Summary
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 95
-
Critical 9.8
tipc: improve size validations for received domain records
In the Linux kernel, the following vulnerability has been resolved: tipc: improve size validations for received domain records The function tipc_mon_rcv() allows a node to receive and process domain_record structs from peer nodes to track their views of the n…
-
Critical 9.8
SUNRPC: Fix loop termination condition in gss_free_in_token_pages()
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix loop termination condition in gss_free_in_token_pages() The in_token->pages[] array is not NULL terminated. This results in the following KASAN splat: KASAN: maybe wild-memory-acc…
-
High 8.1
net: amd-xgbe: Fix skb data length underflow
In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUG_ON() triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix th…
-
High 7.8
ASoC: codecs: wcd938x: fix incorrect used of portid
In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd938x: fix incorrect used of portid Mixer controls have the channel id in mixer->reg, which is not same as port id. port id should be derived from chan_info array. So fix this…
-
High 7.8
net: macsec: Fix offload support for NETDEV_UNREGISTER event
In the Linux kernel, the following vulnerability has been resolved: net: macsec: Fix offload support for NETDEV_UNREGISTER event Current macsec netdev notify handler handles NETDEV_UNREGISTER event by releasing relevant SW resources only, this causes resource…
-
High 7.8
net/smc: Forward wakeup to smc socket waitqueue after fallback
In the Linux kernel, the following vulnerability has been resolved: net/smc: Forward wakeup to smc socket waitqueue after fallback When we replace TCP with SMC and a fallback occurs, there may be some socket waitqueue entries remaining in smc socket->wq, such…
-
High 7.8
RDMA/ucma: Protect mc during concurrent multicast leaves
In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Protect mc during concurrent multicast leaves Partially revert the commit mentioned in the Fixes line to make sure that allocation and erasing multicast struct are locked. BUG: KAS…
-
High 7.8
IB/hfi1: Fix panic with larger ipoib send_queue_size
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix panic with larger ipoib send_queue_size When the ipoib send_queue_size is increased from the default the following panic happens: RIP: 0010:hfi1_ipoib_drain_tx_ring+0x45/0xf0 [hf…
-
High 7.8
btrfs: fix use-after-free after failure to create a snapshot
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free after failure to create a snapshot At ioctl.c:create_snapshot(), we allocate a pending snapshot structure and then attach it to the transaction's list of pending sna…
-
High 7.8
ALSA: hda: Fix UAF of leds class devs at unbinding
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-…
-
High 7.8
rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink()
In the Linux kernel, the following vulnerability has been resolved: rtnetlink: make sure to refresh master_dev/m_ops in __rtnl_newlink() While looking at one unrelated syzbot bug, I found the replay logic in __rtnl_newlink() to potentially trigger use-after-f…
-
High 7.8
net/smc: Transitional solution for clcsock race issue
In the Linux kernel, the following vulnerability has been resolved: net/smc: Transitional solution for clcsock race issue We encountered a crash in smc_setsockopt() and it is caused by accessing smc->clcsock after clcsock was released. BUG: kernel NULL pointe…
-
High 7.8
phylib: fix potential use-after-free
In the Linux kernel, the following vulnerability has been resolved: phylib: fix potential use-after-free Commit bafbdd527d56 ("phylib: Add device reset GPIO support") added call to phy_device_reset(phydev) after the put_device() call in phy_detach(). The comm…
-
High 7.8
rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev
In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdev struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_devic…
-
High 7.8
arm64: extable: fix load_unaligned_zeropad() reg indices
In the Linux kernel, the following vulnerability has been resolved: arm64: extable: fix load_unaligned_zeropad() reg indices In ex_handler_load_unaligned_zeropad() we erroneously extract the data and addr register indices from ex->type rather than ex->data. A…
-
High 7.8
drm/vmwgfx: Fix stale file descriptors on failed usercopy
In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fence_rep object will lead to a stale entry in the file descriptor table as put_unused_fd() won't release i…
-
High 7.8
efi: libstub: only free priv.runtime_map when allocated
In the Linux kernel, the following vulnerability has been resolved: efi: libstub: only free priv.runtime_map when allocated priv.runtime_map is only allocated when efi_novamap is not set. Otherwise, it is an uninitialized value. In the error path, it is freed…
-
High 7.8
netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() syzbot reported that nf_reinject() could be called without rcu_read_lock() : WARNING: suspicious RCU usage 6.9.0-…
-
High 7.8
tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
In the Linux kernel, the following vulnerability has been resolved: tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the maximum transfer length and the size of the tra…
-
High 7.8
fs/ntfs3: Use variable length array instead of fixed size
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use variable length array instead of fixed size Should fix smatch warning: ntfs_set_label() error: __builtin_memcpy() 'uni->name' too small (20 vs 256)
-
High 7.8
fuse: clear FR_SENT when re-adding requests into pending list
In the Linux kernel, the following vulnerability has been resolved: fuse: clear FR_SENT when re-adding requests into pending list The following warning was reported by lee bruce: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 8264 at fs/fuse/dev.c:…
-
High 7.8
usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind.
