Summary
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
Product
Der Kernel stellt den Kern des Linux Betriebssystems dar.
Vulnerabilities 97
-
Critical 9.8
nvme-rdma: fix possible use-after-free in transport error_recovery work
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix possible use-after-free in transport error_recovery work While nvme_rdma_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and sched…
-
Critical 9.8
nvme-tcp: fix possible use-after-free in transport error_recovery work
In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix possible use-after-free in transport error_recovery work While nvme_tcp_submit_async_event_work is checking the ctrl and queue state before preparing the AER command and schedul…
-
Critical 9.8
nvme: fix a possible use-after-free in controller reset during load
In the Linux kernel, the following vulnerability has been resolved: nvme: fix a possible use-after-free in controller reset during load Unlike .queue_rq, in .submit_async_event drivers may not check the ctrl readiness for AER submission. This may lead to a us…
-
Critical 9.8
staging: gdm724x: fix use after free in gdm_lte_rx()
In the Linux kernel, the following vulnerability has been resolved: staging: gdm724x: fix use after free in gdm_lte_rx() The netif_rx_ni() function frees the skb so we can't dereference it to save the skb->len.
-
Critical 9.1
NFSD: Fix ia_size underflow
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix ia_size underflow iattr::ia_size is a loff_t, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file si…
-
Critical 9.1
NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes iattr::ia_size is a loff_t, so these NFSv3 procedures must be careful to deal with incoming client size values that are larger th…
-
High 8.8
mctp: fix use after free
In the Linux kernel, the following vulnerability has been resolved: mctp: fix use after free Clang static analysis reports this problem route.c:425:4: warning: Use of memory after it is freed trace_mctp_key_acquire(key); ^~~~~~~~~~~~~~~~~~~~~~~~~~~ When mctp_…
-
High 8.8
ipv6: mcast: use rcu-safe version of ipv6_get_lladdr()
In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu-safe version of ipv6_get_lladdr() Some time ago 8965779d2c0e ("ipv6,mcast: always hold idev->lock before mca_lock") switched ipv6_get_lladdr() to __ipv6_get_lladdr(), whi…
-
High 8.8
can: isotp: fix potential CAN frame reception race in isotp_rcv()
In the Linux kernel, the following vulnerability has been resolved: can: isotp: fix potential CAN frame reception race in isotp_rcv() When receiving a CAN frame the current code logic does not consider concurrently receiving processes which do not show up in …
-
High 8.8
vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command
In the Linux kernel, the following vulnerability has been resolved: vdpa/mlx5: add validation for VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command When control vq receives a VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET command request from the driver, presently there is no validat…
-
High 7.8
net: mscc: ocelot: fix use-after-free in ocelot_vlan_del()
In the Linux kernel, the following vulnerability has been resolved: net: mscc: ocelot: fix use-after-free in ocelot_vlan_del() ocelot_vlan_member_del() will free the struct ocelot_bridge_vlan, so if this is the same as the port's pvid_vlan which we access aft…
-
High 7.8
vsock: remove vsock from connected table when connect is interrupted by a signal
In the Linux kernel, the following vulnerability has been resolved: vsock: remove vsock from connected table when connect is interrupted by a signal vsock_connect() expects that the socket could already be in the TCP_ESTABLISHED state when the connecting task…
-
High 7.8
iwlwifi: fix use-after-free
In the Linux kernel, the following vulnerability has been resolved: iwlwifi: fix use-after-free If no firmware was present at all (or, presumably, all of the firmware files failed to parse), we end up unbinding by calling device_release_driver(), which calls …
-
High 7.8
scsi: pm8001: Fix use-after-free for aborted TMF sas_task
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted TMF sas_task Currently a use-after-free may occur if a TMF sas_task is aborted before we handle the IO completion in mpi_ssp_completion(). The abo…
-
High 7.8
scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
In the Linux kernel, the following vulnerability has been resolved: scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task Currently a use-after-free may occur if a sas_task is aborted by the upper layer before we handle the I/O completion in mpi_ssp_c…
-
High 7.8
iommu: Fix potential use-after-free during probe
In the Linux kernel, the following vulnerability has been resolved: iommu: Fix potential use-after-free during probe Kasan has reported the following use after free on dev->iommu. when a device probe fails and it is in process of freeing dev->iommu in dev_iom…
-
High 7.8
iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL If we fail to copy the just created file descriptor to userland, we try to clean up by putting back 'fd' and freeing 'i…
-
High 7.8
SUNRPC: lock against ->sock changing during sysfs read
