Skip to content
OpenAdvisories

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen Denial of Service Angriff durchzuführen oder andere nicht spezifizierte Auswirkungen zu verursachen.

Product

Der Kernel stellt den Kern des Linux Betriebssystems dar.

Vulnerabilities 50

  • High 7.8

    drm/amd/display: fix page fault due to max surface definition mismatch

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix page fault due to max surface definition mismatch DC driver is using two different values to define the maximum number of surfaces: MAX_SURFACES and MAX_SURFACE_NUM. Cons…

  • High 7.8

    drm/amdgpu: Add a lock when accessing the buddy trim function

    In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add a lock when accessing the buddy trim function When running YouTube videos and Steam games simultaneously, the tester found a system hang / race condition issue with the multi-…

  • High 7.8

    drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err

    In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Set private->all_drm_private[i]->drm to NULL if mtk_drm_bind returns err The pointer need to be set to NULL, otherwise KASAN complains about use-after-free. Because in mtk_drm_b…

  • High 7.8

    dm array: fix releasing a faulty array block twice in dm_array_cursor_end

    In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to locking or checksum errors, it releases the faulty block implicitly while leaving…

  • High 7.8

    block, bfq: fix waker_bfqq UAF after bfq_split_bfqq()

    In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UAF for v6.6: BUG: KASAN: slab-use-after-free in bfq_init_rq+0x175d/0x17a0 block/bfq-iosched.c:6958 Read…

  • High 7.8

    ipvlan: Fix use-after-free in ipvlan_get_iflink().

    In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix use-after-free in ipvlan_get_iflink(). syzbot presented an use-after-free report [0] regarding ipvlan and linkwatch. ipvlan does not hold a refcnt of the lower device unlike vlan …

  • High 7.5

    afs: Fix the maximum cell name length

    In the Linux kernel, the following vulnerability has been resolved: afs: Fix the maximum cell name length The kafs filesystem limits the maximum length of a cell to 256 bytes, but a problem occurs if someone actually does that: kafs tries to create a director…

  • High 7.3

    sched: sch_cake: add bounds checks to host bulk flow fairness counts

    In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host…

  • High 7.1

    iio: adc: ti-ads1119: fix information leak in triggered buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads1119: fix information leak in triggered buffer The 'scan' local struct is used to push data to user space from a triggered buffer, but it has a hole between the sample (unsign…

  • High 7.1

    iio: adc: ti-ads8688: fix information leak in triggered buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-ads8688: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive cha…

  • High 7.1

    iio: adc: rockchip_saradc: fix information leak in triggered buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: rockchip_saradc: fix information leak in triggered buffer The 'data' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive…

  • High 7.1

    iio: imu: kmx61: fix information leak in triggered buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: imu: kmx61: fix information leak in triggered buffer The 'buffer' local array is used to push data to user space from a triggered buffer, but it does not set values for inactive channels…

  • High 7.1

    iio: light: bh1745: fix information leak in triggered buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1745: fix information leak in triggered buffer The 'scan' local struct is used to push data to user space from a triggered buffer, but it does not set values for inactive channe…

  • High 7.1

    iio: light: vcnl4035: fix information leak in triggered buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: light: vcnl4035: fix information leak in triggered buffer The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the…

  • High 7.1

    iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, bu…

  • High 7.1

    iio: pressure: zpa2326: fix information leak in triggered buffer

    In the Linux kernel, the following vulnerability has been resolved: iio: pressure: zpa2326: fix information leak in triggered buffer The 'sample' local struct is used to push data to user space from a triggered buffer, but it has a hole between the temperatur…

  • High 7.1

    ksmbd: fix a missing return value check bug

    In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix a missing return value check bug In the smb2_send_interim_resp(), if ksmbd_alloc_work_struct() fails to allocate a node, it returns a NULL pointer to the in_work pointer. This can …

