queue and free the receive skb. [ 10.973809] BUG: scheduling while …
-
Unscored —
dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape
In the Linux kernel, the following vulnerability has been resolved: dm-raid456, md/raid456: fix a deadlock for dm-raid456 while io concurrent with reshape For raid456, if reshape is still in progress, then IO across reshape position will wait for reshape to m…
-
Unscored —
usb: dwc3-am62: fix module unload/reload behavior
In the Linux kernel, the following vulnerability has been resolved: usb: dwc3-am62: fix module unload/reload behavior As runtime PM is enabled, the module can be runtime suspended when .remove() is called. Do a pm_runtime_get_sync() to make sure module is act…
-
Unscored —
usb: xhci: Add error handling in xhci_map_urb_for_dma
In the Linux kernel, the following vulnerability has been resolved: usb: xhci: Add error handling in xhci_map_urb_for_dma Currently xhci_map_urb_for_dma() creates a temporary buffer and copies the SG list to the new linear buffer. But if the kzalloc_node() fa…
-
Unscored —CVE-2024-26972 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
fat: fix uninitialized field in nostale filehandles
In the Linux kernel, the following vulnerability has been resolved: fat: fix uninitialized field in nostale filehandles When fat_encode_fh_nostale() encodes file handle without a parent it stores only first 10 bytes of the file handle. However the length of t…
-
Unscored —
powercap: intel_rapl: Fix a NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: powercap: intel_rapl: Fix a NULL pointer dereference A NULL pointer dereference is triggered when probing the MMIO RAPL driver on platforms with CPU ID not listed in intel_rapl_common CPU mod…
-
Unscored —
serial: max310x: fix NULL pointer dereference in I2C instantiation
In the Linux kernel, the following vulnerability has been resolved: serial: max310x: fix NULL pointer dereference in I2C instantiation When trying to instantiate a max14830 device from userspace: echo max14830 0x60 > /sys/bus/i2c/devices/i2c-2/new_device we g…
-
Unscored —CVE-2024-26979 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
nilfs2: fix OOB in nilfs_set_de_type
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfs_set_de_type The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses t…
-
Unscored —
Squashfs: check the inode number is not the invalid value of zero
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check the inode number is not the invalid value of zero Syskiller has produced an out of bounds access in fill_meta_index(). That out of bounds access is ultimately caused because t…
-
Unscored —
drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init
In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix bo leak in intel_fb_bo_framebuffer_init Add a unreference bo in the error path, to prevent leaking a bo ref. Return 0 on success to clarify the success path. (cherry picked from c…
-
Unscored —
drm/amdkfd: Fix memory leak in create_process failure
In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix memory leak in create_process failure Fix memory leak due to a leaked mmget reference on an error handling code path that is triggered when attempting to create KFD processes …
-
Unscored —
mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled
In the Linux kernel, the following vulnerability has been resolved: mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled When I did hard offline test with hugetlb pages, below deadlock occurs: ==============================================…
-
Unscored —
init/main.c: Fix potential static_command_line memory overflow
In the Linux kernel, the following vulnerability has been resolved: init/main.c: Fix potential static_command_line memory overflow We allocate memory of size 'xlen + strlen(boot_command_line) + 1' for static_command_line, but the strings copied into static_co…
-
Unscored —
arm64: hibernate: Fix level3 translation fault in swsusp_save()
In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: Fix level3 translation fault in swsusp_save() On arm64 machines, swsusp_save() faults if it attempts to access MEMBLOCK_NOMAP memory ranges. This can be reproduced in QEMU u…
-
Unscored —
fs: sysfs: Fix reference leak in sysfs_break_active_protection()
In the Linux kernel, the following vulnerability has been resolved: fs: sysfs: Fix reference leak in sysfs_break_active_protection() The sysfs_break_active_protection() routine has an obvious reference leak in its error path. If the call to kernfs_find_and_ge…
-
Unscored —
usb: typec: tcpm: Correct the PDO counting in pd_set
In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: Correct the PDO counting in pd_set Off-by-one errors happen because nr_snk_pdo and nr_src_pdo are incorrectly added one. The index of the loop is equal to the number of PDOs…
-
Unscored —
usb: dwc2: host: Fix dereference issue in DDMA completion flow.