In the Linux kernel, the following vulnerability has been resolved: SUNRPC: lock against ->sock changing during sysfs read ->sock can be set to NULL asynchronously unless ->recv_mutex is held. So it is important to hold that mutex. Otherwise a sysfs read can …
-
High 7.8
misc: fastrpc: avoid double fput() on failed usercopy
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: avoid double fput() on failed usercopy If the copy back to userland fails for the FASTRPC_IOCTL_ALLOC_DMA_BUFF ioctl(), we shouldn't assume that 'buf->dmabuf' is still valid. I…
-
High 7.8
usb: f_fs: Fix use-after-free for epfile
In the Linux kernel, the following vulnerability has been resolved: usb: f_fs: Fix use-after-free for epfile Consider a case where ffs_func_eps_disable is called from ffs_func_disable as part of composition switch and at the same time ffs_epfile_release get c…
-
High 7.8
net/packet: fix slab-out-of-bounds access in packet_recvmsg()
In the Linux kernel, the following vulnerability has been resolved: net/packet: fix slab-out-of-bounds access in packet_recvmsg() syzbot found that when an AF_PACKET socket is using PACKET_COPY_THRESH and mmap operations, tpacket_rcv() is queueing skbs with g…
-
High 7.8
watch_queue: Fix filter limit check
In the Linux kernel, the following vulnerability has been resolved: watch_queue: Fix filter limit check In watch_queue_set_filter(), there are a couple of places where we check that the filter type value does not exceed what the type_filter bitmap can hold. O…
-
High 7.5
NFSD: Fix the behavior of READ near OFFSET_MAX
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix the behavior of READ near OFFSET_MAX Dan Aloni reports: > Due to commit 8cfb9015280d ("NFS: Always provide aligned buffers to > the RPC read layers") on the client, a read of 0xfff …
-
High 7.3
phy: ti: Fix missing sentinel for clk_div_table
In the Linux kernel, the following vulnerability has been resolved: phy: ti: Fix missing sentinel for clk_div_table _get_table_maxdiv() tries to access "clk_div_table" array out of bound defined in phy-j721e-wiz.c. Add a sentinel entry to prevent the followin…
-
High 7.1
mm: don't try to NUMA-migrate COW pages that have other uses
In the Linux kernel, the following vulnerability has been resolved: mm: don't try to NUMA-migrate COW pages that have other uses Oded Gabbay reports that enabling NUMA balancing causes corruption with his Gaudi accelerator test load: "All the details are in t…
-
High 7.0
net/mlx5: Fix a race on command flush flow
In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix a race on command flush flow Fix a refcount use after free warning due to a race on command entry. Such race occurs when one of the commands releases its last refcount and frees…
-
Unscored —
scsi: ufs: Fix a deadlock in the error handler
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: Fix a deadlock in the error handler The following deadlock has been observed on a test setup: - All tags allocated - The SCSI error handler calls ufshcd_eh_host_reset_handler() - u…
-
Unscored —
powerpc/fixmap: Fix VM debug warning on unmap
In the Linux kernel, the following vulnerability has been resolved: powerpc/fixmap: Fix VM debug warning on unmap Unmapping a fixmap entry is done by calling __set_fixmap() with FIXMAP_PAGE_CLEAR as flags. Today, powerpc __set_fixmap() calls map_kernel_page()…
-
Unscored —
net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change
In the Linux kernel, the following vulnerability has been resolved: net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change The refcount leak issues take place in an error handling path. When the 3rd argument buf doesn't match with "offline", "on…
-
Unscored —
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
In the Linux kernel, the following vulnerability has been resolved: xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create If there are failures then we must not leave the non-NULL pointers with the error value, otherwise `rpcrdma_ep_destroy` gets c…
-
Unscored —
dmaengine: ptdma: Fix the error handling path in pt_core_init()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: ptdma: Fix the error handling path in pt_core_init() In order to free resources correctly in the error handling path of pt_core_init(), 2 goto's have to be switched. Otherwise, som…
-
Unscored —
Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj kobject_init_and_add() takes reference even when it fails. According to the doc of kobject_init_and_add()： If this function retur…
-
Unscored —
mtd: parsers: qcom: Fix missing free for pparts in cleanup
In the Linux kernel, the following vulnerability has been resolved: mtd: parsers: qcom: Fix missing free for pparts in cleanup Mtdpart doesn't free pparts when a cleanup function is declared. Add missing free for pparts in cleanup function for smem to fix the…
-
Unscored —
mtd: parsers: qcom: Fix kernel panic on skipped partition
In the Linux kernel, the following vulnerability has been resolved: mtd: parsers: qcom: Fix kernel panic on skipped partition In the event of a skipped partition (case when the entry name is empty) the kernel panics in the cleanup function as the name entry i…
-
Unscored —
mtd: rawnand: gpmi: don't leak PM reference in error path
In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: gpmi: don't leak PM reference in error path If gpmi_nfc_apply_timings() fails, the PM runtime usage counter must be dropped.