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_audio: Fix race condition use of controls after free during gadget unbind. Hang on to the control IDs instead of pointers since those are correctly handled with locks.
-
High 7.8
soundwire: cadence: fix invalid PDI offset
In the Linux kernel, the following vulnerability has been resolved: soundwire: cadence: fix invalid PDI offset For some reason, we add an offset to the PDI, presumably to skip the PDI0 and PDI1 which are reserved for BPT. This code is however completely wrong…
-
High 7.8
dma-mapping: benchmark: handle NUMA_NO_NODE correctly
In the Linux kernel, the following vulnerability has been resolved: dma-mapping: benchmark: handle NUMA_NO_NODE correctly cpumask_of_node() can be called for NUMA_NO_NODE inside do_map_benchmark() resulting in the following sanitizer report: UBSAN: array-inde…
-
High 7.5
net/mlx5e: Avoid field-overflowing memcpy()
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Avoid field-overflowing memcpy() In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intention…
-
High 7.5
block: Fix wrong offset in bio_truncate()
In the Linux kernel, the following vulnerability has been resolved: block: Fix wrong offset in bio_truncate() bio_truncate() clears the buffer outside of last block of bdev, however current bio_truncate() is using the wrong offset of page. So it can return th…
-
High 7.5
net: bridge: vlan: fix memory leak in __allowed_ingress
In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix memory leak in __allowed_ingress When using per-vlan state, if vlan snooping and stats are disabled, untagged or priority-tagged ingress frame will go to check pvid sta…
-
High 7.5
drm/amdgpu: Fix possible null pointer dereference
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix possible null pointer dereference abo->tbo.resource may be NULL in amdgpu_vm_bo_update.
-
High 7.3
KVM: arm64: Avoid consuming a stale esr value when SError occur
In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Avoid consuming a stale esr value when SError occur When any exception other than an IRQ occurs, the CPU updates the ESR_EL2 register with the exception syndrome. An SError may al…
-
High 7.3
enic: Validate length of nl attributes in enic_set_vf_port
In the Linux kernel, the following vulnerability has been resolved: enic: Validate length of nl attributes in enic_set_vf_port enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_…
-
High 7.1
ASoC: max9759: fix underflow in speaker_gain_control_put()
In the Linux kernel, the following vulnerability has been resolved: ASoC: max9759: fix underflow in speaker_gain_control_put() Check for negative values of "priv->gain" to prevent an out of bounds access. The concern is that these might come from the user via…
-
High 7.1
ASoC: hdmi-codec: Fix OOB memory accesses
In the Linux kernel, the following vulnerability has been resolved: ASoC: hdmi-codec: Fix OOB memory accesses Correct size of iec_status array by changing it to the size of status array of the struct snd_aes_iec958. This fixes out-of-bounds slab read accesses…
-
Medium 5.5
mm/kmemleak: avoid scanning potential huge holes
In the Linux kernel, the following vulnerability has been resolved: mm/kmemleak: avoid scanning potential huge holes When using devm_request_free_mem_region() and devm_memremap_pages() to add ZONE_DEVICE memory, if requested free mem region's end pfn were hug…
-
Medium 5.3
block: fix memory leak in disk_register_independent_access_ranges
In the Linux kernel, the following vulnerability has been resolved: block: fix memory leak in disk_register_independent_access_ranges kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add() If this function re…
-
Medium 5.3
usb: xhci-plat: fix crash when suspend if remote wake enable
In the Linux kernel, the following vulnerability has been resolved: usb: xhci-plat: fix crash when suspend if remote wake enable Crashed at i.mx8qm platform when suspend if enable remote wakeup Internal error: synchronous external abort: 96000210 [#1] PREEMPT…
-
Medium 5.3
KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN KVM_SET_CPUID{,2}
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Free kvm_cpuid_entry2 array on post-KVM_RUN KVM_SET_CPUID{,2} Free the "struct kvm_cpuid_entry2" array on successful post-KVM_RUN KVM_SET_CPUID{,2} to fix a memory leak, the callers…
-
Medium 5.3
ceph: properly put ceph_string reference after async create attempt
In the Linux kernel, the following vulnerability has been resolved: ceph: properly put ceph_string reference after async create attempt The reference acquired by try_prep_async_create is currently leaked. Ensure we put it.