In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: host: Fix dereference issue in DDMA completion flow. Fixed variable dereference issue in DDMA completion flow.
-
Unscored —
serial: core: Clearing the circular buffer before NULLifying it
In the Linux kernel, the following vulnerability has been resolved: serial: core: Clearing the circular buffer before NULLifying it The circular buffer is NULLified in uart_tty_port_shutdown() under the spin lock. However, the PM or other timer based callback…
-
Unscored —
serial/pmac_zilog: Remove flawed mitigation for rx irq flood
In the Linux kernel, the following vulnerability has been resolved: serial/pmac_zilog: Remove flawed mitigation for rx irq flood The mitigation was intended to stop the irq completely. That may be better than a hard lock-up but it turns out that you get a cra…
-
Unscored —
serial: mxs-auart: add spinlock around changing cts state
In the Linux kernel, the following vulnerability has been resolved: serial: mxs-auart: add spinlock around changing cts state The uart_handle_cts_change() function in serial_core expects the caller to hold uport->lock. For example, I have seen the below kerne…
-
Unscored —
comedi: vmk80xx: fix incomplete endpoint checking
In the Linux kernel, the following vulnerability has been resolved: comedi: vmk80xx: fix incomplete endpoint checking While vmk80xx does have endpoint checking implemented, some things can fall through the cracks. Depending on the hardware model, URBs can hav…
-
Unscored —
clk: mediatek: Do a runtime PM get on controllers during probe
In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: Do a runtime PM get on controllers during probe mt8183-mfgcfg has a mutual dependency with genpd during the probing stage, which leads to a deadlock in the following call stack…
-
Unscored —
clk: Get runtime PM before walking tree for clk_summary
In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree for clk_summary Similar to the previous commit, we should make sure that all devices are runtime resumed before printing the clk_summary through debugf…
-
Unscored —
clk: Get runtime PM before walking tree during disable_unused
In the Linux kernel, the following vulnerability has been resolved: clk: Get runtime PM before walking tree during disable_unused Doug reported [1] the following hung task: INFO: task swapper/0:1 blocked for more than 122 seconds. Not tainted 5.15.149-21875-g…
-
Unscored —
thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up()
In the Linux kernel, the following vulnerability has been resolved: thermal/debugfs: Add missing count increment to thermal_debug_tz_trip_up() The count field in struct trip_stats, representing the number of times the zone temperature was above the trip point…
-
Unscored —
drm: nv04: Fix out of bounds access
In the Linux kernel, the following vulnerability has been resolved: drm: nv04: Fix out of bounds access When Output Resource (dcb->or) value is assigned in fabricate_dcb_output(), there may be out of bounds access to dac_users array in case dcb->or is zero be…
-
Unscored —
s390/cio: fix race condition during online processing
In the Linux kernel, the following vulnerability has been resolved: s390/cio: fix race condition during online processing A race condition exists in ccw_device_set_online() that can cause the online process to fail, leaving the affected device in an inconsist…
-
Unscored —
net/sched: Fix mirred deadlock on device recursion
In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix mirred deadlock on device recursion When the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to self we hit a qdisc lock deadlock. See t…
-
Unscored —
netfilter: nf_tables: fix memleak in map from abort path
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: fix memleak in map from abort path The delete set command does not rely on the transaction object for element removal, therefore, a combination of delete element + delet…
-
Unscored —
tun: limit printing rate when illegal packet received by tun dev
In the Linux kernel, the following vulnerability has been resolved: tun: limit printing rate when illegal packet received by tun dev vhost_worker will call tun call backs to receive packets. If too many illegal packets arrives, tun_do_read will keep dumping p…
-
Unscored —
net/mlx5e: Prevent deadlock while disabling aRFS
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent deadlock while disabling aRFS When disabling aRFS under the `priv->state_lock`, any scheduled aRFS works are canceled using the `cancel_work_sync` function, which waits for…
-
Unscored —
netfilter: flowtable: incorrect pppoe tuple
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: incorrect pppoe tuple pppoe traffic reaching ingress path does not match the flowtable entry because the pppoe header is expected to be at the network header offset. Thi…
-
Unscored —
r8169: fix LED-related deadlock on module removal
In the Linux kernel, the following vulnerability has been resolved: r8169: fix LED-related deadlock on module removal Binding devm_led_classdev_register() to the netdev is problematic because on module removal we get a RTNL-related deadlock. Fix this by avoid…
-
Unscored —
md: Fix missing release of 'active_io' for flush
In the Linux kernel, the following vulnerability has been resolved: md: Fix missing release of 'active_io' for flush submit_flushes atomic_set(&mddev->flush_pending, 1); rdev_for_each_rcu(rdev, mddev) atomic_inc(&mddev->flush_pending); bi->bi_end_io = md_end_…
-
Unscored —
net/rds: fix WARNING in rds_conn_connect_if_down
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix WARNING in rds_conn_connect_if_down If connection isn't established yet, get_mr() will fail, trigger connection after get_mr().