-
Unscored —
net/smc: Avoid overwriting the copies of clcsock callback functions
In the Linux kernel, the following vulnerability has been resolved: net/smc: Avoid overwriting the copies of clcsock callback functions The callback functions of clcsock will be saved and replaced during the fallback. But if the fallback happens more than onc…
-
Unscored —
crypto: af_alg - get rid of alg_memory_allocated
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - get rid of alg_memory_allocated alg_memory_allocated does not seem to be really used. alg_proto does have a .memory_allocated field, but no corresponding .sysctl_mem. This me…
-
Unscored —
net: dsa: lantiq_gswip: fix use after free in gswip_remove()
In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiq_gswip: fix use after free in gswip_remove() of_node_put(priv->ds->slave_mii_bus->dev.of_node) should be done before mdiobus_free(priv->ds->slave_mii_bus).
-
Unscored —
cfg80211: fix race in netlink owner interface destruction
In the Linux kernel, the following vulnerability has been resolved: cfg80211: fix race in netlink owner interface destruction My previous fix here to fix the deadlock left a race where the exact same deadlock (see the original commit referenced below) can sti…
-
Unscored —
KVM: x86: nSVM: fix potential NULL derefernce on nested migration
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: nSVM: fix potential NULL derefernce on nested migration Turns out that due to review feedback and/or rebases I accidentally moved the call to nested_svm_load_cr3 to be too early, be…
-
Unscored —
net: ieee802154: at86rf230: Stop leaking skb's
In the Linux kernel, the following vulnerability has been resolved: net: ieee802154: at86rf230: Stop leaking skb's Upon error the ieee802154_xmit_complete() helper is not called. Only ieee802154_wake_queue() is called manually. In the Tx case we then leak the…
-
Unscored —
parisc: Fix data TLB miss in sba_unmap_sg
In the Linux kernel, the following vulnerability has been resolved: parisc: Fix data TLB miss in sba_unmap_sg Rolf Eike Beer reported the following bug: [1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018…
-
Unscored —
s390/cio: verify the driver availability for path_event call
In the Linux kernel, the following vulnerability has been resolved: s390/cio: verify the driver availability for path_event call If no driver is attached to a device or the driver does not provide the path_event function, an FCES path-event on this device cou…
-
Unscored —
perf: Fix list corruption in perf_cgroup_switch()
In the Linux kernel, the following vulnerability has been resolved: perf: Fix list corruption in perf_cgroup_switch() There's list corruption on cgrp_cpuctx_list. This happens on the following path: perf_cgroup_switch: list_for_each_entry(cgrp_cpuctx_list) cp…
-
Unscored —
mm: vmscan: remove deadlock due to throttling failing to make progress
In the Linux kernel, the following vulnerability has been resolved: mm: vmscan: remove deadlock due to throttling failing to make progress A soft lockup bug in kcompactd was reported in a private bugzilla with the following visible in dmesg; watchdog: BUG: so…
-
Unscored —
fs/proc: task_mmu.c: don't read mapcount for migration entry
In the Linux kernel, the following vulnerability has been resolved: fs/proc: task_mmu.c: don't read mapcount for migration entry The syzbot reported the below BUG: kernel BUG at include/linux/page-flags.h:785! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: …
-
Unscored —
vt_ioctl: fix array_index_nospec in vt_setactivate
In the Linux kernel, the following vulnerability has been resolved: vt_ioctl: fix array_index_nospec in vt_setactivate array_index_nospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a…
-
Unscored —
net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup ax88179_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in pa…
-
Unscored —
eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
In the Linux kernel, the following vulnerability has been resolved: eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") revealed that ee1004_eeprom_read() did not properly limi…
-
Unscored —
ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler
In the Linux kernel, the following vulnerability has been resolved: ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler Currently, the same handler is called for both a NETDEV_BONDING_INFO LAG unlink notification as for a NETDEV_UNREGISTER call. This is cau…
-
Unscored —
net: dsa: fix panic when DSA master device unbinds on shutdown
In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix panic when DSA master device unbinds on shutdown Rafael reports that on a system with LX2160A and Marvell DSA switches, if a reboot occurs while the DSA master (dpaa2-eth) is up…
-
Unscored —
net: fix a memleak when uncloning an skb dst and its metadata
In the Linux kernel, the following vulnerability has been resolved: net: fix a memleak when uncloning an skb dst and its metadata When uncloning an skb dst and its associated metadata, a new dst+metadata is allocated and later replaces the old one in the skb.…
-
Unscored —
ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path
In the Linux kernel, the following vulnerability has been resolved: ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table() on failure path ip[6]mr_free_table() can only be called under RTNL lock. RTNL: assertion failed at net/core/dev.c (10367) WARNING:…
-
Unscored —
ibmvnic: don't release napi in __ibmvnic_open()