-
Unscored —
isdn: cpai: check ctr->cnr to avoid array index out of bound
In the Linux kernel, the following vulnerability has been resolved: isdn: cpai: check ctr->cnr to avoid array index out of bound The cmtp_add_connection() would add a cmtp session to a controller and run a kernel thread to process cmtp. __module_get(THIS_MODU…
-
Unscored —
ext4: fix error handling in ext4_fc_record_modified_inode()
In the Linux kernel, the following vulnerability has been resolved: ext4: fix error handling in ext4_fc_record_modified_inode() Current code does not fully takes care of krealloc() error case, which could lead to silent memory corruption or a kernel bug. This…
-
Unscored —
perf/x86/intel/pt: Fix crash with stop filters in single-range mode
In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel/pt: Fix crash with stop filters in single-range mode Add a check for !buf->single before calling pt_buffer_region_size in a place where a missing check can cause a kernel crash…
-
Unscored —
bpf: Use VM_MAP instead of VM_ALLOC for ringbuf
In the Linux kernel, the following vulnerability has been resolved: bpf: Use VM_MAP instead of VM_ALLOC for ringbuf After commit 2fd3fb0be1d1 ("kasan, vmalloc: unpoison VM_ALLOC pages after mapping"), non-VM_ALLOC mappings will be marked as accessible in __ge…
-
Unscored —
scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe
In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Make bnx2fc_recv_frame() mp safe Running tests with a debug kernel shows that bnx2fc_recv_frame() is modifying the per_cpu lport stats counters in a non-mpsafe way. Just boot a …
-
Unscored —
drm: mxsfb: Fix NULL pointer dereference
In the Linux kernel, the following vulnerability has been resolved: drm: mxsfb: Fix NULL pointer dereference mxsfb should not ever dereference the NULL pointer which drm_atomic_get_new_bridge_state is allowed to return. Assume a fixed format instead.
-
Unscored —
net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work
In the Linux kernel, the following vulnerability has been resolved: net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work syzkaller was able to trigger a deadlock for NTF_MANAGED entries [0]: kworker/0:16/14617 is trying to acquire…
-
Unscored —
net: ieee802154: ca8210: Stop leaking skb's
In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: ca8210: Stop leaking skb's Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. We then leak the skb structure. Fr…
-
Unscored —
spi: uniphier: fix reference count leak in uniphier_spi_probe()
In the Linux kernel, the following vulnerability has been resolved: spi: uniphier: fix reference count leak in uniphier_spi_probe() The issue happens in several error paths in uniphier_spi_probe(). When either dma_get_slave_caps() or devm_spi_register_master(…
-
Unscored —
iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping() After commit e3beca48a45b ("irqdomain/treewide: Keep firmware node unconditionally allocated"). For tear down scenario, fn…
-
Unscored —
RDMA/siw: Fix refcounting leak in siw_create_qp()
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix refcounting leak in siw_create_qp() The atomic_inc() needs to be paired with an atomic_dec() on the error path.
-
Unscored —
IB/hfi1: Fix AIP early init panic
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix AIP early init panic An early failure in hfi1_ipoib_setup_rn() can lead to the following panic: BUG: unable to handle kernel NULL pointer dereference at 00000000000001b0 PGD 0 P4…
-
Unscored —
dma-buf: heaps: Fix potential spectre v1 gadget
In the Linux kernel, the following vulnerability has been resolved: dma-buf: heaps: Fix potential spectre v1 gadget It appears like nr could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory fr…
-
Unscored —
drm/nouveau: fix off by one in BIOS boundary checking
In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix off by one in BIOS boundary checking Bounds checking when parsing init scripts embedded in the BIOS reject access to the last byte. This causes driver initialization to fail …
-
Unscored —
btrfs: fix deadlock between quota disable and qgroup rescan worker
In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock between quota disable and qgroup rescan worker Quota disable ioctl starts a transaction before waiting for the qgroup rescan worker completes. However, this wait can be in…
-
Unscored —CVE-2022-48736 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —CVE-2022-48737 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
ASoC: ops: Reject out of bounds values in snd_soc_put_volsw()
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and r…
-
Unscored —
selinux: fix double free of cond_list on error paths
In the Linux kernel, the following vulnerability has been resolved: selinux: fix double free of cond_list on error paths On error path from cond_read_list() and duplicate_policydb_cond_list() the cond_list_destroy() gets called a second time in caller functio…
-
Unscored —
ovl: fix NULL pointer dereference in copy up warning
In the Linux kernel, the following vulnerability has been resolved: ovl: fix NULL pointer dereference in copy up warning This patch is fixing a NULL pointer dereference to get a recently introduced warning message working.