-
Unscored —
nbd: null check for nla_nest_start
In the Linux kernel, the following vulnerability has been resolved: nbd: null check for nla_nest_start nla_nest_start() may fail and return NULL. Insert a check and set errno based on other call sites within the same source code.
-
Unscored —
dpll: fix dpll_xa_ref_*_del() for multiple registrations
In the Linux kernel, the following vulnerability has been resolved: dpll: fix dpll_xa_ref_*_del() for multiple registrations Currently, if there are multiple registrations of the same pin on the same dpll device, following warnings are observed: WARNING: CPU:…
-
Unscored —
NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt
In the Linux kernel, the following vulnerability has been resolved: NFS: Fix nfs_netfs_issue_read() xarray locking for writeback interrupt The loop inside nfs_netfs_issue_read() currently does not disable interrupts while iterating through pages in the xarray…
-
Unscored —
f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to remove unnecessary f2fs_bug_on() to avoid panic verify_blkaddr() will trigger panic once we inject fault into f2fs_is_valid_blkaddr(), fix to remove this unnecessary f2fs_bug_on(…
-
Unscored —
cifs: Fix writeback data corruption
In the Linux kernel, the following vulnerability has been resolved: cifs: Fix writeback data corruption cifs writeback doesn't correctly handle the case where cifs_extend_writeback() hits a point where it is considering an additional folio, but this would ove…
-
Unscored —
clk: Fix clk_core_get NULL dereference
In the Linux kernel, the following vulnerability has been resolved: clk: Fix clk_core_get NULL dereference It is possible for clk_core_get to dereference a NULL in the following sequence: clk_core_get() of_clk_get_hw_from_clkspec() __of_clk_get_hw_from_provid…
-
Unscored —
clk: hisilicon: hi3559a: Fix an erroneous devm_kfree()
In the Linux kernel, the following vulnerability has been resolved: clk: hisilicon: hi3559a: Fix an erroneous devm_kfree() 'p_clk' is an array allocated just before the for loop for all clk that need to be registered. It is incremented at each loop iteration.…
-
Unscored —CVE-2024-27042 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()'
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix potential NULL pointer dereferences in 'dcn10_set_output_transfer_func()' The 'stream' pointer is used in dcn10_set_output_transfer_func() before the check if 'stream' is…
-
Unscored —
nfp: flower: handle acti_netdevs allocation failure
In the Linux kernel, the following vulnerability has been resolved: nfp: flower: handle acti_netdevs allocation failure The kmalloc_array() in nfp_fl_lag_do_work() will return null, if the physical memory has run out. As a result, if we dereference the acti_n…
-
Unscored —
net: phy: fix phy_get_internal_delay accessing an empty array
In the Linux kernel, the following vulnerability has been resolved: net: phy: fix phy_get_internal_delay accessing an empty array The phy_get_internal_delay function could try to access to an empty array in the case that the driver is calling phy_get_internal…
-
Unscored —
wifi: brcm80211: handle pmk_op allocation failure
In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: handle pmk_op allocation failure The kzalloc() in brcmf_pmksa_v3_op() will return null if the physical memory has run out. As a result, if we dereference the null value, the …
-
Unscored —
wifi: mt76: mt7925e: fix use-after-free in free_irq()
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925e: fix use-after-free in free_irq() From commit a304e1b82808 ("[PATCH] Debug shared irqs"), there is a test to make sure the shared irq handler should be able to handle the …
-
Unscored —
cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value
In the Linux kernel, the following vulnerability has been resolved: cpufreq: brcmstb-avs-cpufreq: add check for cpufreq_cpu_get's return value cpufreq_cpu_get may return NULL. To avoid NULL-dereference check it and return 0 in case of error. Found by Linux Ve…