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: don't release napi in __ibmvnic_open() If __ibmvnic_open() encounters an error such as when setting link state, it calls release_resources() which frees the napi structures needlessl…
-
Unscored —
net: dsa: lantiq_gswip: don't use devres for mdiobus
In the Linux kernel, the following vulnerability has been resolved: net: dsa: lantiq_gswip: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate th…
-
Unscored —
net: dsa: felix: don't use devres for mdiobus
In the Linux kernel, the following vulnerability has been resolved: net: dsa: felix: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the slave…
-
Unscored —
net: dsa: seville: register the mdiobus under devres
In the Linux kernel, the following vulnerability has been resolved: net: dsa: seville: register the mdiobus under devres As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate th…
-
Unscored —
net: dsa: bcm_sf2: don't use devres for mdiobus
In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcm_sf2: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the sla…
-
Unscored —
net: dsa: ar9331: register the mdiobus under devres
In the Linux kernel, the following vulnerability has been resolved: net: dsa: ar9331: register the mdiobus under devres As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the…
-
Unscored —
net: dsa: mv88e6xxx: don't use devres for mdiobus
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: don't use devres for mdiobus As explained in commits: 74b6d7d13307 ("net: dsa: realtek: register the MDIO bus under devres") 5135e96a3dd2 ("net: dsa: don't allocate the s…
-
Unscored —
tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case
In the Linux kernel, the following vulnerability has been resolved: tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case syzbot found that mixing sendpage() and sendmsg(MSG_ZEROCOPY) calls over the same TCP socket would again trigger the infamous warni…
-
Unscored —
phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable()
In the Linux kernel, the following vulnerability has been resolved: phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable() This error path needs to decrement "usbphyc->n_pll_cons.counter" before returning.
-
Unscored —
scsi: qedf: Fix refcount issue when LOGO is received during TMF
In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Fix refcount issue when LOGO is received during TMF Hung task call trace was seen during LOGO processing. [ 974.309060] [0000:00:00.0]:[qedf_eh_device_reset:868]: 1:0:2:0: LUN RES…
-
Unscored —
scsi: myrs: Fix crash in error case
In the Linux kernel, the following vulnerability has been resolved: scsi: myrs: Fix crash in error case In myrs_detect(), cs->disable_intr is NULL when privdata->hw_init() fails with non-zero. In this case, myrs_cleanup(cs) will call a NULL ptr and crash the …
-
Unscored —
scsi: qedf: Add stag_work to all the vports
In the Linux kernel, the following vulnerability has been resolved: scsi: qedf: Add stag_work to all the vports Call trace seen when creating NPIV ports, only 32 out of 64 show online. stag work was not initialized for vport, hence initialize the stag work. W…
-
Unscored —
drm/vc4: Fix deadlock on DSI device attach error
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Fix deadlock on DSI device attach error DSI device attach to DSI host will be done with host device's lock held. Un-registering host in "device attach" error path (ex: probe retry) w…
-
Unscored —
ima: fix reference leak in asymmetric_verify()
In the Linux kernel, the following vulnerability has been resolved: ima: fix reference leak in asymmetric_verify() Don't leak a reference to the key if its algorithm is unknown.
-
Unscored —
audit: don't deref the syscall args when checking the openat2 open_how::flags
In the Linux kernel, the following vulnerability has been resolved: audit: don't deref the syscall args when checking the openat2 open_how::flags As reported by Jeff, dereferencing the openat2 syscall argument in audit_match_perm() to obtain the open_how::fla…
-
Unscored —
btrfs: skip reserved bytes warning on unmount after log cleanup failure
In the Linux kernel, the following vulnerability has been resolved: btrfs: skip reserved bytes warning on unmount after log cleanup failure After the recent changes made by commit c2e39305299f01 ("btrfs: clear extent buffer uptodate when we fail to write it")…
-
Unscored —
usb: usbtmc: Fix bug in pipe direction for control transfers
In the Linux kernel, the following vulnerability has been resolved: usb: usbtmc: Fix bug in pipe direction for control transfers The syzbot fuzzer reported a minor bug in the usbtmc driver: usb 5-1: BOGUS control dir, pipe 80001e80 doesn't match bRequestType …
-
Unscored —
scsi: mpt3sas: Page fault in reply q processing
In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Page fault in reply q processing A page fault was encountered in mpt3sas on a LUN reset error path: [ 145.763216] mpt3sas_cm1: Task abort tm failed: handle(0x0002),timeout(30) …
-
Unscored —
Input: aiptek - properly check endpoint type
In the Linux kernel, the following vulnerability has been resolved: Input: aiptek - properly check endpoint type Syzbot reported warning in usb_submit_urb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the…
-
Unscored —
usb: gadget: rndis: prevent integer overflow in rndis_set_response()
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: rndis: prevent integer overflow in rndis_set_response() If "BufOffset" is very large the "BufOffset + 8" operation can have an integer overflow.