-
Unscored —
net/mlx5: Use del_timer_sync in fw reset flow of halting poll
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Use del_timer_sync in fw reset flow of halting poll Substitute del_timer() with del_timer_sync() in fw reset polling deactivation flow, in order to prevent a race condition which oc…
-
Unscored —
net/mlx5e: Fix handling of wrong devices during bond netevent
In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix handling of wrong devices during bond netevent Current implementation of bond netevent handler only check if the handled netdev is VF representor and it missing a check if the …
-
Unscored —
drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: invalid parameter check in dpu_setup_dspp_pcc The function performs a check on the "ctx" input parameter, however, it is used before the check. Initialize the "base" variable aft…
-
Unscored —
hwmon: (nct6775) Fix crash in clear_caseopen
In the Linux kernel, the following vulnerability has been resolved: hwmon: (nct6775) Fix crash in clear_caseopen Paweł Marciniak reports the following crash, observed when clearing the chassis intrusion alarm. BUG: kernel NULL pointer dereference, address: 00…
-
Unscored —
powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending
In the Linux kernel, the following vulnerability has been resolved: powerpc/perf: Fix power_pmu_disable to call clear_pmi_irq_pending only if PMI is pending Running selftest with CONFIG_PPC_IRQ_SOFT_MASK_DEBUG enabled in kernel triggered below warning: [ 172.…
-
Unscored —
powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06
In the Linux kernel, the following vulnerability has been resolved: powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 Johan reported the below crash with test_bpf on ppc64 e5500: test_bpf: #296 ALU_END_FROM_LE 64: 0x0123456789abcdef -> 0x674…
-
Unscored —
drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable The function performs a check on the "phy" input parameter, however, it is used before the check. Initialize the "dev" variable afte…
-
Unscored —
net: fix information leakage in /proc/net/ptype
In the Linux kernel, the following vulnerability has been resolved: net: fix information leakage in /proc/net/ptype In one net namespace, after creating a packet socket without binding it to a device, users in other net namespaces can observe the new `packet_…
-
Unscored —
scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put()
In the Linux kernel, the following vulnerability has been resolved: scsi: bnx2fc: Flush destroy_work queue before calling bnx2fc_interface_put() The bnx2fc_destroy() functions are removing the interface before calling destroy_work. This results multiple WARNi…
-
Unscored —
USB: core: Fix hang in usb_kill_urb by adding memory barriers
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix hang in usb_kill_urb by adding memory barriers The syzbot fuzzer has identified a bug in which processes hang waiting for usb_kill_urb() to return. It turns out the issue is no…
-
Unscored —
KVM: x86: Forcibly leave nested virt when SMM state is toggled
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Forcibly leave nested virt when SMM state is toggled Forcibly leave nested virtualization operation if userspace toggles SMM state via KVM_SET_VCPU_EVENTS or KVM_SYNC_X86_EVENTS. If…
-
Unscored —
KVM: LAPIC: Also cancel preemption timer during SET_LAPIC
In the Linux kernel, the following vulnerability has been resolved: KVM: LAPIC: Also cancel preemption timer during SET_LAPIC The below warning is splatting during guest reboot. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 1931 at arch/x86/kvm/x8…
-
Unscored —
drm/amd/display: Wrap dcn301_calculate_wm_and_dlg for FPU.
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wrap dcn301_calculate_wm_and_dlg for FPU. Mirrors the logic for dcn30. Cue lots of WARNs and some kernel panics without this fix.