-
Unscored —CVE-2024-27055 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend When the system is suspended while audio is active, the sof_ipc4_pcm_hw_free() is invoked to reset the pipelines since d…
-
Unscored —
USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command
In the Linux kernel, the following vulnerability has been resolved: USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command The isd200 sub-driver in usb-storage uses the HEADS and SECTORS values in the ATA ID information to calculate cylinder and he…
-
Unscored —
thunderbolt: Fix NULL pointer dereference in tb_port_update_credits()
In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL pointer dereference in tb_port_update_credits() Olliver reported that his system crashes when plugging in Thunderbolt 1 device: BUG: kernel NULL pointer dereference, add…
-
Unscored —
leds: trigger: netdev: Fix kernel panic on interface rename trig notify
In the Linux kernel, the following vulnerability has been resolved: leds: trigger: netdev: Fix kernel panic on interface rename trig notify Commit d5e01266e7f5 ("leds: trigger: netdev: add additional specific link speed mode") in the various changes, reworked…
-
Unscored —
netfilter: nf_tables: Fix a memory leak in nf_tables_updchain
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: Fix a memory leak in nf_tables_updchain If nft_netdev_register_hooks() fails, the memory associated with nft_stats is not freed, causing a memory leak. This patch fixes …
-
Unscored —
netfilter: nf_tables: do not compare internal table flags on updates
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: do not compare internal table flags on updates Restore skipping transaction if table update does not modify flags.
-
Unscored —
xen/evtchn: avoid WARN() when unbinding an event channel
In the Linux kernel, the following vulnerability has been resolved: xen/evtchn: avoid WARN() when unbinding an event channel When unbinding a user event channel, the related handler might be called a last time in case the kernel was built with CONFIG_DEBUG_SH…
-
Unscored —
thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path
In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/mediatek/lvts_thermal: Fix a memory leak in an error handling path If devm_krealloc() fails, then 'efuse' is leaking. So free it to avoid a leak.
-
Unscored —
ovl: relax WARN_ON in ovl_verify_area()
In the Linux kernel, the following vulnerability has been resolved: ovl: relax WARN_ON in ovl_verify_area() syzbot hit an assertion in copy up data loop which looks like it is the result of a lower file whose size is being changed underneath overlayfs. This t…
-
Unscored —
backlight: hx8357: Fix potential NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: backlight: hx8357: Fix potential NULL pointer dereference The "im" pins are optional. Add missing check in the hx8357_probe().
-
Unscored —
media: go7007: fix a memleak in go7007_load_encoder
In the Linux kernel, the following vulnerability has been resolved: media: go7007: fix a memleak in go7007_load_encoder In go7007_load_encoder, bounce(i.e. go->boot_fw), is allocated without a deallocation thereafter. After the following call chain: saa7134_g…
-
Unscored —
media: dvb-frontends: avoid stack overflow warnings with clang
In the Linux kernel, the following vulnerability has been resolved: media: dvb-frontends: avoid stack overflow warnings with clang A previous patch worked around a KASAN issue in stv0367, now a similar problem showed up with clang: drivers/media/dvb-frontends…
-
Unscored —
media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak
In the Linux kernel, the following vulnerability has been resolved: media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak Free the memory allocated in v4l2_ctrl_handler_init on release.