-
Unscored —
usb: gadget: Fix use-after-free bug by not setting udc->dev.driver
In the Linux kernel, the following vulnerability has been resolved: usb: gadget: Fix use-after-free bug by not setting udc->dev.driver The syzbot fuzzer found a use-after-free bug: BUG: KASAN: use-after-free in dev_uevent+0x712/0x780 drivers/base/core.c:2320 …
-
Unscored —
iavf: Fix hang during reboot/shutdown
In the Linux kernel, the following vulnerability has been resolved: iavf: Fix hang during reboot/shutdown Recent commit 974578017fc1 ("iavf: Add waiting so the port is initialized in remove") adds a wait-loop at the beginning of iavf_remove() to ensure that p…
-
Unscored —
ice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats()
In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats() It is possible to do NULL pointer dereference in routine that updates Tx ring stats. Currently only stats and bytes are upd…
-
Unscored —
ice: Fix race condition during interface enslave
In the Linux kernel, the following vulnerability has been resolved: ice: Fix race condition during interface enslave Commit 5dbbbd01cbba83 ("ice: Avoid RTNL lock when re-creating auxiliary device") changes a process of re-creation of aux device so ice_plug_au…
-
Unscored —CVE-2022-48843 Rejected
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
-
Unscored —
Bluetooth: hci_core: Fix leaking sent_cmd skb
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix leaking sent_cmd skb sent_cmd memory is not freed before freeing hci_dev causing it to leak it contents.
-
Unscored —
MIPS: smp: fill in sibling and core maps earlier
In the Linux kernel, the following vulnerability has been resolved: MIPS: smp: fill in sibling and core maps earlier After enabling CONFIG_SCHED_CORE (landed during 5.14 cycle), 2-core 2-thread-per-core interAptiv (CPS-driven) started emitting the following: …
-
Unscored —
block: release rq qos structures for queue without disk
In the Linux kernel, the following vulnerability has been resolved: block: release rq qos structures for queue without disk blkcg_init_queue() may add rq qos structures to request queue, previously blk_cleanup_queue() calls rq_qos_exit() to release them, but …
-
Unscored —
tracing/osnoise: Do not unregister events twice
In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Do not unregister events twice Nicolas reported that using: # trace-cmd record -e all -M 10 -p osnoise --poll Resulted in the following kernel warning: ------------[ cut here…
-
Unscored —
drm/amdgpu: bypass tiling flag check in virtual display case (v2)
In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: bypass tiling flag check in virtual display case (v2) vkms leverages common amdgpu framebuffer creation, and also as it does not support FB modifier, there is no need to check til…
-
Unscored —
net-sysfs: add check for netdevice being present to speed_show
In the Linux kernel, the following vulnerability has been resolved: net-sysfs: add check for netdevice being present to speed_show When bringing down the netdevice or system shutdown, a panic can be triggered while accessing the sysfs path because the device …
-
Unscored —
drm/vc4: hdmi: Unregister codec device on unbind
In the Linux kernel, the following vulnerability has been resolved: drm/vc4: hdmi: Unregister codec device on unbind On bind we will register the HDMI codec device but we don't unregister it on unbind, leading to a device leakage. Unregister our device at unb…
-
Unscored —
Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
In the Linux kernel, the following vulnerability has been resolved: swiotlb: fix info leak with DMA_FROM_DEVICE The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case …
-
Unscored —
net: arc_emac: Fix use after free in arc_mdio_probe()
In the Linux kernel, the following vulnerability has been resolved: net: arc_emac: Fix use after free in arc_mdio_probe() If bus->state is equal to MDIOBUS_ALLOCATED, mdiobus_free(bus) will free the "bus". But bus->name is still used in the next line, which w…
-
Unscored —
sctp: fix kernel-infoleak for SCTP sockets
In the Linux kernel, the following vulnerability has been resolved: sctp: fix kernel-infoleak for SCTP sockets syzbot reported a kernel infoleak [1] of 4 bytes. After analysis, it turned out r->idiag_expires is not initialized if inet_sctp_diag_fill() calls i…