-
Unscored —
tracing/histogram: Fix a potential memory leak for kstrdup()
In the Linux kernel, the following vulnerability has been resolved: tracing/histogram: Fix a potential memory leak for kstrdup() kfree() is missing on an error path to free the memory allocated by kstrdup(): p = param = kstrdup(data->params[i], GFP_KERNEL); S…
-
Unscored —
efi: runtime: avoid EFIv2 runtime services on Apple x86 machines
In the Linux kernel, the following vulnerability has been resolved: efi: runtime: avoid EFIv2 runtime services on Apple x86 machines Aditya reports [0] that his recent MacbookPro crashes in the firmware when using the variable services at runtime. The culprit…
-
Unscored —
bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack()
In the Linux kernel, the following vulnerability has been resolved: bpf: Guard against accessing NULL pt_regs in bpf_get_task_stack() task_pt_regs() can return NULL on powerpc for kernel threads. This is then used in __bpf_get_stack() to check for user mode, …
-
Unscored —
ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound
In the Linux kernel, the following vulnerability has been resolved: ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound Raw packet from PF_PACKET socket ontop of an IPv6-backed ipvlan device will hit WARN_ON_ONCE() in sk_mc_loop() through sch_direct_xm…
-
Unscored —
dma-mapping: benchmark: fix node id validation
In the Linux kernel, the following vulnerability has been resolved: dma-mapping: benchmark: fix node id validation While validating node ids in map_benchmark_ioctl(), node_possible() may be provided with invalid argument outside of [0,MAX_NUMNODES-1] range le…
-
Unscored —
net/sched: taprio: extend minimum interval restriction to entire cycle too
In the Linux kernel, the following vulnerability has been resolved: net/sched: taprio: extend minimum interval restriction to entire cycle too It is possible for syzbot to side-step the restriction imposed by the blamed commit in the Fixes: tag, because the t…
-
Unscored —
netfilter: tproxy: bail out if IP has been disabled on the device
In the Linux kernel, the following vulnerability has been resolved: netfilter: tproxy: bail out if IP has been disabled on the device syzbot reports: general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN …
-
Unscored —
net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Use mlx5_ipsec_rx_status_destroy to correctly delete status rules rx_create no longer allocates a modify_hdr instance that needs to be cleaned up. The mlx5_modify_header_dealloc cal…
-
Unscored —
null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues'
In the Linux kernel, the following vulnerability has been resolved: null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' Writing 'power' and 'submit_queues' concurrently will trigger kernel panic: Test script: modprobe null_blk nr_…
-
Unscored —
tracing/probes: fix error check in parse_btf_field()
In the Linux kernel, the following vulnerability has been resolved: tracing/probes: fix error check in parse_btf_field() btf_find_struct_member() might return NULL or an error via the ERR_PTR() macro. However, its caller in parse_btf_field() only checks for t…
-
Unscored —
net: relax socket state check at accept time.
In the Linux kernel, the following vulnerability has been resolved: net: relax socket state check at accept time. Christoph reported the following splat: WARNING: CPU: 1 PID: 772 at net/ipv4/af_inet.c:761 __inet_accept+0x1f4/0x4a0 Modules linked in: CPU: 1 PI…
-
Unscored —
drm/msm/dpu: Add callback function pointer check before its call
In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add callback function pointer check before its call In dpu_core_irq_callback_handler() callback function pointer is compared to NULL, but then callback function is unconditionall…
-
Unscored —
fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Use 64 bit variable to avoid 32 bit overflow For example, in the expression: vbo = 2 * vbo + skip
-
Unscored —
fs/ntfs3: Check 'folio' pointer for NULL
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Check 'folio' pointer for NULL It can be NULL if bmap is called.
-
Unscored —
stm class: Fix a double free in stm_register_device()
In the Linux kernel, the following vulnerability has been resolved: stm class: Fix a double free in stm_register_device() The put_device(&stm->dev) call will trigger stm_device_release() which frees "stm" so the vfree(stm) on the next line is a double free.
-
Unscored —
dmaengine: idxd: Avoid unnecessary destruction of file_ida
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Avoid unnecessary destruction of file_ida file_ida is allocated during cdev open and is freed accordingly during cdev release. This sequence is guaranteed by driver file oper…
-
Unscored —
watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
In the Linux kernel, the following vulnerability has been resolved: watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger When the cpu5wdt module is removing, the origin code uses del_timer() to de-activate the timer. If the timer handler is r…
-
Unscored —
iio: adc: PAC1934: fix accessing out of bounds array index
In the Linux kernel, the following vulnerability has been resolved: iio: adc: PAC1934: fix accessing out of bounds array index Fix accessing out of bounds array index for average current and voltage measurements. The device itself has only 4 channels, but in …
-
Unscored —
vfio/pci: fix potential memory leak in vfio_intx_enable()
In the Linux kernel, the following vulnerability has been resolved: vfio/pci: fix potential memory leak in vfio_intx_enable() If vfio_irq_ctx_alloc() failed will lead to 'name' memory leak.