-
Unscored —
media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-mem2mem: fix a memleak in v4l2_m2m_register_entity The entity->name (i.e. name) is allocated in v4l2_m2m_register_entity but isn't freed in its following error-handling paths. Thi…
-
Unscored —
media: v4l2-tpg: fix some memleaks in tpg_alloc
In the Linux kernel, the following vulnerability has been resolved: media: v4l2-tpg: fix some memleaks in tpg_alloc In tpg_alloc, resources should be deallocated in each and every error-handling paths, since they are allocated in for statements. Otherwise the…
-
Unscored —
iommu/vt-d: Fix NULL domain on device release
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix NULL domain on device release In the kdump kernel, the IOMMU operates in deferred_attach mode. In this mode, info->domain may not yet be assigned by the time the release_devic…
-
Unscored —
btrfs: fix race when detecting delalloc ranges during fiemap
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix race when detecting delalloc ranges during fiemap For fiemap we recently stopped locking the target extent range for the whole duration of the fiemap call, in order to avoid a dead…
-
Unscored —
ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: remove one synchronize_net() barrier in ipv6_mc_down() As discussed in the past (commit 2d3916f31891 ("ipv6: fix skb drops in igmp6_event_query() and igmp6_event_report()")) I th…
-
Unscored —
wifi: wilc1000: do not realloc workqueue everytime an interface is added
In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: do not realloc workqueue everytime an interface is added Commit 09ed8bfc5215 ("wilc1000: Rename workqueue from "WILC_wq" to "NETDEV-wq"") moved workqueue creation in wilc_netd…
Revision history
-
#239
Neue Updates von Oracle Linux aufgenommen
-
#238
Neue Updates von BROCADE aufgenommen
-
#237
Neue Updates von Ubuntu aufgenommen
-
#236
Neue Updates von Oracle Linux aufgenommen
-
#235
Neue Updates von Dell aufgenommen
-
#234
Neue Updates von Ubuntu aufgenommen
-
#233
Neue Updates von Ubuntu aufgenommen
-
#232
Neue Updates von Ubuntu aufgenommen
-
#231
Neue Updates von Ubuntu aufgenommen
-
#230
Neue Updates von Ubuntu aufgenommen
-
#229
Neue Updates von Ubuntu aufgenommen
-
#228
Neue Updates von Ubuntu aufgenommen
-
#227
Neue Updates von IBM aufgenommen
-
#226
Neue Updates von Siemens aufgenommen
-
#225
Neue Updates von Debian aufgenommen
-
#224
Neue Updates von Ubuntu aufgenommen
-
#223
Neue Updates von Ubuntu aufgenommen
-
#222
Neue Updates von IBM aufgenommen
-
#221
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#220
Neue Updates von Oracle Linux aufgenommen
-
#219
Neue Updates von Red Hat aufgenommen
-
#218
Neue Updates von SUSE aufgenommen
-
#217
Neue Updates von SUSE aufgenommen
-
#216
Neue Updates von SUSE aufgenommen
-
#215
Neue Updates von SUSE aufgenommen
References
-
SUSE Security Update SUSE-SU-2024:4234-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/B6RMLGICBLD3BNXSBS7J23W3GCEJMFJA/
-
SUSE Security Update SUSE-SU-2024:4236-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ODASOBSBN3UUGHNO44MK2K4MC35CPLXJ/
-
SUSE Security Update SUSE-SU-2024:4235-1 vom 2024-12-06
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LIMMCWFWYJUMJTABZZ7ZEYXOOVE5BZY7/
-
SUSE Security Update SUSE-SU-2024:4226-1 vom 2024-12-06
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019950.html
-
Ubuntu Security Notice USN-7159-1 vom 2024-12-12
https://ubuntu.com/security/notices/USN-7159-1
-
Ubuntu Security Notice USN-7156-1 vom 2024-12-12
https://ubuntu.com/security/notices/USN-7156-1
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7159-3
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7166-2
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-17
https://ubuntu.com/security/notices/USN-7159-2
-
SUSE Security Update SUSE-SU-2024:4367-1 vom 2024-12-17
https://lists.suse.com/pipermail/sle-security-updates/2024-December/020025.html
-
SUSE Security Update SUSE-SU-2024:4364-1 vom 2024-12-17
https://lists.suse.com/pipermail/sle-security-updates/2024-December/020019.html
-
Ubuntu Security Notice USN-7166-1 vom 2024-12-17
https://ubuntu.com/security/notices/USN-7166-1
-
Debian Security Advisory DLA-4008 vom 2025-01-03
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
-
IBM Security Bulletin 7180361 vom 2025-01-07
https://www.ibm.com/support/pages/node/7180361
-
SUSE Security Update SUSE-SU-2024:4266-1 vom 2024-12-09
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/RRJRAM3LFR4MNOHCFB2XIOS6OJUDNUPE/
-
SUSE Security Update SUSE-SU-2024:4318-1 vom 2024-12-13
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019999.html
-
SUSE Security Update SUSE-SU-2024:4314-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SARXL66CQHD5VSFG5PUBNBVBPVFUN4KT/
-
SUSE Security Update SUSE-SU-2024:4316-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/S4I5Z6ALCJLHTP25U3HMJHEXN4DR2USM/
-
SUSE Security Update SUSE-SU-2024:4315-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LQPWDP54GSTHYCV4CTCOE67D2ANVPPUW/
-
Ubuntu Security Notice USN-7195-1 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7195-1
-
Ubuntu Security Notice USN-7186-2 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7186-2
-
Ubuntu Security Notice USN-7194-1 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7194-1
-
Ubuntu Security Notice USN-7159-4 vom 2024-12-20
https://ubuntu.com/security/notices/USN-7159-4
-
Ubuntu Security Notice USN-7166-3 vom 2024-12-20
https://ubuntu.com/security/notices/USN-7166-3
-
Red Hat Security Advisory RHSA-2024:2627 vom 2024-05-01
https://access.redhat.com/errata/RHSA-2024:2627
-
Red Hat Security Advisory RHSA-2024:2628 vom 2024-05-01
https://access.redhat.com/errata/RHSA-2024:2628
-