-
Unscored —
gianfar: ethtool: Fix refcount leak in gfar_get_ts_info
In the Linux kernel, the following vulnerability has been resolved: gianfar: ethtool: Fix refcount leak in gfar_get_ts_info The of_find_compatible_node() function returns a node pointer with refcount incremented, We should use of_node_put() on it when done Ad…
-
Unscored —
NFC: port100: fix use-after-free in port100_send_complete
In the Linux kernel, the following vulnerability has been resolved: NFC: port100: fix use-after-free in port100_send_complete Syzbot reported UAF in port100_send_complete(). The root case is in missing usb_kill_urb() calls on error handling path of ->probe fu…
-
Unscored —
net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr
In the Linux kernel, the following vulnerability has been resolved: net: marvell: prestera: Add missing of_node_put() in prestera_switch_set_base_mac_addr This node pointer is returned by of_find_compatible_node() with refcount incremented. Calling of_node_pu…
-
Unscored —
ethernet: Fix error handling in xemaclite_of_probe
In the Linux kernel, the following vulnerability has been resolved: ethernet: Fix error handling in xemaclite_of_probe This node pointer is returned by of_parse_phandle() with refcount incremented in this function. Calling of_node_put() to avoid the refcount …
-
Unscored —
vdpa: fix use-after-free on vp_vdpa_remove
In the Linux kernel, the following vulnerability has been resolved: vdpa: fix use-after-free on vp_vdpa_remove When vp_vdpa driver is unbind, vp_vdpa is freed in vdpa_unregister_device and then vp_vdpa->mdev.pci_dev is dereferenced in vp_modern_remove, trigge…
-
Unscored —
vhost: fix hung thread due to erroneous iotlb entries
In the Linux kernel, the following vulnerability has been resolved: vhost: fix hung thread due to erroneous iotlb entries In vhost_iotlb_add_range_ctx(), range size can overflow to 0 when start is 0 and last is ULONG_MAX. One instance where it can happen is w…
-
Unscored —
mISDN: Fix memory leak in dsp_pipeline_build()
In the Linux kernel, the following vulnerability has been resolved: mISDN: Fix memory leak in dsp_pipeline_build() dsp_pipeline_build() allocates dup pointer by kstrdup(cfg), but then it updates dup variable by strsep(&dup, "|"). As a result when it calls kfr…
-
Unscored —
tipc: fix kernel panic when enabling bearer
In the Linux kernel, the following vulnerability has been resolved: tipc: fix kernel panic when enabling bearer When enabling a bearer on a node, a kernel panic is observed: [ 4.498085] RIP: 0010:tipc_mon_prep+0x4e/0x130 [tipc] ... [ 4.520030] Call Trace: [ 4…
-
Unscored —
HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual n…
Revision history
-
#73
Neue Updates von Ubuntu aufgenommen
-
#72
Neue Updates von Ubuntu aufgenommen
-
#71
Neue Updates von Ubuntu aufgenommen
-
#70
Neue Updates von Ubuntu aufgenommen
-
#69
Neue Updates von SUSE aufgenommen
-
#68
Neue Updates von SUSE aufgenommen
-
#67
Neue Updates von SUSE aufgenommen
-
#66
Neue Updates von SUSE aufgenommen
-
#65
Neue Updates von SUSE aufgenommen
-
#64
Neue Updates von SUSE aufgenommen
-
#63
Neue Updates von SUSE aufgenommen
-
#62
Neue Updates von Oracle Linux aufgenommen
-
#61
Neue Updates von Rocky Enterprise Software Foundation aufgenommen
-
#60
Neue Updates von Red Hat aufgenommen
-
#59
Neue Updates von Dell aufgenommen
-
#58
Neue Updates von Amazon aufgenommen
-
#57
Neue Updates von Oracle Linux aufgenommen
-
#56
Neue Updates von Dell aufgenommen
-
#55
Neue Updates von Amazon aufgenommen
-
#54
Neue Updates von SUSE aufgenommen
-
#53
Neue Updates von SUSE aufgenommen
-
#52
Neue Updates von SUSE aufgenommen
-
#51
Neue Updates von SUSE aufgenommen
-
#50
Neue Updates von SUSE aufgenommen
-
#49
Neue Updates von SUSE aufgenommen
References
-
Linux CVE Announce vom 2024-07-16
https://lore.kernel.org/linux-cve-announce/
-
Ubuntu Security Notice USN-6919-1 vom 2024-07-26
https://ubuntu.com/security/notices/USN-6919-1
-
Ubuntu Security Notice USN-6917-1 vom 2024-07-26
https://ubuntu.com/security/notices/USN-6917-1
-
Ubuntu Security Notice USN-6927-1 vom 2024-07-30
https://ubuntu.com/security/notices/USN-6927-1
-
Red Hat Security Advisory RHSA-2024:5101 vom 2024-08-08
https://access.redhat.com/errata/RHSA-2024:5101
-
Red Hat Security Advisory RHSA-2024:5102 vom 2024-08-08