  • High 7.1

    sctp: sysctl: udp_port: avoid using current->nsproxy

    In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inco…

  • High 7.1

    sctp: sysctl: auth_enable: avoid using current->nsproxy

    In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - I…

  • High 7.1

    sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy

    In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons:…

  • High 7.1

    net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue

    In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue The TQP BAR space is divided into two segments. TQPs 0-1023 and TQPs 1024-1279 are in different BAR space addresses.…

  • Medium 5.5

    usb: typec: tcpci: fix NULL pointer issue on shared irq case

    In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci: fix NULL pointer issue on shared irq case The tcpci_irq() may meet below NULL pointer dereference issue: [ 2.641851] Unable to handle kernel NULL pointer dereference at vir…

  • Medium 5.5

    misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling

    In the Linux kernel, the following vulnerability has been resolved: misc: microchip: pci1xxxx: Resolve kernel panic during GPIO IRQ handling Resolve kernel panic caused by improper handling of IRQs while accessing GPIO values. This is done by replacing generi…

  • Medium 5.5

    drm/amd/display: fix divide error in DM plane scale calcs

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix divide error in DM plane scale calcs dm_get_plane_scale doesn't take into account plane scaled size equal to zero, leading to a kernel oops due to division by zero. Fix b…

  • Medium 5.5

    drm/amd/display: Add check for granularity in dml ceil/floor helpers

    In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Add check for granularity in dml ceil/floor helpers [Why] Wrapper functions for dcn_bw_ceil2() and dcn_bw_floor2() should check for granularity is non zero to avoid assert an…

  • Medium 5.5

    nfs: Fix oops in nfs_netfs_init_request() when copying to cache

    In the Linux kernel, the following vulnerability has been resolved: nfs: Fix oops in nfs_netfs_init_request() when copying to cache When netfslib wants to copy some data that has just been read on behalf of nfs, it creates a new write request and calls nfs_ne…

  • Medium 5.5

    cgroup/cpuset: remove kernfs active break

    In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: remove kernfs active break A warning was found: WARNING: CPU: 10 PID: 3486953 at fs/kernfs/file.c:828 CPU: 10 PID: 3486953 Comm: rmdir Kdump: loaded Tainted: G RIP: 0010:kernfs…

  • Medium 5.5

    rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy

    In the Linux kernel, the following vulnerability has been resolved: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reas…

  • Medium 5.5

    sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy

    In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different r…

  • Medium 5.5

    sctp: sysctl: rto_min/max: avoid using current->nsproxy

    In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - I…

  • Medium 5.5

    mptcp: sysctl: blackhole timeout: avoid using current->nsproxy

    In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: blackhole timeout: avoid using current->nsproxy As mentioned in the previous commit, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsi…

  • Medium 5.5

    mptcp: sysctl: sched: avoid using current->nsproxy

    In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: sched: avoid using current->nsproxy Using the 'net' structure via 'current' is not recommended for different reasons. First, if the goal is to use it to read or write per-netns…

  • Medium 5.5

    drm/xe: Fix tlb invalidation when wedging

    In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix tlb invalidation when wedging If GuC fails to load, the driver wedges, but in the process it tries to do stuff that may not be initialized yet. This moves the xe_gt_tlb_invalidati…

  • Medium 5.5

    net: hns3: fix kernel crash when 1588 is sent on HIP08 devices

    In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices does not register the ptp devices, so the hdev->ptp is NULL. But the tx process would still try to set …

  • Medium 4.7

    usb: gadget: f_fs: Remove WARN_ON in functionfs_bind

    In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_fs: Remove WARN_ON in functionfs_bind This commit addresses an issue related to below kernel panic where panic_on_warn is enabled. It is caused by the unnecessary use of WARN_O…

  • Unscored —

    iio: adc: at91: call input_free_device() on allocated iio_dev

    In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91: call input_free_device() on allocated iio_dev Current implementation of at91_ts_register() calls input_free_deivce() on st->ts_input, however, the err label can be reached bef…

  • Unscored —
    CVE-2024-57915 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    topology: Keep the cpumask unchanged when printing cpumap

    In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the following warning was discovered: different return values (15 and 11) from vsnprintf("%*pbl ", ...) test:key…

  • Unscored —
    CVE-2024-57920 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path