-
Unscored —
serial: max3100: Update uart_driver_registered on driver removal
In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Update uart_driver_registered on driver removal The removal of the last MAX3100 device triggers the removal of the driver. However, code doesn't update the respective global …
-
Unscored —
serial: max3100: Lock port->lock when calling uart_handle_cts_change()
In the Linux kernel, the following vulnerability has been resolved: serial: max3100: Lock port->lock when calling uart_handle_cts_change() uart_handle_cts_change() has to be called with port lock taken, Since we run it in a separate work, the lock may not be …
-
Unscored —
f2fs: multidev: fix to recognize valid zero block address
In the Linux kernel, the following vulnerability has been resolved: f2fs: multidev: fix to recognize valid zero block address As reported by Yi Zhang in mailing list [1], kernel warning was catched during zbd/010 test as below: ./check zbd/010 zbd/010 (test g…
-
Unscored —
greybus: lights: check return of get_channel_from_mode
In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of get_channel_from_mode If channel for the given node is not found we return null from get_channel_from_mode. Make sure we validate the return pointer before us…
-
Unscored —
bpf: Allow delete from sockmap/sockhash only if update is allowed
In the Linux kernel, the following vulnerability has been resolved: bpf: Allow delete from sockmap/sockhash only if update is allowed We have seen an influx of syzkaller reports where a BPF program attached to a tracepoint triggers a locking rule violation by…
-
Unscored —
dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
In the Linux kernel, the following vulnerability has been resolved: dma-buf/sw-sync: don't enable IRQ from sync_print_obj() Since commit a6aa8fca4d79 ("dma-buf/sw-sync: Reduce irqsave/irqrestore from known context") by error replaced spin_unlock_irqrestore() …
Revision history
-
#89
Neue Updates von Red Hat aufgenommen
-
#88
Neue Updates von SUSE aufgenommen
-
#87
Neue Updates von SUSE aufgenommen
-
#86
Neue Updates von Debian aufgenommen
-
#85
Neue Updates von Dell aufgenommen
-
#84
Neue Updates von SUSE aufgenommen
-
#83
Neue Updates von SUSE aufgenommen
-
#82
Neue Updates von Dell aufgenommen
-
#81
Neue Updates von SUSE aufgenommen
-
#80
Neue Updates von IBM aufgenommen
-
#79
Neue Updates von Ubuntu aufgenommen
-
#78
Neue Updates von BROCADE aufgenommen
-
#77
Neue Updates von SUSE aufgenommen
-
#76
Neue Updates von SUSE aufgenommen
-
#75
Neue Updates von Ubuntu aufgenommen
-
#74
Neue Updates von Ubuntu aufgenommen
-
#73
Neue Updates von Ubuntu aufgenommen
-
#72
Neue Updates von Debian aufgenommen
-
#71
Neue Updates von Ubuntu aufgenommen
-
#70
Neue Updates von Ubuntu und SUSE aufgenommen
-
#69
Neue Updates von SUSE und Oracle Linux aufgenommen
-
#68
Neue Updates von Ubuntu, SUSE und Red Hat aufgenommen
-
#67
Neue Updates von SUSE aufgenommen
-
#66
Neue Updates von Ubuntu aufgenommen
-
#65
Neue Updates von Ubuntu aufgenommen
References
-
Ubuntu Security Notice USN-7159-1 vom 2024-12-12
https://ubuntu.com/security/notices/USN-7159-1
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-17
https://ubuntu.com/security/notices/USN-7159-2
-
SUSE Security Update SUSE-SU-2024:4364-1 vom 2024-12-17
https://lists.suse.com/pipermail/sle-security-updates/2024-December/020019.html
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7159-3
-
Red Hat Security Advisory RHSA-2024:11313 vom 2024-12-18
https://access.redhat.com/errata/RHSA-2024:11313
-
Ubuntu Security Notice USN-7159-2 vom 2024-12-18
https://ubuntu.com/security/notices/USN-7166-2
-
Ubuntu Security Notice USN-7166-1 vom 2024-12-17
https://ubuntu.com/security/notices/USN-7166-1
-
Debian Security Advisory DLA-4008 vom 2025-01-03
https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html
-
Ubuntu Security Notice USN-7144-1 vom 2024-12-09
https://ubuntu.com/security/notices/USN-7144-1
-
SUSE Security Update SUSE-SU-2024:4315-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/LQPWDP54GSTHYCV4CTCOE67D2ANVPPUW/
-
SUSE Security Update SUSE-SU-2024:4316-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/S4I5Z6ALCJLHTP25U3HMJHEXN4DR2USM/
-