https://access.redhat.com/errata/RHSA-2024:5102
-
Oracle Linux Security Advisory ELSA-2024-5101 vom 2024-08-09
https://linux.oracle.com/errata/ELSA-2024-5101.html
-
Red Hat Security Advisory RHSA-2024:5266 vom 2024-08-13
https://access.redhat.com/errata/RHSA-2024:5266
-
Red Hat Security Advisory RHSA-2024:5256 vom 2024-08-13
https://access.redhat.com/errata/RHSA-2024:5256
-
Red Hat Security Advisory RHSA-2024:5257 vom 2024-08-13
https://access.redhat.com/errata/RHSA-2024:5257
-
Red Hat Security Advisory RHSA-2024:5282 vom 2024-08-13
https://access.redhat.com/errata/RHSA-2024:5282
-
SUSE Security Update SUSE-SU-2024:2893-1 vom 2024-08-13
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019187.html
-
SUSE Security Update SUSE-SU-2024:2892-1 vom 2024-08-13
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019188.html
-
Red Hat Security Advisory RHSA-2024:5281 vom 2024-08-13
https://access.redhat.com/errata/RHSA-2024:5281
-
SUSE Security Update SUSE-SU-2024:2894-1 vom 2024-08-13
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019182.html
-
SUSE Security Update SUSE-SU-2024:2902-1 vom 2024-08-14
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019193.html
-
SUSE Security Update SUSE-SU-2024:2901-1 vom 2024-08-14
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019194.html
-
SUSE Security Update SUSE-SU-2024:2923-1 vom 2024-08-15
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019201.html
-
SUSE Security Update SUSE-SU-2024:2929-1 vom 2024-08-15
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019209.html
-
SUSE Security Update SUSE-SU-2024:2939-1 vom 2024-08-16
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019211.html
-
SUSE Security Update SUSE-SU-2024:2948-1 vom 2024-08-16
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019219.html
-
SUSE Security Update SUSE-SU-2024:2947-1 vom 2024-08-16
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019220.html
-
SUSE Security Update SUSE-SU-2024:2940-1 vom 2024-08-16
https://lists.suse.com/pipermail/sle-security-updates/2024-August/019212.html
-
Red Hat Security Advisory RHSA-2024:5692 vom 2024-08-21
https://access.redhat.com/errata/RHSA-2024:5692
-
Red Hat Security Advisory RHSA-2024:6156 vom 2024-09-03
https://access.redhat.com/errata/RHSA-2024:6156
-
Red Hat Security Advisory RHSA-2024:6160 vom 2024-09-03
https://access.redhat.com/errata/RHSA-2024:6160
-
Red Hat Security Advisory RHSA-2024:6297 vom 2024-09-04
https://access.redhat.com/errata/RHSA-2024:6297
-
SUSE Security Update SUSE-SU-2024:3190-1 vom 2024-09-10
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019403.html
-
SUSE Security Update SUSE-SU-2024:3189-1 vom 2024-09-10
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019404.html
-
SUSE Security Update SUSE-SU-2024:3209-1 vom 2024-09-11
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/YNWVZVIFSX7PLBJX3I3PDZ4MIBERTN2Y/
-
SUSE Security Update SUSE-SU-2024:3225-1 vom 2024-09-12
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019432.html
-
SUSE Security Update SUSE-SU-2024:3252-1 vom 2024-09-16
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019436.html
-
SUSE Security Update SUSE-SU-2024:3249-1 vom 2024-09-16
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019438.html
-
SUSE Security Update SUSE-SU-2024:3251-1 vom 2024-09-16
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019435.html
-
Ubuntu Security Notice USN-7022-1 vom 2024-09-18
https://ubuntu.com/security/notices/USN-7022-1
-
SUSE Security Update SUSE-SU-2024:3304-1 vom 2024-09-18
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019453.html
-
Ubuntu Security Notice USN-7028-1 vom 2024-09-23
https://ubuntu.com/security/notices/USN-7028-1
-
Red Hat Security Advisory RHSA-2024:6992 vom 2024-09-24
https://access.redhat.com/errata/RHSA-2024:6992
-
Red Hat Security Advisory RHSA-2024:7001 vom 2024-09-24
https://access.redhat.com/errata/RHSA-2024:7001
-
Red Hat Security Advisory RHSA-2024:6991 vom 2024-09-24
https://access.redhat.com/errata/RHSA-2024:6991
-
Red Hat Security Advisory RHSA-2024:6990 vom 2024-09-24
https://access.redhat.com/errata/RHSA-2024:6990
-
Red Hat Security Advisory RHSA-2024:7000 vom 2024-09-24
https://access.redhat.com/errata/RHSA-2024:7000
-
Oracle Linux Security Advisory ELSA-2024-7000 vom 2024-09-26