    In the Linux kernel, the following vulnerability has been resolved: btrfs: zlib: fix avail_in bytes for s390 zlib HW compression path Since the input data length passed to zlib_compress_folios() can be arbitrary, always setting strm.avail_in to a multiple of …

  • Unscored —

    fs: relax assertions on failure to encode file handles

    In the Linux kernel, the following vulnerability has been resolved: fs: relax assertions on failure to encode file handles Encoding file handles is usually performed by a filesystem >encode_fh() method that may fail for various reasons. The legacy users of ex…

  • Unscored —

    netfs: Fix enomem handling in buffered reads

    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix enomem handling in buffered reads If netfs_read_to_pagecache() gets an error from either ->prepare_read() or from netfs_prepare_read_iterator(), it needs to decrement ->nr_outstand…

  • Unscored —

    x86/fpu: Ensure shadow stack is active before "getting" registers

    In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack support has its own set of registers. Those registers are XSAVE-managed, but they are "supervisor state …

  • Unscored —
    CVE-2025-21633 Rejected

    This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  • Unscored —

    netfs: Fix kernel async DIO

    In the Linux kernel, the following vulnerability has been resolved: netfs: Fix kernel async DIO Netfslib needs to be able to handle kernel-initiated asynchronous DIO that is supplied with a bio_vec[] array. Currently, because of the async flag, this gets pass…

  • Unscored —

    platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it

    In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it Wakeup for IRQ1 should be disabled only in cases where i8042 had actually enabled it, otherwise "wake_depth" for…

  • Unscored —

    netfilter: conntrack: clamp maximum hashtable size to INT_MAX

    In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size for the conntrack hashtable. Otherwise, it is possible to hit WARN_ON_ONCE in __kvmalloc_node_noprof(…

  • Unscored —

    net: hns3: don't auto enable misc vector

    In the Linux kernel, the following vulnerability has been resolved: net: hns3: don't auto enable misc vector Currently, there is a time window between misc irq enabled and service task inited. If an interrupte is reported at this time, it will cause warning l…

  • Unscored —

    net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute

    In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT attribute was not validated. Right shitfing a 32bit integer is undefined for large shift values. UBSA…

  • Unscored —

    ovl: support encoding fid from inode with no alias

    In the Linux kernel, the following vulnerability has been resolved: ovl: support encoding fid from inode with no alias Dmitry Safonov reported that a WARN_ON() assertion can be trigered by userspace when calling inotify_show_fdinfo() for an overlayfs watched …

Revision history

  1. #71

    Neue Updates von Ubuntu aufgenommen

  2. #70

    Neue Updates von Ubuntu aufgenommen

  3. #69

    Neue Updates von Debian aufgenommen

  4. #68

    Neue Updates von Ubuntu aufgenommen

  5. #67

    Neue Updates von Ubuntu aufgenommen

  6. #66

    Neue Updates von IBM aufgenommen

  7. #65

    Neue Updates von Siemens aufgenommen

  8. #64

    Neue Updates von Red Hat aufgenommen

  9. #63

    Neue Updates von SUSE aufgenommen

  10. #62

    Neue Updates von SUSE aufgenommen

  11. #61

    Neue Updates von Red Hat aufgenommen

  12. #60

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  13. #59

    Neue Updates von Oracle Linux aufgenommen

  14. #58

    Neue Updates von Rocky Enterprise Software Foundation aufgenommen

  15. #57

    Neue Updates von Red Hat aufgenommen

  16. #56

    Neue Updates von Dell aufgenommen

  17. #55

    Neue Updates von Debian aufgenommen

  18. #54

    Neue Updates von Dell aufgenommen

  19. #53

    Neue Updates von Debian aufgenommen

  20. #52

    Neue Updates von Oracle Linux aufgenommen

  21. #51

    Neue Updates von Debian aufgenommen

  22. #50

    Referenz(en) aufgenommen:

  23. #49

    Neue Updates von Ubuntu aufgenommen

  24. #48

    Neue Updates von Ubuntu aufgenommen

  25. #47

    Neue Updates von Oracle Linux aufgenommen

References