SUSE Security Update SUSE-SU-2024:4318-1 vom 2024-12-13
https://lists.suse.com/pipermail/sle-security-updates/2024-December/019999.html
-
SUSE Security Update SUSE-SU-2024:4314-1 vom 2024-12-13
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/SARXL66CQHD5VSFG5PUBNBVBPVFUN4KT/
-
Ubuntu Security Notice USN-7194-1 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7194-1
-
Ubuntu Security Notice USN-7195-1 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7195-1
-
Ubuntu Security Notice USN-7186-2 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7186-2
-
Ubuntu Security Notice USN-7185-2 vom 2025-01-09
https://ubuntu.com/security/notices/USN-7185-2
-
Ubuntu Security Notice USN-7166-3 vom 2024-12-20
https://ubuntu.com/security/notices/USN-7166-3
-
Ubuntu Security Notice USN-7159-4 vom 2024-12-20
https://ubuntu.com/security/notices/USN-7159-4
-
SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18
https://lists.suse.com/pipermail/sle-security-updates/2024-December/020028.html
-
Oracle Linux Security Advisory ELSA-2024-12887 vom 2024-12-18
https://linux.oracle.com/errata/ELSA-2024-12887.html
-
SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/WFOJHFFEHK42VPQ6XLZWB77H5OEJ3FF4/
-
SUSE Security Update SUSE-SU-2024:4376-1 vom 2024-12-18
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WFOJHFFEHK42VPQ6XLZWB77H5OEJ3FF4/
-
Ubuntu Security Notice USN-7184-1 vom 2025-01-06
https://ubuntu.com/security/notices/USN-7184-1
-
Ubuntu Security Notice USN-7159-5 vom 2025-01-06
https://ubuntu.com/security/notices/USN-7159-5
-
Ubuntu Security Notice USN-7186-1 vom 2025-01-06
https://ubuntu.com/security/notices/USN-7186-1
-
Ubuntu Security Notice USN-7183-1 vom 2025-01-06
https://ubuntu.com/security/notices/USN-7183-1
-
Ubuntu Security Notice USN-7148-1 vom 2024-12-10
https://ubuntu.com/security/notices/USN-7148-1
-
Linux CVE Announcement CVE-2021-4439 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062001-CVE-2021-4439-59ce@gregkh/
-
Linux CVE Announcement CVE-2022-48711 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062053-CVE-2022-48711-4d4e@gregkh/
-
Linux CVE Announcement CVE-2022-48712 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062054-CVE-2022-48712-6289@gregkh/
-
Linux CVE Announcement CVE-2022-48713 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062054-CVE-2022-48713-6025@gregkh/
-
Linux CVE Announcement CVE-2022-48714 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062054-CVE-2022-48714-726f@gregkh/
-
Linux CVE Announcement CVE-2022-48715 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062055-CVE-2022-48715-dba4@gregkh/
-
Linux CVE Announcement CVE-2022-48716 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062055-CVE-2022-48716-7621@gregkh/
-
Linux CVE Announcement CVE-2022-48717 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062055-CVE-2022-48717-064d@gregkh/
-
Linux CVE Announcement CVE-2022-48718 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062056-CVE-2022-48718-1d94@gregkh/
-
Linux CVE Announcement CVE-2022-48719 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062056-CVE-2022-48719-4312@gregkh/
-
Linux CVE Announcement CVE-2022-48720 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062056-CVE-2022-48720-5541@gregkh/
-
Linux CVE Announcement CVE-2022-48721 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062056-CVE-2022-48721-3959@gregkh/
-
Linux CVE Announcement CVE-2022-48722 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062057-CVE-2022-48722-dc20@gregkh/
-
Linux CVE Announcement CVE-2022-48723 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062057-CVE-2022-48723-1347@gregkh/
-
Linux CVE Announcement CVE-2022-48724 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062057-CVE-2022-48724-6bcd@gregkh/
-
Linux CVE Announcement CVE-2022-48725 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062058-CVE-2022-48725-aba3@gregkh/
-
Linux CVE Announcement CVE-2022-48726 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062058-CVE-2022-48726-adb1@gregkh/
-
Linux CVE Announcement CVE-2022-48727 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062058-CVE-2022-48727-5101@gregkh/
-
Linux CVE Announcement CVE-2022-48728 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062058-CVE-2022-48728-caf6@gregkh/