Linux CVE Announce Mailing List CVE-2022-48669 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050131-CVE-2022-48669-15cf@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2023-52647 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050119-CVE-2023-52647-82e4@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2023-52648 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050122-CVE-2023-52648-4e0d@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2023-52649 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050109-CVE-2023-52649-4614@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2023-52650 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050109-CVE-2023-52650-e2d1@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2023-52651 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050110-CVE-2023-52651-5907@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2023-52652 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050131-CVE-2023-52652-9e84@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2023-52653 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050131-CVE-2023-52653-a5c2@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26929 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050122-CVE-2024-26929-07f0@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26930 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050122-CVE-2024-26930-4f3e@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26931 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26931-01d9@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26932 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26932-587d@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26933 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26933-c18d@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26934 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050123-CVE-2024-26934-e2fc@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26935 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050124-CVE-2024-26935-8b4e@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26936 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050141-CVE-2024-26936-0264@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26937 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050124-CVE-2024-26937-3d21@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26938 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050124-CVE-2024-26938-b3f9@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26939 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050124-CVE-2024-26939-5314@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26940 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050125-CVE-2024-26940-1785@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26941 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050125-CVE-2024-26941-7c68@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26942 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050125-CVE-2024-26942-2f72@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26943 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050125-CVE-2024-26943-9ea5@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26944 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050125-CVE-2024-26944-598c@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26945 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050126-CVE-2024-26945-bf47@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26946 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050126-CVE-2024-26946-ad5d@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26947 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050126-CVE-2024-26947-c9b8@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26948 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050126-CVE-2024-26948-43bb@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26949 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050127-CVE-2024-26949-cf74@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26950 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050127-CVE-2024-26950-4424@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26951 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050127-CVE-2024-26951-5cbe@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26952 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050127-CVE-2024-26952-7f65@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26953 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050128-CVE-2024-26953-8304@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26954 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050128-CVE-2024-26954-18d5@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26955 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050128-CVE-2024-26955-3205@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26956 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050128-CVE-2024-26956-94b7@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26957 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26957-9e6b@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26958 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26958-6c15@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26959 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26959-cbbc@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26960 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26960-ad6b@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26961 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050129-CVE-2024-26961-408d@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26962 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-26962-cbb0@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26963 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-26963-3eac@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26964 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-26964-54c8@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26965 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050130-CVE-2024-26965-a43f@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26966 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050131-CVE-2024-26966-1afc@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26967 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050131-CVE-2024-26967-3ccc@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26968 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050131-CVE-2024-26968-bd35@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26969 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050131-CVE-2024-26969-13cf@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26970 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050132-CVE-2024-26970-ad9a@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26971 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050132-CVE-2024-26971-6e28@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26972 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050132-CVE-2024-26972-bf6c@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26973 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050132-CVE-2024-26973-54a3@gregkh/T/
-
Linux CVE Announce Mailing List CVE-2024-26974 vom 2024-05-01
https://lore.kernel.org/linux-cve-announce/2024050132-CVE-2024-26974-13eb@gregkh/T/