https://linux.oracle.com/errata/ELSA-2024-7000.html
-
Ubuntu Security Notice USN-7039-1 vom 2024-09-26
https://ubuntu.com/security/notices/USN-7039-1
-
SUSE Security Update SUSE-SU-2024:3483-1 vom 2024-09-29
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/2HO244EHQ65DPDJ2NOBAXLG7QYWSCUMA/
-
SUSE Security Update SUSE-SU-2024:3483-1 vom 2024-09-29
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2HO244EHQ65DPDJ2NOBAXLG7QYWSCUMA/
-
SUSE Security Update SUSE-SU-2024:3467-1 vom 2024-09-27
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019532.html
-
Rocky Linux Security Advisory RLSA-2024:7001 vom 2024-09-30
https://errata.build.resf.org/RLSA-2024:7001
-
SUSE Security Update SUSE-SU-2024:3499-1 vom 2024-09-30
https://lists.suse.com/pipermail/sle-security-updates/2024-September/019536.html
-
Ubuntu Security Notice USN-7022-2 vom 2024-10-01
https://ubuntu.com/security/notices/USN-7022-2
-
SUSE Security Update SUSE-SU-2024:3566-1 vom 2024-10-09
https://lists.suse.com/pipermail/sle-security-updates/2024-October/019578.html
-
SUSE Security Update SUSE-SU-2024:3559-1 vom 2024-10-09
https://lists.suse.com/pipermail/sle-security-updates/2024-October/019575.html
-
Ubuntu Security Notice USN-7022-3 vom 2024-10-10
https://ubuntu.com/security/notices/USN-7022-3
-
SUSE Security Update SUSE-SU-2024:3591-1 vom 2024-10-10
https://lists.suse.com/pipermail/sle-security-updates/2024-October/019587.html
-
Ubuntu Security Notice USN-7028-2 vom 2024-10-17
https://ubuntu.com/security/notices/USN-7028-2
-
Red Hat Security Advisory RHSA-2024:8318 vom 2024-10-23
https://access.redhat.com/errata/RHSA-2024:8318
-
Red Hat Security Advisory RHSA-2024:8616 vom 2024-10-30
https://access.redhat.com/errata/RHSA-2024:8616
-
IBM Security Bulletin
https://www.ibm.com/support/pages/node/7174634
-
Red Hat Security Advisory RHSA-2024:8870 vom 2024-11-05
https://access.redhat.com/errata/RHSA-2024:8870
-
Red Hat Security Advisory RHSA-2024:8856 vom 2024-11-05
https://access.redhat.com/errata/RHSA-2024:8856
-
Oracle Linux Security Advisory ELSA-2024-8856 vom 2024-11-06
https://linux.oracle.com/errata/ELSA-2024-8856.html
-
Oracle Linux Security Advisory ELSA-2024-12806 vom 2024-11-06
http://linux.oracle.com/errata/ELSA-2024-12806.html
-
ORACLE OVMSA-2024-0015 vom 2024-11-08
https://oss.oracle.com/pipermail/oraclevm-errata/2024-November/001103.html
-
Rocky Linux Security Advisory RLSA-2024:8870 vom 2024-11-08
https://errata.build.resf.org/RLSA-2024:8870
-
Red Hat Security Advisory RHSA-2024:9315 vom 2024-11-12
https://access.redhat.com/errata/RHSA-2024:9315
-
Red Hat Security Advisory RHSA-2024:9942 vom 2024-11-19
https://access.redhat.com/errata/RHSA-2024:9942
-
Red Hat Security Advisory RHSA-2024:9943 vom 2024-11-19
https://access.redhat.com/errata/RHSA-2024:9943
-
Ubuntu Security Notice USN-7119-1 vom 2024-11-20
https://ubuntu.com/security/notices/USN-7119-1
-
Red Hat Security Advisory RHSA-2024:10275 vom 2024-11-26
https://access.redhat.com/errata/RHSA-2024:10275
-
Red Hat Security Advisory RHSA-2024:10262 vom 2024-11-26
https://access.redhat.com/errata/RHSA-2024:10262
-
Red Hat Security Advisory RHSA-2024:10265 vom 2024-11-26
https://access.redhat.com/errata/RHSA-2024:10265
-
Red Hat Security Advisory RHSA-2024:10273 vom 2024-11-26
https://access.redhat.com/errata/RHSA-2024:10273
-
SUSE Security Update SUSE-SU-2024:4100-1 vom 2024-11-28
https://lists.suse.com/pipermail/sle-security-updates/2024-November/019864.html
-
Red Hat Security Advisory RHSA-2024:10771 vom 2024-12-04
https://access.redhat.com/errata/RHSA-2024:10771
-
SUSE Security Update SUSE-SU-2024:4367-1 vom 2024-12-17
https://lists.suse.com/pipermail/sle-security-updates/2024-December/020025.html
-
SUSE Security Update SUSE-SU-2025:0034-1 vom 2025-01-08
https://lists.suse.com/pipermail/sle-security-updates/2025-January/020071.html
-
SUSE Security Update SUSE-SU-2025:0035-1 vom 2025-01-08
https://lists.suse.com/pipermail/sle-security-updates/2025-January/020070.html
-
Oracle Linux Security Advisory ELSA-2024-9315 vom 2025-01-13
https://oss.oracle.com/pipermail/el-errata/2025-January/017000.html
-
SUSE Security Update SUSE-SU-2025:0152-1 vom 2025-01-17
https://lists.suse.com/pipermail/sle-security-updates/2025-January/020152.html
-
IBM Security Bulletin 7182335 vom 2025-02-03
https://www.ibm.com/support/pages/node/7182335