-
Linux CVE Announcement CVE-2022-48729 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062059-CVE-2022-48729-dc0b@gregkh/
-
Linux CVE Announcement CVE-2022-48730 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062059-CVE-2022-48730-f1fd@gregkh/
-
Linux CVE Announcement CVE-2022-48731 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062059-CVE-2022-48731-d547@gregkh/
-
Linux CVE Announcement CVE-2022-48732 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062000-CVE-2022-48732-9d9b@gregkh/
-
Linux CVE Announcement CVE-2022-48733 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062000-CVE-2022-48733-4217@gregkh/
-
Linux CVE Announcement CVE-2022-48734 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062000-CVE-2022-48734-88b7@gregkh/
-
Linux CVE Announcement CVE-2022-48735 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062001-CVE-2022-48735-32e6@gregkh/
-
Linux CVE Announcement CVE-2022-48736 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062001-CVE-2022-48736-afa0@gregkh/
-
Linux CVE Announcement CVE-2022-48737 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062001-CVE-2022-48737-8efb@gregkh/
-
Linux CVE Announcement CVE-2022-48738 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062001-CVE-2022-48738-ecf0@gregkh/
-
Linux CVE Announcement CVE-2022-48739 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062002-CVE-2022-48739-c0d9@gregkh/
-
Linux CVE Announcement CVE-2022-48740 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062002-CVE-2022-48740-a623@gregkh/
-
Linux CVE Announcement CVE-2022-48741 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062002-CVE-2022-48741-cdd7@gregkh/
-
Linux CVE Announcement CVE-2022-48742 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062003-CVE-2022-48742-6393@gregkh/
-
Linux CVE Announcement CVE-2022-48743 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062003-CVE-2022-48743-ee30@gregkh/
-
Linux CVE Announcement CVE-2022-48744 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062003-CVE-2022-48744-0f03@gregkh/
-
Linux CVE Announcement CVE-2022-48745 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062004-CVE-2022-48745-7f0a@gregkh/
-
Linux CVE Announcement CVE-2022-48746 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062004-CVE-2022-48746-3d3a@gregkh/
-
Linux CVE Announcement CVE-2022-48747 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062004-CVE-2022-48747-c63f@gregkh/
-
Linux CVE Announcement CVE-2022-48748 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062004-CVE-2022-48748-3e75@gregkh/
-
Linux CVE Announcement CVE-2022-48749 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062005-CVE-2022-48749-0566@gregkh/
-
Linux CVE Announcement CVE-2022-48750 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062005-CVE-2022-48750-20d1@gregkh/
-
Linux CVE Announcement CVE-2022-48751 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062005-CVE-2022-48751-10d0@gregkh/
-
Linux CVE Announcement CVE-2022-48752 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062006-CVE-2022-48752-7ff8@gregkh/
-
Linux CVE Announcement CVE-2022-48753 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062006-CVE-2022-48753-38c0@gregkh/
-
Linux CVE Announcement CVE-2022-48754 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062006-CVE-2022-48754-4012@gregkh/
-
Linux CVE Announcement CVE-2022-48755 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062006-CVE-2022-48755-8abf@gregkh/
-
Linux CVE Announcement CVE-2022-48756 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062007-CVE-2022-48756-fc26@gregkh/
-
Linux CVE Announcement CVE-2022-48757 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062007-CVE-2022-48757-c816@gregkh/
-
Linux CVE Announcement CVE-2022-48758 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062007-CVE-2022-48758-1500@gregkh/
-
Linux CVE Announcement CVE-2022-48759 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062008-CVE-2022-48759-d017@gregkh/
-
Linux CVE Announcement CVE-2022-48760 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062008-CVE-2022-48760-b80e@gregkh/
-
Linux CVE Announcement CVE-2022-48761 vom 2024-06-20
https://lore.kernel.org/linux-cve-announce/2024062008-CVE-2022-48761-51ee@gregkh/